tombrossman

I set this up earlier this month after seeing someone recommend it here on HN in a comment, and after a very good start I decided to stop using it.

The performance was very good, and switching default DNS from Google to OpenNIC was easy enough, but the default blocklists included too many domains I needed to use (e.g. mailchimp.com) which were not explicitly ad domains. Whitelisting domains is possible but you have to drop what you are doing and SSH into the Pi, whitelist it and reload the config, then resume what you were doing.

But the real dealbreaker for me was that this is largely incompatible with NoScript and its 'Application Boundaries Enforcer' which gave me constant warnings due to some content being served from my LAN. The way pi-hole works is to intercept your DNS query for 'bad' domains, re-route it to its own server, and return an empty page. It is the return of an empty page over the LAN that was problematic.

Maybe someone more savvy could have made it all work together but at some point you have to evaluate the usability of this versus just toggling an ad-blocker with your browser. The browser ad blocker is just faster and easier when you need to override anything.

The linked website is using Google Analytics which is not a surprise, but they fail to warn visitors about it on their Privacy page[0] which which is mandatory under the Google Analytics T&C's[1] "You must disclose the use of Google Analytics, and how it collects and processes data".

I realise I'm probably not in the target demographic but I wonder if the OP can comment on this, and state whether anything else is missing from the privacy policy, and whether they will bring the service into compliance with Google's Terms please?

The site looks really nice and I wish them good luck with the launch, but as a privacy-conscious user this is one of the first things I look for and my success rate for finding sites which fail to disclose is nearly 100%. If it were some random programmer's blog I could understand but this is a service built on top of Google Analytics and I'll have to hold them to a higher standard.

[0] http://whatagraph.com/privacy/ [1] https://www.google.com/analytics/terms/us.html

EDIT: Also, no HTTPS for the site or the app subdomain login page? Certs can be had for free with Let's Encrypt or for well under $10USD/year from a commercial supplier. Email in profile, I'm happy to help anyone understand how to set it up on Apache or Nginx if you need. HTTPS is cheap and relatively easy, please add it to your sites.

Give the recoll package (and Unity scope) a try and your opinion might change. I use this all the time and it's pretty amazing to just type a string of text into the dash and see whichever document contains that text string appear in my search results. If I already have a terminal window open I'll do grep -R "text-string" /dir/ or if not I hit the super key and type the text string for recoll, both are equally fast.

> Even AWS limits how fast you can upload to S3...

I'm on gigabit fiber and use S3 to backup hundreds of gigs per month to S3. I've never seen them limit upload speeds, it is clearly saturating the connection for the entire duration of my upload. I would expect that because I am paying for the storage, they would be happy to let me write data to their machines as fast as I like. Is there a citation you can provide from their docs that supports your statement? Genuinely curious, because my experience has been different.

To the point that some of these sync or backup providers limit bandwidth, I have definitely experienced that. Tested SpiderOak and Dropbox and upload speed was horrid. Dropbox in particular was disappointing because they can't even claim to have the extra encryption overhead SpiderOak does, it was just shit speed every day. I'm paying a premium for gigabit fiber to the home and you really can tell who over-promises and under-delivers quickly. Fortunately my 'roll your own' backup + sync works well and is price competitive so I'll stick with that.

You should probably add HTTPS too, especially for the account login page. Since you are using CloudFlare you can add it for free and this is best practice.

Aluminium is an excellent material for printing photos onto, and when I saw this it was the first thing I thought of. Too bad you don't offer that material yet because you could make some really cool art to hang on your wall which would look fantastic and last for a very long time. Here is one example of a supplier with a very limited selection of shapes: http://aluminyze.com/ Now imagine having them print a big skyline photo of a city and shipping it to you to have the sky cut out. It would look pretty amazing, and generating the vector path wouldn't bee too difficult if the image had suitable contrast (or the object in silhouette).

The original is still archived at http://web.archive.org/web/20151103154949/http://antirez.com..., so if the goal is to make the script kiddies work for it you need to add this to your robots.txt:

  User-agent: ia_archiver
  Disallow: /

Unfortunately that excludes your whole site from the Wayback Machine, but you might try modifying the Disallow. (I haven't a clue if their rules are granular or strictly site-wide.)

Interesting, I'll have to try again. When I first used the beta I imported a VCF exported from ownCloud (which I think stored the images as data URIs). I'll try to figure out how to upload them via CardDAV now, thanks.

The only feature I miss with your CardDAV implementation is contact photos. Everything else works very well so I leave email and calendaring to FastMail but I'm back to self-hosted contacts for now. Really hope this can be added soon.

I don't really have any utopian visions because by definition they are impossible to achieve.

We have to be realistic and I think Udemy will get away with this and my comment above was basically me calling bullshit on their public statements. They didn't seem sincere to me, that's all.

I'm a regular user of Darktable for several years and I wouldn't call it a 'user-hostile' project, but the impossibly tiny controls for some functions is frustrating. Maybe they just need more UX experts to pitch in and help improve the product? This is certainly a common theme with FOSS.

Overall I get excellent results with the software, I like it and I'm pretty quick in my workflow, but those little triangles you have to right-click on (e.g. to adjust the exposure or black point) take me multiple tries. Every. Single. Time! My fine motor skill is great. And I'm using a good quality wired mouse because I like the precision.

Here is another angle to consider. How many of the viewers of Troy's 'free' plagiarized courses saw them and were impressed enough to convert to paying customers? Difficult to measure but Udemy will have a pretty good idea.

For Udemy to say that no money changed hands is a bit myopic, but perhaps this is unintentional. Money likely did change hands, but it was abstracted from the original transaction and only Udemy knows that figure.

Exactly. Imagine I ripped a MPAA film DVD and distributed via free coupon codes to users of this service. Think any lawyers would have an issue or would they go 'oh, no money changed hands' and give it a pass?

Also, they used the boilerplate 'taking it seriously' twice, including the second sentence. Can corporate PR people please stop with this silliness? It seems like it is in every press release ever.

This Medium post would probably work better as a single 140 character tweet, there is nothing of substance here. I'm surprised to see it made the front page.

Perfect illustration of 'free as in speech or free as in beer?'. Wonder who I should contact at CloudFlare for my 'free' DV cert that I can use on my server...

Also worth pointing out that neither Dropbox nor SpiderOak are fully open-source, so you are having to place some degree of 'blind trust' in either service. It is in their own best interests to have great security so that customers trust the product, but this cannot be verified by someone outside the company.

Remember that for some users Facebook effectively is the Internet. They have a normal broadband connection in a relatively affluent western country but spend much of their time online using Facebook for browsing and two-way communication with other Facebook users.

On a regular basis I'll hear someone mention 'their website' and when I ask for the URL it is clear from their reply that what they mean is they have a Facebook page for their group/business/whatever. When I press further they seem to understand the concept that owning a domain name and having a 'website' on Facebook are not exactly the same. These are normal users, not stupid people, and this is how perceive things right now.

This is anecdotal and I don't have any peer-reviewed studies to cite but I suspect this is pretty common and I wonder if others are seeing the same thing?

Thanks, good to know.

The ownCloud Android client required duplicate copies of all the photos & videos (the original plus a copy in the ownCloud folder) which filled up storage on my phone too quickly. Once this is sorted I might try it again, even if only for the calendar and contacts. It has many features but I just don't need most of them.

You update manually via SSH. It's a bit more tedious than a package manager but not too bad. It took me a while to wrap my head around their file layout and how they do things, but I have it figured out now and updating takes a couple minutes. I can have two SSH terminals open on the same machine and by the time the first one completes `apt-get update && apt-get -y upgrade` I'm nearly done with the Seafile update. I really don't like adding third-party PPAs so I'll probably stick with this method for a while even if someone manages to package it up.

I nearly went with Syncany, they were a very close second but they are still in alpha, plus they have no mobile apps (yet). I really like being able to take a photo with my phone and have it sync to my computer.

Development on Seafile is very active and they are transparent about security issues. I don't think it is poorly written but maybe a third-party audit like Truecrypt did is a good idea.

Here's their 'Records of security issues' page: https://seacloud.cc/group/3/wiki/security-records/

> Did you host OwnCloud yourself?

Yes, I prefer to self-host anything I can. I'm lucky to have a gigabit FTTH connection and moving lots of data around is no problem. I still prefer to use a remote VPS because some things are best left to the pros.

> But you didn't trust the software with your files? In what way is the SeaFile solution you are running now more trustworthy?

Seafile has a much smaller attack surface (no PHP, MySQL not required, etc) and handles the client-side encryption itself. We are discussing degrees of trust here, so while I was happy to trust ownCloud and the VPS to be there for a request, and to not corrupt my data, I didn't trust that my sensitive data was safe if the server was compromised. EncFS was a workaround, but it cluttered up Nautilus with extra drives since every encrypted directory had to be mounted as a drive. Now I'm comfortable trusting Seafile to do all that because an attacker would need to compromise both my VPS and my local machine to gain access to sensitive data. This is orders of magnitude less likely and for me is an acceptable risk, especially considering the simpler software stack.

And I'm definitely checking out radicale, thanks for the tip. If it does contact photo sync (annoyingly not currently supported my FastMail CardDAV) I'll give it a try.

I've installed and abandoned ownCloud several times, mostly because it is far too heavy for what I need and I had concerns about its security. I also had to set up EncFS on my local machines for client-side encryption of sensitive files because there was no way I was trusting that to ownCloud server-side.

It took more work to set up but I have Seafile self-hosted on the smallest DigitalOcean VPS and it works beautifully. $5/month, plenty of space for the amount of files I need to sync across machines, and my data is in Germany which is great (I'm in Europe). Native client-side encryption is built-in to the client so I have an easier configuration on local machines, and it does most of what I need.

I'm still looking for a good self-hosted CalDAV/CardDAV option that doesn't require PHP or MySQL, but as this data is less sensitive I'm happy to trust it to FastMail for now.

Oh I think it's simple enough and thanks for the tool, but I'm comparing it to the workflow I currently use which has fewer steps (generate CSR, paste in form on issuer's website, click link to validate domain). Headed out now but I'll try to provide some better feedback later.

Here's the issuer from the certificate I got, and I believe it was the (beta) production one and not the development endpoint.

Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X1

Possibly user error still, but I use HTTPS across all my personal sites and they all rate well on third-party tests so I'm not a total noob (I hope...).

I'm really pleased to see this initiative and I've used the private beta with letsencrypt-nosudo[0] to issue a certificate, but after successfully getting a certificate my site failed the SSL Labs test[1] with an 'unknown CA' error, even though I used the newer one that should have been trusted. It was probably down to user error and the additional complexity of denying sudo privileges for the set up script, but it took much more work than I expected. Then I noticed the certs will only ever be good for 90 days, and I'll have to do this multiple times a year!

Bottom line for me is that with DV certs so inexpensive and simple to get, I'd rather pay a few dollars a year for normal commercial certificates. I can do things like use CloudFront at a custom subdomain with HTTPS without needing to point DNS somewhere every few months to get a cert reissued.

I simply can't justify the extra work involved to get 'free' certificates, and I'm happy to continue buying regular DV certs. Maybe these are temporary limitations and if so I will definitely try again in the future.

[0]https://github.com/diafygi/letsencrypt-nosudo [1]https://www.ssllabs.com/ssltest/index.html

I've got basic Skeleton and Pure CSS sites for Jekyll available on GitLab below, since these are my two favorite starting points. My minor changes in adapting them to Jekyll are released to the public domain.

https://gitlab.com/tombrossman/Jekyll_Skeleton_CSS_Boilerpla...

https://gitlab.com/tombrossman/Jekyll_Pure_CSS

Facebook explicitly deny creating 'shadow profiles' and I'm not aware of any proof that they do so, have I overlooked this somehow?

I was interested in this too, and I'm in Europe and submitted a formal request for data. I've never used Facebook but because I'm active in a number of community groups, my name comes up on the occasional Facebook page and I'm in photos taken at some events.

At the time I was using a catchall email address so I entered facebook@(my-domain-dot-tld) which is all they used to search for a match. Because that wasn't a real email address I wasn't surprised that in their response they claimed to hold none of my personal data, though that seems a bit weaselly.

Here is their email reply from 2013:

Hi,

We've received your request for information about the possible storage of your personal data.

There isn't a Facebook account associated with the email address from which you are writing. This might be because you don't have a Facebook account or because you already deleted your account. In either of these cases, we do not hold any of your personal data.

Please refer to our Privacy Policy (also called “Data Use Policy”) for more information:

https://www.facebook.com/about/privacy

It contains a description of: - The categories of data being processed by Facebook - The personal data that Facebook receives from Facebook members - The purpose or purposes of the processing of such data - The source or sources(s) of the data, if known - The recipients or categories of recipients to whom Facebook members’ personal data are or may be disclosed

If you're referring to an account associated with another email address, please use that email address to file a new request:

https://www.facebook.com/help/contact/?id=166828260073047

Once we receive your request, we'll take further steps to assist you.

Thanks, The Facebook Team

I have no idea, sorry. I just happened to see it when someone else re-tweeted it and it looked perfect.

The service was provided by JT Global (website here: http://www.jtglobal.com/jersey/) and Purple WiFi (http://www.purplewifi.net/) so you might try following up with them? I don't know any of the people involved, I just showed up for my talk and left soon after.

I did a talk on privacy topics from a user's perspective at a small 'tech fair' this weekend and I was delighted to see this tweet showing a map of the venue showing everyone's precise location: https://twitter.com/johnebridge/status/662984007370612736

I was able to add it to the slide deck just in time and people were genuinely surprised by it. It's a good thing that the company were transparent about it and shared the image but for many non-technical attendees it was a bit of a wake-up call.

"Do you use the free WiFi at the local supermarkets?" "Did you buy a bunch of liquor and condoms, and then come back a few weeks later and buy pregnancy tests?" "Did you think you were pretty slick because you paid cash?" The audience's eyes getting bigger and bigger...

Try running it alongside GA and comparing stats. I did this for a while and switched to Piwik as it consistently counted more visits (legitimate visits, obviously).

Also, please consider adding your Google Analytics use to your privacy policy. They require it, even though most people ignore this requirement and there is no enforcement.

Side note, I just tried @ replying to your companies post on Twitter and got a @your account may not be allowed to perform this action' http://i.imgur.com/9uoEn9B.png Strange, never saw that before...