tombrossman

Are you certain that Chromium does this too? Because their documentation explicitly contradicts your statement: "This is done using the computer's normal DNS resolution mechanism; no connection to Google is used." Source - https://www.chromium.org/developers/design-documents/dns-pre...

Two options that I'm aware of:

Self-host Nextcloud and use the Keeweb app with Keepass encrypted databases - https://apps.nextcloud.com/apps/keeweb

Run your own Firefox accounts server, and let FF store all your passwords - https://docs.services.mozilla.com/howtos/run-fxa.html

> Doesn't necessarily prove the earlier point, but your rebuttal, qualifying yourself as "well-travelled", explicitly makes your perspective that of a minority's view.

Look at it this way: 'mjolk' could be well travelled within the United States and have a very good idea of Americans sentiments. Therefore (s)he could be confidently expressing a true statement. Also, being a minority voice is not an indicator of how truthful or accurate someone is. When people believed the Earth was flat, were the minority of thinkers who decided it was round any less credible?

You are right about the word libel though, it's the wrong word in this instance. I can't think of a better substitute better than 'generalizing' though.

Years ago when red light cameras were new I remember hearing a comedian say "The city sent me a photo of my car running a red light and a ticket for $100. So, I took a photo of $100 and sent that back to them with the ticket".

That's completely silly but it sounds like it was just as effective as your efforts so far. Hope you get it sorted some day.

A few bonus images, useful for messing with people's heads:

FBI "This Hidden Site Has Been Seized" https://i.imgur.com/Ovp6VEa.jpg

ICE "Domain Name Seized" https://i.imgur.com/6667N7b.gif

There's probably a Tumblr page somewhere with all these but I haven't checked lately.

Serious question, what's preventing someone from exploiting this for profit?

For example, could you list a uniquely named item on Amazon (perhaps as a Marketplace seller) and charge high restocking fees? Then instead of just trolling people for a laugh, your business model would basically be collecting restocking fees.

host lavabit.com && whois 72.249.41.52

Lavabit LLC - Dallas TX and Colo4, LLC - St Louis MO.

(Insert your own joke here about Americans not caring about mass surveillance...)

I had high hopes for Geary but it was underfunded and lacks the feature set I need to replace Thunderbird. https://en.wikipedia.org/wiki/Geary_(software)

You simply register to vote at the last voting district you resided in in the USA. Use your current overseas address. It is surprisingly easy, especially if you were already registered to vote there before.

Now whether the politicians for that voting district will listen to you or help you is another question, but that's the same for most voters regardless of where they live.

> We're not harvesting your data. In fact, we nuke it right after we serve the request. We're super privacy conscious.

That's not the whole truth. While you may be deleting the submitted form values, your site uses a third-party tracking service which collects a range of visitor data[0] which is stored by that third party. Third-party tracking is useful and mainstream, but you should have a privacy policy and disclose the tracking in that policy.

On a more positive note, your site has a solid A+ for HTTPS configuration on SSL Labs[1], so that's great to see. The only change I would make is to switch server_tokens to 'off'[2] so you aren't leaking the Nginx version number (but this is admittedly just a minor bit of security through obscurity).

[0]https://clicky.com/terms

[1]https://www.ssllabs.com/ssltest/analyze.html?d=whoaremyrepre...

[2]http://nginx.org/en/docs/http/ngx_http_core_module.html#serv...

For me, the possibility of faster page loads with HTTP/2 is the main selling point, plus the usual TLS advantages of guaranteeing the integrity of page content, etc.

Plenty of info on speed out there, here's one example: https://blog.httpwatch.com/2015/01/16/a-simple-performance-c...

A few weeks after my car was stolen, another car appeared around the corner and looked to be abandoned (newer car, window left rolled down overnight for a few days) and I mentioned this to my mom. She's very community-minded and went and looked in the abandoned car. She found a letter inside the glove box with a name and looked the person up in the phone book. Nice old lady who confirmed it was her car and it had been stolen.

We learned from this lady that our neighbor's meth head twentysomething son had a girlfriend who lived in the same neighborhood as she did - where my stolen car was abandoned. A lazy cop would call that one hell of a coincidence. A motivated cop would have made the effort and rid the neighborhood of a pest who had graduated from petty crime to multiple felonies.

Just one example and honestly, what are the odds of all those pieces coming together, but it does show that selective enforcement isn't impressing anyone.

I have found that when I use a GPS navigation device, it is only a secondary reference that I rarely look directly at. I also disable all audio output.

I find them very useful for navigating through an unfamiliar area, but I mostly see the screen in my peripheral vision because I'm paying more attention to the road and signs, etc. I can see when a turn is coming up because the brightly colored line indicating my path on the screen bends, and I complete the turn having never looked directly at the device. I do look at it occasionally when going straight to have a sense of the next road name, distance until next turn, etc.

Try this if you haven't already, because I found looking at the device too often was disorienting (especially in traffic circles or complex intersections) because the display lags slightly behind your actual position.

You are absolutely right about situational awareness though. That's always top priority and any device that interferes with it should be disabled or repositioned in your field of vision.

I had my car stolen a while ago in San Diego county. I was very low on fuel so I knew whoever did it would have had to fill up soon after the theft.

Fast forward two weeks and my car was found. When I got it back, a credit card receipt for fuel at a nearby gas station was sitting in a tray in the center console. The date and time were the same night as the theft, after I had parked for the night. I first rang the station to explain and they confirmed they had CCTV and would hold it for the police, then I rang the detective assigned to handle vehicle thefts locally. He seemed interested and said he'd send a uniformed police officer over to follow up.

While waiting, I checked the trunk and found some trash neatly tied up in plastic bags with more receipts. The officer showed up and could not have been more openly hostile and bored with the whole thing. Big sighs, complaining that he was wasting his time while he dusted for fingerprints and collected the receipts. I waited a few more days and rang the gas station to see if the police had followed up - nope.

Years later I was on a jury for a car thief and I was really impressed by the professionalism of the police in tracking down the thief, and the extra efforts they made. They were all over the CCTV footage and tracking the usage of a particular store's membership card that the victim had left in the car. Same county, different police department though.

I guess the point is that the tools are there for law enforcement when they need them. But there is still no technical solution for when someone is a lazy fuck and can't be bothered to do their job.

GoAccess have a PPA for Ubuntu / Debian as well: https://goaccess.io/download#official-repo

This would be extremely useful data to have and when I last looked I found little to go on. For example, how great would it be to have an extra column on a page like this with cache hit rates? https://cdnjs.com/libraries

Nice to have these free hosted assets, but I suspect that a lot of these are an additional download and not actually cached by the majority of visitors. Just having a rough estimate would be helpful when choosing whether to directly serve an asset or use a CDN.

> and they would consistently exceed maximum hours cdl drivers are allowed to work

Just a reminder, there exists no maximum number of hours CDL holders may work, they just can't drive after a certain number of hours without a sleep break. Many truckers will operate in such a manner that they drive to the destination legally, reach their max allowable hours driving upon arrival, and then continue working several more hours unloading. Grocery warehouses are notorious for this.

It's an important distinction because if you are a local driver with a 'day cab', you can't exactly take your sleep break in the truck and would be more likely to break the law to drive the truck back home (or the company yard). An 'over the road' driver has a sleeper berth and can take a proper break most anywhere they can legally park.

I did many FedEx loads as an over the road driver and I found them to be good runs. Many were overnight runs from one airport to another and I definitely had enough time, it wasn't as if I had to skip breaks or hurry. And the FedEx staff and load/unload procedures were very organised and easy. FedEx loads were seen as desirable and hassle-free.

I wonder if Canonical could use this to their advantage, now that they are 'taking a stand against unofficial Ubuntu images'.[0] (looking at you, OVH...)

It could also go a long way towards addressing concerns that they, as a UK corporation, may now be subject to the Investigatory Powers Act requiring encryption 'back doors' be inserted in communications software.[1] Even if you argue that Ubuntu isn't communication software, they do ship plenty of packages that are.

[0]http://insights.ubuntu.com/2016/12/01/taking-a-stand-against...

[1]http://www.theregister.co.uk/2016/11/30/investigatory_powers...

I manually added the 's' to the protocol to test and the server sent the only cert it had (if present, this is normal). It's like entering an IP address and having the server return the default site over HTTP.

Many sites ignore the Google Analytics requirement but I think this one should aim a bit higher, especially with all the legal geniuses involved in writing that privacy page.

Is this a hoax site or are they for real?

The website uses Google Analytics and does not disclose this in their Privacy Policy which is mandatory[0] under Google's T&C's.

The Policy also includes this gem: "We may, along with our affiliates and marketing partners enhance and/or merge personal information about you with data collected from other sources and use it in direct and/or online marketing and, to the extent permitted by law, individual reference and look-up service programs."[1]

Also, no HTTPS support but if you try anyway they do have a cert for annualmedicalreport.com. No thanks.

[0]https://www.google.com/analytics/terms/us.html

[1]http://www.stopdatamining.me/privacy-policy/

Interesting discussion of this idea on the Stack Exchange photo site (from 2013): https://photo.stackexchange.com/questions/33902/do-any-dslrs...

Where is this list? On my (Ubuntu) machine I suspect it's ~/.mozilla/firefox/<profile-string-here>.default/browser-extension-data/jid1-<another-string-here>@jetpack/storage.js. However it definitely does not include a list of every domain I've ever visited.

I have Firefox set to clear everything except for bookmarks and saved passwords each time I close it (which is frequently) and there are definitely sites in that storage.js file from previous sessions, but it is not complete. I wonder if another mechanism purges domains after a time?

The seamless redirect after install is a nice touch. However the "receive link in email for software/plugin download to install so you can do this important thing" harkens back to earlier times and is the classic malware infection scenario. I guess it still works because enough people still do it.

I think this isn't necessarily about open source, it's about tracking users in order to manipulate them with relevant ads. A company could use a fully open-source stack and still cross that creepy threshold with user tracking no problem.

A few years back I was using a paid Google Apps account (which IIRC excludes you from some tracking?) and FastMail simultaneously. Both were excellent from a technical perspective, but FastMail was just better. They make all their money from selling their service to end users and I trust this model more. So I switched to using FastMail exclusively.

I use free and open source software and strongly prefer it - but I don't see it as some kind of 'automagic' solution to tracking and privacy concerns. Buying the product, and not being the product, is what is important to me.

Also don't forget to self-host what you can, for example it's not that difficult or expensive to set up Nextcloud on a VPS for file and contacts/calendar syncing. And don't be a cheap bastard with the FOSS you use, make donations to developers of useful tools. You're going to pay for all this one way or another.

On AWS you get a big bill, but they continue serving your content. With DigitalOcean, I've heard multiple reports that they simply disable your VPS until the DDoS ends, making your instance unreachable. With OVH, they include DDoS protection as standard. I use all three services and I like them all, but there are some big strengths and weaknesses to be aware of among them.

What you describe is probably domain name 'front running', which was an abuse of the domain name 'tasting' scheme that some Registrars engaged in. https://en.wikipedia.org/wiki/Domain_name_front_running

So called premium domains are set by the Registry managing the TLD, and Registrars offering those domains for sale pass along the premium price.

This looks pretty slick and well done for having a comprehensive FAQ section and plenty of info which answered most of my questions.

For me, email is the 'master key' for most of my online accounts (because password resets are done via email so if your email account is compromised an attacker can quickly leverage access to other services) and email security is top priority. I didn't see anything about using two-factor authentication with this service - is it available?

Also, your site only supports obsolete HTTPS protocols. TLS 1.0 and SSLv3. You should drop SSL 3 and enable support for TLS 1.2. Here's a test you can run with feedback and resources to learn more about secure configurations: https://www.ssllabs.com/ssltest/analyze.html?d=migadu.com&s=...

You donate by contributing content to their sites. How (or if) they monetize this is up to them.

As a user, I feel obliged to help others out and I make an extra effort to answer some questions when I ask one, or when I find a particularly useful answer that helps me with anything work related. This adds value to the site and again, how they monetize is up to them.

I think Google's 'product' is their ability to demonstrate to advertisers Google's ability to manipulate users more effectively than their competitors can. To accomplish this, tracking is necessary. Any 'help' they provide you is purely incidental. If the data showed it was more effective to mislead users, they would be obliged to do that and ensure maximum value to shareholders. Look at the fake news controversy Facebook is dealing with. Fake news generated more page views and was more profitable, so that's what everyone pushed.

What I'd love to see is a service doing some or all of the tracking and data storage on the end user's device, with relevant data being matched and pushed to anonymous users algorithmically. Easier said than done I concede, but that's what I want. I'm happy to pay for such a useful service and I strongly prefer this to trading personal info.

I have about 150GB in /home backed up daily using Duplicity, which encrypts & compresses everything and saves to a second internal backup drive. Data is kept for 6 months minimum. After several years, the total backup size is 190GB which syncs daily to an S3 bucket and my monthly bills are about $11USD. If I ever had to restore all that from S3 it would cost extra but would not be prohibitively expensive.

Install the AWS CLI (https://aws.amazon.com/cli/) and choose whatever method you like for making an encrypted local backup. Then sync that backup partition to S3 every day.

Here's an example command you can adapt for cron to call via a shell script:

    /home/tom/.local/bin/aws s3 sync /mnt/backups/daily s3://your-s3-bucket-name --storage-class STANDARD_IA --acl private --sse

The -sse means server side encryption which is redundant since I've encrypted the data prior to uploading, but why not?