Salta al contenuto principale





Getting Started with Go - Trevors-Tutorials.com #2


Technology reshared this.

in reply to rocket9

This video complements the text tutorial at trevors-tutorials.com/0002-get…

Trevors-Tutorials.com is where you can find free programming tutorials. The focus is on Go and Ebitengine game development. Watch the for more info.



Getting Started with Go - Trevors-Tutorials.com #2


in reply to trevor

This video complements the text tutorial at trevors-tutorials.com/0002-get…

Trevors-Tutorials.com is where you can find free programming tutorials. The focus is on Go and Ebitengine game development. Watch the for more info.


in reply to ☆ Yσɠƚԋσʂ ☆

and if you notice, you will rarely see them actually be able (or willing) to change things significantly for the better. crumbs here and there, at best. usually just big nothing burgers. reality checks out as almost literally just glowing descriptions of hopeful could-have-beens.
Questa voce è stata modificata (1 mese fa)
in reply to ☂️-

Exactly, they act as a pressure relief valve for the system ensuring that public anger doesn't boil over into meaningful action that threatens the ruling class in any way.


Shouting into the void


Copilot on teams Android keeps turning itself on. I looked through docs & found I was doing things correctly. So I opened it up out of frustration.

I know it means nothing, but I had to say (type?) it out loud. I have really come to hate Windows since 11 was forced on us at work.

Ironically, it'll just ape back what you want to hear by being sympathetic towards my concerns, addressing nothing.

Don't know who's more pathetic, the chatbot or me 🥲

in reply to kippinitreal

so you can keep Windows for work but use Linux for everything else


LOL

Questa voce è stata modificata (1 mese fa)

in reply to ☆ Yσɠƚԋσʂ ☆

I remember Tom Tanuki on YouTube did a video about or mentioning the ones in Australia.
Questa voce è stata modificata (1 mese fa)



Switzerland plans surveillance worse than US


The proposed update to Switzerland’s Ordinance on the Surveillance of Postal and Telecommunications Traffic (VÜPF: Verordnung über die Überwachung des Post- und Fernmeldeverkehrs) represents a significant expansion of state surveillance powers, worse than the surveillance powers of the USA. If enacted, it would have serious consequences for encrypted services such as Threema, an encrypted WhatsApp alternative and Proton Mail as well as VPN providers based in Switzerland.
Questa voce è stata modificata (1 mese fa)
in reply to underline960

switzerland was never a utopia for anybody except corporations, billionaires, and nazis. their "neutrality" was nothing more than an excuse for unregulated capitalism.
in reply to underline960

Switzerland never had solid privacy laws - and is known for intelligence service overreach for decades.

They had a Stasi like system of "who to imprison" when "the time comes".

They listen to all IP traffic in and out the country - which is concerning in times of traffic pattern analysis.
And they are known for their close cooperation with US intelligence services.

Protons (and Threemas) claim of "soo good swiss privacy laws" is nothing more than swiss-washing. And they know it.

Proton has already given away data of its customers (climate activists) to the swiss authorities. And only talked about it when the press got onto it.

Questa voce è stata modificata (1 mese fa)


Buried in Proton's AI announcement today is a pretty shocking detail about their service 👀




Buried in Proton's AI announcement today is a pretty shocking detail about their service 👀
Because of legal uncertainty around Swiss government proposals to introduce mass surveillance — proposals that have been outlawed in the EU — Proton is moving most of its physical infrastructure out of Switzerland. Lumo will be the first product to move.


#Proton #Switzerland #Privacy #EuroStack #ProtonMail


Technology reshared this.



The Promised LAN


Saw this posted over on HackerNews, and loved it. I'm big on self-hosting, and this is an incredibly exciting idea to me.

The Promised LAN is a closed, membership only network of friends that operate a 24/7 always-on LAN party, running since 2021. The vast majority of documentation is maintained on the LAN, but this website serves to give interested folks, prospective members or friends an idea of what the Promised LAN is, and how it works.


Their manifesto is also worth reading. My personal favorite part:

We do not wish to, nor will we, rebuild the internet. We do not wish to, nor will we, scale this. We will never be friends with enough people, as hard as we may try. Participation hinges on us all having fun. As a result, membership will never be open, and we will never have enough connected LANs to deal with the technical and social problems that start to happen with scale. This is a feature, not a bug.

This is a call for you to do the same. Build your own LAN. Connect it with friends’ homes. Remember what is missing from your life, and fill it in. Use software you know how to operate and get it running. Build slowly. Build your community. Do it with joy. Remember how we got here. Rebuild a community space that doesn’t need to be mediated by faceless corporations and ad revenue. Build something sustainable that brings you joy. Rebuild something you use daily.

Bring back what we’re missing.


in reply to Pro

Not like I'm gonna make art for anybody else anyway. Do I look like a fucking party clown? I'll take your ideas, they're gonna suck, and maybe if it's impressive I'll write a note I never look at again.
in reply to Pro

If you offer somone 60$, and they deny it and say they can only do it for 260 it's because they already have someone willing to pay 250, and they can only make 1 piece at a time. Why would they turn down a 250$ piece to make your 60$ piece? It's simple scarcity. You aren't entitled to someones labor for any price. I really don't care if you use AI to make what you want. The only thing about AI that annoys me is that it's everywhere now, and it looks bad a lot of the time. But just understand that your post here just makes you look entitled. That's why your being mass downvoted. I suggest you do some introspection, and try to see things from other peoples perspectives.

in reply to Pro

spamming this cringe bullshit across a bunch of different instances doesn't make you any less of a permavirgin slop fiend who loves to be cucked by corporations

in reply to Pro

Doesnt matter. True of all women in your case (sorry, had to).
Questa voce è stata modificata (1 mese fa)

Pro doesn't like this.

in reply to outhouseperilous

What is "women"?
Questa voce è stata modificata (1 mese fa)

in reply to Pro

spamming this cringe bullshit across a bunch of different instances doesn't make you any less of a permavirgin slop fiend who loves to be cucked by corporations



Should i install a discontinued custom recovery ? And how to keep root after update on LineageOS!


Am using my redmi note 8 with lineageos built in custom recovery. And my device was rooted. Recently i installed a OTA update and i loose my root access. As i don't own a laptop (i used my friend laptop to flash custom rom and magisk) it's cery inconvenient to lose root on every OTA update.

I researched about it and find magisk don't root android in a deeper level but in a surface level, thats why an OTA update wipes root access.

So recently i was looking at custom recovery like orangefox and twrp fir fixing this issue. For my device orangefox dropped development and rwrp have updates only one a year and last one was yeras ago...

What should i do ? How can i really keep root on an OTA update without a PC or Second device with OTG cable ?

Is there any other root manager that don't allow to lose root after OTA updates ? And is this issue caused by updating the recovery along with the OTA update ? Just so confusing!

Or should i avoid rooting at all ?

Questa voce è stata modificata (1 mese fa)
in reply to dejected1761

Try Lygisk, it's a fork of Magisk that's meant to survive OTAs for devices that only have one system partition. I've used it on a previous phone and it worked great.
in reply to dejected1761

What's your fear in relation to using older recovery?



Deleting Windows from dual boot Linux/Windows computer


I have a PC currently configured to dual boot Windows 10 and Linux Mint. I don't need Windows anymore, but Mint is working just fine and I'd rather avoid wiping the whole thing and starting over. Is there a safe way to just get rid of Windows?
in reply to Demonmariner

Do you have data on the Windows partition?

Either way, a good way to do it might be to use dd (or a different disk image tool) to copy your Linux installation partitions to a portable hard drive, and make sure the image works. Then wipe the drive and copy the Linux partitions back to it via dd or another imaging tool.

in reply to Demonmariner

Hi,
I didn't see the answer if you only have your pc and no other big storage :
If you still have the installation usb or recreate one. Boot on it then you open gparted with that you remove the two partition off windows, the main with the system and the recovery one (if there is) but don't touch the first or last partition esp if it exits.
Then you can expand the partitions to get the free space. Extend to the right is fast but extend to the left can be really slow and prone to failures.
I case you Linux partition are all on the right you can also create new main partition, do the install of the linux on this one, then reboot on the USB, move the user and configuration files on the new system, delete old installation partitions, then extend the new install to take the full drive.
There is commands to remove the old esp entries I don't remember yet.
This can take few hours so be patient.

The other option with a backup (dd) of the main partition is obviously safer but take nearly the same amount of time and need an external drive.



in reply to Amoxtli

Wtf, it doesn't make a lot of sens since open ai doesn't have the monopole of ia anymore.
Also the only service they found to sell is literally a chatbot wich no company will find interesting if it cost too much
in reply to Amoxtli

We all will pay for it to Larry's pocket and then he will pay the 3 letter agency for a favor. That's how Larry is doing business for years.


( Very Related to Libre Software ) How AI, ICE and Elon Musk Manipulate People Into Supporting Evil?


I did a very deep dive into the history of Libre Software and stuff, and how "Open Source" became a term. And speculated out of it a whole theory about AI, ICE and US Politics in general.

Probably the best article I've ever written.




Instagram changes its algorithm after being accused of steering predators to children


It will now “avoid” doing that on more accounts.




Tesla’s earnings hit a new low, with largest revenue drop in years


The Verge is about technology and how it makes us feel. Founded in 2011, we offer our audience everything from breaking news to reviews to award-winning features and investigations, on our site, in video, and in podcasts.


Missing something on scheduled posts?


I recently scheduled several posts, but they didn't post at the scheduled time, unless I'm missing something. Any suggestions?
Missing something on scheduled posts?
in reply to PugJesus

Hey good folks, i.e. Rimu & PugJesus@piefed.social / piefed.social/u/PugJesus (pardon, not yet sure how to correctly tag here),

I happened to have this same issue last week, and am pleased to see today that the bugfix seems to have worked! Ah, and one other useful thing I discovered was that one can go back and correct a post if one happened to have botched the scheduled time, previously:

I couldn't find a way to go back to that post directly, but sure enough, I pulled up browser history, went back to the post link, made the edits, and it successfully posted at the corrected, specified time! 😃



in reply to TurboLag

If Wikipedia can't fully comply and has to resort to blocking, how a small one-man platform is supposed to do it?

Yeah, exactly, block all the UK and move on.

Questa voce è stata modificata (1 mese fa)
in reply to PushButton

I think the law would only apply above a certain number of monthly users, so small platforms are safe from it for now.


Border Patrol Wants Advanced AI to Spy on American Cities


cross-posted from: sh.itjust.works/post/42675636

Protection, flush with billions in new funding, is seeking “advanced AI” technologies to surveil urban residential areas, increasingly sophisticated autonomous systems, and even the ability to see through walls.

A CBP presentation for an “Industry Day” summit with private sector vendors, obtained by The Intercept, lays out a detailed wish list of tech CBP hopes to purchase, like satellite connectivity for surveillance towers along the border and improved radio communications. But it also shows that state-of-the-art, AI-augmented surveillance technologies will be central to the Trump administration’s anti-immigrant campaign, which will extend deep into the interior of the North American continent, hundreds of miles from international borders as commonly understood.

Technology reshared this.

in reply to Basic Glitch

"When the students poured into Tiananmen Square, the Chinese government almost blew it. Then they were vicious, they were horrible, but they put it down with strength. That shows you the power of strength. Our country is right now perceived as weak."

-Donald Trump

Shows you what type of person he is

Questa voce è stata modificata (1 mese fa)
in reply to DeathByBigSad

Is this real? This can't be real. Then, on the other hand, it's the American president. The guy who said that ancient Rome and the US have always been allied.

Edit:

He did not say that, I was bamboozled again

Questa voce è stata modificata (1 mese fa)


Judge rules Epstein grand jury records will remain sealed


Judge rules Epstein grand jury records will remain sealed
ABC News
3–4 minutes

The records were related to grand juries convened in West Palm Beach.

A federal judge in Florida denied a Justice Department request to unseal grand jury records tied to federal investigations into Epstein, according to a public order released Wednesday.

The request is one of three made by the Justice Department to judges in New York and Florida seeking to unseal records from federal investigations into Epstein.

This photo provided by the New York State Sex Offender Registry shows Jeffrey Epstein, March 28, 2017.

New York State Sex Offender Registry via AP

According to the order by District Judge Robin Rosenberg, the records the department sought to unseal related to grand juries convened in West Palm Beach in 2005 and 2007 that had investigated Epstein.

Judge Rosenberg faulted the Justice Department for failing to outline sufficient arguments to justify the unsealing of the records, which are normally protected under strict secrecy rules.

Rosenberg's opinion states her "hands are tied" given existing precedent in the Eleventh Circuit Court of Appeals which only permits the disclosure of such grand jury materials under narrow exceptions.

She further denied a request to transfer the issue into the jurisdiction of the Southern District of New York, where two judges are separately mulling over similar motions from the department seeking to unseal grand jury records tied to Epstein and his longtime associate Ghislaine Maxwell.

A Justice Department spokesperson did not immediately respond to a request for comment on the order.

Popular Reads

Meanwhile, a federal judge in New York denied Ghislaine Maxwell's request to review grand jury testimony related to Epstein.

"It is black-letter law that defendants generally are not entitled to access to grand jury materials," U.S. District Judge Paul Engelmayer wrote.

Attorney General Pam Bondi speaks during a news conference with President Donald Trump in the Brady Briefing Room of the White House, June 27, 2025, in Washington.

Andrew Caballero-Reynolds/AFP via Getty Images, Files

Maxwell's lawyers requested access to the sensitive grand jury records to determine if Maxwell would take a position on the records' release.

Judge Engelmayer wrote that there is no "compelling necessity" for Maxwell to review the records. An objection from Maxwell into unsealing the records could further complicate the process of potentially releasing the records.

"She has not shown, or attempted to show, that the grand jury materials in her case are apt to reveal any deficiency in the proceedings leading to her indictment," he wrote.

Judge Engelmayer noted that he plans to "expeditiously" review the transcripts himself and would consider providing an excerpt or synopsis to Maxwell's lawyers.

in reply to crankyrebel

Can’t Trump just issue an executive order like he has done for everything else? What’s so special about this? It can’t be because he doesn’t have authority because he didn’t have authority for most of the other EOs. It’s probably just smokescreen and there is no intention of releasing anything about his pedo mate Epstein.


the order of redirections is significant


In bash, if you put:

ls /Users/*/.ssh/id_rsa 2>&1 > rsa-keys.log

...you're redirecting stderr to the stdout's destination while stdout is still sending output to the screen. So any permission errors encountered will go to the screen, not to rsa-keys.log.

From the bash manpage:

==================

Note that the order of redirections is significant. For example, the command

   ls > dirlist 2>&1

directs both standard output and standard error to the file dirlist, while the command
   ls 2>&1 > dirlist

directs only the standard output to file dirlist, because the standard error was duplicated from the standard output before the standard output was redirected to dirlist.

==================

Commands given to the shell are evaluated and processed in a specific order and fashion, and this is one quirk of that that many people are unaware of.

in reply to lousyd

In bash if you want to redirect both stderr and stdout to file you can use &>filename.

in reply to cm0002

This works, but just FYI you made a typo.
Questa voce è stata modificata (1 mese fa)


Gazeta Destinacioni pubblicizza la mia ultima opera "Sorella di Perfezione" (LFA Publisher)


Grazie infinite a tutta la Redazione di Gazeta Destinacioni, che pubblicizza la mia ultima opera "Sorella di Perfezione" (LFA Publisher).
È una sorpresa inaspettata, e sono al settimo cielo.

gazetadestinacioni.al/sorella-…



in reply to Ephera

First one is an AA game I guess. Better production value than an indie title, but far from Skyrim or GTA.


il cartafacenzio di octo e la foglianza interattiva!!! (Papiellify, nuova app per creare fogli decorati)


Nel tentare (in parte invano, ma in parte no, dai) di alleviare le mie sofferenze giornaliere, dovute alle solite impossibilità di incartamento, eccomi qui di nuovo ad uscirmene fuori dal letterale nulla con un nuovissimo dei miei toolini pazzurdi… Ma a ‘sto giro ho davvero poca voglia di scherzare, quindi, per una buona volta, metto […]

octospacc.altervista.org/2025/…


il cartafacenzio di octo e la foglianza interattiva!!! (Papiellify, nuova app per creare fogli decorati)


Nel tentare (in parte invano, ma in parte no, dai) di alleviare le mie sofferenze giornaliere, dovute alle solite impossibilità di incartamento, eccomi qui di nuovo ad uscirmene fuori dal letterale nulla con un nuovissimo dei miei toolini pazzurdi… Ma a ‘sto giro ho davvero poca voglia di scherzare, quindi, per una buona volta, metto la fine della storia all’inizio: l’aggeggio di questa volta è caricato su https://hub.octt.eu.org/Papiellify/ (ed era da tanto che non mettevo una roba nuova lì sopra…), ed in poche parole è nientedimeno che un (o meglio, il; credo sia l’unico al mondo) fogliatore… 🍀

In pratica, ero qui di nuovo a voler stampare fogli con grafichine personalizzate, come mostrai qualche altra volta, ma il solo pensiero di dovermi ancora mettere a fare tutta quella roba strana in programmi tipo Office (di qualsiasi vendor; io uso Libre, ma non cambia) — assolutamente non fatti per questo tipo di cose, nonostante stranamente usati da tutti per questo tipo di cose — piazzando nei bordi le immagini, poi le righe, e infine non ne parliamo di layout un pochino più complessi… mi fa venire subito la nausea e dunque addio alle intenzioni spassose. Ovviamente, come all’assoluto solito, sono una ragazza magica, e quindi, piuttosto che avvilirmi, è spuntato fuori il momento di mettermi all’opera, con la programmazione… e questa qui è la primissima versione abbastanza utilizzabile da essere pubblicata, gnam! 🥰

Ho avuto rubamenti di tempo vari adesso eh, quindi ci ho messo qualche giorno in più che normalmente non avrei impiegato per arrivare al punto di qualcosa che già mi sta essendo di enorme utilità, ma la app per ora è ancora abbastanza semplice, pure se non sembra… Ci sono tanti controlli a schermo, si, e si possono già creare infiniti layout sfiziosi semplicemente maneggiando con questi form, certo, però questo ancora non è niente rispetto a quello che potrebbe essere… neanche il tempo di saltellare per i progressi già fatti finora, infatti, e già sento la mancanza di una gestione multi-pagina, o di più preset di stile impostabili, ma vedrò di adoperarmi man mano che le necessità spunteranno fuori (a me, o ad altri… vi scongiuro, apprezzate il mio lavoro cartiaco…) 😳

Io invito come sempre a provare per credere (e sennò che cazzo li metto online a fare i miei tool…), ma in buona sostanza questo è come funziona la app: sfruttando non casualmente, ma proprio esattamente (cioè, usare altro di base mi avrebbe richiesto infinitamente più lavoro), le funzioni di layout intrinseche della piattaforma web (il CSS, bono!), permette di gestire dei livelli (che nella pagina sono non altro che elementi HTML con applicati particolari stili), che sono definiti da immagini caricabili o pattern preprogrammati (come codici SVG), e sono personalizzabili in una marea di criteri tra cui dimensioni, spaziature, slittamenti, e per i pattern cose come spessore del tratto, colori e vattelappesca — tutto impostabile precisamente, e altamente risminchiabile, senza scrivere codice! 😜
Esempio Sailor Moon e stampa da FirefoxEsempio pattern personalizzato e PDF A4
Qui, per esempio, ho creato due diversi papielli (ovviamente stampabili, e che goduria) per provare un po’ il tutto: il primo, a righe azzurre spaziate a 8mm e con una decorazione di Sailor Moon in basso a destra (dimensionata in modo ideale per l’A5, ma ovviamente modificabile); ed il secondo, con una griglia a puntini di 10mm decorata ogni 4 con dei cuoricini ed entrambi usano solo due livelli, quindi si può fare solo di meglio. Questi esempi, ed eventualmente altri che creerò, li ho salvati in JSON con l’apposita funzione del menu in-app, e chiunque voglia usarli può semplicemente caricarli nell’applicazione, sono scaricabili qui: memos.octt.eu.org/m/gnwNvbS4zv…. 💖

Un bonus per me, per concludere, è che ho notato che sui browser web mobile questa app funziona a metà… e detto così sembra qualcosa di negativo, ma io ero partita dal presupposto che la UI di questa app dovesse essere così intricata da essere virtualmente inutilizzabile su smartphone; quindi, scoprire che in realtà si riesce realisticamente ad usare (forse anche grazie al fatto che il pannello delle opzioni si può restringere, e viceversa quello dell’anteprima) mi fa piacere. Il problema tuttavia è che, sia da Firefox che da Chromium, su Android (almeno, sul mio Xiaomi del cazzo…), l’esportazione su PDF o in stampa è rotta, e la pagina esce vuota… quindi poi dovrò usare qualche libreria JavaScript strana per esportare dal lato del mio codice, anziché delegare al browser, che abbiamo capito fa cagare. Una cosa comunque è certa: con tutte queste caselle di input, slider per i numeri, ed alcune opzioni forse relativamente criptiche, non è un software adatto agli utonti deboli di cuore… ma, il suo lo fa al top (credo). 😺

#design #paper #Papiellify #tool #webapp



in reply to crankyrebel

You think AOC is to blame here? Really? You think AOC is sneaking into rooms with republicans where they all agree not to talk about Israel’s weapons? That’s your truth?

Genuine question: how retarded are you?

in reply to mienshao

You don't have to sneak in a room to agree not to talk about it if you already agree not to talk about it. You just don't talk about it.

Has she talked about it? If she has you may have a point. Otherwise you are running defense while being objectively wrong.



Watermarks offer no defense against deepfakes, study suggests


Technology reshared this.

in reply to Davriellelouna

There is a solution, but y'all aren't going to like it.

The solution is blockchain. Actually, it's even worse, the solution is NFT's.

Not the scammy, crypto bro, nonsense it has been used for; but the actual technology.

A cryptographically secure digital token that can track where something was made, where it's being used, who has the rights to it, and ensures that it's authentic and not some copy made with AI.

Unfortunately, thanks to crypto bros, the technology has become so tainted by scams that most people get upset just hearing the letters NFT, so adoption isn't likely.

in reply to I_Has_A_Hat

I don't think this is that controversial. If you take out NFTs, it's using the block chain as a hash. I think that works, but at that point you might as well use regular hashes to verify the integrity of your video
in reply to Randomgal

at that point you might as well use regular hashes to verify the integrity of your video


Generated by what authority, though?

in reply to Randomgal

Just fucking sign it. With your private key.

And publish your public key.

Then everyone will be able to verify it's your work, and no deepfake will ever pass that test.

in reply to msage

Yeah, I don't know why this is so difficult. Can even have players that autoread the signature to tell you the source/etc.
in reply to I_Has_A_Hat

There are other privacy issues with having an indelible marker as to the origin and chain of custody of every digital artifact. And other non-privacy issues.

So the idea here is that my phone camera attaches a crypro token to the metadata of every photo it takes? (Or worse, embeds it into the image steganographically like printer dots.) Then if I send that photo to a friend in signal, that app attaches a token indicating the transfer? And so on?

If that's a video of say, police murdering someone, maybe I don't want a perfect trail pointing back to me just to prove I didnt deep fake it. And if that's where we are, then every video of power being abused is going to "be fake" because no sane person would sacrifice their privacy, possibly their life, to "prove" a video isnt AI generated.

And those in power, the mainstream media say, aren't going to demonstrate the crypto chain of custody on every video they show on the news. They're going to show whatever they want, then say "its legit, trust us!" and most people will.

These are the fundamental issues with crypto that people actually don't understand: too much of it is actually opt-in, it's unclear to most people what's actually proved or protected, and it doesn't actually address or understsnd where trust, authority, and power actually come from.

in reply to I_Has_A_Hat

Sorry for blowing this on you, but fuck blockchain, fuck NFTs.

What we need is better understanding of cryptography.

PGP has solved this problems decades ago, and crypto has just borrowed some parts, but made it worse in every possible way and into incomprehensible depths.

Again, fuck crypto, fuck NFTs.

I should make a guide on how to use GPG.

in reply to msage

I thought GPG was bad? I don't have enough personal experience with it to quickly summarize or opine on the merits of either of these two articles, but:

The PGP Problem: latacora.com/blog/2019/07/16/t…

What To Use Instead of PGP: soatok.blog/2024/11/15/what-to…

I do agree with "fuck NFTs" though, and mostly agree with "fuck cryptocurrency" (mostly because porn and drugs are in my view legitimate use cases for at least a hypothetical non-environmentally-destructive cryptocurrency).


What To Use Instead of PGP


It’s been more than five years since The PGP Problem was published, and I still hear from people who believe that using PGP (whether GnuPG or another OpenPGP implementation) is a thing they should be doing.

It isn’t.

I don’t blame individual Internet users for this confusion. There is a lot of cargo-culting around communication tools in the software community, and the evangelists for the various projects muddy the waters for the rest of us.

Harubaki

The part of the free and open source software community that thinks PGP is just dandy, and therefore evangelize the hell out of it to unsuspecting people, are the same kind of people that happily use XMPP+OMEMO, Matrix, or weird Signal forks that remove forward secrecy and think it’s fine.

Not to mince words: The same people who believe PGP is good are also famously not great at cryptography engineering.

If you’re going to outsource your opinions on privacy technology to someone else, make sure it’s someone who has actually found vulnerabilities in cryptographic software before. Most evangelists have not.

CMYKat

I’m not here to litigate the demerits of PGP. The Latacora article I linked above makes the same arguments I would make today, and is a more entertaining read.

It is of my opinion as a security engineer that specializes in applied cryptography that nobody should use PGP, because there’s virtually always a better tool for the job you want to use PGP for.

(And for the uncommon use cases, offering a secure, purpose-built replacement is a work-in-progress.)

Note: I’m deliberately being blunt in this post because literally more than a decade of softspokenness from cryptography experts has done nothing to talk users off the PGP cliff. Being direct seems more effective than being tactful.

If you want a gentler touch, ask your cryptographer. If you don’t have a cryptographer, hire one.


If you can accept that every billionaire is the result of a failed system, that’s how cryptographers feel about people using PGP.

Instead, let’s examine the “use cases” of PGP and what you should be using instead. (Some of this is redundant with the Latacora article, but I’m also writing it 5 years later, so some things have changed.)

Clipboard StickerCMYKat

Instead of PGP, Use This


This section contains specific tools to solve the same problems that PGP tries to solve, but better.

What makes these recommendations better than PGP?

Simply, they don’t make cryptographers want to run the other way screaming when they look under the hood. PGP does.

Some people are forced to use PGP because they work for a government that legally requires them to use PGP. In that corner case, your hands are tied by lawyers, so you don’t need to bother with what cryptographers recommend.

OwO stickerCMYKat

Signing Software Distributions


Use Sigstore.

Note that this is an ecosystem-wide consideration, not something that specific individuals must manually opt into for each of their hobby projects. The only downside to Sigstore is it hasn’t been widely adopted yet.

If you’re a Python developer, you can just use PEP 740 to get attestations with Trusted Publishers, which gives you Sigstore for free. For most developers, this is as simple as setting up a GitHub Action to publish to PyPI.

This is a developing trend: Other programming language and package management ecosystems are following suit. I expect to see Sigstore attestations baked into NPM and Maven before the next US presidential election. With any luck, your favorite programming language could be on this list too.


Sigstore doesn’t just give you a signature that you check with a long-lived public key, nor does it require you to do the Web Of Trust rigamarole.

Rather, Sigstore gives you a lot for free. Sigstore was designed around ephemeral signing certificates rather than a long-lived private key. It was purpose-built for preventing supply-chain attacks against open source software.

Combined with Reproducible Builds, Sigstore solves the triangle of secure code delivery.

Alternatively, use minisign. If your package ecosystem doesn’t support Sigstore yet, you can get by with minisign (which is signify-compatible) until they modernize.

You can also use SSH signatures, if you’d prefer. (More on that below.)

Drakeposting Yes StickerCMYKat

Signing Git Tags/Commits


Use SSH Signatures, not PGP signatures.

With Ed25519. Stop using RSA.

Art by Harubaki

Sending Files Between Computers


Use Magic Wormhole.

You could also use SSH + rsync to do this job. That’s fine too.

CMYKat

Encrypting Backups


Tarsnap is the usual recommendation here.

There are a lot of other encrypted backup tools that work fine, if you don’t want to give Colin Percival your business. I don’t have a financial stake in any of them, nor have I audited them thoroughly.

Borg uses reasonable cryptography, but I haven’t had the time to review it carefully.

Kopia looks fine, but I really hate that they misuse “zero knowledge” to describe an encryption protocol (rather than a proof system). We should not reward this misbehavior by marketers.

The point is: You’ve got options.

Too many options, in my opinion, to settle for PGP.

Speechless StickerCMYKat

Encrypting Application Data


Use Tink or libsodium.

Avoid: OpenPGP, OpenSSL and its competitors.

Not a lot to say here. I’ve written a lot about this over the years. Misuse-resistant cryptography libraries–especially ones that make key management less painful for users–are the way to go.

Harubaki

Encrypting Files


Use age.

Age is what PGP file encryption would be if PGP didn’t suck shit.

Age has two modes: Public-key encryption, and password-based key derivation.

Here’s a quick comparison table between what age offers, and what PGP uses in the installed base:

agePGP
Data encryption modeAEAD (ChaPoly)CAST5 (64-bit block cipher) in CFB mode with a strippable SHA1 “MDC”
Key-commitmentYes (via the header)Pah! You wish! Dream on.
PGP isn’t even AEAD.
Password KDF memory hard?Yes, with scrypt.No.
Vulnerable to chosen-ciphertext attacks?No.Yes, but PGP proponents stupidly consider this a good thing.
Supports 90’s-era cryptography?No.Yes.
Releases unauthenticated plaintext?No.Yes.
Uses versioned protocols rather than “cipher agility”?Yes.No. See: 90’s era cryptography.
Most common implementations are memory-safe?Yes (Go, Rust).No (C).

Like, it’s not even close.

NO stickerCMYKat

Some PGP proponents will insist that AEAD is possible now, but as long as the installed base of PGP remains backwards compatible with the lowest common denominator, that’s what your software uses.

Just use age. Or rage, if you’re a Rust enthusiast.

(And if you have concerns about “which age key should I trust?”, I’m already planning an age-v1 extension for the Public Key Directory project. More on that below.)

Art by Scruff

Private Messaging


Use Signal.

Security teams around the world insist that they need PGP for bug bounty submissions or security operations, but Signal does this job better than PGP ever did.

Once upon a time, you needed to give people a phone number to use Signal, but that hasn’t been the case for a long time. Still, many people have missed that memo and think it’s a requirement.

My Signal username is soatok.45. Go ahead and message me. You won’t learn my phone number that way.

In the near future, I plan on developing end-to-end encryption for direct messages on the Fediverse (including Mastodon). This is what motivated my work on the Public Key Directory to begin with.

But this is not intended to be a Signal competitor by any measure. It’s a bar-raising activity, nothing more.

Soatok drinking coffeeCMYKat

Miscellaneous PGP Alternatives


This section contains things people think they need PGP for.

Identity Verification


I’m actively working on something better!

via XKCD

If you want the ability to vend a transparently verifiable public key for a given user, that’s one of the use cases for the Public Key Directory I’m designing in order to build end-to-end encryption for the Fediverse.

Although this is purpose-built for the Fediverse, I’ve deliberately included support for Auxiliary Data messages, whose formats will be specified by protocol extensions.

Rather than trying to grok the Web-of-Trust, you can simply have your software check that multiple independent Public Key Directories have verified the record, since its inclusion is published in an append-only transparency log, secured by a Merkle tree.

My design doesn’t preclude any manual key verification, or key-signing parties, or whatever other PGP cultural weirdness you want to do with these public keys. It just establishes a baseline trustworthiness even if you’re not a paranoid computer nerd.

My project isn’t finished yet. In the meantime, you can manually check public keys when using the other recommendations on this page.

Harubaki

Encrypted Email


Don’t encrypt email. From the Latacora article:

Email is insecure. Even with PGP, it’s default-plaintext, which means that even if you do everything right, some totally reasonable person you mail, doing totally reasonable things, will invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen). PGP email is forward-insecure. Email metadata, including the subject (which is literally message content), are always plaintext.


There isn’t a recommendation for encrypted email because that’s not a thing people should be doing.

Art by AJ

Now, there exists a minority of extremely technical computer user for which Signal is a nonstarter (because you need a smartphone and valid phone number to enroll in the first place).

Because those people are generally not the highest priority of cryptographers (who are commonly focused on the privacy of common folk–including people in poor and developing countries where smartphones are more common than desktop computers), there presently isn’t really a good recommendation for private messaging that meets their constraints.

Not Matrix.

Not XMPP+OMEMO.

Certainly not PGP, either.

What PGP offers here is security theater: the illusion of safety. But it’s not actually a robust private communication mechanism, as Latacora argues.

Sad StickerCMYKat

“I insist that I need encrypted email!”


If you find someone insisting that they “need” encrypted email, read up on the XY Problem. In a lot of cases, that’s what’s happening here.

Do they ipso facto need email (as in, specifically the email protocols and email software)?

And do they care more about this constraint, or the privacy of their communications?

Because if their goal just to communicate privately, see above.

If the tool they’re using being email is more important than privacy, they should consider sending empty messages with an attachment, and use age to encrypt the actual message before attaching it.

That’s serviceable, just beware that everything Latacora wrote about encrypted emails still applies to your use case, so expect someone to CC or forward your message as plaintext.

(Unless you’re legally required to use PGP because of a government regulation… in which case, why do you care about my recommendations if you’re chained by the ankle to your government’s bad technology choices?)

Finally, miss me with the “but someone can screenshot Signal” genre of objections.

As Latacora noted, people accidentally fuck up PGP all the time! It’s very easy to do.

Conversely, you have to deliberately leak something from Signal. There is no plaintext mode.

That’s the fucking bar you need to meet to compete with Signal.

PGP fails to be a Signal competitor, in ways that are worse than Threema, Matrix, or OMEMO.

Watch This Space


With all that said, I am actually designing an encrypted messaging protocol that will have an email-like user experience, except:

  1. Everything is always end-to-end encrypted, with forward secrecy.
  2. It’s not backwards compatible with insecure email.
  3. It doesn’t use PGP, or any 1990’s era cryptography.

I can’t promise a release date yet. I’m prioritizing end-to-end encryption for the Fediverse before I write the specification for that project (tentatively called AWOO, but the cryptography underpinning both projects should be similar).

Maybe 2026? We’ll see!

If someone beats me to the punch, and their design is actually good, I’ll update the post and replace this with a specific recommendation.

galaxy brain stickerCMYKat

Against PGP


I don’t know how to get the message out louder or clearer about how cryptographers feel about PGP than what I wrote here.

Latacora wrote their criticism in 2019. As I write this, 2024 is almost over. When will the PGP-induced madness end?

Blue Screen of Death StickerCMYKat


Header art credits: CMYKat and the GnuPG logo.

Update (2024-11-16)


Someone tried to use their Fediverse software to submit an anti-furry comment to this blog post.

Therefore, I’ve added more furry art to it.

loviesophiee

#alternatives #codeSigning #digitalSignatures #encryption #PGP #security #SecurityGuidance #signing


in reply to Noxy

It's not good.

But it's leagues better than crypto.

I hate typing 'asymmetric key cryptography', and GPG is just three letters.

Those blog posts explain a lot, but one use case is missing (at least I don't see it apart from git commit signing), and that is verifying the source of a public message.

And I do wish we tried using the private keys more. Specially now when anyone can deepfake anything.

If I ever release my nudes, never trust them unless they are signed and you can check them with public key in my profile.

in reply to I_Has_A_Hat

The tech would have been great for bestowing ownership over the digital goods bought with microtransactions, but never would have gotten there since corpos have the rule of law under their thumb.
in reply to I_Has_A_Hat

You can have whatever token you want with all the metadata, licensing and ownership information you want...

...unless you plan on only seeing images in your own platform, nobody gives a shit, people will take screenshots and image files and share and use them however they want. There's no world in which you load a full DRM plugin or do 4 different types of handshake with a full blockchain just to load a jpeg into a comment.



'We're dying in front of the world': Palestinian journalist describes daily famine in Gaza to Le Monde


in reply to inlandempire

i keep seeing these people's experiences on tiktok and rednote and still can't imagine what life is like knowing that the entire world is going to do nothing but watch as you live out the last few hours/days of your life with the knowledge you're going to die slowly from starvation and that the lucky ones are the ones who die quickly from a missile strike or gunshot from an idf soldier.

you beg and you plead for help and an overwhelming majority just ignore you, with the few that will try to help are just as impotent as you are to help your situation.



Microsoft C++ static analysis tool bolsters warning suppressions






Anti-genocide protesters block hundreds of Israeli tourists from disembarking in Greek port


Israeli passengers on a cruise ship arriving in Greece on 22 July were unable to disembark the vessel due to a large crowd of pro-Palestine protesters demonstrating against the Israeli genocide of Palestinians in the Gaza Strip.

The MS Crown Iris, owned by Israeli cruise line Mano Maritime, arrived on Tuesday at the Greek island of Syros in the Aegean Sea. The passengers were supposed to disembark for six hours.

However, they were forced to remain on board due to the protests in support of Palestine.

[...]

A group of the Greek island’s residents organized the protest and posted on social media that they “raise their fists in solidarity with the Palestinians in Gaza,” adding that “it is unacceptable that tourists from Israel continue to be welcomed here while the Palestinians are suffering in the Strip.”



diggita 2: storia di un reboot


l'ex Diggita.it, progetto partito nel 2007 è stato abbanonato definitivamente nel 2024, ora c'è diggita.com che gira su lemmy, gestito da un diverso gruppo di volontari facenti parte dell’associazione no-profit Fedimedia APS.

In origine il progetto era nato nel 2007 sul vecchio dominio diggita.it come iniziativa personale mia e di un’altra persona. Avrei voluto migrare nel Fediverso già diversi anni fa, ma il percorso non è stato semplice: il software che stavamo seguendo, Kbin, è stato abbandonato dallo sviluppatore; anche il fork Mbin non ha avuto il successo sperato e ora rimane con una misera eredità di una ventina di istanze.
Alla fine, l’unica piattaforma che risulta affidabile per aprire un sito con gruppi tematici sembrò essere Lemmy, e così nel 2024 abbiamo deciso di ripartire da lì, da zero iscritti, da zero articoli , abbandonando quindi 17 anni di articoli e 80mila iscritti 😅

In pratica, abbiamo buttato via 17 anni di lavoro per amore del feiverso. La persona che gestiva il progetto precedente su diggita.it ha lasciato ed è subentrato alla gestione tecnica il gruppo devol e fedimedia con l'intento di fare un reboot etico e no-profit.

L’intero archivio dal 2007 al 2024 è stato cancellato, dato che la proprietà è cambiata e non ha nulla più a che fare con la precedente gestione, abbiamo deciso di ricominciare da zero con un progetto dal basso, partecipato dalle persone di mastodon.uno e del fediverso.

Le uniche cose che abbiamo conservato del vecchio Diggita sono il nome e il logo che, per la cronaca, si ispiravano a Digg, un portale americano a cui ci rifacevamo e che ormai non esiste più da anni 😁

reshared this