Salta al contenuto principale



US | Supreme Court allows Trump to remove 3 Democrats on the Consumer Product Safety Commission


The Supreme Court has allowed the Trump administration to remove three Democratic members of the Consumer Product Safety Commission, who had been fired by President Donald Trump and then reinstated by a federal judge.

https://apnews.com/article/supreme-court-trump-consumer-product-safety-f0ed5ff2409287440f5067d64031429d



[Opinion] The Last Thing We Had in Gaza Was Flour. Now Even That Is Gone.


My father feels dizzy every single day. I lost four kilograms in just one week. People are collapsing in the streets.


Archived version: archive.is/newest/truthout.org…


Disclaimer: The article linked is from a single source with a single perspective. Make sure to cross-check information against multiple sources to get a comprehensive view on the situation.


in reply to ☆ Yσɠƚԋσʂ ☆

So they keep saying hegseth is doing and saying things that aren't policy, that end up being policy. His wrongs seem to be leaking the policies. Is that about it?



The DuckDuckGo Browser: Fresh New Look, Same Great Protections, AI Optional


Redesigned icons, a softer interface, a fresh color palette, and interactive elements to show you exactly how DuckDuckGo is protecting you.


US | 'There Is No Evidence': Judge Orders Kilmar Abrego Garcia's Release While Ripping Trump DOJ


Federal judge orders Kilmar Abrego Garcia released ahead of his trial while slamming the Trump administration's MS-13 claims


Case file: storage.courtlistener.com/reca…




US | DOJ told Trump that his name is among others in the Epstein files: report


The report comes as president sues the Wall Street Journal for defamation


Archived version: archive.is/newest/independent.…


Disclaimer: The article linked is from a single source with a single perspective. Make sure to cross-check information against multiple sources to get a comprehensive view on the situation.



Iranian Navy helicopter intercepts US destroyer in Sea of Oman


According to a statement from Iran's military, the US warship approached waters monitored by Iran, prompting a rapid-reaction helicopter from the Third Naval Region of the Iranian Army's Navy (NEDAJA) to deploy.

The helicopter hovered over the destroyer and delivered a clear radio warning to steer clear of Iranian-monitored waters.

In the ensuing standoff, the crew of the USS Fitzgerald threatened to engage the helicopter if it remained in proximity.

Iran’s Army Air Defense Command then intervened, declaring the helicopter under full air defense protection and ordering the American destroyer to change its course.

According to the statement, the USS Fitzgerald complied, heading south away from the disputed area.

in reply to geneva_convenience

Is this different from typical boundary testing? All major militaries will do this to gage response time of other countries.
in reply to meco03211

Only one major military does this in every single ocean of the world on every single nation's naval borders and only one does so weeks after dropping bunker busters on nuclear sites in an unprovoked preemptive strike.

in reply to TurboLag

If Wikipedia can't fully comply and has to resort to blocking, how a small one-man platform is supposed to do it?

Yeah, exactly, block all the UK and move on.

Questa voce è stata modificata (1 mese fa)
in reply to PushButton

I think the law would only apply above a certain number of monthly users, so small platforms are safe from it for now.


AI-Powered Vision System Helps Drones Navigate Safely


#AII




Border Patrol Wants Advanced AI to Spy on American Cities


cross-posted from: sh.itjust.works/post/42675636

Protection, flush with billions in new funding, is seeking “advanced AI” technologies to surveil urban residential areas, increasingly sophisticated autonomous systems, and even the ability to see through walls.

A CBP presentation for an “Industry Day” summit with private sector vendors, obtained by The Intercept, lays out a detailed wish list of tech CBP hopes to purchase, like satellite connectivity for surveillance towers along the border and improved radio communications. But it also shows that state-of-the-art, AI-augmented surveillance technologies will be central to the Trump administration’s anti-immigrant campaign, which will extend deep into the interior of the North American continent, hundreds of miles from international borders as commonly understood.

Technology reshared this.

in reply to Basic Glitch

"When the students poured into Tiananmen Square, the Chinese government almost blew it. Then they were vicious, they were horrible, but they put it down with strength. That shows you the power of strength. Our country is right now perceived as weak."

-Donald Trump

Shows you what type of person he is

Questa voce è stata modificata (1 mese fa)
in reply to DeathByBigSad

Is this real? This can't be real. Then, on the other hand, it's the American president. The guy who said that ancient Rome and the US have always been allied.

Edit:

He did not say that, I was bamboozled again

Questa voce è stata modificata (1 mese fa)


Judge rules Epstein grand jury records will remain sealed


Judge rules Epstein grand jury records will remain sealed
ABC News
3–4 minutes

The records were related to grand juries convened in West Palm Beach.

A federal judge in Florida denied a Justice Department request to unseal grand jury records tied to federal investigations into Epstein, according to a public order released Wednesday.

The request is one of three made by the Justice Department to judges in New York and Florida seeking to unseal records from federal investigations into Epstein.

This photo provided by the New York State Sex Offender Registry shows Jeffrey Epstein, March 28, 2017.

New York State Sex Offender Registry via AP

According to the order by District Judge Robin Rosenberg, the records the department sought to unseal related to grand juries convened in West Palm Beach in 2005 and 2007 that had investigated Epstein.

Judge Rosenberg faulted the Justice Department for failing to outline sufficient arguments to justify the unsealing of the records, which are normally protected under strict secrecy rules.

Rosenberg's opinion states her "hands are tied" given existing precedent in the Eleventh Circuit Court of Appeals which only permits the disclosure of such grand jury materials under narrow exceptions.

She further denied a request to transfer the issue into the jurisdiction of the Southern District of New York, where two judges are separately mulling over similar motions from the department seeking to unseal grand jury records tied to Epstein and his longtime associate Ghislaine Maxwell.

A Justice Department spokesperson did not immediately respond to a request for comment on the order.

Popular Reads

Meanwhile, a federal judge in New York denied Ghislaine Maxwell's request to review grand jury testimony related to Epstein.

"It is black-letter law that defendants generally are not entitled to access to grand jury materials," U.S. District Judge Paul Engelmayer wrote.

Attorney General Pam Bondi speaks during a news conference with President Donald Trump in the Brady Briefing Room of the White House, June 27, 2025, in Washington.

Andrew Caballero-Reynolds/AFP via Getty Images, Files

Maxwell's lawyers requested access to the sensitive grand jury records to determine if Maxwell would take a position on the records' release.

Judge Engelmayer wrote that there is no "compelling necessity" for Maxwell to review the records. An objection from Maxwell into unsealing the records could further complicate the process of potentially releasing the records.

"She has not shown, or attempted to show, that the grand jury materials in her case are apt to reveal any deficiency in the proceedings leading to her indictment," he wrote.

Judge Engelmayer noted that he plans to "expeditiously" review the transcripts himself and would consider providing an excerpt or synopsis to Maxwell's lawyers.

in reply to crankyrebel

Can’t Trump just issue an executive order like he has done for everything else? What’s so special about this? It can’t be because he doesn’t have authority because he didn’t have authority for most of the other EOs. It’s probably just smokescreen and there is no intention of releasing anything about his pedo mate Epstein.



the order of redirections is significant


In bash, if you put:

ls /Users/*/.ssh/id_rsa 2>&1 > rsa-keys.log

...you're redirecting stderr to the stdout's destination while stdout is still sending output to the screen. So any permission errors encountered will go to the screen, not to rsa-keys.log.

From the bash manpage:

==================

Note that the order of redirections is significant. For example, the command

   ls > dirlist 2>&1

directs both standard output and standard error to the file dirlist, while the command
   ls 2>&1 > dirlist

directs only the standard output to file dirlist, because the standard error was duplicated from the standard output before the standard output was redirected to dirlist.

==================

Commands given to the shell are evaluated and processed in a specific order and fashion, and this is one quirk of that that many people are unaware of.

in reply to lousyd

In bash if you want to redirect both stderr and stdout to file you can use &>filename.

in reply to cm0002

This works, but just FYI you made a typo.
Questa voce è stata modificata (1 mese fa)



Gazeta Destinacioni pubblicizza la mia ultima opera "Sorella di Perfezione" (LFA Publisher)


Grazie infinite a tutta la Redazione di Gazeta Destinacioni, che pubblicizza la mia ultima opera "Sorella di Perfezione" (LFA Publisher).
È una sorpresa inaspettata, e sono al settimo cielo.

gazetadestinacioni.al/sorella-…



in reply to Ephera

First one is an AA game I guess. Better production value than an indie title, but far from Skyrim or GTA.


il cartafacenzio di octo e la foglianza interattiva!!! (Papiellify, nuova app per creare fogli decorati)


Nel tentare (in parte invano, ma in parte no, dai) di alleviare le mie sofferenze giornaliere, dovute alle solite impossibilità di incartamento, eccomi qui di nuovo ad uscirmene fuori dal letterale nulla con un nuovissimo dei miei toolini pazzurdi… Ma a ‘sto giro ho davvero poca voglia di scherzare, quindi, per una buona volta, metto […]

octospacc.altervista.org/2025/…


il cartafacenzio di octo e la foglianza interattiva!!! (Papiellify, nuova app per creare fogli decorati)


Nel tentare (in parte invano, ma in parte no, dai) di alleviare le mie sofferenze giornaliere, dovute alle solite impossibilità di incartamento, eccomi qui di nuovo ad uscirmene fuori dal letterale nulla con un nuovissimo dei miei toolini pazzurdi… Ma a ‘sto giro ho davvero poca voglia di scherzare, quindi, per una buona volta, metto la fine della storia all’inizio: l’aggeggio di questa volta è caricato su https://hub.octt.eu.org/Papiellify/ (ed era da tanto che non mettevo una roba nuova lì sopra…), ed in poche parole è nientedimeno che un (o meglio, il; credo sia l’unico al mondo) fogliatore… 🍀

In pratica, ero qui di nuovo a voler stampare fogli con grafichine personalizzate, come mostrai qualche altra volta, ma il solo pensiero di dovermi ancora mettere a fare tutta quella roba strana in programmi tipo Office (di qualsiasi vendor; io uso Libre, ma non cambia) — assolutamente non fatti per questo tipo di cose, nonostante stranamente usati da tutti per questo tipo di cose — piazzando nei bordi le immagini, poi le righe, e infine non ne parliamo di layout un pochino più complessi… mi fa venire subito la nausea e dunque addio alle intenzioni spassose. Ovviamente, come all’assoluto solito, sono una ragazza magica, e quindi, piuttosto che avvilirmi, è spuntato fuori il momento di mettermi all’opera, con la programmazione… e questa qui è la primissima versione abbastanza utilizzabile da essere pubblicata, gnam! 🥰

Ho avuto rubamenti di tempo vari adesso eh, quindi ci ho messo qualche giorno in più che normalmente non avrei impiegato per arrivare al punto di qualcosa che già mi sta essendo di enorme utilità, ma la app per ora è ancora abbastanza semplice, pure se non sembra… Ci sono tanti controlli a schermo, si, e si possono già creare infiniti layout sfiziosi semplicemente maneggiando con questi form, certo, però questo ancora non è niente rispetto a quello che potrebbe essere… neanche il tempo di saltellare per i progressi già fatti finora, infatti, e già sento la mancanza di una gestione multi-pagina, o di più preset di stile impostabili, ma vedrò di adoperarmi man mano che le necessità spunteranno fuori (a me, o ad altri… vi scongiuro, apprezzate il mio lavoro cartiaco…) 😳

Io invito come sempre a provare per credere (e sennò che cazzo li metto online a fare i miei tool…), ma in buona sostanza questo è come funziona la app: sfruttando non casualmente, ma proprio esattamente (cioè, usare altro di base mi avrebbe richiesto infinitamente più lavoro), le funzioni di layout intrinseche della piattaforma web (il CSS, bono!), permette di gestire dei livelli (che nella pagina sono non altro che elementi HTML con applicati particolari stili), che sono definiti da immagini caricabili o pattern preprogrammati (come codici SVG), e sono personalizzabili in una marea di criteri tra cui dimensioni, spaziature, slittamenti, e per i pattern cose come spessore del tratto, colori e vattelappesca — tutto impostabile precisamente, e altamente risminchiabile, senza scrivere codice! 😜
Esempio Sailor Moon e stampa da FirefoxEsempio pattern personalizzato e PDF A4
Qui, per esempio, ho creato due diversi papielli (ovviamente stampabili, e che goduria) per provare un po’ il tutto: il primo, a righe azzurre spaziate a 8mm e con una decorazione di Sailor Moon in basso a destra (dimensionata in modo ideale per l’A5, ma ovviamente modificabile); ed il secondo, con una griglia a puntini di 10mm decorata ogni 4 con dei cuoricini ed entrambi usano solo due livelli, quindi si può fare solo di meglio. Questi esempi, ed eventualmente altri che creerò, li ho salvati in JSON con l’apposita funzione del menu in-app, e chiunque voglia usarli può semplicemente caricarli nell’applicazione, sono scaricabili qui: memos.octt.eu.org/m/gnwNvbS4zv…. 💖

Un bonus per me, per concludere, è che ho notato che sui browser web mobile questa app funziona a metà… e detto così sembra qualcosa di negativo, ma io ero partita dal presupposto che la UI di questa app dovesse essere così intricata da essere virtualmente inutilizzabile su smartphone; quindi, scoprire che in realtà si riesce realisticamente ad usare (forse anche grazie al fatto che il pannello delle opzioni si può restringere, e viceversa quello dell’anteprima) mi fa piacere. Il problema tuttavia è che, sia da Firefox che da Chromium, su Android (almeno, sul mio Xiaomi del cazzo…), l’esportazione su PDF o in stampa è rotta, e la pagina esce vuota… quindi poi dovrò usare qualche libreria JavaScript strana per esportare dal lato del mio codice, anziché delegare al browser, che abbiamo capito fa cagare. Una cosa comunque è certa: con tutte queste caselle di input, slider per i numeri, ed alcune opzioni forse relativamente criptiche, non è un software adatto agli utonti deboli di cuore… ma, il suo lo fa al top (credo). 😺

#design #paper #Papiellify #tool #webapp



in reply to crankyrebel

You think AOC is to blame here? Really? You think AOC is sneaking into rooms with republicans where they all agree not to talk about Israel’s weapons? That’s your truth?

Genuine question: how retarded are you?

in reply to mienshao

You don't have to sneak in a room to agree not to talk about it if you already agree not to talk about it. You just don't talk about it.

Has she talked about it? If she has you may have a point. Otherwise you are running defense while being objectively wrong.


in reply to davel

This and autocorrect are the first crap I desactivated on all my devices. It¡s annoying and insulting to have a text undelined in red every word which are not in the poor dictionary of this "feature", or changing FloC with fuck (well, anyway not so different)
in reply to Zerush

Yeah I have autosuggest but not autocorrect. When the word pops up on the 3 choices above the keyboard, they might be useful but they can almost never predict full sentences from what my thought process is.
in reply to davel

I find it so bizarre, too. I've been using quite a similar autosuggestion feature as part of Fish shell for a few years now. But when an LLM keeps spewing words at me, that's a whole different shtick. It genuinely just inhibits my thinking, which is a feeling I never had with Fish.

I guess, one difference is that Fish uses real intelligence, a.k.a. my shell history. If it has a suggestion, the chance is high that it's actually what I want to do or close to it. And it also shuts the hell up when there's no good suggestion. I don't have to be constantly vigilant that what it suggests might be complete garbage.

And the other difference is probably that it's *my* intelligence, *my* shell history. I will have thunk the thoughts before which lead to the command it suggests, which brings the brain load much further down again.
Occasionally, it'll suggest something where I have no recollection of having run that command before, but knowing that I have, is still really useful and this only happens for niche commands anyways. Most of the suggestions are just stuff which I've run a few minutes ago or last week or such, where I won't have to think about it.

I guess, it probably also helps that commands have simple formatting, with only a single line and you can mostly read the flags in any order...



Watermarks offer no defense against deepfakes, study suggests


Technology reshared this.

in reply to Davriellelouna

There is a solution, but y'all aren't going to like it.

The solution is blockchain. Actually, it's even worse, the solution is NFT's.

Not the scammy, crypto bro, nonsense it has been used for; but the actual technology.

A cryptographically secure digital token that can track where something was made, where it's being used, who has the rights to it, and ensures that it's authentic and not some copy made with AI.

Unfortunately, thanks to crypto bros, the technology has become so tainted by scams that most people get upset just hearing the letters NFT, so adoption isn't likely.

in reply to I_Has_A_Hat

I don't think this is that controversial. If you take out NFTs, it's using the block chain as a hash. I think that works, but at that point you might as well use regular hashes to verify the integrity of your video
in reply to Randomgal

at that point you might as well use regular hashes to verify the integrity of your video


Generated by what authority, though?

in reply to Randomgal

Just fucking sign it. With your private key.

And publish your public key.

Then everyone will be able to verify it's your work, and no deepfake will ever pass that test.

in reply to msage

Yeah, I don't know why this is so difficult. Can even have players that autoread the signature to tell you the source/etc.
in reply to I_Has_A_Hat

There are other privacy issues with having an indelible marker as to the origin and chain of custody of every digital artifact. And other non-privacy issues.

So the idea here is that my phone camera attaches a crypro token to the metadata of every photo it takes? (Or worse, embeds it into the image steganographically like printer dots.) Then if I send that photo to a friend in signal, that app attaches a token indicating the transfer? And so on?

If that's a video of say, police murdering someone, maybe I don't want a perfect trail pointing back to me just to prove I didnt deep fake it. And if that's where we are, then every video of power being abused is going to "be fake" because no sane person would sacrifice their privacy, possibly their life, to "prove" a video isnt AI generated.

And those in power, the mainstream media say, aren't going to demonstrate the crypto chain of custody on every video they show on the news. They're going to show whatever they want, then say "its legit, trust us!" and most people will.

These are the fundamental issues with crypto that people actually don't understand: too much of it is actually opt-in, it's unclear to most people what's actually proved or protected, and it doesn't actually address or understsnd where trust, authority, and power actually come from.

in reply to I_Has_A_Hat

Sorry for blowing this on you, but fuck blockchain, fuck NFTs.

What we need is better understanding of cryptography.

PGP has solved this problems decades ago, and crypto has just borrowed some parts, but made it worse in every possible way and into incomprehensible depths.

Again, fuck crypto, fuck NFTs.

I should make a guide on how to use GPG.

in reply to msage

I thought GPG was bad? I don't have enough personal experience with it to quickly summarize or opine on the merits of either of these two articles, but:

The PGP Problem: latacora.com/blog/2019/07/16/t…

What To Use Instead of PGP: soatok.blog/2024/11/15/what-to…

I do agree with "fuck NFTs" though, and mostly agree with "fuck cryptocurrency" (mostly because porn and drugs are in my view legitimate use cases for at least a hypothetical non-environmentally-destructive cryptocurrency).


What To Use Instead of PGP


It’s been more than five years since The PGP Problem was published, and I still hear from people who believe that using PGP (whether GnuPG or another OpenPGP implementation) is a thing they should be doing.

It isn’t.

I don’t blame individual Internet users for this confusion. There is a lot of cargo-culting around communication tools in the software community, and the evangelists for the various projects muddy the waters for the rest of us.

Harubaki

The part of the free and open source software community that thinks PGP is just dandy, and therefore evangelize the hell out of it to unsuspecting people, are the same kind of people that happily use XMPP+OMEMO, Matrix, or weird Signal forks that remove forward secrecy and think it’s fine.

Not to mince words: The same people who believe PGP is good are also famously not great at cryptography engineering.

If you’re going to outsource your opinions on privacy technology to someone else, make sure it’s someone who has actually found vulnerabilities in cryptographic software before. Most evangelists have not.

CMYKat

I’m not here to litigate the demerits of PGP. The Latacora article I linked above makes the same arguments I would make today, and is a more entertaining read.

It is of my opinion as a security engineer that specializes in applied cryptography that nobody should use PGP, because there’s virtually always a better tool for the job you want to use PGP for.

(And for the uncommon use cases, offering a secure, purpose-built replacement is a work-in-progress.)

Note: I’m deliberately being blunt in this post because literally more than a decade of softspokenness from cryptography experts has done nothing to talk users off the PGP cliff. Being direct seems more effective than being tactful.

If you want a gentler touch, ask your cryptographer. If you don’t have a cryptographer, hire one.


If you can accept that every billionaire is the result of a failed system, that’s how cryptographers feel about people using PGP.

Instead, let’s examine the “use cases” of PGP and what you should be using instead. (Some of this is redundant with the Latacora article, but I’m also writing it 5 years later, so some things have changed.)

Clipboard StickerCMYKat

Instead of PGP, Use This


This section contains specific tools to solve the same problems that PGP tries to solve, but better.

What makes these recommendations better than PGP?

Simply, they don’t make cryptographers want to run the other way screaming when they look under the hood. PGP does.

Some people are forced to use PGP because they work for a government that legally requires them to use PGP. In that corner case, your hands are tied by lawyers, so you don’t need to bother with what cryptographers recommend.

OwO stickerCMYKat

Signing Software Distributions


Use Sigstore.

Note that this is an ecosystem-wide consideration, not something that specific individuals must manually opt into for each of their hobby projects. The only downside to Sigstore is it hasn’t been widely adopted yet.

If you’re a Python developer, you can just use PEP 740 to get attestations with Trusted Publishers, which gives you Sigstore for free. For most developers, this is as simple as setting up a GitHub Action to publish to PyPI.

This is a developing trend: Other programming language and package management ecosystems are following suit. I expect to see Sigstore attestations baked into NPM and Maven before the next US presidential election. With any luck, your favorite programming language could be on this list too.


Sigstore doesn’t just give you a signature that you check with a long-lived public key, nor does it require you to do the Web Of Trust rigamarole.

Rather, Sigstore gives you a lot for free. Sigstore was designed around ephemeral signing certificates rather than a long-lived private key. It was purpose-built for preventing supply-chain attacks against open source software.

Combined with Reproducible Builds, Sigstore solves the triangle of secure code delivery.

Alternatively, use minisign. If your package ecosystem doesn’t support Sigstore yet, you can get by with minisign (which is signify-compatible) until they modernize.

You can also use SSH signatures, if you’d prefer. (More on that below.)

Drakeposting Yes StickerCMYKat

Signing Git Tags/Commits


Use SSH Signatures, not PGP signatures.

With Ed25519. Stop using RSA.

Art by Harubaki

Sending Files Between Computers


Use Magic Wormhole.

You could also use SSH + rsync to do this job. That’s fine too.

CMYKat

Encrypting Backups


Tarsnap is the usual recommendation here.

There are a lot of other encrypted backup tools that work fine, if you don’t want to give Colin Percival your business. I don’t have a financial stake in any of them, nor have I audited them thoroughly.

Borg uses reasonable cryptography, but I haven’t had the time to review it carefully.

Kopia looks fine, but I really hate that they misuse “zero knowledge” to describe an encryption protocol (rather than a proof system). We should not reward this misbehavior by marketers.

The point is: You’ve got options.

Too many options, in my opinion, to settle for PGP.

Speechless StickerCMYKat

Encrypting Application Data


Use Tink or libsodium.

Avoid: OpenPGP, OpenSSL and its competitors.

Not a lot to say here. I’ve written a lot about this over the years. Misuse-resistant cryptography libraries–especially ones that make key management less painful for users–are the way to go.

Harubaki

Encrypting Files


Use age.

Age is what PGP file encryption would be if PGP didn’t suck shit.

Age has two modes: Public-key encryption, and password-based key derivation.

Here’s a quick comparison table between what age offers, and what PGP uses in the installed base:

agePGP
Data encryption modeAEAD (ChaPoly)CAST5 (64-bit block cipher) in CFB mode with a strippable SHA1 “MDC”
Key-commitmentYes (via the header)Pah! You wish! Dream on.
PGP isn’t even AEAD.
Password KDF memory hard?Yes, with scrypt.No.
Vulnerable to chosen-ciphertext attacks?No.Yes, but PGP proponents stupidly consider this a good thing.
Supports 90’s-era cryptography?No.Yes.
Releases unauthenticated plaintext?No.Yes.
Uses versioned protocols rather than “cipher agility”?Yes.No. See: 90’s era cryptography.
Most common implementations are memory-safe?Yes (Go, Rust).No (C).

Like, it’s not even close.

NO stickerCMYKat

Some PGP proponents will insist that AEAD is possible now, but as long as the installed base of PGP remains backwards compatible with the lowest common denominator, that’s what your software uses.

Just use age. Or rage, if you’re a Rust enthusiast.

(And if you have concerns about “which age key should I trust?”, I’m already planning an age-v1 extension for the Public Key Directory project. More on that below.)

Art by Scruff

Private Messaging


Use Signal.

Security teams around the world insist that they need PGP for bug bounty submissions or security operations, but Signal does this job better than PGP ever did.

Once upon a time, you needed to give people a phone number to use Signal, but that hasn’t been the case for a long time. Still, many people have missed that memo and think it’s a requirement.

My Signal username is soatok.45. Go ahead and message me. You won’t learn my phone number that way.

In the near future, I plan on developing end-to-end encryption for direct messages on the Fediverse (including Mastodon). This is what motivated my work on the Public Key Directory to begin with.

But this is not intended to be a Signal competitor by any measure. It’s a bar-raising activity, nothing more.

Soatok drinking coffeeCMYKat

Miscellaneous PGP Alternatives


This section contains things people think they need PGP for.

Identity Verification


I’m actively working on something better!

via XKCD

If you want the ability to vend a transparently verifiable public key for a given user, that’s one of the use cases for the Public Key Directory I’m designing in order to build end-to-end encryption for the Fediverse.

Although this is purpose-built for the Fediverse, I’ve deliberately included support for Auxiliary Data messages, whose formats will be specified by protocol extensions.

Rather than trying to grok the Web-of-Trust, you can simply have your software check that multiple independent Public Key Directories have verified the record, since its inclusion is published in an append-only transparency log, secured by a Merkle tree.

My design doesn’t preclude any manual key verification, or key-signing parties, or whatever other PGP cultural weirdness you want to do with these public keys. It just establishes a baseline trustworthiness even if you’re not a paranoid computer nerd.

My project isn’t finished yet. In the meantime, you can manually check public keys when using the other recommendations on this page.

Harubaki

Encrypted Email


Don’t encrypt email. From the Latacora article:

Email is insecure. Even with PGP, it’s default-plaintext, which means that even if you do everything right, some totally reasonable person you mail, doing totally reasonable things, will invariably CC the quoted plaintext of your encrypted message to someone else (we don’t know a PGP email user who hasn’t seen this happen). PGP email is forward-insecure. Email metadata, including the subject (which is literally message content), are always plaintext.


There isn’t a recommendation for encrypted email because that’s not a thing people should be doing.

Art by AJ

Now, there exists a minority of extremely technical computer user for which Signal is a nonstarter (because you need a smartphone and valid phone number to enroll in the first place).

Because those people are generally not the highest priority of cryptographers (who are commonly focused on the privacy of common folk–including people in poor and developing countries where smartphones are more common than desktop computers), there presently isn’t really a good recommendation for private messaging that meets their constraints.

Not Matrix.

Not XMPP+OMEMO.

Certainly not PGP, either.

What PGP offers here is security theater: the illusion of safety. But it’s not actually a robust private communication mechanism, as Latacora argues.

Sad StickerCMYKat

“I insist that I need encrypted email!”


If you find someone insisting that they “need” encrypted email, read up on the XY Problem. In a lot of cases, that’s what’s happening here.

Do they ipso facto need email (as in, specifically the email protocols and email software)?

And do they care more about this constraint, or the privacy of their communications?

Because if their goal just to communicate privately, see above.

If the tool they’re using being email is more important than privacy, they should consider sending empty messages with an attachment, and use age to encrypt the actual message before attaching it.

That’s serviceable, just beware that everything Latacora wrote about encrypted emails still applies to your use case, so expect someone to CC or forward your message as plaintext.

(Unless you’re legally required to use PGP because of a government regulation… in which case, why do you care about my recommendations if you’re chained by the ankle to your government’s bad technology choices?)

Finally, miss me with the “but someone can screenshot Signal” genre of objections.

As Latacora noted, people accidentally fuck up PGP all the time! It’s very easy to do.

Conversely, you have to deliberately leak something from Signal. There is no plaintext mode.

That’s the fucking bar you need to meet to compete with Signal.

PGP fails to be a Signal competitor, in ways that are worse than Threema, Matrix, or OMEMO.

Watch This Space


With all that said, I am actually designing an encrypted messaging protocol that will have an email-like user experience, except:

  1. Everything is always end-to-end encrypted, with forward secrecy.
  2. It’s not backwards compatible with insecure email.
  3. It doesn’t use PGP, or any 1990’s era cryptography.

I can’t promise a release date yet. I’m prioritizing end-to-end encryption for the Fediverse before I write the specification for that project (tentatively called AWOO, but the cryptography underpinning both projects should be similar).

Maybe 2026? We’ll see!

If someone beats me to the punch, and their design is actually good, I’ll update the post and replace this with a specific recommendation.

galaxy brain stickerCMYKat

Against PGP


I don’t know how to get the message out louder or clearer about how cryptographers feel about PGP than what I wrote here.

Latacora wrote their criticism in 2019. As I write this, 2024 is almost over. When will the PGP-induced madness end?

Blue Screen of Death StickerCMYKat


Header art credits: CMYKat and the GnuPG logo.

Update (2024-11-16)


Someone tried to use their Fediverse software to submit an anti-furry comment to this blog post.

Therefore, I’ve added more furry art to it.

loviesophiee

#alternatives #codeSigning #digitalSignatures #encryption #PGP #security #SecurityGuidance #signing


in reply to Noxy

It's not good.

But it's leagues better than crypto.

I hate typing 'asymmetric key cryptography', and GPG is just three letters.

Those blog posts explain a lot, but one use case is missing (at least I don't see it apart from git commit signing), and that is verifying the source of a public message.

And I do wish we tried using the private keys more. Specially now when anyone can deepfake anything.

If I ever release my nudes, never trust them unless they are signed and you can check them with public key in my profile.

in reply to I_Has_A_Hat

The tech would have been great for bestowing ownership over the digital goods bought with microtransactions, but never would have gotten there since corpos have the rule of law under their thumb.
in reply to I_Has_A_Hat

You can have whatever token you want with all the metadata, licensing and ownership information you want...

...unless you plan on only seeing images in your own platform, nobody gives a shit, people will take screenshots and image files and share and use them however they want. There's no world in which you load a full DRM plugin or do 4 different types of handshake with a full blockchain just to load a jpeg into a comment.



Editorial: Zelensky just betrayed Ukraine's democracy — and everyone fighting for it


Last week, we warned of a coming anti-democratic backslide. Now, we see it happening.

Under the new law, the prosecutor general, a notoriously non-independent figure, will now oversee anti-corruption investigations — in a complete overturn of the system that was set up to be independent from other law enforcement bodies.

In reality, it means that Zelensky’s office will be able to stop investigations with a phone call.

It also closely follows an escalated prosecution of Ukraine’s best-known anti-corruption activist, an outspoken critic of Zelensky.

in reply to IndustryStandard

so he's being discarded after doing west's dirty job (and not even finishing it)? boy, saddam hussein and noriega are laughing right now in hell, saying "at least they gave us a little bit more time".
in reply to vfreire85

Its kinda funny because those guys turned against the US while zelensky has been a loyal dog lmao.
in reply to IndustryStandard

Sadly I think this was bound to happen. Zelenskyy has been not only fighting the physical war with Russia but also a prolonged propaganda war and the measures he's used to fight against the mass of disinformation flowing out of Putin's bullshit machine were bound to be corrupt by their very nature. You can see the paranoia that has set in as he was not only attacked by the east but now with Trump in office, he started getting it from the west as well. I fear that it's only going to be downhill from here.


'We're dying in front of the world': Palestinian journalist describes daily famine in Gaza to Le Monde


in reply to inlandempire

i keep seeing these people's experiences on tiktok and rednote and still can't imagine what life is like knowing that the entire world is going to do nothing but watch as you live out the last few hours/days of your life with the knowledge you're going to die slowly from starvation and that the lucky ones are the ones who die quickly from a missile strike or gunshot from an idf soldier.

you beg and you plead for help and an overwhelming majority just ignore you, with the few that will try to help are just as impotent as you are to help your situation.



Congressman Introduces New ‘Stop AI Price Gouging and Wage Fixing Act’ - first proposal to ban companies from using AI to set prices or wages based on Americans’ personal data.


Questa voce è stata modificata (1 mese fa)


I am, once again a member of the greatest community to ever exist!


My 2nd build ever and first time building on my own. I was happier than a pig in mud when it power on and posted on the first attempt.

My build (nothing fancy, just for some 1080p gaming):

  • AMD Ryzen 7 7700X
  • 32 GB G.Skill Flare X5 DDR5
  • ASRock AMD Radeon RX 9060 XT
  • Gigabyte B650 X AV V2 Motherboard
  • CoolMaster Master Liquid 240L Core ARGB
  • Cosair RM850e Power Supply (850W, Gold)
  • Cosair 3500X Mid Tower Case
  • 2TB PNY XLR8 NVMe Gen4 M.2 Drive*

*Edited: Forgot to add the storage.

Questa voce è stata modificata (1 mese fa)
in reply to Damage

I made the switch! My last build was Intel + Nvidia. Now it's all AMDaaaaayumn



Microsoft C++ static analysis tool bolsters warning suppressions


Technology reshared this.



Microsoft C++ static analysis tool bolsters warning suppressions



in reply to Jaden Norman

I was wondering how many sensors it took to detect these signatures. The paper demonstrates its possible to detect with a single 3 antenna router.





MP warns David Lammy he could 'end up in The Hague' over Gaza 'cowardice'


Malthouse, a vocal critic of Israel's war on Gaza, lashed out at Lammy's remarks, saying he was "frankly astonished at the statement of the foreign secretary".

"At a time when we've got daily lynchings and expulsions on the West Bank, dozens being murdered as they beg for aid," he said.

"Can he not see that his inaction - and frankly, cowardice - is making this country irrelevant? Can he also not see the personal risk to him, given our international obligations, that he may end up at The Hague because of his inaction?

Lammy responded with: "I understand the fury that the right honourable gentleman feels, but I have to tell him... I have to tell him that it demeans his argument when he personalises it in the way that he does.

"It is unbecoming, and not something the House expects, particularly of its more senior members."

Questa voce è stata modificata (1 mese fa)

in reply to RubberDuck

Liberals went so far into Fascism that 2016 conservatives look like leftists.


Anti-genocide protesters block hundreds of Israeli tourists from disembarking in Greek port


Israeli passengers on a cruise ship arriving in Greece on 22 July were unable to disembark the vessel due to a large crowd of pro-Palestine protesters demonstrating against the Israeli genocide of Palestinians in the Gaza Strip.

The MS Crown Iris, owned by Israeli cruise line Mano Maritime, arrived on Tuesday at the Greek island of Syros in the Aegean Sea. The passengers were supposed to disembark for six hours.

However, they were forced to remain on board due to the protests in support of Palestine.

[...]

A group of the Greek island’s residents organized the protest and posted on social media that they “raise their fists in solidarity with the Palestinians in Gaza,” adding that “it is unacceptable that tourists from Israel continue to be welcomed here while the Palestinians are suffering in the Strip.”