copygirl

Selhosting and a vpn are optional depending on your use case; the app works with niether to help users try it out and get started. Like all secure messaging apps, its better to selfhost given the option.

I’d say self-hosting is done for control over your data, not security. A typical end user will not know how to self-host, how to pick a privacy-respecting VPN, let alone secure their system. If your aim is to get to that same level of security, then I feel like the current direction is flawed, at least from what I took away from the readme.

Or, in other words, “self-hosting is more secure given the option” sounds kind of like “writing your own software is more secure”.

This project is aiming to create the most secure and private chat app. It will heavily depend on how you use it. Here are some reccomended security optimizations/advice to keep your data secure and private:

• Use a self-hosted instance of the app.
• Use a VPN to protect your data from being intercepted.
• Only connect to trusted peers.
• Validate public key hashes.
• You and your peer should use a secure device/os/browser with the latest updates.
• use general security practices like not sharing sensitive information, not clicking on suspicious links, etc.

These recommendations are bizarre.

• Is it really P2P if you need to a host your own instance?
• Use a VPN? So a company can now track you instead of the ISP?
• If it’s aiming to be safe, then why not share sensitive information?

If you want secure and private, then I would first look at Session.

most of the the Arch cult forget to mention that

The “Arch cult’s” holy book, the ArchWiki, states the following pretty clearly:

Warning: AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

Mention of one’s use of the AUR for their needs doesn’t need to come with a disclaimer.
People who don’t read or don’t use their brain are going to keep not doing so, regardless.

That probably counts as a privileged page, as in something uBlock Origin can’t access or modify.

Mozilla has probably been running another “experiment”, meaning not every user is affected. In the past they claimed it’s not advertisements because they are “continually looking for more ways to say thanks for using Firefox”. (Bullshit.) If you go to Settings > Home, you disable anything you don’t want to see, or just set your home page to a blank page, period.

JavaScript is already sandboxed. You can only execute functions where there is an actual API defined by the browser to do so, for example Date.getTime(). There is / should be no way to get, say, your device ID. (With the exception of unpatched exploits that allow executing arbitrary code. But keep in mind browsers are likely one of the if not the most security tested software.)

What you linked to here appears to specific to Google Tag Manager in a way that I don’t fully understand, but is not related to how websites usually execute JavaScript code.

Can you link to a source that confirms this information can be collected with JavaScript (with browser comparison, ideally)? That seems outrageous if it was actually possible.

What is meant by “sensitive information” here? Browsers can’t just willy-nilly access your local files or something like that. The one thing I can think of is using JavaScript to collect information that can be used to identify you. (Is that “sensitive”? I’d put that in “identifying information”.) My honest suggestion is to keep using NoScript and just allow as few domains as possible. The next best option is to stop using websites that break without JavaScript when there’s no reason why they’d need it.

I can imagine there being a plugin that spoofs some common ways that allow sites to identify you cross-sessions / browser / websites without your consent, but blocking JavaScript (by default) is likely one of the best ways to reduce the amount of information collected about you. When you do find such a plugin, check out one of the “browser fingerprint” testing sites to see how unique your fingerprint is.

(That is, if I even understood the request properly in regards to the “sensitive information” bit.)

There is something called “local storage” that allows applications to store more information than just a cookie. Cookies are sent to the server, while local storage, as the name implies, stays local. (That doesn’t mean that this data can’t be sent to the server via JavaScript.) But local storage makes it possible to make 100% offline applications if the whole webpage is cached / downloaded (assuming no online functionality is required).

edit: As for deleting this, if I click on the lock icon in the address bar in Firefox, I have an option to clear cookies and site data for the current site. I assume the “site data” is the local storage I mentioned. If you’re using a Chrome based browser, you can probably google how to do the same thing.

That’s probably the “just one step above” part. You do have the option to inspect the script you’re executing before you do so with curl | sh too, if you know what you’re doing. If you don’t, then you’d be pretty likely to just skip the prompt from yay as well. (Automatic diffs are nice tho.) Note: I use paru instead so I don’t know what yay does.

To be fair, that’s why they said

in terms of security.

The comments are worth a giggle but the AI voice ruins it. Also horrible choice of music.

Then you should also override Equals(object), GetHashCode, and implement IEquatable<T>.

Thankfully a lot of the usual boilerplate code can be avoided using a record class or struct:

public record Person(string Name, uint Age);

Is this not what the “active” sorting does?

A lot of contributors of FOSS projects make small changes that aren’t copyrightable.

Indeed, it’s a neat way to visualize gravity, but that’s it. It lacks any sort of explanation of why masses appear to be pulled towards one another. (I will point to the other person in this thread saying it “explains gravity with gravity”.) This is why I think the metaphor you mentioned detracts from the original video.

I think that explains the “how” more than the “why”.

Could you please provide some sources for that? I’d like to know more.

First of all though, there is no such thing as a “hostile fork”. Being able to fork a project, for any reason, is the entire point of open source. And to be fair, not wanting to continue working for a for-profit company for free is a very good reason.

And yeah, when you suddenly turn a FOSS project that’s been developed with the help of a bunch of contributors, into a for-profit company, without making a big fuss about it beforehand and allow the contributors and community to weigh in, then yeah, that’s a hostile takeover of sorts, at least in my opinion. Developers gotta make money, but they could’ve done that by creating a new brand instead of taking over that of a previously completely FOSS project. Forgejo is preventing that exact thing from happening by joining Codeberg (a non-profit).

There’s been a hostile takeover at Gitea and it’s now run / owned by a for-profit company. The developers forked the project under the name Forgejo and are continuing the work under a non-profit. See also: Their introduction post and a page comparing the two projects. Feel free to look up more, since I haven’t familiarized myself with the incident all that much myself. Either way though, maybe consider using Forgejo instead of Gitea.

What I’m saying is that Microsoft is, in fact, being hostile by limiting OSS builds such as Codium in the ways I’ve mentioned above. I guess that’s how they try to get people to keep using their proprietary build instead.

except for visual studio code

But also:

• Telemetry everywhere
• Not permitted to use the official marketplace with OSS builds
• Not able to use certain extensions (like C# debugger) with OSS builds

Though I’ve been very happy about the direction .NET and C# have been going, especially the licensing.