sam ✅🇬🇪
@sam@chven.us
sam ✅🇬🇪
@sam@chven.us
#GCompris 25.0 Open-Source Educational Suite Released with Five New Activities, Now Ported to Qt 6 https://9to5linux.com/gcompris-25-0-open-source-educational-suite-released-with-five-new-activities
@gcompris #OpenSource #FreeSoftware #education #Linux
Alt...
Screenshot of GCompris showing the main window with the activities and application menu.
"I really wish there were something around now like IRC so we didn't need to use discord"
amazing
I believe, and forgive me for saying this, but the alternative you may be looking for is a thing called IRC.
@babe Best things last forever 🧡
@babe
Bet it’s not as cool as AIM…
@babe I've been curious to go back to IRC but my hangup is I've largely assumed there's no encryption?
@babe i wonder what IRC clients look like now, is there shiny embed stuff and new things like threads or whatever, or is it still like in the 90s?
@barbapoilu IRCCloud has imbed stuff and profile photos but mostly it's still as it ever was
@babe ooouh, profile pics, noice!
@barbapoilu @babe still the 90s. and the better for it
@quokka1 hmmm, dunno if it's always for the best. I do like to know what kind of link I'm clicking on and stuff. Embed pics and videos are a nice addition too.
And as far as i remember, crowded channels were always messy and following any discussion was tricky enough that people would create their own channel to speak about it in a calmer place. Threads help with that, but I'm not sure if/how it'd be doable on IRC 🤔
@barbapoilu @quokka1 You don't tend to get too many crowded channels these days. Ones with a lot of people in now are often largely bouncers keeping people online or filler bots
@babe is IRC like IRC? 
@babe big, if true
@babe Matrix! Nice mobile clients too (Element X)
(and then install an IRC bridge on the server)
((yes I do this))
@babe
I prefer QuakeNet ;)
@weipah oh hey that's the one I started on!
@babe the golden days of the internet if you asked me. I'm not using IRC anymore, but I wonder if I have still some old mIRC logs hidden somewhere.
@babe Well, after Discord bought IRC, they shut it down, so that's what we have now.
@babe IIRC IRC is rather convenient
@babe I haven't ever used IRC. How do I start?
@licho You download an irc client (mirc, xchat, irccloud...) then take your pick which server you want to try.
libera is the biggest/nerdiest one, then there's undernet for general chat, quakenet for gaming, rizon, ircnet...
Here's a good list to get you started https://netsplit.de/networks/top100.php
Vorsicht mit dem neuen @accrescent App-Store:
Das ist ein neuer alternativer Android-App-Store, der von sich behauptet, auf Privacy und Security fokussiert zu sein. Er wird auch über den @GrapheneOS Appstore angeboten.
Bei genauerem Hinsehen finden sich allerdings Apps, die Werbe- und Analysetracking enthalten, wie ich nach kurzer Prüfung feststellte.
Der Entwickler sieht darin kein Problem …
1/2
Alt...
Ein Screenshot aus PCAPdroid, auf dem man Verbindungen der App qlango zu firebaseinstallations.googleapis.com, firebase-setting.crashlytics.com, graph.facebook.com und server.qlango.com erkennt.
@rufposten @accrescent The purpose of Accrescent is not providing a small catered set of Android apps. It's meant to become an alternative to the Play Store where you could gets apps like Facebook or Uber. Accrescent never claims to disallow apps with advertising or analytics. It's not the purpose of what it's providing. It's meant to become a place people can get nearly any app instead of having to use the Play Store or a sketchy mirror site. It's not only for the apps you want to use.
@GrapheneOS @accrescent Thanks for the explanation. It's a good thing - but in my opinion it's misleading to advertise it a "privacy focused" app store if you can only download the usual apps with ad tracking in a secure way.
@GrapheneOS @rufposten @accrescent why not giving tags like 'open source' or foss on first screen?
@voiges @GrapheneOS @rufposten @accrescent The open source tag is a planned feature: https://github.com/accrescent/meta/issues/25.
We intend to add filters so users can search for only open source apps as well.
@rufposten @accrescent @GrapheneOS
...danke fürs Recherchieren und Bescheid geben! 👍
@rufposten @accrescent @GrapheneOS Always sad to see how people jump on a train without even checking where it's going 🙄
@GrapheneOS Quote from Accrescents website:
"Accrescent is a private and secure Android app store built with modern features in mind. It aims to provide a developer-friendly platform and pleasant user experience while enforcing modern security and privacy practices and offering robust validity guarantees for installed apps."
It's kinda missleading in my opinion, it make people think of it as an F-Droid alternative, rather than a Play Store alternative.
Also, I wasn't reffering to Accrescent, but rather to many of it's users and supporters which had an false-impression of it and promoted it as an better F-Droid alternative, which could have been avoided if they would have dig a little bit deeper.
> while enforcing modern security and privacy practices
F-Droid has no real standards for these things. Their focus is nearly entirely on whether something is closed source or not rather than privacy or security. They don't even have a basic target API level requirement or the expectation that apps are receiving any form of privacy/security patches for serious vulnerabilities.
@GrapheneOS This isn't an discussion about F-Droid and I totally agree that there are valid concerns regarding F-Droid's pratices in terms of security (which affects privacy too), but it doesn't affect what I've said before.
@voxel Accrescent is not supposed to be a repository of only privacy-focused apps and is separately not supposed to be only open source apps. It could have a way to filter based on properties related to those things but it's not intended to be a small catered set of apps. It's in an early phase and isn't open to everyone freely submitting apps to it like the Play Store yet so there's very little in it. That's the reason people get the wrong idea it's a catered set of apps. That will go away.
"In addition, "trackers" are subjective. Accrescent has no plans to enumerate specific libraries or classes and blacklist them solely based on the fact that they connect to Google, Amazon, etc.; collect analytics; or contain proprietary code."
https://github.com/accrescent/accrescent/issues/637
Man kann diese Meinung haben, aber eine Fokussierung auf Privatsphäre passt nicht zu dieser Haltung. Daher kann ich nur warnen, den Appstore als Laie zu verwenden, ohne Apps vorher zu prüfen. Bleibt besser bei @fdroidorg
2/2
@rufposten @fdroidorg Ich habe immer mehr das Gefühl, dass es da 2 Lager zu geben scheint. 1. um GrapheneOS, welches Security ohne Kompromisse will 2. F-Droid, welches Wert auf FOSS und Privacy legt aber aus der Sicht von 1. nicht secure genug ist. Da wird dann oft einander angegriffen und gebasht und am Ende haben wir nen tollen Sicheren Store ohne Privacy und nen tollen Privacy Store mit Schwächen in der Security. Das strengt sehr an.
GrapheneOS and our community care about real privacy rather than a performative approach. The implication that GrapheneOS and our community care about security rather than privacy is nonsense. It's misinformation that's propagated by people who are pushing products far less private and secure than if people simply used iOS. Privacy is the main focus of GrapheneOS and our community. Our work and focus on security is entirely to defend privacy. It makes no sense to separate it.
I'm very new to grapheneos and I was surprised to find accrescent and not fdroid as an installable option.
I performed some web searches (not very extensive) and found no reason for this choice (yet).
Especially with #qlango containing so many trackers (see OP) - could you elaborate your point a bit more? Why is #Accrescent favored by #GrapheneOS by offering it as an installable app and how is this privacy focused?
@klopf @rufposten
@manu @klopf @rufposten F-Droid isn't a secure or trustworthy way to obtain open source apps. We're all for having a high quality app store which only packages apps meeting a high standard, but F-Droid is definitely not that app store and almost certainly never will be. It is not in our App Store because it's not safe and the developers have clearly demonstrated they cannot be trusted. Use it at your own risk, we don't recommend it and expect it to end very badly for people who use it.
@manu @klopf @rufposten Accrescent is an alternative to the Play Store where developers can distribute their apps to users securely with objective standards put in place for privacy and security. It is not supposed to be only privacy focused apps or only open source apps. We include it as being the best way for people to get specific apps available in it. It is not included as a way for people to get a list of recommended apps. We have the Play Store in our App Store too, so what's the issue?
@manu @klopf @rufposten If you're using F-Droid to obtain open source apps, you're making a mistake and putting your privacy and security at risk. You are far better off using the builds from the open source app developers which are signed by the developers. That way, you don't have unpredictable massive delays for updates which can go on for months. You avoid the apps being built on known to be poorly maintained infrastructure with outdated tools with sketchy downstream changes to them.
@manu @klopf @rufposten Either way, you're trusting the actual developers of the apps. By getting them from F-Droid, you're getting builds made on F-Droid's sketchy infrastructure with outdated tooling where you still trust the app developers just as much (it's not as if they review the code or changes to it) but are also trusting a whole additional set of infrastructure and people who we think have quite clearly demonstrated themselves to be highly untrustworthy for multiple reasons.
@manu @klopf @rufposten Repeatedly denying and covering up security flaws, downplaying the importance of app sandboxing and other security measures which they consistently claim are not useful, engaging in extreme harassment and libel towards multiple security researchers talking about flaws in an attempt to silence or discredit them, etc. The harassment is at the extreme level that they are actively involved in encouraging attacks which include violence such as swatting and double down more.
@manu @klopf @rufposten Why would we include software from a group of people who have pushed completely fabricated stories about our development team and engaging in endless harassment from repeatedly calling us schizophrenic, etc. across dozens of rooms to directly supporting/spreading content from Kiwi Farms users targeting our team? That is who the people behind F-Droid are. There's no good reason to trust them with building and signing your apps. Obtainium is flawed but better than that.
@manu @klopf @rufposten We're more than willing to include additional app stores within our App Store if they meet basic standards for security and trustworthiness. It's not going to be limited to Accrescent and the Play Store. F-Droid definitely won't be included in it. Obtainium won't be included but a similar approach which instead had a curated + extensive list of app sources and key fingerprints to obtain apps directly from where developers publish them would be something we'd like to have.
@GrapheneOS @manu @klopf @rufposten Are your arguments only targeting the Official F-Droid Repository, or the Repository architecture of F-Droid in general?
E.g. when I install Molly or Newpipe via the F-Droid repositories of their developers.
@linos @manu @klopf @rufposten The design and implementation of F-Droid as a whole including the repository system, repository metadata, scripting for builds/packaging/signing, official client and above all the main F-Droid repository. The most severe issues are with the main F-Droid repository and the infrastructure used to do the builds/signing. The team behind it is also an issue, not only technical issues. It is more than a technical problem.
@linos @manu @klopf @rufposten Here's a post from the WireGuard developer about it:
https://gitlab.com/fdroid/fdroiddata/-/issues/3110#note_1613430404
You can already read what other security-focused developers from projects like Signal and many others think about it.
@pixelcode ein neuer Fall von Graphenes Ansichten! Würde ja gerne kommentieren, möchte aber nicht durch den Dreck gezogen werden
@linos @manu @klopf @rufposten Molly is available in Accrescent already. If all the apps you wanted were available there, what would be the reason to use another way to obtain them? That includes whatever closed source apps people want to use. If they were in Accrescent, why get them from the Play Store? It would of course not replace the apps depending on Google Play services and the Play Store for the services it provides but it would be a start.
@GrapheneOS
Hi, thanks four your summary and the pointer to the wireguard dev comment. I'll certainly follow up on this to better gauge the extent to which I'll trust F-Droid from here on out.
I've re-read my question and I've put the emphasis too much on the absence of F-Droid. I actually wouldn't have expected it to be part of GrapheneOS in the first place because it's easy to install for anyone who's capable of installing Graphene.
However, I was stumped to see Accrescent offered prominently because it does offer apps with privacy-invasive tracking and doesn't (and has no ability to) warn users about this. Considering the low number of apps in Accrescent, this is even more surprising because they probably know details about every single app in there. The Accrescent publication requirements do not regulate online-tracking at all. While I do understand your issues with F-Droid, I still don't understand how Accrescent deserves this favored place on GrapheneOS. I don't mean to challenge your decision but I'd like to understand how it came to be.
And yes, the Play Store is also offered but that has technical reasons beyond privacy. Anyone who cares the least bit will know that it's to be used cautiously. And it doesn't explain the reasons for why Accrescent is being favored beyond promising that privacy is important to them. Google would say the same, so do the F-Droid devs.
P.S.: I've found this closed issue on the Accrescent github and it's very verbose on how Accrescent decides about user tracking.
I don't know if this reasoning extends to GrapheneOS but I'll share for completenes' sake:
https://github.com/accrescent/accrescent/issues/637
@linos @klopf @rufposten
@manu @GrapheneOS @klopf @rufposten Hmm, I would enjoy seeing a contributions welcome or a label that indicates that possible better solutions need to be sketched out first, rather than having a not planned label on that issue
@linos @manu @klopf @rufposten See https://github.com/accrescent/meta/issues/25. The criteria for labels have to be objective and enforceable. An open source label, reproducible build label, etc. has to be well defined. They do have it as a planned feature, but it's meant to be an alternative to the Play Store and that includes packaging apps you don't like. It wouldn't be an alternative to the Play Store if it only permitted open source apps. If people want that they'll be able to get it from it.
@linos @manu @klopf @rufposten Accrescent is also not a GrapheneOS project. It meets our standards for an app repository distributing developer builds of apps securely and was therefore included in our App Store. Other app stores meeting our standards can be included there too. F-Droid does not and will not meet our standards. It will never be included in our App Store. A secure and trustworthy implementation of a repository of only open source apps would be happily included there.
@GrapheneOS
It would simply be nice to know what these standards are and how Accrescent is currently the only candidate that meets them (and what would need to be done to meet them).
This should fit well into the 'bundled-apps' section in the FAQ, I think. If it's already somewhere else, I couldn't find it.
@GrapheneOS
Ok, from what I collect, the reasoning is that tracking is "subjective", which means here that connecting to Google, Facebook etc. doesn't necessarily qualify as (harmful?) tracking. Furthermore it says that blocklisting individual libraries or URLs is not in the development scope. I can respect that but I also understand it's controversial.
There is a policy issue in the Meta repo for Accrescent here that takes this into account and tries to find some middle-ground (I think): https://github.com/accrescent/meta/issues/40
The line of reasoning works for me even if I tend to disagree. Seems that GrapheneOS is more or less aligned with this. I think it's a justified position (agree with it or not) but I think it would be beneficial to have some easy to find explanation (e.g. in the FAQ) that goes beyond saying 'Accrescent is privacy and security oriented' or 'better than F-Droid'.
There are some social media posts, one also mentions that Accrescent comes from within GrapheneOS. This way the choice makes more sense to me. But it's not very obvious on first use of GrapheneOS and the posts aren't too easy to find.
Posting this before checking if there are any new replies since my last post.
@manu @linos @klopf @rufposten
> Ok, from what I collect, the reasoning is that tracking is "subjective"
If you want subjective warning and filtering, don't be surprised if you don't agree with the way that's managed. F-Droid is a highly untrustworthy source of apps and highly insecure. It's unsafe to use and could be branded as such with a warning notice. It could also be included on DNS filtering lists. You probably wouldn't agree, but yet you're proposing blocking Firebase services.
@manu @linos @klopf @rufposten F-Droid developers have been heavily involved in extensive harassment towards members of our team and multiple of our community members. The overall harassment has escalated to stalking, swatting and real world violence including severe swatting attacks aimed at having someone killed by law enforcement. F-Droid is an untrustworthy and unsafe source of apps particularly for GrapheneOS users who they've been repeatedly targeting with underhanded attacks.
@manu @linos @klopf @rufposten Can you explain what Google has done which is remotely as bad as what F-Droid has been doing towards the GrapheneOS project, team and community members? In what sense are they more trustworthy or should have connections to their services allowed while filtering out connections to Firebase services? Put aside all the marketing about their claimed values not aligned with their actions and what they actually do. Why should Firebase be blocked but not F-Droid?
@manu @linos @klopf @rufposten If you open the can of worms that is subjectively adding blocking for DNS queries, warning labels for apps, etc. then don't be surprised if the way that ends up being done goes against what you want. F-Droid would be one of the first apps we'd label as a danger to our users if we were doing that since it's likely going to result in a large number of GrapheneOS users getting malware on their devices in the future. It is a serious threat to the safety of our users.
@GrapheneOS
You didn't read my post entirely, I think. I'm really trying to understand and not take sides before I understand.
I had to add the quotation marks because it's a quote and it was the central point of argument here.
I continue to agree that the argument made by the Accrescent dev is sound even if I still disagree with it.
The privacy standards that Accrescent applies to apps are unfortunately not published or published in a clear way (e.g. when would tracking be problematic?). But that is not a GrapheneOS issue itself.
GrapheneOS on the other hand doesn't publicly define standards for bundled apps at all, for what I found. And I wonder if you (person who runs the account) could point me somewhere useful. It is a pity that it's like this but doesn't mean the choice of adding Accrescent is inherently wrong. However, pointing out how much worse F-Droid or others is no basis for a reason. Why include an App Store at all?
@manu @linos @klopf @rufposten
> You didn't read my post entirely, I think.
No.
> The privacy standards that Accrescent applies to apps are unfortunately not published or published in a clear way
You realize it is in Alpha, right? Quite premature for people to be spreading attacks on it because not all the basic features and documentation is in place yet.
> GrapheneOS on the other hand doesn't publicly define standards for bundled apps at all
Not true, and Accrescent is also not bundled.
@manu @linos @klopf @rufposten
> Why include an App Store at all?
GrapheneOS needs our own App Store in order to ship updates to OS components and bundled apps without needing to update the whole OS. We clearly need to be able to ship out-of-band updates to Vanadium and GmsCompatConfig at a bare minimum. We also clearly need a way for people who want to use sandboxed Google Play to obtain it easily and securely. That bootstraps getting apps from the sandboxed Play Store securely too.
@manu @linos @klopf @rufposten
We don't particularly need to provide another way to get apps available on the Play Store which include the Google Play SDK. That's why we don't mirror things like Pixel Camera and Google Play Gamers, because people who want them can just get them from the sandboxed Play Store. Android auto and Pixel Thermometer is mirrored so we can control updates for people who use it due to needing compatibility code. Markup is mirrored because it's not in the Play Store.
@manu @linos @klopf @rufposten
You're portraying it as if apps we make available in our app store are bundled in the OS which is not the case. Accrescent is not a GrapheneOS project and is not included in GrapheneOS. Google Play is also not included in GrapheneOS. Putting apps into our App Store doesn't make them bundled apps. Having Accrescent and Play Store there allows securely obtaining them and then securely obtaining apps through them. F-Droid is not a secure source of apps regardless.
@manu @linos @klopf @rufposten GrapheneOS supports what Accrescent is building. We're going to support them and we're going to fight back against people and projects harming these efforts. We published https://grapheneos.social/@GrapheneOS/113900949999725460 across platforms (not only Mastodon) as a response to this thread, and we intend to publish several more threads about F-Droid. That one was to cover what WireGuard said about it. There's a lot more. We can also cover their team's harassment in much more depth than before.
@manu @linos @klopf @rufposten F-Droid is not a safe or trustworthy source of apps. It also has very lacking security, which contributes to it not being safe or trustworthy. A massive overhaul and rewrite fixing the major security design and implementation issues is possible, but that won't make it safe or trustworthy. The people behind it have very clearly demonstrated they can't be trusted at least to us and our community. Why have them as middlemen between users and app developers?
@GrapheneOS
Accrescent is not bundled, correct. It's only offered for installation in the GrapheneOS App Store as one of ten available apps.
Saying that it's "not true" that the bundled app standards aren't published omits my "for what I found". I've really looked but couldn't find something definite. As you say, it's not bundled, so I'll correct myself: Are there published privacy and security standards for Apps that are published in the GrapheneOS app store?
Could you please point me in the right direction for this? If you know that these standards are defined, why not point me to them? I'd actually be willing to argue your case but you don't seem to realize that.
I'll give up after asking this one last time.
@manu @linos @klopf @rufposten You need to press All packages in the menu to see the full list of apps. As an example, we only show Play services rather than Play services + Play Store since they depend on each other so showing both is redundant. There are currently a total of 16 packages in it. We could add 100 things we could update out-of-band but it would be a lot of work and we don't need regular updates to most OS components separate from overall OS updates the changes are tied to.
@manu @linos @klopf @rufposten Accrescent is not a bundled app so the criteria for including it in our App Store is not the same thing as criteria for including an app in the base OS. For example, we don't allow connections to non-GrapheneOS services in the base OS as a default behavior so Accrescent can't be bundled there.
https://grapheneos.org/faq#default-connections
https://grapheneos.org/faq#other-connections
We're also mirroring official releases of Accrescent and letting it take over updating itself, not acceptable for bundling.
@manu @linos @klopf @rufposten Bundling an app would involve forking it, changing the app id, rebranding and hosting any services it needs ourselves, potentially with the option to switch to other providers depending on how it works. We intend to replace several of the AOSP apps that way instead of overhauling them. Putting stuff in our app repository is far different than putting it in GrapheneOS. If F-Droid had trustworthy developers and was well designed/written it could be in the App Store.
@manu @linos @klopf @rufposten Similarly, Aurora Store can't be included because it doesn't verify Play Store app signatures, the default account sharing it does is highly questionable and it was recently taken over by a group of people overlapping with the F-Droid developers who we consider highly untrustworthy and want to limit our exposure to their code going forward. It's also a factor in why we're going to completely fork Seedvault, not just the fact that it doesn't work well.
@manu @linos @klopf @rufposten F-Droid is not a secure or trustworthy source of apps. Distributing it in our app store would put users at risk. Users should be using builds from the developers signed by the developers rather than people who have proven themselves to be highly untrustworthy. F-Droid developers have repeatedly engaged in harassment and libel towards security researchers, members of the GrapheneOS project and our community members. They targeted multiple people in our community.
Dann darf man auch den Play-Store nicht verwenden, der keine Tracker anzeigt. Die Anwender bekämen große Augen 😲👀, wenn sie das sähen.
Der Aurora-Store hat die gleichen Apps, zeigt aber die Tracker an bzw. bietet auf Wunsch eine entspr. Analysefunktion. Man sollte sich aber tunlichst nicht mit seinem Google-Konto dort anmelden, sondern die „Anonym“-Funktion nutzen, weil Google das missfallen könnte und das Konto ggf. sperrt.
@Lapidarius @rufposten It displays a specific list of libraries they've deemed are trackers, which is done in an incredibly arbitrary way and does not indicate that apps without what they call trackers are at all privacy friendly. They say Facebook Lite has 0 trackers based on the methodology that's used:
https://reports.exodus-privacy.eu.org/en/reports/com.facebook.lite/latest/
There's also the issue of having a highly inaccurate and misleading list of permissions / descriptions which misleads people about how stuff actually works.
@Lapidarius
Als ob Menschen in den App-Stores eine "Liste enthaltener Tracker" ansehen würden.
Das wäre ja fast so, als würden sie sich Nutzungsvereibarungen oder Cookie-Zusimmungen durchlesen.
Naja, dann bin ich wohl ein Außenseiter, ein Renegade. Ich gucke mir das immer an und überlege, ob andere Maßnahmen womöglich verhindern, dass eine App zuviel flüstert. Ich schaue oft auch nach, ob es nicht etwas ähnliches im F-Droid u.ä. gibt, was womöglich besser ist. Wer dazu zu faul ist … hat Pech gehabt und wird ausspioniert, verfolgt, mit Werbung zerbombt. Culpa sua!
@Lapidarius
Ich lade ja grundsätzlich nicht über den Google App-Store.
Aber es gilt halt der Satz:
"Schließe nicht von Dir auf andere" ;)
In F-Droid schaue ich auch immer, welche Berechtigungen eine App anfordert.
Und welche, die "Unerwünschte Merkmale" hat, lade ich in der Regel gar nicht erst herunter.
(Seit ein paar Monaten auf GrapheneOS)
@fasnix @Lapidarius The information on the permissions shown by app stores is misleading and inaccurate. Installing an app does not grant it access to that list of permissions. It also doesn't mean it requires those permission to be granted to it in order to use it.
Privacy sensitive permissions are controlled via runtime permission toggles, special access permission toggles and case-by -case consent systems. The low-level list is what the app can request and what it gets depends on choices.
@rufposten @accrescent @GrapheneOS
Ich denke der Hintergrund ist ein grundsätzlich unterschiedliches Verständnis von Datenschutz in verschiedenen Bubbles der Privacy-Community.
Auf der einen Seite ist es mehr absolut: Was eine App kann, das müssen wir auch annehmen, dass sie das auch tut. Ob es faktisch Tracking gibt oder nicht, ist dabei fast egal, genauso wer die Daten bekommt (weil er ja weitergeben könnte). Der einzige wirksame Schutz ist, die zugreifbaren Daten zu reduzieren.
@pixelschubsi @rufposten @accrescent That is how GrapheneOS approaches privacy as an OS but it is not how we approach privacy in terms of recommending apps and services. They're different things. Technical measures in the OS can't be based on enumerating badness and implementing easily bypassed barriers which don't work if adversaries are aware of them. Privacy/security features need to hold up to an adversary aware of it and which can actively adapt to it in order to be a serious approach.
@pixelschubsi @rufposten @accrescent Accrescent is not the GrapheneOS app store. It's a third party project. We added it to our app store because they can focus on providing a way for developers to securely distribute apps meeting objective privacy/security requirements based on things like target API level and rules for using permissions. We can instead focus on providing a catered set of privacy focused apps where we make our own builds, update the dependencies and harden them against attacks.
@GrapheneOS @rufposten @accrescent
> Privacy/security features need to hold up to an adversary aware of it and which can actively adapt to it in order to be a serious approach.
See, this is what I mean. I totally agree with you on the one hand, but on the other hand, I understand people consider, for example, an ad blocker a useful tool, because it works reasonably well in practice even if technically, it can be bypassed easily.
@pixelschubsi @rufposten @accrescent
Content filtering based on enumerating things that are only used for ads, tracking, etc. and not for anything useful is inherently incapable of fundamentally protecting privacy. It can only provide an opportunistic reduction in exposure to privacy invasive practices. In practice, adblockers cannot and do not block services which are used for both useful functionality and ads/tracking. It is not simply that they are easy to bypass due to enumerating badness.
@pixelschubsi @rufposten @accrescent There's a big difference between fundamental privacy improvements and increasingly weak approaches for opportunistically improving privacy. The opportunistic privacy improvements get increasingly less useful as development practices change to integrate the privacy invasive code without having an easy way to block it. The more coarsely the filtering is done, the easier it is to render it useless as an approach. Sharing with 3rd parties can be done server side.
@GrapheneOS @rufposten @accrescent
I know all this. But again: In practice ad blockers work reasonably well. Yes, some ads manage to pass through, but most get blocked. It effectively improves the user's experience.
The absolute stance would be to say that either you have to accept the websites render ton of ads, because there is no guaranteed way of blocking them, or you stop using the web. But some people prefer the non-absolutist way, that is to use an ad blocker.
@pixelschubsi @rufposten @accrescent GrapheneOS has a Vanadium browser project which includes an adblocker. We do not present it as an important privacy feature. It uses EasyList + EasyPrivacy and enables language specific lists based on which languages the user has enabled to avoid it being additional fingerprinting attack surface. The content filters are shipped in a signed APK via our App Store. It is not a fundamental improvement to privacy. It only opportunistically eliminates some stuff.
@GrapheneOS @rufposten @accrescent
Please realize how I was talking about ad blocking and ad blocking only here, not that some ad blocker lists also include tracking blocking.
I use the ad blocker example because it's a perfect analogy that is much easier to grasp. The effect of privacy blocking is almost impossible to quantify, because you don't know how much less data about you is collected due to using them. With ad blockers you can easily see yourself how effective they are.
@GrapheneOS @rufposten @accrescent
If ad blockers work reasonably well in practice, it is likely that privacy blockers do so as well. They're not perfect, they will let some data slip through, so any absolute approach is to be preferred when available and applicable. But they likely are a good addition to provide opportunistic improvements for what absolute approaches can't do (yet).
Opportunistic improvements are still better than no improvements.
@pixelschubsi @rufposten @accrescent No, that is not a reasonable thing to infer because privacy works fundamentally differently from displaying ads and can't be seen and corrected when they slip through. Invasion of privacy including sharing data with third parties after it's obtained does not require any direct contact to third parties from the client side, which is what those are focused on filtering, but only when it doesn't break functionality of sites. They can't block dual use tracking.
@GrapheneOS @rufposten @accrescent
You're right in theory, but not how things work in practice. The large majority of apps send tracking data to Google exclusively directly through their tracking library. They don't send tracking data to their own servers so they couldn't silently forward it. A future version could send tracking data to their server, just as a future version could serve ads through their server. Thus, with every new version you'd need to verify again what they send where.
@GrapheneOS @rufposten @accrescent
We know that in reality, most websites don't try to bypass adblockers. Some try to detect them and block using their websites if you don't disable them. The same holds true for tracking, where the ROI to build a bypass for the blocker is even lower (because the tracking data really isn't worth as much). This is of course what we know from the web, but there's no reason why this should be any different on android apps.
@pixelschubsi @rufposten @accrescent Content filters have barely any impact on the website itself performing tracking of what users are doing. That is where they largely succeed rather than with ads, which are visible to users and get reported and fixed. They also aren't fundamentally tied into the site working in the way that tracking users often is. No need for entirely separate stuff to track users, it can be baked into everything.
@pixelschubsi @rufposten @accrescent Sites do often put effort into bypassing adblockers but users see it and report it, then it gets addressed. They can keep doing it again and again but don't generally bother since it won't last. Lower traffic sites have much more success with this. There hasn't been much serious effort into breaking adblockers for web sites yet but it's gradually happening.
@GrapheneOS @rufposten @accrescent
Also, there's privacy laws (at least here in the EU). Forwarding the user's IP address from your server to Google for Analytics would be illegal without good reason, but connecting to Google servers for Analytics and there for effectively sharing the user's IP address as well is considered legal because it's technically required.
@GrapheneOS @rufposten @accrescent And lastly, Google doesn't even provide proper APIs to pass data into Google Analytics without using their tracking library. So using a tracking blocked which blocks their tracking library in fact does effectively block the app from sending tracking data to Google. Yes, a win against Google is just a small win, but it's a win that can be reached.
@pixelschubsi @rufposten @accrescent Sites use plenty of APIs which are genuinely useful to users and therefore don't get blocked by a content filter. Third party tracking does not have to be a service called analytics. It can be a bunch of useful functionality such as maps, push, etc. they include in the site which is not going to be blocked by any normal adblocker since it would break sites. Look into how the adblocker lists work. They permit tracking if sites break without it.
@pixelschubsi @rufposten @accrescent One of the most simple and successful ways to do it is where requests are sent through a third party service for click tracking which involves a redirect to the service and then to the site where it has to be followed to get the destination. Adblockers have exceptions for these in the privacy filters since blocking them would break sites. These also bypass cookie isolation used by Firefox, Brave, etc. to restrict cross-site cookies by matching heuristics.
@GrapheneOS @rufposten @accrescent
All you write is correct and still it is totally missing the point.
Try the following: Install a popular ad blocker into your web browser and configure ad and privacy filters. Now open the developer tools to monitor all requests done. Navigate to a few popular websites and check how many invasive cookies are set and how many tracking endpoints data is sent to. Now reset and repeat the same with the ad blocker disabled.
You'll see the blocker blocked a lot.
@GrapheneOS @rufposten @accrescent
If those resources and cookies blocked had not been of purpose to the tracking/ads/... industry, they would not have been requested. Thus, while certainly not perfect, it reduces how much tracking happens and/or how much data is shared and/or how many receive it.
It might not be perfect, but it did some good. And that's better than doing nothing just because you can't be perfect.
@pixelschubsi @rufposten @accrescent We never said to do nothing and after all our Vanadium browser includes content filtering with a privacy list in addition to an ads list. It doesn't mean we think it's a strong privacy feature or a fundamental privacy improvement. It's an opportunistic privacy improvement with rapidly dwindling value.
@GrapheneOS @rufposten @accrescent
Not everytime people talk with you it's also about GrapheneOS. This is about Accrescent not caring about and not willing to tag apps with known tracking. This is the kind of tracking you also block in Vanadium. And I understand Accrescent can't block the tracking, but at least tagging it if it's known (opportunistically) would be possible. Not doing so is thus similar as it would be to not have an ad blocker in Vanadium.
@GrapheneOS @rufposten @accrescent
And in case that wasn't obvious, this isn't meant as an attack towards GrapheneOS. You do amazing work and your results are astonishing. But that shouldn't keep you from realizing that the work of others, even if only opportunistic, also improves people's life in the wild.
Greetings from a user of a custom-built GrapheneOS modified to support microG in regular user sandbox.
@pixelschubsi @rufposten @accrescent Doing something is not always better than doing nothing when it gives people a false sense of privacy/security, takes away from other efforts, etc. There is a limited amount that can be done and it matters where those resources are expended. Users can also tolerate a limited amount of complexity, sites breaking, etc.
@rufposten @accrescent @GrapheneOS
Auf der anderen Seite ist es deutlich differenzierter: Bei FOSS Apps guckt man einfach was sie machen und die Berechtigungen sind quasi nebensächlich, bei proprietären Apps gilt zwar die Annahme, dass sie womöglich die Daten "falsch" verwenden, aber ein Nachweis dazu macht es eben doch noch schlimmer. Dazu kommt, dass man einem kleinen, lokalen Unternehmen anders Daten zugesteht als etwa Apple oder Google (wo Missbrauch stärker vermutet wird).
@pixelschubsi @rufposten @accrescent
That's really not actually how open source works and how it influences privacy and security. It is not easy to determine what apps do even with full access to the sources, let alone if they are private and secure.
Sandboxing and permissions are certainly relevant to open source apps. They are very relevant within the OS too. Sandboxing and the principle of least privilege is used throughout the OS and is immensely important. Open source doesn't change this.
@pixelschubsi @rufposten @accrescent
You're still trusting the developers of open source apps with access to whatever you trust them with. The app being open source or built by someone else doesn't mean you aren't trusting the people who developed it. The fact that serious vulnerabilities persist for so long in open source projects before being discovered and fixed disproves the idea that an intentionally hidden privacy or security hole would be discovered because they're open source.
@pixelschubsi @rufposten @accrescent
Open source provides no inherent privacy and security properties itself, only easier review of the code. That doesn't mean there is actually any significant review of the code in practice. It only helps to enable it, which usually doesn't happen for most open source projects. It does not prevent the developers putting in shady code and does not mean it will be quickly discovered. It can in fact play a role in hiding it through unwarranted trust.
@GrapheneOS @rufposten @accrescent
I'm not saying that FOSS has better privacy just because it's FOSS, but also we know that in practice, this is the case. The average FOSS app is more privacy friendly. If you install 10 random apps listed on F-Droid, you're likely to end up with 10 somewhat privacy-friendly apps (especially if you have the filter for anti-features enabled). If you install 10 random apps from Play Store, about half of them probably perform tracking that is illegal in the EU.
@pixelschubsi @rufposten @accrescent If you install 10 apps from F-Droid, you have 10 apps where you receive delayed privacy/security patches from the developers, which are built with outdated tools/SDK with vulnerabilities often being introduced and where a group of highly untrustworthy people involved in incredibly underhanded attacks on projects like GrapheneOS and our userbase have control of the signing keys for ~9/10 of those and are capable of shipping malware if they choose to do it.
@pixelschubsi @rufposten @accrescent F-Droid is not a good way of obtaining open source apps. It also has a strange selection of the open source Android app ecosystem heavily weighted towards obsolete, no longer maintained apps and with a huge number of high quality modern apps not included.
F-Droid is not the open source Android app ecosystem. It's a poor way to access that ecosystem. It's not secure and it's not trustworthy. There are better ways to get open source apps.
@GrapheneOS @rufposten @accrescent
I just took F-Droid as an example source for FOSS apps and not to discuss issues F-Droid has, which (while they exist and are relevant) are no excuse to not realize that FOSS apps - as they exist in reality - are on average significantly more privacy-friendly than proprietary apps with known included tracking.
@GrapheneOS Oh noes, you will get an update two days later! Drama Baby, Drama! Btw., there have already been situations where an update was faster published on F-Droid than on Google Play.
@pixelschubsi @rufposten @accrescent
@maggus @pixelschubsi @rufposten @accrescent F-Droid regularly has months of delays for browser security updates. It has regularly reintroduced security vulnerabilities by downgrading dependency versions. It's a serious issue heavily impacting people's safety. F-Droid isn't a safe way to obtain open source apps.
@maggus @pixelschubsi @rufposten @accrescent
To provide some helpful context for other people, you've been repeatedly participating in targeting our team with harassment through spreading Kiwi Farms style content targeting them with spin and fabrications including from a Kiwi Farms user you support who regularly targets people in this way:
@rufposten @accrescent @GrapheneOS
Ich würde eher sagen: Vorsicht vor Missverständnissen und Falschinformationen!
Accrescent ist keine Alternative oder Ersatz für F-Droid. Die beiden Systeme sind fundamental unterschiedlich und lassen sich nicht wirklich miteinander vergleichen. Accrescent ist eine Open Source Alternative zum Google Play Store und dessen App-Distributionsmodell. Wie im Play Store kompilieren Entwickler ihre Apps hier selbst und signieren sie mit ihren eigenen Schlüsseln. Das ist der große Unterschied zu F-Droid. Hier wird nämlich nur der Source Code vom Entwickler veröffentlicht und die Kompilierung und Signierung der App erfolgt auf einem F-Droid Server und ohne Einflüsse des Entwicklers (mit Ausnahme von Apps, welche Reproducible Builds unterstützen). Der Fokus auf Privatsphäre bei Accrescent liegt darin, dass Nutzer im Vergleich zum Play Store kein Konto benötigen, mit dem sie sich anmelden und dass das Backend Open Source ist. Der Nutzer ist selbst dafür verantwortlich zu entscheiden, welchen Apps er denn seine Daten anvertraut und welchen nicht. Die Apps werden so zum Download angeboten, wie sie vom Entwickler bereit gestellt werden. Aus der Perspektive der Sicherheit ist dieser Ansatz dem von F-Droid klar überlegen. Die Sicherheitsmängel von F-Droid sind klar dokumentiert: https://privsec.dev/posts/android/f-droid-security-issues/
@SupportGrapheneOS_667 @Andromxda @rufposten @accrescent This is very far from the worst case of it and we don't think this stuff is an important issue. Perhaps it's helpful to demonstrate their usual attitude but there are better examples of it. Look at https://archive.ph/j7qql if you haven't seen it for one little example, followed by a cover up and then fabricated stories about what happened which they are still spreading elsewhere.
@GrapheneOS In Germany we say: "Wie man in den Wald hinein schreit, so schreit es auch wieder raus."
@SupportGrapheneOS_667 @Andromxda @rufposten @accrescent
@maggus @SupportGrapheneOS_667 @Andromxda @rufposten @accrescent
To provide some helpful context for other people, you've been repeatedly participating in targeting our team with harassment through spreading Kiwi Farms style content targeting them with spin and fabrications including from a Kiwi Farms user you support who regularly targets people in this way:
@GrapheneOS Btw, you're linking to an old state of the MR, here's the current one, just for reference:
https://gitlab.com/fdroid/fdroid-website/-/merge_requests/834
@SupportGrapheneOS_667 @Andromxda @rufposten @accrescent
@maggus @SupportGrapheneOS_667 @Andromxda @rufposten @accrescent We linked to an older version because F-Droid engaged in a cover up of the extreme harassment their team engaged in across Matrix, Telegram and GitLab followed by spreading fabricated stories about it. It is clear that you support that since you're spreading Kiwi Farms style harassment and fabrication content about our team members elsewhere including from an active user of Kiwi Farms with far right views who you support.
@maggus @SupportGrapheneOS_667 @Andromxda @rufposten @accrescent
To provide some helpful context for other people, you've been repeatedly participating in targeting our team with harassment through spreading Kiwi Farms style content targeting them with spin and fabrications including from a Kiwi Farms user you support who regularly targets people in this way:
@Andromxda @rufposten @accrescent F-Droid's reproducible builds system is used for a tiny subset of apps and requires developers to do things in a particular way they require rather than simply supporting reproducible builds in general. If the developer ever makes a change F-Droid doesn't like, no more updates for that app because they'll enforce their opinion and refuse to update it until the developer changes it, but they can't change it themselves as they usually do with downstream patches.
@Andromxda @rufposten @accrescent WireGuard was one of the apps included in F-Droid via reproducible builds. WireGuard strongly disagreed with the F-Droid policies and viewed it as a major security risk. The developer added a self-update system despite it being banned by F-Droid, and since F-Droid doesn't even do a cursory review of the changelogs they of course shipped this. WireGuard then took over updating itself. It took months before F-Droid realized what happened and it was free by then.
@Andromxda @rufposten @accrescent See https://gitlab.com/fdroid/fdroiddata/-/issues/3110#note_1613430404 for a post from the WireGuard developer about their experience with F-Droid after extensive involvement with it. Strongly recommend reading it.
CC: @Andromxda@infosec.exchange @rufposten@social.tchncs.de @accrescent@infosec.exchange
@rufposten LOL, und @GrapheneOS macht fleißig Werbung für @accrescent!
@maggus @rufposten @accrescent
To provide some helpful context for other people, you've been repeatedly participating in targeting our team with harassment through spreading Kiwi Farms style content targeting them with spin and fabrications including from a Kiwi Farms user you support who regularly targets people in this way:
I've had a lot of people ask how BlueSky compares to Mastodon and the Fediverse. I've tried to make the answer as simple and easy to understand as possible:
🦋 BlueSky is designed to give corporations and wealthy people full control of the network. All of its traffic has to flow through expensive-to-run corporate relays.
The Fediverse is designed to give ordinary people control of the network. All of its traffic flows directly from one cheap-to-run server to another.
Alt...
Diagrams of how BlueSky and its AT Protocol functions, compared to how The Fediverse and its ActivityPub protocol functions.
BlueSky's traffic flows from servers to corporate-owned relays, and these relays communicate with each other before allowing traffic to flow to servers. The servers cannot communicate with each other at all.
The Fediverse's traffic flows directly between cheap-to-run servers, with no need for any corporate involvement.
While technically these are both forms of decentralisation, the BlueSky interpretation puts corporations, rich people and wealthy organisations in full control of the network. The Fediverse interpretation puts ordinary people in full control of the betwork.
@FediTips people flocking to bsky thinking it's going to be different has me shaking my head. Just look at their investors. Blockchain, lovely.
Most of BlueSky's board is blockchain people. Their CEO's CV is mostly blockchain and cryptocurrency companies.
@FediTips @effariwhy One day we'll purge anyone who has ever worked on a crypto project from working on anything ever again
@FediTips @effariwhy Do you have a link to the current status as a source?
I only know this article (in german) from November: "Bluesky: How is a ‘decentralised ecosystem’ financed? Bluesky was launched as a non-profit organisation, and controversial names emerged in the latest round of financing"
https://www.derstandard.de/story/3000000245588/bluesky-wie-finanziert-sich-ein-dezentrales-oekosystem
This is on my to read list
https://dustycloud.org/blog/how-decentralized-is-bluesky/
@w_b @caos @FediTips @effariwhy
So... BlueSky Direct messages all go through a central server. And are not encrypted E2E anyway.
I don't like that.
Never thought about it but DMs in Mastodon are not E2E either.
I'm just learning about ActivityPub. How difficult would it be to E2E DMs?
Could you provide encryption keys on both ends. And make it to where something like the users pass decrypts DMs?
@txtechnician @caos @FediTips @effariwhy
End to end encryption has been a problem in email that still is not solved. The problem is the key distribution.
I don't know how Signal, etc. do it but it would seem publishing the public key in the user profile would solve e2e for at least DMs.
@w_b @txtechnician @caos @effariwhy
Social networks in general aren't good for privacy, as far as I know none of them have E2EE. It's much better to use encrypted messaging systems such as XMPP with OMEMO, @briar etc.
There is discussion of how to bring E2EE to Mastodon at https://github.com/mastodon/mastodon/issues/19565 but it hasn't been updated in some time.
@FediTips @w_b @caos @effariwhy @briar oh man. I think that encrypting toots. Is Overkill. But I do see the need to encrypt private messages.
I mean the difference is obvious. One of those is meant to be public. The other one is meant to be private.
BlueSky is not a non-profit, it is owned by Bluesky Social PBC which is a for-profit corporation.
In October it announced that it had partially sold itself to Blockchain Capital, and the same announcement said they had appointed a blockchain/cryptocurrency expert to their board:
https://social.growyourown.services/@FediTips/113364985280012085
This is in addition to their CEO being a blockchain/cryptocurrency person:
https://en.wikipedia.org/wiki/Jay_Graber
AFAIK the board only has three people, so a majority are from blockchain.
@FediTips Probably worth mentioning at some point that the design for interop between platform corporations is pure vapor at this point and there are no real efforts underway to implement it.
Even if it was real, BlueSky could simply defederate from everyone as they have such a large share of the userbase. This is what Facebook did with XMPP interoperability, they kept it internally but switched off all external connections.
@FediTips @janxdevil having lived through the "embrace, extend, extinguish" strategy of both Facebook And Google via XMPP, I'd replace "could" by "will"...
@benjamin @FediTips @janxdevil Facebook *never* federated, what they offered was client connection (which many people used pidgin for, which could have other accounts as well)
Interesting, hadn't heard that before. Did Google federate properly?
@FediTips Google did federate for a long time, but it was defederated by many deployements before they stopped the service, because it was effectively abandoned and not even supporting STARTTLS (which means everything went there in cleartext)
@FediTips @mathieui You could also federate over XMPP with iChat. In-fact, Mac OS X Server had an option to host a local version of the iChat server!
https://en.m.wikipedia.org/wiki/IChat
https://wiki.xmpp.org/web/IChat_Server
@FediTips @janxdevil I am getting your point and of course, I promote Fediverse as much as I can.
But there are definitely reasons why users prefer BlueSky massively. I am not sure about their MAU, because they are centralized service, there is no way to verify independently, but they may be easily 10 times our MAU.
I think the need to choose the instance is not the main problem of Mastodon and Fediverse. It is quite easy to explain to newbies. The problem is quite simple and straighforward: it is UX focused on power users.
There are too many new concepts to learn. There is no reason, why end users should have to even know about federation: it is the implementation, that matters. Backfilling history of toots and timeline of other instances instead of "opening original page". Starter packs (ie. easy sharing of user-generated lists - no CSV imports). Propper scanning for all replies (somehow). Better search feature. Better explore feature...
Also, even if Mastodon may be the best ActivityPub client so far, it is definitely not for everyone. It is quite complex chunk of code. The frontend is written in JavaScript, which is of course very standard and it is my fault I am not more familliar with it. But Ruby is pretty oldschool server side language and not among the most popular. This makes the backend quite unreadable... although probably still better, than node.js 🙂
Anyway, it is not easy for me to participate in development of neither frontend nor backend of Mastodon.
Writing completely different Fediverse application would be probably hard and I definitely don't feel one should attempt it as one man show. The team would need to start with such ActivityPub implementation, which would fix the issues like replies, and then maybe work with W3C to standardize account list sharing, so other Fedi implementations can join.
Good cellphone app would be a must. It would have to come with good instance selector. Etc.
If you care about MAU, why not just join Twitter, Facebook, Instagram etc? They have much bigger MAUs than BlueSky.
What exactly is the point of joining BlueSky at all as it is going down exactly the same path as Twitter, Facebook etc? What advantage is there to users?
@FediTips
performativity
@FediTips @xChaos @janxdevil It could be that these 12M+ people just don't agree that it is going down exactly the same path as Twitter, Facebook etc?…
You brought up MAUs as a reason to be on Bluesky.
I replied that if MAUs are your main concern, you can get even higher MAUs on Twitter etc.
As for going down the path, it's a matter of fact that Bluesky has adopted the same structure as Twitter, Facebook etc. Pretending it hasn't doesn't change this fact.
@FediTips @xChaos @janxdevil I didn't bring it up, @xChaos did
Ahh apoloiges 😳 My mistake, sorry.
@FediTips @mackuba @janxdevil All I said is that many Bluesky users are quite nice and they have chosen the platform because lot of people went there and because it was straightforward to use.
I did my best, but Mastodon is simply not user friendly enough for most people. It offers some quite advanced features for power users, but at the same time, it lacks certain basics, which newbies would take for granted. The don't care about the architecture of the network, as long as they don't have to think about it.
We need to keep on trying and one day, Bluesky may seem boring to some and they will move here...
Ordinary users are attracted to a well-funded simple platform.
The trouble is this simplicity is what makes it easy for Musk etc to buy it out. And the massive amount of funding is what will eventually force it to start exploiting and manipulating its users, because the funding comes from selling itself to the funders.
There is no perfect solution, there are just a range of most or least worst options. It's up to each person to decide what is least worst for them.
@FediTips yes, BlueSky is going to be bought out eventually. But maybe people already got used to being digital nomads and they will just move again, when it happens.
I created separate list of bridged BlueSky accounts and they just seem to use it and don't think about it too much. Maybe we are too meta here...
(and also, the funding of Fedi instances is open issue... small instances are admin sponsored, but as the instances grow, they may easily reach the point, when they will be too big to be sponsored but still too small to raise funds... we will see.... I wrote python scripts, which crawl explore Mastodon compatible Fedi on various TLDs and and I am going to put the charts online soon...)
@xChaos @FediTips @janxdevil Tbh, power users also like having certain basics like working search or seeing complete threads (power user here) ;)
@FediTips Sure, but as a practical matter, BlueSky can’t even connect, much less disconnect.
It’s also not clear whether they would make any connections, if it were a capability they even possessed, which they don’t.
@FediTips Cory Doctorow has written about the Sky one several times lately, but I think this piece is a decent verbal explication of what the graphic is representing visually (I'm not great with visuals; it took me a minute LOL): https://doctorow.medium.com/https-pluralistic-net-2024-12-14-fire-exits-graceful-failure-modes-fa815198e17d
Doctorow seems to think that if there is a choice of corporate relays, that that will somehow make things okay. I admire him greatly, but respectfully think he is mistaken on this particular topic.
About the diagrams on my post, they should be explained by the text in the original post? Fediverse servers are cheap to run and talk directly to each other, BlueSky servers can only talk to expensive-to-run corporate relays.
☝️ This is a great explainer of the difference between Mastodon and Bluesky, with one correction. At present there is only ONE corporate node, and the technology to create more has not been proven.
Even worse then, isn't it! 😬
I've mainly put multiple relays on there so people can see even in the best case scenario, the AT protocol is still putting corporations in control of the network.
@FediTips @mastodonmigration apparently several people have run their own relays for personal use but it's not for the faint of heart apparently you need several terabytes of preferably solid state storage and a very fast network connection and while the code for the relay server is public it isn't terribly well documented
Take a look at these links if you'd like to learn more
https://alice.bsky.sh/post/3laega7icmi2q
@FediTips In my opinion, the apps for accessing the fediverse simply have much better features than BlueSky. Also, I block 20 bots on BlueSky for every human I find to follow.
There is one key question I haven’t yet seen answered anywhere:
“[…] our proposed methodology here of networking through Relays instead of server-to-server isn’t prescriptive. The protocol is actually explicitly designed to work both ways.”
https://docs.bsky.app/docs/advanced-guides/federation-architecture
QUESTION: What would that look like? Would each PDS have to crawl all relevant PDSes (=very inefficient)?
Whether or not AT Protocol can be decentralized hinges on the answer.
As far as I know, in the real world AT protocol servers cannot federate without being connected to relays.
There is also only one relay at the moment.
True! But (and I’m saying that as someone who thinks the Fediverse is the better choice):
It *sounds* like the protocol was designed to support true federation (vs. “big world” design based on Relays). What would that look like?
If that works well then, in principle, AT *could* become a reasonable and open alternative to ActivityPub.
If not (which is my current impression but I may be wrong) then there is no way of that ever happening.
It sounds more like a hypothetical thing in a document rather than a real world thing actually being implemented.
BlueSky are a for-profit corporation dependent on VC money, and they've given their staff shares. That gives all of them a huge financial incentive to create a network that can be bought out by billionaires etc.
It's difficult to see why they would do anything to endanger their ability to sell themselves to wealthy investors.
@FediTips It’ll be interesting to watch for sure! They made a lot of promises w.r.t. openness.
There is also this group of people: https://freeourfeeds.com/
It’s interesting that, per their FAQ, they want to build a second Relay. That doesn’t sound like AT will ever be truly decentralized.
It feels like they could achieve their goals with much less money if they focused on ActivityPub instead of AT.
That is 100% fine! 👍 Very happy if this info spreads more widely.
@FediTips @liveloveintifada added the image to my post from earlier it tells the story straight, about time to, nice work.
https://hamishcampbell.com/public-social-media-the-choice-is-clear/
My favorite part is when people say "Bluesky has no algorithm" (as someone who studied computer science, I hate that "algorithm" has become this dirty and evil word). This is false. It does has a bunch of algo feeds that one can subscribe to (https://bsky.app/feeds). Things like "Discover", "Popular with friends", and so on. You're not forced or nagged to look at these feeds, but they do exist for anyone who wishes to use them.
Furthermore all Bluesky posts can be boosted by algorithmic feeds; there's no "unlisted" post setting. Forced discoverability is not good for someone who just wants a quiet social media presence.
Finally, blocks are public, which is a world of drama waiting to happen. There's even a block leaderboard https://clearsky.app
@FediTips Your post needs more reach. Very succinct description!
@FediTips this is arguably oversimplified..... but maybe oversimplified is helpful in this case
@FediTips What's the difference between a server and a relay?
@FediTips great job with the visual 💯
@FediTips It would be quite easy for me to trust BlueSky’s intentions if the flagship instance had been set up as an independent non-profit.
@FediTips can you clarify for Bluesky? Are you talking about the standard or current ownership model?
@FediTips I will stick to Mastodon, but even as technical minded user, it's way more frustrating to use. I can't even see half the content that is on other Mastodon instances, let alone comfortably interact with other protocols. It's confusing and badly communicated by the UI. Things need multiple times the clicks than on bsky.
I understand the limitations, and things are getting better. But realistically there is no way an average internet user can comfortably switch to Mastodon at this point.
BlueSky isn't showing things from other instances at all though.
BlueSky is currently just a for-profit centralised single-instance social network, like Twitter or Facebook.
Even if it eventually linked to other instances (which isn't currently happening), it would be through massive corporate relays that would need to exploit user data to fund themselves.
@FediTips I understand that - and I'm not expecting bsky to stay a viable network for long (their lack of moderation will prob get them first).
But the fact that Mastodon, at it's current state, is not usable for tech-noobs, is true at the same time. I directly experienced that when trying to get some to use it.
The green dots on the bottom image could be labelled "just an everyday person", "a small group", "a non profit organisation", "a media that has a vision", "an enthousiast hobbyist", "not a billionnaire", "a cooperative", #GeorgeTakei, "an association", " "just regular folks like you", "just an other everyday person" and so on.
@FediTips Failing to mention that for the average (non-tech-savvy) user Bluesky is *significantly* more user-friendly than Mastodon and the Fediverse makes this not a very honest comparison.
Mastodon has real advantages and should in an ideal world be the main social network, but it is unable to reach that critical mass because Fedi-enthusiasts refuse to look critically at what could be improved (a lot).
Usability is simply not where it needs to be to reach a wider audience.
BlueSky is easier because it's centralised, like Twitter or Facebook. And it's going down exactly the same path to become just as awful as they are, because it is structurally the same: VC backers on a centralised for-profit corporate network.
Even if they "decentralised" with the AT protocol, it would still remain in corporate control.
If someone doesn't mind them becoming awful like this, then they might as well stay on Twitter or Facebook. What's the point of moving?
@FediTips That's just one of the reasons it's easier.
It's orders of magnitude more usable than both ex-twitter and FB and it's not run by (or overrun with) literal nazis. If you want twitter without the nazis and other shit, that's Bluesky... if you don't mind jumping through myriad technical hoops and a much smaller audience, there's Mastodon.
I'm still detecting zero willingness to look critically at Fedi and its UX issues here.
"and it's not run by (or overrun with) literal nazis"
Because of the way Bluesky is structured, Musk could buy it tomorrow. There's nothing to stop Twitter happening all over again.
"If you want to be smug"
I'm not being smug, I am being deeply worried by what centralised corporate social networks have done to the world:
This is caused by centralised networks run for profit. It doesn't happen at first when it's building up, but it happens eventually.
@FediTips Yes, any private company could in theory be bought and change how it operates, but what *could* happen at some unknown point in the future is not what is happening right now, and this again does not address the real weaknesses of Fedi.
The fact is that for most people Bluesky TODAY is a better alternative than Mastodon. This is not because they are stupid, this is because for a non-tech-savvy user basic usability far FAR outweighs any potential advantages of open source independence.
@FediTips lol it's a bit subjective but it's MY kind of subjective, I love it
@FediTips Bluesky is where BlueMAGA ppl who didn’t care about Palestine go to clutch their pearls about Trump. Fedi is where no one sees my posts. 😂😭
@FediTips Thank you for the drawing chart. Make things more understandable. 🫶🏼😅
@FediTips Relays are how the Reapers controlled everything.
@FediTips I find this picture to be misleading.
It seems to imply that users are the green dots for BlueSky and they communicate with servers (red dots) which are (so far) run by corporations. No complaints, that's all pretty accurate.
But when you use the same green dots for the Fediverse on the bottom, it seems to imply that individuals are directly connecting to each other which is NOT accurate. Servers are still intermediaries on the Fediverse. I don't believe this is a minor distinction.
@FediTips I’m saving this as my shorthand explanation. Thank you 🙏
@FediTips Well, the tech aspect is interesting, but let's also discuss the UI experience. The BlueSky interface is much more rewarding to the user as we get to see much more content.
BlueSky is a centralised social network, it is on one instance like Twitter or Facebook. It's inherently easier to navigate a single instance network, but it comes at the cost of making it ultra-easy to be bought out, Musk etc could buy it any time.
The BlueSky interface is paid for by selling itself to VC investors. The VCs will then be demanding lots of monetisation once they've gathered enough users. They're on the path to becoming as bad as Twitter or Facebook because of this.
@FediTips Should that happen, I'll jump, just like I bailed from Twatter. Meanwhile, I find much more progressive content on BlueSky & my posts are much more effective.
It's totally your call what you do, I'm not trying to condemn people's choice of platforms.
However, if we keep jumping the problem will keep repeating, and many never jump so the problem never gets solved anyway.
We have to do things differently if we want to break the cycle.
BlueSky is advertising itself as if it is breaking the cycle, the point of the post above is that they're not really breaking the cycle.
@FediTips I like how you cut through a lot of tech talks (I find it of some interest though) to the highlight key basic differences that actually reveal the true nature of the architectures (one requiring big money, hence needing corporations vs. simple architecture costing little money to run). Thanks! I also am watching Spritely to see how it goes!
If is is not freedom software of open source I am not interested. The tranparencey of Bluesky is quite opaque.
@FediTips love the explainer. To be fair though search and reliable distribution is hard in a decentralized network and search works pretty badly here. I’ll still take federated for the reasons you outline but we should be honest about the tradeoffs.
@FediTips at least my humble artwork reached some people on BlueSky. On Mastodon, it's usually crickets like it's a ghost town.
@FediTips after spending a little time on both (Masto is my platform but I also have Bsky) I think the online cultures are wildly different, in a way everyone could describe differently, but Masto is DIY, and people seem more free to be eccentric out of the confines of online formality crossing over into those all too-keenly-aware professionalism and other hats that you see worn on Bsky, Fedi is more free in a lot of ways I think. Eccentrics tend to feel at home here and that gives me so much joy. Others feel like walls for thoughts but Mastodon offers more space for expression and community, I feel.
@FediTips Bluesky is VC funded for-profit that makes 0 revenue today. How will they give back 30M they owe (so far) and start making profit?
@FediTips Yup!
Been saying this for a while
People flee from one centralized place to another making endless accounts in the menanwhile
But ofc the Fedi is certainly too much work 
@FediTips
Aaand that's why the mainstream media won't cover the Fediverse even though they covered both BlueSky and Threads. It doesn't make money for the corporations that fund them.
@FediTips Sadly all people can see is that they only have one signup on the corporate version and the interface is a little more polished. And for that they're willing to become part of something that is specifically designed to harm them.
@FediTips@social.growyourown.servicesomebody needs to post this on BS because I dunno if all those Xitter refugees got the memo
@FediTips but the main reason I hear people join bsky is because it’s easier. Not sure #average_user is too clued in to the inner workings, or even cares about it all too much.
You might not care about the workings of something, but you might care about the effects of something. No one cares about how a medicine works, but they care if it stops them being sick.
The structure Bluesky has chosen for its tech and its business is very likely to repeat all the problems that Twitter, Facebook etc suffer from.
The things that make people leave Twitter & Facebook now are going to get repeated on Bluesky with its current structure. Then they'll have to move again.
@FediTips sure, but what I’m saying is that in order to convince the masses to join mastodon over bsky, we need to make it not just theoretically better but also easy to use and connect.
I’ve read the comments, spoken to colleagues who joined this then that, and the consensus is that “mastodon is hard, difficult UI” compared to bsky.
For context, my friends are scientists with very little time.
If they have no time or will to consider sustainability, then they will end up having these same Musk-type problems happen to them again and again. I'm not saying this with any sort of judgement against them, it is just the consequence of their choices.
It's much easier to use a single-instance network, but that makes it easy to be taken over.
It's much easier to use a network that has massive amounts of funding from VCs, but that makes it certain to enshittify and exploit its users.
@FediTips that's a great graphic to illustrate a federated approach! There is a realtime variant that shows that exact same concept applied to real world chat servers that use the XMPP protocol. You can see it at https://xmppnetwork.goodbytes.im/
(It's getting rather big. On mobile, this webgl rendering typically had better performance: https://xmppnetwork.goodbytes.im/webgl.html - there's also a link to a rather nice 3d version on that site).
@FediTips
From what I've read, bluesky is vulnerable to being scraped (?) by 3rd party bots/spiders, and may be that way for it to make a profit in the future?
Just start out on a big server on Mastodon, get the community of friends & hashtags you like, then if you want later, easily transfer your settings & follows to a specialized server.
@PamelaBarroway
This Valentine's Day, Don't Just Say It, Show It: – Make Your Partner Fall in Love All Over Again With This Adorable Gift! Limited Time Offer: Grab Your ILY Necklace at Up to 75% Off
@FediTips The thing that is missing from your diagram is that while #Fediverse servers CAN communicate with each other, not all of them DO. This is most noticeable when you follow a #hashtag - If you are on a large, well connected instance you will see many (maybe almost all) posts containing that hashtag. If you are on a small instance, or an instance that is not well connected (for whatever reason) you will see only a small percentage (maybe close to 0%) of the posts made using that hashtag.
In situations like that, from the user's perspective the #Bluesky / AT protocol is superior, because with the centralized server and corporate relays pretty much anything posted using a given hashtag will be seen by all those who follow that hashtag.
I'm not saying we all should move to Bluesky. I'm saying that this is a problem that needs to be solved by whoever writes the software for #Mastodon and similar Fediverse instances. And if there already is a solution but few instances are using it, what is that solution and where can you find a list of instances that are already using it? I understand there will always be some blockages because instance operators don't want traffic from certain types of instances, but I'm not talking about that, I am talking about cases where a post with a hashtag doesn't reach your instance because no one using your instance is specifically following the user that made that post.
There are various ways to make any Fediverse server see a lot more of the Fediverse:
https://fedi.tips/using-relays-to-quickly-expand-a-servers-view-of-the-fediverse/
@magnus her har vi måske nogle tips!
@FediTips @kryptec Right, but as a USER I have no way of knowing if the instance I am using has implemented any of those. How about publishing a list of such servers? And if you have no way of knowing which servers are using any of those various ways, then how is the user supposed to know? A solution that few instances are using and/or where users have no way of knowing if their instance (or any other) is using that solution adds a level of complication and annoyance that you don't have with the big corporate platform.
The idea isn't to have a listed set of features, it's just to provide more posts visible to the instance.
Also, the user themselves can implement things like following groups which totally bypass whatever their instance can see. If you follow a group, you will see the same posts no matter which instance you are on. It's the same if you follow a particular set of accounts, the act of a user following an account changes which posts are visible to the user's instance.
@FediTips Well the problem with groups is that you first have to know that a group you are interested in exists, and then chances are if you do find one it's not specific enough. Say I am running some piece of software that is giving me trouble, I can subscribe to a hashtag with the name of that piece of software, which (hopefully) will only show me posts related to that software, although that is not always the case, for example if I want to see posts about Joplin (the note taking application) I could use (hashtag)Joplin and hopefully I would get mostly posts about that software and not Joplin, Missouri or Scott Joplin the composer.
But will there be a group about Joplin? Probably not. And also, as I understand it, groups follow users, not hashtags. And in that case you can get inundated with posts that are not about the topic of interest. I have tried to follow groups a few times and generally speaking I've had to turn them off almost immediately because they flooded my timeline with uninteresting and irrelevant posts.
I think we might be talking about different kinds of groups? 🤔 A lot of different services on here have used the name "group".
Groups from services like Guppe are basically just "super hashtags". If you mention the group, the post is distributed to everyone that follows the group on any server. You can make a new group just by mentioning it.
If someone spams the group with irrelevant content, they can be reported for spamming (just like they can be with hashtag spamming).
@FediTips Well there is a chicken/egg issue there, far more people are likely to use a hashtag than a group mention, and that is because they are familiar with hashtags from the dead bird site and other existing social media platforms.
So again taking Joplin (the software) as an example, chances are there is no existing group for it, and yes I could easily create one but chances are all I'm going to get is crickets because other people who post about Joplin will be using the hashtag (with which they are familiar) and not the group identifier.
Basically what I am hearing is "we can't make hashtags work the way they are supposed to in the Fediverse, so here is this substitute that few users have heard of and even fewer will actually use", rather than "we really need to fix the fediverse software so that hashtags work as they are supposed to."
@maple @FediTips ok, but having all the data stored in a single, owned, instance (like BlueSky) would potentially expose users to an unknown future... as it happened with the current "big tech". I rather prefer fix and improve what is not working in the fedivese, which is the real alternative. I wish a future were we always own data, regardless of the app/technology we use
Yeah, this is another worry. BlueSky's valuation is approaching 1 billion dollars, and part of that will be the user data they expect to hoard.
"I wish a future were we always own data, regardless of the app/technology we use"
I think @timbl has been working on something like this for some time with the Solid project?
@skamu @FediTips That is great and I hope you are able to fix and improve what is not working, but right now this is still a problem and it is something that would cause ordinary users (like me) to consider switching to Bluesky (or to just start with Blueskay in the first place). You have to realize that most users just don't care if they own data (probably better than half don't even seem to care about privacy, which totally blows my mind) so saying that they should use the Fediverse because of some philosophical argument about ownership isn't going to carry much weight, if they can receive most or all of the posts they want to see on another platform.
@maple @FediTips Hi Maple, yeah I get your point and I agree that most of the users don't care, and it is really sad.
I am also an "ordinary user" anyway, I am just tired of directly supporting huge corporation with my personal data. I have opened my eyes and I do believe that the rest of "ordinary users" (like us) will do the same in a point.
It will probably take time, but I really believe that the "fediverse approach" will be the future.
@skamu @FediTips I hope you are right, but it will take a lot longer if people think that you shouldn't even try the Fediverse because any posts you make will only be seen by a limited subset of users, even if you include hashtags they are following. People who are frequent posters often desire that what they write will be seen by the highest number of users (or at least users interested enough to follow whatever hashtags they include), so they may not have much interest in platforms that limit their exposure. And factors such as who "owns" the post content may not matter at all to them.
I am on a single user server and have over 200k followers. My other accounts on this server have 70k, 8k, 5k and 3k followers. It is possible to build a mass following without being on a large server.
"they may not have much interest in platforms that limit their exposure."
...if exposure is all they care about, why would they leave Twitter, Facebook, Instagram etc? (Genuine question.)
@FediTips @skamu You're in kind of a unique position because you are very well known, so people follow you directly.
"...if exposure is all they care about, why would they leave Twitter, Facebook, Instagram etc? (Genuine question.)"
Well, I can think of two reasons, one is that they don't want some big corporation (or the evil owner thereof) owning or controlling or censoring their posts, and the other is that they don't want to share a platform with Nazis/fascists/anti-science types. But if they don't fall into either of those categories, I can't think of any reason they would want to leave one of those platforms. And right now, for the most part those things would not apply to Bluesky users (yet) so the case for leaving to come to the Fediverse is even weaker for them.
"You're in kind of a unique position because you are very well known, so people follow you directly."
I'm not though? No one knows me outside of these accounts.
"...one is that they don't want some big corporation (or the evil owner thereof) owning or controlling or censoring their posts, "
They already have a big corporation owning/controlling their posts. Bluesky is a for-profit corporation valued at nearly a billion dollars now.
@FediTips That is true but they don't have the stink of Musk or Zuckerberg associated with them. People don't always think of big corporations as being necessarily bad, and more to the point, Bluesky doesn't seem to be trying to attract the kind of people that would make you avoid a bar or restaurant if you found it was filled with those kind of people. People are leaving the dead bird site and Meta not necessarily because they are run by big corporations (although that is the reason for some), but because they have become hangouts for the Nazis and the far right and the Christian nationalists and the anti science anti-vax crowd. And because even if they don't really want to leave, their friends and family are shaming them for staying there.
That is simply not the case with Bluesky (yet).
@FediTips Honestly, the lowest cost for a master. Don't instance. I would say it would be about $70 plus 12 or so a month to keep the D. N. S registered. $60 for raspberry Pi $10 for the needed storage to add to the pi 12 a month for domain registration can we get this Lower?
@FediTips The problem is that Bluesky is lively. People respond. Here, other than this post of yours, almost nothing anybody posts here gets any comments.So ironically, there's no sense of community here. We are all just barking into the void.
It is more work to build up connections on here than on Bluesky, Twitter or Facebook. There are good reasons for this, because the structure here is designed to stop people like Musk taking over the network.
And once you do make connections on here, I would say the community on here is much more genuine, deep and friendly.
I've done some tips on how to discover accounts at https://fedi.tips/how-do-i-find-accounts-to-follow-on-mastodon-and-the-fediverse-how-do-i-find-my-friends/ and how to make your own account more discoverable at https://fedi.tips/how-do-i-get-more-followers-on-mastodon-and-the-fediverse/
@FediTips you didn't mention the AT-protocol, underneath Bluesky: it's because you don't know what it is, you didn't understand how it works or simply because you just need to keep perpetrating this completely nonsense - and frankly very boring - argument Mastodon VS Bluesky?
It's not a war, man. Be at peace.
Every so often, I wonder about not having a smartphone.
Something which could do cellular calls, XMPP and Signal, basic PIM (email, calDAV, cardDAV), and have a decent enough camera.
Which, sadly, is enough to push it into "need a smartphone" territory, AFAIK.
@sam Yes, I wasn't enamoured with either the PinePhone or the PPP.
I still reach for them from time to time, to tinker.
Could any #privacy , #infosec people weigh in on whether the you tube guy Rob Braxman is legit. The usual searches don't lead to much.
https://www.youtube.com/@robbraxmantech
@Asbestos in my opinion he’s a grifter fraud and should be avoided. He’s a fear monger and his followers are mostly unwitting suckers who’ve bought into his schtick.
@moelassus @Asbestos This is 100% accurate. Braxman spreads massive amounts of misinformation and he's a serial fabricator. He's scamming people selling them highly insecure products and services. He endlessly makes up fabrications to justify why people should buy his products and avoid more private and secure ones.
@Asbestos He's not an actual privacy or security expert. He's a serial fabricator and charlatan who pushes endless unsubstantiated and outrageously false claims about privacy and security topics. His focus is convincing people to buy his insecure products and services. Look into what actual privacy and security professionals have to say about his content. He has also repeatedly engaged in libel and harassment towards privacy and security engineers/researchers who debunk his endless false claims.
You are asking the wrong question, IMHO. He talks about many issues related to privacy and not only one. You should ask one question for each issue.
@solarveggie @Asbestos He pushes fabrications in nearly all his content. His focus is consistently on ripping people off selling them insecure products and services. There's no redeeming quality to it. People who watch substantial amounts of his content end up believing large amounts of falsehoods and making poor decisions for their privacy/security based on it. He's doing immense harm in the space with both his content and scamming people. He's attacking and harming actual privacy work.
@solarveggie
Survey says FULL OF SHIT
Alt...
Family feud survey says meme
Survey says full of shit
I only watched 2 videos and it seemed like it could go either way he wasn't hawking anything on them but Mastodon has a very high signal to noise ratio for this kind of thing so I figured this was the place to go.
Thanks all.
@solarveggie
@Asbestos @solarveggie He posts lots of privacy and security content that's full of false claims, misrepresentations and spin which aligns with him selling products and services. He does often promote his products and services in his videos but he's mostly promoting them through claiming everything else is insecure and then people see him as the solution to that. He's not an actual technical privacy or security expert. He fills in the blanks with his assumptions and fabrications.
Rob's services are closed-source. That does ring an alarm bell.
@solarveggie @Asbestos Go look for the sources for the phone OS...
@sam @solarveggie @Asbestos No, that's not what is being asked. Where are the sources for the OS on each of the Brax devices? We're not asking where the sources are for the operating systems they forked.
The fedi experience
Alt...
Girl walking down a road with her hands over her ears with the words "mentioning any minor software issue" next to her. Following her down the road is a boy obnoxiously playing a trumpet at her, the words overlayed "The problem here is that you're using proprietary software and just giving your data away to corporations, what you need to do is adopt free open source..."
@babe I used to be like that in the mid-late 90s, because I was a Mac zealot. And then I became a Linux *and* Mac zealot. And then I accidentally became an OSS maintainer.
Now I'm none of those things.
Over time I've become painfully aware that what works for me ain't for everyone, that nobody really cares about what works for me if it doesn't for them, so now neither do I. Someone wants to use IPX networking, or an ancient version of Solaris on hardware that keeps the house warm? Go for it!
Wow what a view captured by Perseverance just 8 hours ago. This is probably her new science site: Witch Hazel Hill.
#Mars Dec. 16, 2024 (Sol 1359)
📷 https://areo.info/mars20/ecams/1359
#Perseverance #rover #Sol1359 #WitchHazelHill #PerseveranceRover #NorthernRimCampaign #space #science #research #news #STEM #Mars2020 #geology #planetaryscience #Martian #landscape #photography #news #Astrodon
Alt...
A photography of a Martian landscape, captured by the Perseverance rover on the west side of the rim of Jezero Crater.
@pomarede
Looks like a great place for a billionaire to build a luxury mansion with complete privacy.
The long-running Fedi server mstdn.social (not to be confused with mastodon.social 🙂 ) has just received a takedown request from the Russian government for hosting @Bellingcat, a news site which has long been critical of Putin:
https://mstdn.social/@stux/113652461647125214
Thankfully mstdn.social isn't in Russia so Putin has no power over it.
If anyone wants to turn this into a Streisand Effect kind of thing, you might want to follow @Bellingcat and slip a donation to @stux at https://mstdn.social/@stux/113623791580168625
@FediTips
That gets @Bellingcat a follow. 👍
Support truly open social media! Buy @stux a Ko-Fi for Christmas >>> https://ko-fi.com/mstdn
@FediTips @Bellingcat Thank you! ❤️
“The Earth is not dying,
it is being killed.
And the people
who are killing it
have names
and addresses.”
- #UtahPhillips
#ClimateCrisis #Ecocide #WaterIsLife #WorldOceansDay #Wildfires #AirPollution #Corporations #Capitalism
Alt...
“The Earth is not dying,
it is being killed.
And the people
who are killing it
have names
and addresses.” - Utah Phillips
There was a protest at UnitedHealthcare offices. This disabled woman with a UHC Medicare plan was denied approval for treatment: “A year ago, while UnitedHealthcare was celebrating over a billion dollars at first quarter profits, I was selling the last of my belongings that had any value.”
The fourteenth evening of anti-government protests has begun in Georgia.
Mastodon isn't perfect.
But the fact a social network exists that is completely free to use
has no venture capital investors
has no shareholders to answer to
has no growth targets
with a web interface with zero tracking cookies
and mobile apps with zero trackers at all
with ten thousand server administrators who donate their time for user safety
is - in my opinion - mindbogglingly cool, given the state of the world we live in. Not everything has to be shit. People make things better.
The PeerTube mobile app is out!
A simple way to explore platforms and enjoy #videos.
Free from doomscrolling and dark patterns, this app respects your attention.
Learn all about behind the scenes and the upcoming updates on our blog: https://framablog.org/2024/12/10/peertube-mobile-app-discover-videos-while-caring-for-your-attention/
With our huge thanks to @NGIZero Entrust program and to @nlnet: those funds allowed us to dip into mobile dev, a new territory for us.
At Framasoft, we aim to keep those talents within our team. We are raising funds for our 2025 budget, and you can help here : https://support.framasoft.org
@peertube Hello. I translated the app to Polish. Will have to test it in the app later when it releases on f-droid with Polish and context that was missing from the translation page. I hope I did a good enough job for the time being. Cheers.
@peertube@framapiaf.org Do you have a roadmap of what you have planned for your app?
@crossgolf_rebel Yes, it's in the blog post above (under "Coming soon, in the PeerTube App" title)
As many users have asked for it, there is now an option to make the number of followed and following accounts public (still disabled by default). These are only the numbers; the lists themselves are never published.
Some fixes to blocked instances code (posts from them were sometimes shown).
Fixed non-appearing buttons Approve and Discard if the account requesting a follow were being followed.
If you find #snac useful, please consider contributing via LiberaPay: https://liberapay.com/grunfink/
This release has been inspired by the songs All Is Lost by #KatieGarfield and All Is Not Lost by #TonyAnderson.
@grunfink great release! Thank you!
https://github.com/macports/macports-ports/pull/27028/
2 out of 3 of GitHub Actions Continuous Integration checks have passed (and the third is running and hopefully will as well).
As in the past, I don't have commit access, so it's up to someone else to merge it.
Thank you for the continued improvements and bug fixes!
#snac #MacPorts #OpenSource #ActivityPub #Mastodon #NoDatabaseNeeded
#NoJavaScript #NoCookiesEither#NotMuchBullShit #snacAnnounces
#RaspberryPi 500 Computer Launches with the Official Raspberry Pi Monitor, Based on #RaspberryPi5 https://9to5linux.com/raspberry-pi-500-computer-launches-with-the-official-raspberry-pi-monitor
Alt...
Photo of the Raspberry Pi 500 computer with the RaspberryPi Monitor and Mouse.
Ukrainian Foreign Minister Andrii Sybiha walked out of the OSCE plenary hall in Malta as Russian Foreign Minister Lavrov began his speech.
Earlier, in his speech, he had called Lavrov a "war criminal."
In addition to Sybiha, the foreign ministers of Poland, the Czech Republic, and several other foreign ministers and diplomats also left the hall.
Just got an email thanking me for creating and sharing my NixBook project built on #nixos
He's apparently been installing it and using it for weeks on a number of computers.
Nothing feels better than #OpenSource winning, let me tell you!
The project in question is here:
https://github.com/mkellyxp/nixbook
Students from dozens of schools across Georgia are refusing to start the school week.
They are protesting against police violence and expressing support for the demonstrators.
#Georgia #Georgiaelections #Tbilisi #Protests #EU
Students of Batumi State University have halted the educational process and declared a strike.
They are calling for an end to violence against protesters, freedom of assembly, and a return to European integration.
#Georgia #GeorgiaProtests #Batumi #Protests #EU #EuropeanUnion
that's funny, because I've always thought a lot of apps behave pretty much like a website and the app is unnecessary.
This is a very good and informative piece done by PBS. Explains everything you need to know about #Georgia and #protest there.
#Tbilisi #georgiaprotests #freedom #democracy #politics #worldpolitics
Georgia's ruling party, the Russian puppet regime "Georgian Dream", is showing who they truly are. Openly cutting ties with the West, specifically the EU, so they can once again make Georgia an autocratic Russian colony. The people of Georgia are having none of it and the regime is beating them to a pulp. The regime is also targeting journalists because they are embarrassed and afraid of the world and the Georgian people seeing who they really are. But we see. #Tbilisi #Georgia #EU
Alt...
Young woman facing a police line in Tbilisi at night with smoke, wrapped in an EU flag waving a Georgian flag.
Libreboot T480 and Libreboot M920 coming soon, on https://minifree.org/
If anyone still wants Haswell (4th gen) T440p, W541, 9020 etc, order now. It'll be gone soon (won't be deleted from Libreboot, only minifree).
Libreboot replaces proprietary BIOS/UEFI firmware. I run the project; Minifree sales fund the work.
I'm doing a new Libreboot release soon, with ThinkPad T480 and ThinkCentre M920q support. Intel 8th gen. They'll replace the Intel 4th gen (Haswell) machines that I currently sell.
edit: my move isn't about politics. Looks like things are not going to be much better where I'm going.
I watched live on TV as #Georgian #journalist Guram Rogava, was assaulted by one of the unmarked "police" operatives, while he was reporting on brutality against protesters in #Tbilisi #Georgia
Politicians and activists are targeted explicitly, what seems to be a clear punitive operation.
Zebra Rock, a mysterious rock with black and white stripes, captured by Perseverance in Stereo3D
To go 3D: eyes' lines of sight parallel/left image for left eye/right image for right eye
Calibrated images by the Mastcam-Z team at Arizona State Univ., Sol 1268, Sep. 13, 2024
#Mars #Perseverance #ZebraRock #FreyaCastle #3D #Stereo3D #stereoscopy #geology #planetaryscience #Mars2020 #rock #rocks #solarocks #science #Stem #astrodon #Mastcam #MastcamZforall #photography
In the justly derided later seasons of the X-Files, they produced one masterpiece episode, easily among the all time best: The Lost Art Of Forehead Sweat. The "peak" of that ep is this scene, in which Dr. They explains exactly what's happened in the last decade. This is the ballgame. Watch it or not, it probably won't matter. But you should.
Added a new user option to disable automatic follow confirmations (follow requests must be manually approved from the people page).
The search box also searches for accounts (via webfinger).
New command-line action import_list, to import a Mastodon list in CSV format (so that Mastodon Follow Packs can be directly used).
New command-line action import_block_list, to import a Mastodon list of accounts to be blocked in CSV format.
If you find #snac useful, please consider contributing via LiberaPay: https://liberapay.com/grunfink/
What are Follow Packs?These "follow packs" can also be used from #snac pretty easily. To do it, just download the list you are interested in and run the following command for each one:They are just packaged topical lists of up to 35 accounts you can follow from your Mastodon or other Fediverse account. You can follow the entire pack by importing a file. And the entire pack loads into a list, so it becomes a feed for that subject. You can also just browse for accounts you might want to follow individually.
So, they’re like Bluesky Starter Packs?
Yes, but not quite as convenient. It’s not hard, but because Mastodon does not have a one-click way to do this, you need to download a follow pack file and then use Mastodon’s import facility. Instructions are provided in the directory and also below.
snac import_list $BASE_DIR $USER_ID /path/to/the/file.csvThe list will be created and the accounts inside followed. After that, you'll find a link to the list at the top of your private timeline. Please, take note that these lists are not automatically populated; they will eventually fill with the new posts from the new accounts, that will also appear in your timeline.
snac's web UI does not allow maintaining these lists, but you can do it with any Mastodon API client or from https://mastodonlistmanager.org (which is, em, also a Mastodon API client).
