copygirl

I can understand that way of thinking, but

• you’re at risk of becoming dependent, and not building the understanding you’ll need to make something that matters
• many things start out as hobby projects that end up mattering after all

Computers have become more complicated than when he learned to code and was “typing in programs from computer magazines.” Vibe coding, he said, is a great way for people to “get computers to do something that maybe they couldn’t do otherwise.”

But the equivalent would be to take tutorials, examples and small open source projects and tinkering with them, rather than asking a machine to do it for you, no? I guess we’ll have to see how this affects young / beginner programmers going forward. I’d rather be careful than just hoping it all works out fine.

Or worse, “nevermind, fixed it”.

Selhosting and a vpn are optional depending on your use case; the app works with niether to help users try it out and get started. Like all secure messaging apps, its better to selfhost given the option.

I’d say self-hosting is done for control over your data, not security. A typical end user will not know how to self-host, how to pick a privacy-respecting VPN, let alone secure their system. If your aim is to get to that same level of security, then I feel like the current direction is flawed, at least from what I took away from the readme.

Or, in other words, “self-hosting is more secure given the option” sounds kind of like “writing your own software is more secure”.

This project is aiming to create the most secure and private chat app. It will heavily depend on how you use it. Here are some reccomended security optimizations/advice to keep your data secure and private:

• Use a self-hosted instance of the app.
• Use a VPN to protect your data from being intercepted.
• Only connect to trusted peers.
• Validate public key hashes.
• You and your peer should use a secure device/os/browser with the latest updates.
• use general security practices like not sharing sensitive information, not clicking on suspicious links, etc.

These recommendations are bizarre.

• Is it really P2P if you need to a host your own instance?
• Use a VPN? So a company can now track you instead of the ISP?
• If it’s aiming to be safe, then why not share sensitive information?

If you want secure and private, then I would first look at Session.

Discord also works poorer in Linux

Certainly not Linux’ fault if developers write shitty Electron apps and then put a bunch of OS-specific stuff in it.

Also, try Vesktop? I like that I can customize my experience a little more with the plugins.

Snap

All my homies hate Snap.

Haven’t watched the video, but I think just the conversation this created ended up being interesting to me. A handful of extra views won’t do any harm.

most of the the Arch cult forget to mention that

The “Arch cult’s” holy book, the ArchWiki, states the following pretty clearly:

Warning: AUR packages are user-produced content. These PKGBUILDs are completely unofficial and have not been thoroughly vetted. Any use of the provided files is at your own risk.

Mention of one’s use of the AUR for their needs doesn’t need to come with a disclaimer.
People who don’t read or don’t use their brain are going to keep not doing so, regardless.

That probably counts as a privileged page, as in something uBlock Origin can’t access or modify.

Mozilla has probably been running another “experiment”, meaning not every user is affected. In the past they claimed it’s not advertisements because they are “continually looking for more ways to say thanks for using Firefox”. (Bullshit.) If you go to Settings > Home, you disable anything you don’t want to see, or just set your home page to a blank page, period.

JavaScript is already sandboxed. You can only execute functions where there is an actual API defined by the browser to do so, for example Date.getTime(). There is / should be no way to get, say, your device ID. (With the exception of unpatched exploits that allow executing arbitrary code. But keep in mind browsers are likely one of the if not the most security tested software.)

What you linked to here appears to specific to Google Tag Manager in a way that I don’t fully understand, but is not related to how websites usually execute JavaScript code.

Can you link to a source that confirms this information can be collected with JavaScript (with browser comparison, ideally)? That seems outrageous if it was actually possible.

What is meant by “sensitive information” here? Browsers can’t just willy-nilly access your local files or something like that. The one thing I can think of is using JavaScript to collect information that can be used to identify you. (Is that “sensitive”? I’d put that in “identifying information”.) My honest suggestion is to keep using NoScript and just allow as few domains as possible. The next best option is to stop using websites that break without JavaScript when there’s no reason why they’d need it.

I can imagine there being a plugin that spoofs some common ways that allow sites to identify you cross-sessions / browser / websites without your consent, but blocking JavaScript (by default) is likely one of the best ways to reduce the amount of information collected about you. When you do find such a plugin, check out one of the “browser fingerprint” testing sites to see how unique your fingerprint is.

(That is, if I even understood the request properly in regards to the “sensitive information” bit.)

There is something called “local storage” that allows applications to store more information than just a cookie. Cookies are sent to the server, while local storage, as the name implies, stays local. (That doesn’t mean that this data can’t be sent to the server via JavaScript.) But local storage makes it possible to make 100% offline applications if the whole webpage is cached / downloaded (assuming no online functionality is required).

edit: As for deleting this, if I click on the lock icon in the address bar in Firefox, I have an option to clear cookies and site data for the current site. I assume the “site data” is the local storage I mentioned. If you’re using a Chrome based browser, you can probably google how to do the same thing.

From what I read online, Matrix is not very good with its federated moderation tools. Apparently, a quirk of it can cause the state of a federated channel to reset in time, thus also undoing removing of messages. Here is a blog post criticizing Matrix.

I can also recommend the NoScript extension.

It breaks a lot of websites – which you then have to unbreak by re-allowing scripts for certain domains, temporarily if desired – but you end up getting a better feeling of how bad the web has become when you come across places that want to load scripts from dozens or more of different domains. Like, you’re intending to tell how many other parties that I’ve visited this website?

I was editing my comment as you were responding. Check the issue on GitHub I linked in the edit, and maybe thumbs it up for visibility. One of the commenters mentions using a third-party tool but I’m not sure the one they linked to can grab posts. In theory another one might exist to dump your post data.

Which service? Mastodon has a built-in export functionality in preferences.

I can’t find such an option on Lemmy, but you should be able to do a GDPR request for your information as a last resort.

edit: Non-post data / user settings can be exported (and imported!) but posts are a separate issue. See this open issue.

A lot of contributors of FOSS projects make small changes that aren’t copyrightable.

The real question is not what the algorithm pushes to you, but whether their moderation actually bans bigots and removes their posts. Any other instance would lose their “right” to federate with a queer-friendly instance if they didn’t do that, so why would Threads get an exception?

Isn’t “queer friendly” and “federates with Threads” an oxymoron?

I don’t think that’s how it works and it would likely not be legal. By explicitly blocking Threads, you make a big statement about not wanting your instance’s posts to show up there. Also from a technical standpoint, I don’t think a “middle-man” instance will push posts from another instance to a third one. You’d have to explicitly scrape data that’s not available via the API. Please correct me if I’m wrong.