• 1 Post
  • 21 Comments
Joined 1 year ago
cake
Cake day: June 22nd, 2023

help-circle

  • This seems incredibly interesting, but the idea of a ‘general purpose syncing service’, in the way he describes it, makes my head scream’security concern’. In general the way it’s described the format is not fixed for these services so your data might as well be encrypted in any arbitrary way I think?

    But knowing this wouldn’t this kind of general purpose syncing service need some way of identifying what data it is even syncing? Unless you encooperate something grand like the signal protocol (as in encrypted anonymous messaging) you d always run a security risk if the service you use for syncing is not self-controlled?

    If anyone has more insight on this I’d be very interested, it seems like a very good concept.

    It sounds to me like anything other than p2p local syncing with some protocol is a confidentiality no-go.






  • In general the article seems to be a summary of current legislative actions that are ongoing between big tech and EU. Though in the article it’s worded with the much more fitting ‘game of chicken between EU and Big Tech’ rather than something like the title, but I guess “drop dead has a better ring to it”…

    I general the article has a lightly optimistic tone, which I very deeply hope holds true.



  • […]Plants vs. Zombies Jordan Adams, and Director Partnerships at EAX Matthew Angeleri.

    Adams would also send female coworkers pornographic videos and even reference them in EA Slack conversations

    While that seemed like an act of goodwill, Angeleri privately sexually harassed said female coworkers and even followed it up with videos of himself having lewd acts performed on himself.

    Why the article can’t just state what the allegations are and at whom is just annoying, so here you go.

    What confuses me a bit is the sentence just before the allegations to Angeleri:

    As for Matthew Angeleri, he invited his female coworkers to stay at his home with his wife while visiting Vegas where they were given free room and lodging. While that seemed like an act of goodwill, Angeleri privately sexually harassed said female coworkers and even followed it up with videos of himself having lewd acts performed on himself.

    Like… What? What is the logical connection between these two sentences? There could be months or years between those two events? How do these two relate? This reads as two completely separate events. So one could just be an act of goodwill and afterwards he decided to be a prick. Or, first the was a prick and then felt bad and offered the coworker a place to stay?

    And if the two events were concurrent that makes it immensely more creepy.







  • /u/Chainweasel@lemmy.world explains this well, though I got a different take on the analogy.

    Imagine you are trying to put air into a deflating balloon that’s about to ‘loose form’ that’s essentially what you are trying.

    Put just enough air (energy/mass) into the star and it will stay stable, loosing as much as you put into it.

    Too little and the star will dissolved, in this example you’d fully absorb it.

    Too much and you are essentially infusing a star with so much mass that it explodes all over again.

    If you are trying to stabilise a star this way, ideally, it would never even begin to go nova.




  • Here is a documentation link of chromiums conceptual application layer: https://www.chromium.org/developers/design-documents/displaying-a-web-page-in-chrome/ which clearly shows the core of chromium (especially rendering, and API infrastructure by w3) is done via WebKit through a Webkit Port and a glue layer for type compatability.

    I never said WebKit and Chromium are the same engine, mainly because chromium is not an engine at all. WebKit is a browser engine and is the core of chromium, chromium is a browser core, but not an engine.

    Where do you get the information from that most fingerprinting is done in JS ? Because, in the end, the data has to be sent to a server to be processed (even if the fingerprint is aggregated in a cookie). Which in turn would just be another way of saying its on the backend.

    If i do a JS request to the backend bc i want to see album X and its cover, i request the resource from the server. There is no way around this. If the actions I took are saved on a local cookie or the server directly logs the request makes 0 difference in the end as to process the logged action it would’ve to be sent to the server anyways; else there is no point in logging.

    Here is mozillas docs for fingerprinting: https://developer.mozilla.org/en-US/docs/Glossary/Fingerprinting As can be seen the tab itself only has access to the APIs of the hardware down under, which can in turn not really be trusted as any linux user can easily spoof these. Sure you can be identified, as in your browser. But nothing about your hardware. I just did that test and all the hardware info is miles off.

    I am not sure what point you are trying to make.


  • I’ve been using e os every since the fairphone 4 hit the market (and I got it quite fast). I think it’s absolutely great. A caveat which is funny to me and I like: Since the playstore service is missing, and micro G sinks every server request to Google, in app purchases via those systems are simply not a thing. Personally I love this si ce I have never needed or want to buy anything from any app; but it’s incredible to me that any ad that even tried to load, can’t


  • This is true for the desktop/mobile app application I aggree with you there since its a CEF native on desktop and mobile apps have these kinds of APIs. I very much disagree with the Web client (which admittedly my original comment didn’t mention at all, personally I mainly use the Web player)

    Since on Web it’s just a Website, all previously mentioned serve side tracking applies; but getting any hardware information through the sandboxing would break the browser security model and is not possible since there is no such web API. Web fingerprinting is one of the reasons apple (at least they keep bringing it up as a concern) is not keen on implementing the Web API for the luminance sensor on safari. Interestingly webkit (chromium core) does have the functionality which is why it’s behind a dev flag atm (https://developer.mozilla.org/en-US/docs/Web/API/AmbientLightSensor)

    Identifying hardware should not be possible according to the browsers security model.

    I should’ve phrased my question as ‘what advantage does spotube provide over Spotify premium in the browser’, after downloading it and trying it out I am guessing the biggest advantage is the download button and stuff like that? Though… I personally have no use for offline Musik nowadays.

    Edit: Sidenote: the Mozilla docs frequently mention that the user agent may be used to infer hardware/browser information, and therefore developers are encouraged so spoof it (and in general not to trust the information given)


  • Anything you do in the UI has some associated backend request (everything relevant at least). Search queries, loading albums, skipping, changing settings, anything is just a Web requ on their backend server which could still be collected. The custom ui does not save you from relevant data collection. Only thing potentially not getting tracked is empty navigation between tabs, but there is not a lot of info in tab switching