Mastodon Feed
slightlyoff@toot.cafe ("Alex Russell") wrote:
Part 2: Object Lesson
What hath we wrought? A case study of US public services and the JavaScript that broke them.
Mastodon FeedMastodon Feedslightlyoff@toot.cafe ("Alex Russell") wrote:
Part 2: Object Lesson
What hath we wrought? A case study of US public services and the JavaScript that broke them.
Mastodon Feedisagalaev ("Ivan Sagalaev :flag_wbw:") wrote:
Kubo and the Two Strings is a fantastic movie! Watch it if you haven't.
Mastodon Feedcollinsworth@hachyderm.io ("Josh Collinsworth") wrote:
This whole Apple/Patreon debacle reaffirms my belief that PWAs are actually the future.
With how much Apple skims (and Google), companies could boost profits by *over 42%* by just saying no to app stores.
It might sound wildly unrealistic right now, but the cracks are already showing.
No wonder Safari bends over backwards to undermine PWAs. It won't work forever though. It's too big a number for companies to ignore. Through migration or through mitigation (or both), the bubble will burst.
Mastodon FeedReblogged by rmrenner ("The Old Gay Gristle Fest"):
Jo@social.sublingual.xyz ("Sublingual Multimedia") wrote:
"Cya later loser, I'm off to cruise ..... Utopia 🖕"
Jude Law as Johnny Utopia in "Cruising Utopia: The Then and There of Queer Futurity: The Movie"
Mastodon FeedReblogged by collinsworth@hachyderm.io ("Josh Collinsworth"):
mattwilcox@mstdn.social ("Matt Wilcox") wrote:
Do Americans realise how absolutely insane the very concept of “purging a voter registration list” is? You have to *register to vote*? What are you even talking about?
Are you a citizen? Then you should automatically get a vote. There isn’t anything to administer. You live there. The government serves you; not you it. Voting isn’t supposed to be a privilege, or reward.
The obvious abuse vector that any system other than “all citizens vote” becomes is astounding.
Mastodon FeedReblogged by cstanhope@social.coop ("Your friendly 'net denizen"):
genehack@dementedandsadbut.social wrote:
Anybody aware of a federated Meetup alternative? #lazyWeb
Mastodon Feedcstanhope@social.coop ("Your friendly 'net denizen") wrote:
I'm listening to Blondie's "Picture This" and I hear Harry mention pocket computer, and I'm like, "A pocket computer? In 1978? What is she talking about? A calculator? Some sort of non-electronic computing device like a slide rule or wheel?" :thonking:
Mastodon Feedcstanhope@social.coop ("Your friendly 'net denizen") wrote:
That's what's on my mind as I listen to the album. 😆
Also, I didn't know there was some creepy background vocals on "One Way or Another".
Mastodon Feedcstanhope@social.coop ("Your friendly 'net denizen") wrote:
Debbie Harry's little growl in some of the songs off "Parallel Lines".
Mastodon Feedslightlyoff@toot.cafe ("Alex Russell") wrote:
For the past few weeks I've been working on a post (now a series) that investigates what JavaScript-based frontend development has done to these, the least of our brothers.
Today, Part 1: The Landscape
https://infrequently.org/2024/08/the-landscape/
Subscribe to the RSS feed for the rest of the series as it comes out.
Mastodon FeedGargron ("Eugen Rochko") wrote:
A #blahaj cocktail for the boy.
Attachments:
Mastodon FeedReblogged by cstanhope@social.coop ("Your friendly 'net denizen"):
kwf@social.afront.org ("Kenneth Finnegan") wrote:
Fucking FINALLY. Admin local DNS namespace! https://www.theregister.com/2024/08/08/dot_internal_ratified/
Mastodon Feedcstanhope@social.coop ("Your friendly 'net denizen") wrote:
One thought I have is a memorial day where engineering failures are recounted along with the lessons that were extracted that prevents or mitigates future failures. Something to keep us humble, remind us of the seriousness of the work, and reinforce the hard lessons of the past.
Mastodon Feedcstanhope@social.coop ("Your friendly 'net denizen") wrote:
Learning about the 1937 school explosion in New London has me thinking about ways people involved in engineering (using a *very* inclusive definition of that term) could build and maintain a culture of care and safety outside of laws, regulations, and professional societies as one bulwark against regulatory capture and capitalist greed.
Mastodon FeedReblogged by jsonstein@masto.deoan.org ("Jeff Sonstein"):
NewsDesk@flipboard.social ("Flipboard News Desk") wrote:
"New preliminary data from major U.S. cities shows a sharp drop in violent crime in the first half of the year — more than 25% in some communities — as the COVID-era crime wave recedes."
@AxiosNews reports: "The drop in violent crime puts a serious dent in one of the most frequently used lines of attack by former President Trump and his allies, who have sought to tie Democrats to the issue since 2020."
Mastodon FeedReblogged by jsonstein@masto.deoan.org ("Jeff Sonstein"):
UnicornRiot ("Unicorn Riot") wrote:
The 90th Anniversary of the 1934 Truckers’ Strike Honors Minneapolis’ Militant Labor History
Union members, labor leaders, and descendants of the 1934 Truckers’ Strike honor the 90th anniversary of the historic strike in south Minneapolis.
Mastodon FeedReblogged by jsonstein@masto.deoan.org ("Jeff Sonstein"):
theintercept@journa.host ("The Intercept") wrote:
The U.S. just resumed sales of bombs and missiles to the Gulf state, which still owes $15 million for jet fuel from its war on Yemen. https://theintercept.com/2024/08/12/saudi-arms-sales-yemen/
Mastodon Feedisagalaev ("Ivan Sagalaev :flag_wbw:") wrote:
My #Flickr personal feed have broken today in a funny way: it's empty save for a single photo from one of about 50 people I follow, posted 7 years ago. The photo is a nude portrait of the account's author :-)
Thanks Flickr, I guess? :-)
Mastodon Feedpzmyers@octodon.social ("pzmyers 🦑") wrote:
The End. No more summer.
https://freethoughtblogs.com/pharyngula/2024/08/12/doom-doom-dooooom/
Attachments:
Mastodon Feedjsonstein@masto.deoan.org ("Jeff Sonstein") wrote:
any informed opinions on this analysis?
https://www.brookings.edu/articles/how-african-governments-can-regain-the-trust-of-their-citizens/
Mastodon Feedjsonstein@masto.deoan.org ("Jeff Sonstein") wrote:
amusing
Mastodon FeedReblogged by isagalaev ("Ivan Sagalaev :flag_wbw:"):
Waxingtonknee@mastodon.org.uk ("Waxing and Waning") wrote:
@isagalaev I never left Firefox. I was there that day in '04 when we broke the 'most downloaded' in 24 hours record. I was there during the buggy years and I'm still here today, despite Mozilla's misguided attempts to get on the AI bandwagon.
If a website won't work on Firefox I won't give them my business. No my browser isn't out of date, your website has failed basic compliance.
Mastodon Feednadim@infosec.exchange ("Nadim Kobeissi") wrote:
Never mind, I found this. https://github.com/aadomn/aes
Mastodon Feednadim@infosec.exchange ("Nadim Kobeissi") wrote:
Are there any AES implementations out there that implement the S-Box lookup algebraically (GF(2⁸) byte inversion followed by affine transformation) so as to avoid the timing side-channels associated with table lookups? Performance not an issue!
Mastodon FeedReblogged by kornel ("Kornel"):
caseyliss ("Casey Liss") wrote:
This is so gross. 👎🏻 × ∞
When is Apple going to realize that rent-seeking anywhere and everywhere is not only a bad look, but will get them regulated straight to hell?
(And at this point, it's more than deserved. Bring it on.)
https://news.patreon.com/articles/understanding-apple-requirements-for-patreon
Mastodon FeedReblogged by kornel ("Kornel"):
kate@fosstodon.org ("Kate Morley") wrote:
From the Guardian: “Banksy has unveiled the eighth artwork in his animal-themed collection in London, a mural of a rhinoceros that looks as though it is climbing on top of a car.”
Yes, “climbing on top of”:
Attachments:
Mastodon Feednadim@infosec.exchange ("Nadim Kobeissi") wrote:
Addendum:
Signal should be a driver of new cryptography like it once was. Its initial success and influence stemmed from its pioneering approach to cryptographic innovation. The development of the Signal Protocol, which now underpins the security of not just Signal but also other major platforms like WhatsApp and Facebook Messenger, was a groundbreaking achievement that set a new standard for secure communication. However, in recent years, Signal has lost its momentum as a driver of new cryptographic methods and standards.
The real cost isn't in making bad decisions: it's in not making good ones. The consequences of inaction can be just as severe, if not more so, than the consequences of making poor decisions. Signal’s current trajectory reflects a dangerous complacency, where the organization seems more concerned with avoiding mistakes than with seizing opportunities for improvement. This mindset has led to a failure to address emerging threats proactively and to capitalize on opportunities to enhance the platform’s security and user experience.
When an organization like Signal hesitates to innovate or to implement necessary changes due to fear of potential backlash or technical challenges, it creates a vacuum. This vacuum is quickly filled by adversaries who exploit the weaknesses Signal has failed to address, or by competing platforms, such as Telegram, that offer better UX but infinitely worse security guarantees.
Mastodon Feednadim@infosec.exchange ("Nadim Kobeissi") wrote:
Regarding my recent critiques of Signal:
Over the past few months, I have not hesitated to voice strong criticism against Signal, a platform that many in the privacy and security community regard as one of the most robust tools available for secure communication. My critiques have centered on what I perceive to be significant technical and institutional failings—issues that are not merely theoretical but have tangible implications for the security and privacy of millions of users worldwide. However, despite these criticisms, I must emphasize that Signal remains, in many ways, one of the best solutions we have. This essay seeks to balance my harsh criticisms with an acknowledgment of Signal's continued importance while underscoring the urgent need for accountability and reform within the organization.
The main issue with Signal today is not the technology itself but the institutional rot and lack of accountability that have taken root within the organization. The security community has been too deferential, too willing to give Signal a pass on issues that would not be tolerated from other organizations. This must change. Signal needs a watchdog—a mechanism of external accountability that can hold the organization to the high standards it claims to uphold.
Technical Failings: A Case of Mismanagement, Not Ineptitude
My concerns about Signal's technical direction are rooted in specific, actionable issues that the organization has, thus far, handled poorly. The implementation of usernames, for example, was executed in a manner that arguably undermines the privacy standards Signal is supposed to champion. Rather than adopting a more privacy-preserving approach, Signal opted for a method that, while functional, exposes users to potential risks that could have been mitigated with better design choices. More specifically, Signal tied usernames to phone numbers, which gives its users a false sense of safety by encouraging them to distribute their usernames online, not necessarily realizing that their phone numbers and revealable by a simple legal request tied to that supposedly pseudonymous username.
Moreover, the degradation of Signal's security standards over time is troubling. As new cryptographic attacks emerge, one would expect Signal to be at the forefront of addressing these vulnerabilities. Instead, we've seen a slow, sometimes dismissive response to these threats despite their practical implications and despite them being presented at top-tier security conferences (one random example: https://cs-people.bu.edu/kaptchuk/publications/ndss21.pdf) which not only erodes trust but also puts users at unnecessary risk. The recently handling of Signal Desktop's security weaknesses—initially radically downplayed and then suddenly addressed when public pressure mounted—is a stark example of this reactive, rather than proactive, approach.
Signal's approach to censorship circumvention further illustrates this trend. The reliance on random people running NGINX proxy Docker containers, advertised haphazardly by volunteers on social media, lacks the rigor and foresight expected of a platform that markets itself as a bastion of secure communication. Without a proper web of trust, these solutions are not only ineffective but potentially dangerous.
Institutional Failings: Accountability and Transparency in Decline
Institutionally, Signal's trajectory raises serious concerns. The organization's repeated appeals for donations, juxtaposed against a $1M USD compensation package for its new president, Meredith Whittaker (right as she wrote blog posts begging for users to donate) and a staggering $50M loan, suggest a misalignment of priorities. Signal's status as a 501c3 nonprofit should imply a commitment to frugality and transparency, yet the financial decisions being made seem more aligned with corporate self-interest than with the values of the open-source community.
The composition of Signal's board of directors exacerbates these concerns. When leadership surrounds themselves with personal friends, including individuals with controversial backgrounds especially in global activist circles, it not only undermines trust but also raises questions about the governance and decision-making processes within the organization. Signal increasingly appears to be more focused on the personal brand and career advancement of its leadership than on fulfilling its core mission.
A Call for Constructive Criticism and Vigilance
Despite these criticisms, it is important to recognize that Signal remains one of the few tools we have that can provide secure and private communication in a world where such capabilities are under constant threat. The platform's underlying technology, when properly implemented and maintained, is still among the best available. But this does not mean we should turn a blind eye to its flaws.
It bears repeating: the main issue with Signal today is not the technology itself but the institutional rot and lack of accountability that have taken root within the organization. The security community has been too deferential, too willing to give Signal a pass on issues that would not be tolerated from other organizations. This must change. Signal needs a watchdog—a mechanism of external accountability that can hold the organization to the high standards it claims to uphold.
In conclusion, while my critique of Signal has been harsh, it comes from a place of genuine concern for the platform's future and its role in the broader privacy and security ecosystem. Signal is too important to fail, but it is also too important to be allowed to continue on its current path without scrutiny. As users, donors, and members of the security community, we have a responsibility to hold Signal accountable, to demand better, and to ensure that it lives up to the promise of secure, private communication for all.
Signal can and should be better. It is not too late for the organization to course-correct, but that will only happen if we refuse to let our respect for the platform blind us to its flaws. Constructive criticism, combined with a commitment to transparency and accountability, is the only way forward.
For reference, my recent threads on Signal:
- Today's thread on Signal's censorship-circumvention strategy: https://x.com/kaepora/status/1822884292596224393
- Critiques of Signal's new leadership: https://x.com/kaepora/status/1811336288521347109
- Research publications that Signal has downplayed and ignored: https://x.com/kaepora/status/1810613043685888399
Mastodon FeedReblogged by zack@toot.cafe ("Zack"):
0x1C3B00DA@stereophonic.space wrote:
And there was already prior art on this that the #mastodon team ignored. That's #mastodev for you :blobokhand:
https://indieweb.org/rel-author#How_to_link_to_ActivityPub_followable_profile