• 23 Posts
  • 304 Comments
Joined 9 months ago
cake
Cake day: February 10th, 2024

help-circle


  • The security provided by a browser is constantly changing, as the vulnerabilities, attacks, and countermeasures are constantly changing. It’s a cat-and-mouse game that never ends.

    The privacy provided by a browser would be difficult to measure, since it depends a lot on browsing habits, extensions, code changes between versions, etc.

    There’s no good way to calculate a metric for either type of protection, and even if there was, the metrics would be obsolete very quickly. For these reasons, I wouldn’t have tried what you attempted here.

    However, there is a very simple way to compare the major browsers on privacy and reach a pretty accurate conclusion: Compare the developers’ incentives.







  • Unfortunately, I don’t think D is good enough to prove your point. From your follow-up comment:

    A language that for all intents and purposes is irrelevant despite being exactly what everyone wanted,

    As someone who uses D, I can attest that it is not what everyone wanted; at least not yet. Despite all the great things in the language, the ergonomics around actually using it are mediocre at best: Several of its appealing features quickly turn it into a noisy language, error messages are often so obtuse as to be useless (especially with templates and contracts in play), and Phobos (the standard library) is practically made of paper cuts. Also, the only notable async support is a fragile mess, and garbage collection is too deeply embedded into both the stdlib and the ecosystem.

    (To be fair, D could be vastly improved with better defaults and standard library. That might happen in time, as Walter and the other maintainers have shown interest, but it’s just wishful thinking for now.)

    Also, D is an entirely different language from C++, and as such, would require code rewrites in order to bring safety to existing projects. It’s not really comparable to a C++ extension.



  • Given how long and widely C++ has been a dominant language, I don’t think anyone can reasonably expect to get rid of all the unsafe code, regardless of approach. There is a lot of it.

    However, changing the proposition from “get good at Rust and rewrite these projects from scratch” to “adopt some incremental changes using the existing tooling and skills you already have” would lower the barrier to entry considerably. I think this more practical approach would be likely to reach far more projects.




  • There is no privacy-focused PayPal alternative in the US, in part because US money transfer laws and policies (e.g. Know Your Customer) directly oppose privacy.

    However, there are a couple of projects in development that might eventually lead to something less bad for privacy than PayPal is:

    • GNU Taler, if they ever get any exchanges, and they either figure out how to mitigate the high fees for wire transfers or use some other transfer method when people make small payments. (Their plan to use batch wire transfers won’t help until the exchanges get a lot of adoption and frequent use. Of course, high fees discourage adoption and use, so this might not ever happen.)
    • FedNow, if banks ever use it to build person-to-person payment services instead of just using it for themselves and their business customers.

  • The rest of the sentence you truncated points out forwarding services. Yes, others exist beyond the four I mentioned, of course.

    Edit to clarify: Your “it doesn’t” argument is that you can use forwarding from other domains that you own. Indeed you can, but that’s not a counterargument, because those are forwarding services. They do exactly what I described: the same thing as the example forwarding services that I pointed out in my original comment. You still have to maintain the them, as well as maintain the extra domains.



  • The correct fix is to get the site maintainers to stop rejecting email addresses based on the characters they contain. They shouldn’t be doing that. Sadly, some developers believe it’s an appropriate way to deter bots, and it can be difficult to educate them.

    If they won’t fix it, the workarounds are to either not use those sites, or to give them a different address. Unfortunately, the latter means having to maintain multiple email accounts, or forwarding services like Addy.io, SimpleLogin, Firefox Relay, or DuckDuckGo Email.



  • I no longer consider any email app to be okay for privacy if I can’t build it from source code. There are just too many opportunities and incentives for someone to exploit it. That could be the developer, or the maintainer of some obscure code library, or a company that buys one of them out, or an attacker who found a vulnerability. We no longer live in a world where it’s reasonable to think we’ll get privacy from communications software that we can’t inspect.

    Thankfully, we also no longer live in a world without options. There are more than a few email apps with nothing to hide. :)



  • mox@lemmy.sdf.orgtoPrivacy@lemmy.mlfixed
    link
    fedilink
    arrow-up
    13
    ·
    edit-2
    18 days ago

    People in privacy circles do talk about phone numbers, but it’s usually about them being collected in the first place. Most of us realize that corporate promises to delete them later are easily reneged and impossible to verify, and therefore next to worthless. We need laws forbidding data collection. We don’t have them yet.

    By the way, that title is useless to people who are browsing Lemmy to see which posts might interest them.


  • mox@lemmy.sdf.orgtoPrivacy@lemmy.mlfixed
    link
    fedilink
    arrow-up
    27
    ·
    edit-2
    18 days ago

    I don’t know why VPN providers promote themselves as like they are going to make your connection more private, everything is already encrypted (except DNS).

    It’s true that most popular web sites have moved to HTTPS, but even if all of them had, not all network traffic is web traffic. Also, even if someone uses the network only for web browsing, DNS is not the only privacy-relevant data that gets exchanged outside the HTTPS connection.

    You are just shifting the trust from your ISP to the people that run the VPN.

    Some people have reason to distrust their ISP more than their VPN provider, so this is a valid use case.

    VPN isn’t really comparable to HTTPS. The former protects all traffic, and with a relatively small attack surface, but only up to the VPN edge. The latter protects all the way to the network peer (the web server), but only web traffic, and with a massive attack surface: scores of certificate authorities in countries all over the world, any of which could be compromised to nullify the protection. They address different problems.