Hans-Christoph Steiner @eighthave@librem.one

Recommendation engines based on tracking individual users' behavior will always be dangerous. They are fatally flawed and not beneficial to humanity, even if they are free software and publicly audited. They inevitably result in someone invisibly controlling many others as they are in the process of thinking. That said, they will always be with us, so we must push for regulation of how they are used. The standard #Mastodon experience does not use such algorithms, but they are coming soon.

This level of vigilance is hard, so we have added another layer of defense in the upcoming #FDroid client v1.16 release, currently in beta. We've moved the database to be based on #Room and its built-in #security measures, then had that new code audited https://f-droid.org/2022/12/22/third-audit-results.html 2/2

If you want to see a real world attempt at adding a #SQL #injection #vulnerability to an #Android app via merge request, take a look at https://gitlab.com/fdroid/fdroidclient/-/merge_requests/889#note_506478642 1/2

I just remembered a wonderful feature in #Android that has been broken by #security features: it used to be possible to do a parallel install of GNU/Linux on Android devices. #SecureBoot features are of course important, but they do come at a cost. Android's #VerifiedBoot does have some nice properties that make the devices pretty resilient. It is equally important to recognize that security is not the goal, but part of the process. A brick will always be more secure than any computing device.

#BillGates biggest legacy will perhaps be that he built a #monopoly that delivered crappy #software for so long, that a bunch of idealists, volunteers,and kids were able to create the #FreeSoftware movement which the vast majority of companies have now signed on to. Using #OpenSource is the default now in software development, there is almost no major software that is purely proprietary. Converting open source to free software is the next struggle, freedom is an essential aspect for the future

#Debian and #FDroid require signature verification, and #FDroid is built on top of #Android's APK signing. This improves things a lot but does not mean they are immune. Debian and F-Droid repos can still override packages lower priority repos. It could make sense to have a "no overrides allowed" setting, but that would restrict useful features. Maybe F-Droid could implement "no new signing keys when overriding" rule by default, I wonder how much that would break what people are doing now? 2/2

#Decentralized #software repository systems like #npm #maven #rubygems #pypi etc have key issues that make them hard to decentralize properly: solid verification is optional, one repo can override packages from another, and the tooling makes it hard to see which repo was actually used. #MavenCentral has additional measures which make it more trustworthy, but if devs add repos, those can still override it. #Gradle verification helps a lot when using Maven repos but does not solve everything 1/2

Since I was an adult, I've had big swings in income, my lowest year was about 1/8 of my highest. This is by choice mostly, so I'm very lucky. It gives me perspective, and actually I was usually happier when I had less money and more time, though the insecurity of the lean years was tough. A small, steady income and housing would be the ideal. I also consumed much less in the lean years, and this article about going off grid reminded me of the benefits of a simpler life https://arstechnica.com/science/2023/01/i-disconnected-from-the-electric-grid-for-8-months-in-manhattan/