Hans-Christoph Steiner @eighthave@librem.one

Tell the U.S. Senate: RISAA does not reform mass surveillance — it greatly expands who can be surveilled and why. https://act.eff.org/action/tell-the-u-s-senate-stop-risaa-the-fisa-mass-surveillance-expansion

Lucky Spain. Three eclipses in three years. 🫠

#eclipse

Every time I do tech support for my family I get very angry about people who whine about lacking "tech literacy".

90% of the stuff I have to teach them is how to navigate manipulative software and dark patterns. This has nothing to do with tech, but with capitalism. Tech is not complicated, it is just made maximally confusing on purpose to remove agency.

Better tech ed won't fix this.

We need your help! Call your senators and tell them to vote NO on reauthorizing and expanding Section 702. https://eff.org/risaa

Welcome to Stephen Farrell as #curl commit author 1260: https://github.com/curl/curl/pull/11922

"Just search for 'Linux Foundation Events' in your app store to find our brand new [proprietary?] AI-powered app!"

- Jim Zemlin @ #OSSNA

#OSSNA24 #FDroid #hypocrisy

🕵️🔎🔎📱 The “repackaged” EU Council version of #chatcontrol still includes #MassSurveillance & serious threats to #encryption. Fortunately 🇩🇪🇵🇱🇫🇷🇦🇹🇳🇱🇪🇪🇫🇮 have acknowledged the severe concerns. We call on EU Member States to reject this dangerous position.
https://epicenter.works/content/open-letter-eu-councils-chatcontrol-is-still-mass-surveillance-undermining-encryption

Come work with us at @sovtechfund for a unique job opportunity where you'll be at the intersection of bug bounty programs and public interest.

As the BRP Manager, you'll spearhead our efforts to enhance bug resilience in FOSS projects, leveraging responsible bug bounty programs and more to make a meaningful impact in open source critical infrastructure.

Apply now at https://www.sovereigntechfund.de/jobs/bug-resilience-program-manager

(You're welcome to apply even if you don't meet 100% of the description, it's just a wishlist)

Major push to impose a U.S. site-blocking law. Nothing has changed since SOPA. Of course, lawful content would also be blocked https://arstechnica.com/tech-policy/2024/04/movie-industry-demands-us-law-requiring-isps-to-block-piracy-websites/ #Quad9

PSA: The panic button features built into F-Droid break when targeting newer Android SDK versions (e.g. #targetSdkVersion) due to new restrictions.

It might be possible to get them working again, but we currently do not have the bandwidth to maintain this. We welcome contributions to get it going again. Until then, removing the panic features looks to be our only responsible course of action. #CalyxOS includes built-in panic features like app removal, so that is a recommended replacement.

This week in #FDroid was published again.

You should read it if you're on Android 7 or older. For those on newer versions we have following tl;dr, but you're also welcome to read it all:

- 1.20 is in the making with even better repo handling
- custom Anti-Features will be on by default
- TetheredNet will be a new AF
- our website still has problems with localization
- Bunny Media Editor is new
- Secreto is now known as Sekreto
- 2 removals, 10 additions and 206 updates

https://f-droid.org/2024/04/04/twif.html

Risk of socially engineered backdoors in critical software seems like an indictment of open-source projects, but it could happen anywhere, EFF’s Molly told @theintercept - in fact, this one was found only due to the project’s open nature.
https://theintercept.com/2024/04/03/linux-hack-xz-utils-backdoor/

Bullying in Open Source Software Is a Massive Security Vulnerability https://www.404media.co/xz-backdoor-bullying-in-open-source-software-is-a-massive-security-vulnerability/

Some thoughts about attribution in the XZ backdoor, having just wasted so many hours digging into the details.

The email addresses used for a couple of years at least by the parties involved have absolutely *zero* trace in any kind data breach or database beyond Github/Gitlab, and maybe Tukaani and Debian and a few mailing lists.

Normally when I see this, the assumption is that we're dealing with a single-use or single-purpose email address that was created either for fraud or b/c someone is super paranoid about privacy.

The people in the latter camp who do this tend to have other tells that give them away, or at least *some* trace or home base in the online world. Especially if we're talking on the order of years using that address.

Either way, very few people do opsec well, and for every year you're operating under the same name, nick, number, email, etc you dramatically increase the risk of screwing up that opsec. And almost everyone does, eventually.

To see this complete lack of presence in breached databases once or twice in the course of an investigation is rare, but to find it multiple times suggests we're dealing with an operation that was set up carefully from the beginning. And that almost certainly means a group project (state-sponsored).