Guardian Project @guardianproject@librem.one

#Zoom on iOS is sending personal data to #Facebook https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account

We're starting another round of translation workflow improvements for websites working with #Weblate: this time the focus is taking the pain out of translating Markdown texts, this builds upon the work on the @fdroidorg@mastodon.technology website

https://guardianproject.info/2020/03/05/improving-crowdsourced-translation-of-long-form-text/

@bortzmeyer @Shaft @tania @fdroidorg@mastodon.technology @exodus @lenaki@mastodon.social @Jolivier
And of course, we're contributing back to Exodus as much as possible. My personal view is that Exodus should be the canonical database of all this stuff but I'm not sure they want the noise of this discovery process in their issue tracker.

@bortzmeyer @Shaft @tania @fdroidorg@mastodon.technology @exodus @lenaki@mastodon.social @Jolivier F-Droid and Exodus have been working together since 2017! https://f-droid.org/2017/12/14/new-collaborations-on-exposing-tracking.html

We are building upon Exodus' work, this is a vast project. Exodus is currently tracking libraries and domain names. Turns out, there are a number of other things that haven't been mapped out yet, like API keys and Broadcast Receivers.

#MachineLearning is proving to be quite #exploit-able, humans need to stay in charge, with #AI only as an assistant:
"Hackers stuck a 2-inch strip of tape on a 35-mph speed sign and successfully tricked 2 Teslas into accelerating to 85 mph"
https://www.businessinsider.nl/hackers-trick-tesla-accelerating-85mph-using-tape-2020-2?international=true&r=US

It has been interesting to dig into this, the vast #malware body of knowledge has gotten us started, but it isn't the same problem, so similar but different tools are needed.

#TrackingTheTrackers I'm digging into tools these days, #faup provides lookups if a string is a known domain name, and #ipgrep returns all strings that resolve to an IP address. The #ipgrep approach seems much more useful since it doesn't need a pre-prepared list of "known domain names", instead #DNS provides that

https://github.com/stricaud/faup
https://github.com/jedisct1/ipgrep

One murky area of #FreeSoftware is what the #mirrors do with the all the #metadata they inevitably collect. Big mirrors like https://mirrors.kernel.org/ have no apparent public #privacy #policy. Purdue PLUG https://plug-mirror.rcac.purdue.edu/info.html and FAU https://ftp.fau.de/datenschutz post theirs

#Privacy policies need not be dense legalese meant to confuse and obscure, @EFF's #DoNotTrack #Policy provides a well crafted, privacy promise for like minded organizations to adopt https://www.eff.org/dnt-policy

@fdroidorg@mastodon.technology thanks for shining a little light on #gradle

anyone ever seen a #maven API that lets you query by SHA256? Like start with the hash of a JAR, then see which repos it is on? #TrackingTheTrackers

@nicooo @fdroidorg@mastodon.technology Yes, a crowdfunding drive would be amazing! I could see a combined @exodus @fdroidorg@mastodon.technology project in a project for that. The only block is someone running the crowdfunding drive, as far as I can see.