Guardian Project @guardianproject@librem.one

The jury in Epic v. Google has delivered its verdict — and it found that Google turned its Google Play app store and Google Play Billing service into an illegal monopoly.

https://www.theverge.com/23994174/epic-google-trial-jury-verdict-monopoly-google-play

Also need to address Apple’s monopoly too. https://www.gov.uk/cma-cases/investigation-into-apple-appstore

https://ec.europa.eu/commission/presscorner/detail/es/ip_20_1073

1.2+ million downloads and a rating of 4.2 – a good indicator for a safe app in Google's #PlayStore? One should think so – until one takes a look at its #permissions (46, including access to quite personal data) and the number of KNOWN #trackers #ExodusPrivacy reports (28!!).

Just wow. Had to add that one to my app lists, as a warning example.

https://android.izzysoft.de/applists/category/named/office_contacts_callerid

Who Cares Who Delivers Our Notifications? https://wrily.foad.me.uk/who-cares-who-delivers-our-notifications

In addition, we strongly advise developers to encrypt their push notifications, recommending #WebPush (following RFC 8291, forget about this draft abandoned 7 years ago!) or to adopt a sync-on-push strategy (which is what Signal does).

@Mer__edith Here is one thing Signal could be doing that it is not: the Signal fork @mollyim has already implemented #UnifiedPush support, Signal can help there, or even integrate that work https://github.com/mollyim/mollysocket

@Mer__edith @unifiedpush @fdroidorg and since you mentioned the world, there are 1.4 billion mobile phone users in China without Apple or Google push. There are half a billion #Huawei users around the world who do not have access to Apple or Google push. #AppGallery devices are sold around the world, including here in Austria. Signal's stance on push really only works in North America. 2/2

@Mer__edith I respect the work that Signal has done, and Signal has been a great leader in pushing e2ee over the past 15 years. Signal can also do better on push. It is not a binary choice, other options provide much improved privacy with smaller hit on battery usage. @unifiedpush does that and falls back to Google push for devices that don't have #UnifiedPush built-in. @fdroidorg is also helping to get it integrated into #CalyxOS #LineageOS etc https://f-droid.org/2022/12/18/unifiedpush.html

1/

PSA: We've received questions about push notifications. First: push notifications for Signal NEVER contain sensitive unencrypted data & do not reveal the contents of any Signal messages or calls–not to Apple, not to Google, not to anyone but you & the people you're talking to. 1/

Molly now officially supports #UnifiedPush with a separate app, available for download on GitHub and F-Droid through Molly's FOSS repository. Say goodbye to relying on Google for #Signal push notifications. Setting up your MollySocket server is all you need to start receiving notifications. 📡 Big thanks to @S1m for making this possible! ❤️ https://github.com/mollyim/mollysocket

Unidentified governments are surveilling smartphone users via their apps' push notifications, a U.S. senator warned : https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/

That's why it's important to offer your users alternatives.

We invite you to nominate a FOSS project for the Bluehats prize. There are four prizes of €10.000 each, to be spent freely.

Bluehats are civil servants who promote the use and development of Free Software in public administrations.

The French public administration has established the Bluehats prize for maintainers of critical Free Software. To be eligible the software must be in use by at least one agency of the French administration.

https://nlnet.nl//bluehatsprize/2024/

Seems google/apple's push notifications services are regularly queried by state authorities for obtaining user data -- see this german #netzpolitik article https://netzpolitik.org/2023/push-dienste-behoerden-fragen-apple-und-google-nach-nutzern-von-messenger-apps/ --
#deltachat only uses apple's push notifications on iOS for "heartbeat" services -- otherwise it's too hard to ensure the app can show messages for their user (and many users are asking for tighter integration). On Android and Desktop platforms no push notifications are used or needed, also no heartbeat ones.

@dethos Use a Google- and Apple-free device and apps that respect privacy. I can recommend #CalyxOS for the system, and @Tutanota, #Signal, #Threema and others that have removed proprietary #push

Been a good day in #Brussels. Attending the #DigitalCompetitionDay event.

I believe that the Digital Markets Act (#DMA), has the potential to make a significant difference.

Explained a bit what I have experienced over the years with #Microsoft , #Apple and #Google.

Talked about the importance of not leaving holes through not designating products, such as #edge

Talked about the importance of regulating use of data. Data may be the new oil and oil is ruining the planet. We can allow use of data for services, without saying that the data can be used for profiling and marketing as well!

Got great feedback, so happy about that.

@EU_Commission @Vivaldi #Regulation

We couldn't be happier that one of the most recognized human rights organizations has adopted an onion service to provide greater online protections for those seeking information, support, and advocacy. Amnesty's choice to offer an onion version of their website underlines the role of this open source privacy technology as a vital tool in our shared work of advancing human rights.
🧅 amnestyl337aduwuvpf57irfl54ggtnuera45ygcxzuftwxjvvmpuzqd.onion

ℹ️https://blog.torproject.org/amnesty-international-launches-onion-service/

TOR support for Debian bullseye and buster have been marked End-of-Life (EOL). Consider upgrading to bookworm to continue receiving TOR support and updates. https://lists.debian.org/debian-lts/2023/11/msg00019.html https://micronews.debian.org/2023/1701658911.html?utm_source=dlvr.it&utm_medium=mastodon

Later today, I am finally going to live-present a conference paper again: "Anonymously Publishing Liveness Signals with Plausible Deniability", mostly by Michael Sonntag and in cooperation with Stefan Rass and me. The topic is a cryptographic protocol for verifying that whistleblowers and other secrets holders are still alive and well, that is, generating and verifying binary signals (without further information content) sent (semi-) regularly.

The most interesting aspects follow from the goal of plausible deniability: as a prover (whisteblower) or verifier, being able to plausibly claim to hold the respective other role or being part of an interaction that has already become inactive before, because stored data does not allow deciding either way when provided with the wrong decryption passphrase. Tools we use are Tor onion services and hash chains (totally not a Blockchain), prototyped as a Java library and Android app.

Details at https://link.springer.com/chapter/10.1007/978-3-031-48348-6_1, preprint soon so be available at https://www.digidow.eu/publications/.