Like many problems with targeted ads, both Naviance, the platform, and college officials who use the platform to target applicants by race, are at fault. Children aren't products. https://themarkup.org/machine-learning/2022/01/11/this-private-equity-firm-is-amassing-companies-that-collect-data-on-americas-children
The US State Dept's "Global Internet Freedom" funds (#OpenTechFund #StateDRL #USAGM and more) now require #OpenSource: section 7050, "Funds... may only be made available to support open-source technologies that undergo comprehensive security audits...".
With #Debian, it is now possible to get all updates from official HTTPS sources. In combination with other work from the apt developers, this improves privacy and provides backup security https://guardianproject.info/2021/12/08/debian-over-https/
The FBI produced this nice chart comparing what kinds of privacy leaks the various messaging apps have.
One of the hazards of #TLS #ECH is that a deployment could end up leaking as much information as a non-ECH TLS connection if the ECH Config in DNS is only associated with a given domain. https://blog.cloudflare.com/handshake-encryption-endgame-an-ech-update/#focusing-on-deployability
#Android apps can track users based on their wallpaper: https://lwn.net/Articles/873921/ https://fingerprintjs.com/blog/how-android-wallpaper-images-threaten-privacy/
#Debian created an ecosystem where the software available there is reviewed and trusted, so the system can prioritize flexibility over security. In #Google Play, there are many apps we feel forced to use, despite knowing they are unethical or are tracking us. Google responds by locking down #Android to reduce data leaks, which also reduces the system's flexibility. #FreeSoftware puts the user in control so we can build user-friendly systems without being forced into bad decisions.
I'd love to see data on what verified boot actually stops. The ideal malware implants itself at the lowest level possible. Is there good public data on these kinds of exploits on #Android #Debian #Windows #iOS etc? Does standard spyware do that? Writing to /system requires a root exploit, lots of malware never gets root. How often there are vulns in #VerifiedBoot itself. Here's a real world full #exploit of verified boot:
Does anyone know how to query the system for information about Trichrome Libraries https://chromium.googlesource.com/chromium/src.git/+/refs/heads/main/docs/android_native_libraries.md#Trichrome? They seem to be installed as APKs, but the regular way of querying for app metadata does not work. For example, is there a separate concept of "Version Code" for Trichrome libraries?
EU-Commissioner Johannes Hahn on 'Public Money? Public Code!' https://peertube.social/videos/watch/20512955-f554-428e-a563-abc74dc806c8
Anyone know what #google ULR is?
"Suppose a user has disabled permissions to, say, Google Maps for Mobile (GMM). With client-side location, GMM will not get location, as the user intended However, they can still get a place card (e.g. Riddler) via ULR-->████-->GMM server--> GMM client. (URL has GmsCore's location permissions, not GMM's). This seems like a bypass to Android's permissions model."
NetCipher v2.2.0-alpha released! Supports the new TorServices app; adds new libraries for enabling Tor/proxying with Conscrypt and WebViews. Get them on Maven Central:
If anyone is looking for a #ReproducibleBuilds #Java / #Android project to hack around with, jtorctl now builds with #Gradle (from gradle.org or #Debian), #Maven, and #Bazel with sketches of Ant. The idea is that if all the build tools make the same JAR, no need to trust the build tool.
New AI law proposal agrees with the risks and harms of biometric mass surveillance but *fails* to properly ban it.
Companies and authorities aren't prohibited from these practices and the law enforcement ban has way too many exceptions. 🤦
61 MEPs from different political groups just asked the EU to ban biometric mass surveillance, days before @EU_Commission@twitter.com proposes new laws on AI.
People, apps and code you can trust