Kyle Rankin @kyle@librem.one

I elaborate on some ways to protect the digital supply chain while borrowing metaphors from the food industry in this post: https://puri.sm/posts/protecting-the-digital-supply-chain/

This is why projects like Reproducible Builds are so important. Basing all of your security on a company's signature on proprietary code is too risky.

https://www.wired.com/story/barium-supply-chain-hackers/

A animal with a history of abuse will often flinch when a well-meaning new owner tries to pet it. It takes a lot of time and effort to rebuild trust and security.

The emotional damage in the #FOSS community from decades of abuse by exploitative companies isn't acknowledged nearly enough, and is hard to overcome.

@gbryant @purism Phone/desktop app or web-based?

Baby Shark is *just* different enough from Y'all Ready For This that it's technically a different riff. #dodododododo

@phessler We hear you, and we are addressing your concerns.

This was the backer milestone I was waiting for! #LeetbremOne

@downey As a general rule we only run stable released upstream versions of things. This was a special case because we needed specific functionality.

We've published a blog post with all of the details of this morning's security bug in Librem Chat and our response. https://puri.sm/posts/underscoring-our-transparency-first-librem-one-bug-report/

@rae As an update, we've fixed the bug and chat is back up. I am writing up a full report and will publish it after the development team is able to distribute a security patch of their own. Thank you for your responsible disclosure!

OK, so that's creepy: "The online tool allows everyday supporters to contribute to the campaign’s voter database by logging names and background information of anyone from a family member to a stranger met at a bus stop." #privacy
https://www.nbcnews.com/politics/2020-election/bernie-sanders-2020-campaign-unveils-app-increase-its-voter-database-n999206

This is arguably even more impactful than NIST's upgraded password policy recommendations, because far too many in IT ignore modern #infosec thought on password policy (among other things) and just apply the Microsoft recs. #defaultsmatter https://arstechnica.com/gadgets/2019/04/password1-password2-password-3-no-more-microsoft-drops-password-expiration-rec/

I used to be a sysadmin, I used to fool around
But I couldn't take the punishment and had to settle down
Now I'm in security, and my OS is rare
You might think I'm crazy, but I don't even care
Cuz Qubes can run apps in VMs

It's hip to be square.

Apple marketing: We take privacy very seriously.
Apple stores: We install facial recognition and file a court summons based on computer matches.

https://www.cnet.com/news/teen-hits-apple-with-1b-lawsuit-over-facial-recognition-arrest/

Hello World!