Kyle Rankin @kyle@librem.one

So much drama in the SPC
It's kinda hard being T-O-double-D
But, he, somehow, someway, keeps on comin' up with Librem hardware every single day

He's got coders in the chat room buildin' a phone
They ain't leavin' till 6 in the morn (PST)
Now we gonna pick a license for this. GNU's up, closed's down while you other developers code to this.

Rollin' down the street, writin' free code, licensed for GNU, laid back, with my mind on the Librem and the Librem on my mind.

@ConnyDuck Sorry for causing you so much trouble over the past few days. I assure you we didn't have malicious intent and it was just a oversight in the process of this launch.

Outside of the notices that are in the application now, are there any places that you feel are missing appropriate attribution?

For what it's worth, we elaborate on the reasoning behind doing a fork for Librem One client apps here: https://puri.sm/posts/how-purism-works-upstream-and-gives-back/

I elaborate on some ways to protect the digital supply chain while borrowing metaphors from the food industry in this post: https://puri.sm/posts/protecting-the-digital-supply-chain/

This is why projects like Reproducible Builds are so important. Basing all of your security on a company's signature on proprietary code is too risky.

https://www.wired.com/story/barium-supply-chain-hackers/

A animal with a history of abuse will often flinch when a well-meaning new owner tries to pet it. It takes a lot of time and effort to rebuild trust and security.

The emotional damage in the #FOSS community from decades of abuse by exploitative companies isn't acknowledged nearly enough, and is hard to overcome.

@gbryant @purism Phone/desktop app or web-based?

Baby Shark is *just* different enough from Y'all Ready For This that it's technically a different riff. #dodododododo

@phessler We hear you, and we are addressing your concerns.

This was the backer milestone I was waiting for! #LeetbremOne

@downey As a general rule we only run stable released upstream versions of things. This was a special case because we needed specific functionality.

We've published a blog post with all of the details of this morning's security bug in Librem Chat and our response. https://puri.sm/posts/underscoring-our-transparency-first-librem-one-bug-report/

@rae As an update, we've fixed the bug and chat is back up. I am writing up a full report and will publish it after the development team is able to distribute a security patch of their own. Thank you for your responsible disclosure!

OK, so that's creepy: "The online tool allows everyday supporters to contribute to the campaign’s voter database by logging names and background information of anyone from a family member to a stranger met at a bus stop." #privacy
https://www.nbcnews.com/politics/2020-election/bernie-sanders-2020-campaign-unveils-app-increase-its-voter-database-n999206

This is arguably even more impactful than NIST's upgraded password policy recommendations, because far too many in IT ignore modern #infosec thought on password policy (among other things) and just apply the Microsoft recs. #defaultsmatter https://arstechnica.com/gadgets/2019/04/password1-password2-password-3-no-more-microsoft-drops-password-expiration-rec/