Kyle Rankin @kyle@librem.one

This last week all Firefox addons were accidentally disabled due to issues in Mozilla certs. Many security measures out there require full, unrevokable trust in the vendor for them to work and this is a great example of the risks with that approach. Imagine if that ever happened with SecureBoot... #infosec

Uncle Ben said that with great power comes great responsibility, but he didn't explain that responsibility lags behind power a bit. There's a brief period where you can enjoy the rush of great power before the weight of great responsibility hits.

This makes a lot of sense given MS's larger strategy with Azure. They need to get Linux devs off Macs and AWS and onto Windows and Azure. Github and Linux tools on Windows are the gateway. #devops #cloud https://arstechnica.com/gadgets/2019/05/windows-10-will-soon-ship-with-a-full-open-source-gpled-linux-kernel/

For those of you using Librem Chat on Android, the latest version (0.1.4) removes any code traces from trackers left behind in the upstream Riot codebase (we had disabled them before but the code itself was still there).

https://source.puri.sm/liberty/chat/android/issues/1

I take a top down approach to wine tasting. #ghia

So much drama in the SPC
It's kinda hard being T-O-double-D
But, he, somehow, someway, keeps on comin' up with Librem hardware every single day

He's got coders in the chat room buildin' a phone
They ain't leavin' till 6 in the morn (PST)
Now we gonna pick a license for this. GNU's up, closed's down while you other developers code to this.

Rollin' down the street, writin' free code, licensed for GNU, laid back, with my mind on the Librem and the Librem on my mind.

I elaborate on some ways to protect the digital supply chain while borrowing metaphors from the food industry in this post: https://puri.sm/posts/protecting-the-digital-supply-chain/

This is why projects like Reproducible Builds are so important. Basing all of your security on a company's signature on proprietary code is too risky.

https://www.wired.com/story/barium-supply-chain-hackers/

A animal with a history of abuse will often flinch when a well-meaning new owner tries to pet it. It takes a lot of time and effort to rebuild trust and security.

The emotional damage in the #FOSS community from decades of abuse by exploitative companies isn't acknowledged nearly enough, and is hard to overcome.

Baby Shark is *just* different enough from Y'all Ready For This that it's technically a different riff. #dodododododo

This was the backer milestone I was waiting for! #LeetbremOne

We've published a blog post with all of the details of this morning's security bug in Librem Chat and our response. https://puri.sm/posts/underscoring-our-transparency-first-librem-one-bug-report/

OK, so that's creepy: "The online tool allows everyday supporters to contribute to the campaign’s voter database by logging names and background information of anyone from a family member to a stranger met at a bus stop." #privacy
https://www.nbcnews.com/politics/2020-election/bernie-sanders-2020-campaign-unveils-app-increase-its-voter-database-n999206

This is arguably even more impactful than NIST's upgraded password policy recommendations, because far too many in IT ignore modern #infosec thought on password policy (among other things) and just apply the Microsoft recs. #defaultsmatter https://arstechnica.com/gadgets/2019/04/password1-password2-password-3-no-more-microsoft-drops-password-expiration-rec/