groovybits

Facebook indeed collects data on non-users

https://www.howtogeek.com/768652/what-are-facebook-shadow-pr...

I would argue what you just said is also a privilege that one must afford: technical knowledge, or the privilege to have access to resources that will teach it to you.

I found this site that has operators you can type in the search bar:

https://seosly.com/youtube-search-operators/

Date operators:

  before:[date]

  after:[date]

  [search term], today

  [search term], last hour

  [search term], this month

  [search term], this year

I tried the search:

  tesla, before:2019-01-02, after:2019-01-01

And it appeared to work like you'd expect.

Edit: I'm not sure how intuitive the operators are. Ex: Combining them doesn't seem to give the expected results.

Not the most imperative metrics, but CarMax says that the majority of car buyers have different priorities in their purchase: https://www.carmax.com/articles/stick-shift-index

Anecdotally, I don't know anyone - outside of car enthusiasts - who drive a manual. Not only would they not consider it, a manual would be a non-starter.

Note: I used to drive a manual, and I am in the first half of my lifespan.

Currently, this is false[1].

Additionally, both of the previous two comments are based on false equivalence[2]. The two technologies discussed (online certificate checking, and file hash detection) are not the same, nor do they affect the user's privacy in remotely the same way.

I would argue this thread has devolved into misinformation stemming from uneducated claims.

1. https://www.macrumors.com/2021/12/15/apple-nixes-csam-refere...

2. https://en.wikipedia.org/wiki/False_equivalence

Previously: https://news.ycombinator.com/item?id=31851373

"The main provider of map data is TomTom, but data is also supplied by Automotive Navigation Data, Getchee, Hexagon AB, IGN, Increment P, Intermap Technologies, LeadDog, MDA Information Systems, OpenStreetMap, and Waze."

https://en.wikipedia.org/wiki/Apple_Maps#Features

The code is open, if you'd like to decide for yourself: https://github.com/signalapp

I find most of the discussions on r/privacy befuddling.

That comment by /u/DocMorp gets it right:

"The problem is abstract. So you have to find examples where they are actually directly negatively affected."

Online privacy IS an abstract concept. To the layman, digital privacy != physical privacy. Even on forums dedicated to the subject, its importance cannot be explained simply in plain words.

A somewhat cynical take: If users could contribute directly to Firefox development, it would still pale in comparison to the amount of money they get from Google for search.

While it would be a noble cause to support the browser directly, it sounds like Mozilla Corp could make better use of the funds.

So does every other service on the internet, unless you're going out of your way to mask your IP addr. That in itself does not expose the sites you visit via SafeBrowsing.

<< Why it doesn't use stored credentials just like Sync does? >>

If you sign into Pocket with your Firefox Sync account, this is the behavior.

It should only prompt you to re-login if you've cleared cookies. Even then, you can re-login via FF Sync without entering the password in again.

If you're logging in with a service other than FF Sync (ex: Google), I'm not sure how you expect FF to know what your credentials are to log you in.

<< it also connects to Google's SafeBrowsing servers. >>

As a privacy enthusiast, what's wrong with Google's SafeBrowsing service? It provides protection from low-hanging fruit with anonymized data (hashes of URLs).

A quick search has shown this has not been submitted since 2017.

EteSync now supports iOS, making it officially available on all popular platforms. Self-hosted option is also available.

I'm not affiliated with the project. I just think it works well, and is a good alternative to NextCloud, for those who do not need self-hosted file storage.

I love this feature... on one machine at a time.

Without a built-in sync feature, I continue to use the simplest form of cookie management: Private Windows.

I know there's been some discussion on sync: https://github.com/mozilla/multi-account-containers/issues/3....

As of Dec 2019, it looks like some traction will be coming to syncing just Containers and Site Assignments (which I believe would perfectly suffice most basic needs).

If anyone really wanted to keep an eye on sync, I'm guessing these features will be committed to their syncserver, when available: https://github.com/mozilla-services/syncserver.

I would wager any email provider would suffice for a simply diary, if thats how you want to keep it.

I'm assuming you're speaking to higher-level issues, such as privacy or security?

Context? And why is this rated second in this thread?

It sounds like your workflow could be replaced with Firefox Focus: https://support.mozilla.org/en-US/kb/focus

Available for Android and iOS.

If the author of the OP is reading this, the first link in the article:

> The goal of Google Research [...]

points to http://research.google instead of https://research.google :)

Looking at reddit.com/r/linusrants ...

Most of his worst rants were directed at maintainers who commited changes that resulted in bugs in the kernel.

The OP of this thread is from a user, so perhaps we need to wait until another big bug gets commited to see the results of his hiatus.

Further details as to why Torvalds is not concerned:

From the email...

"I haven't seen the attack yet, but git doesn't actually just hash the data, it does prepend a type/length field to it. That usually tends to make collision attacks much harder, because you either have to make the resulting size the same too, or you have to be able to also edit the size field in the header."

[...]

"I haven't seen the attack details, but I bet

(a) the fact that we have a separate size encoding makes it much harder to do on git objects in the first place

(b) we can probably easily add some extra sanity checks to the opaque data we do have, to make it much harder to do the hiding of random data that these attacks pretty much always depend on."

At the bottom of that page is a link to general browser recommendations: https://wikitech.wikimedia.org/wiki/HTTPS/Browser_Recommenda...

One piece of advice that I'm glad to see included in that link: "Disable or uninstall any 3rd party "anti-virus" software. Most of them do more harm than good when they interfere with your browser's secure connections."

If you're using Windows, there is little need to use anything other than Defender (built-in). Any 3rd party anti-virus is intercepting your traffic for analysis.

Some 3rd party anti-viruses are even crashing browsers: https://support.google.com/chrome/thread/17555930

I'm sure the film's budget could have afforded a consultant. However, if you watch the movie, you may notice that there was no need to show ProtonMail at all. It was a close-up, over-the-shoulder shot of the culprit using a phone to send an email. The whole shot lasted ~2 seconds, with narration. They could have simply chosen a front-facing shot of the culprit using a computer or phone to achieve the same affect.

In any case, there are still plently of TV series and movies that put less effort into a 5 minute 'hacker' scene than this movie did into a 2 second shot. They get my kudos.

I would say its more suprising that ProtonMail shows up in a movie like Knives Out (which has no technical content), than it is for it to appear in Mr. Robot (a purposefully technical series, and being underwritten by Michael Bazzel, who is an advocate of ProtonMail).

I also saw it, and got a chuckle. I noticed how they were using the mobile web-app version instead of dedicated app.

I think its a testament to ProtonMail's popularity, that they get some screentime in a film with such a high-profile cast. Perhaps a techie in the film crew suggested they use it.

Its the same threat vector as BlueKeep, so I would imagine the prime exploitation window for Win7 (which was/is vulnerable to both) has already passed.

A quick Shodan query already does what you're thinking.

Thinking of this in context to Win7 EOL approaching:

I imagine the type of people who have RDP publicly exposed are the same type of people who will not be upgrading from Win7 anytime soon.

I suspect we will see many exploits of this to come.

> “Our in-house news team monitors every alert that comes through our system and determines if they are relevant crime & safety incidents to send out to impacted neighborhoods,” Ring says in one a document provided exclusively to law enforcement officials.

Of all things, doesn't this sound like something that would be pretty easy to automate? The data points sound straightforward (crime type, time, location, investigation status, etc).

> I am sure you can do the same with a Raspberry Pi and some scripts

Actually you don't even need to write your own scripts. There is an official steamlink package available for Raspbian. I just set up a Pi3 to run as a dedicated steamlink the other day, and it works fairly well.

Just run:

  apt install steamlink

  steamlink

Edit: And if you want it to run the steamlink interface on bootup, you can stick this in your crontab:

  @reboot steamlink