vader1

> This is because app stores do a lot of heavy lifting to provide security for the app ecosystem. Specifically, they provide integrity, ensuring that apps being delivered are not tampered with, consistency, ensuring all users get the same app, and transparency, ensuring that the record of versions of an app is truthful and publicly visible.

The Google Play Store does none of this, lol. All apps created since 2021 have to make use of Google Play App Signing, which means Google holds the keys used to sign the app. They leverage this to include stuff like their Play Integrity in the builds that are served. The Android App Bundle format means that completely different versions of the app are delivered depending on the type of device, locale, etc. There is 0 transparency about this for the end-user.

This sounds great! Does anyone know what this means for Google Pay and Apple Pay? In this country there's not a single bank anymore that offers contactless payments without going through Google or Apple...

Very fair. Doing anything with online advertising, either as an advertiser or as a publisher, without it involving any of Google's platforms is nearly impossible.

GrapheneOS found a way to provide eSIM support, but it depends on installing a patched version of Google's proprietary LPA app. I don't know how future-proof that is..

The lack of a physical SIM tray is just one more way to lock users in Google's walled garden. eSIM support is not implemented in Android itself (AOSP), but part of the proprietary GMS package. This means Google-free Android forks like LineageOS will be unusable on the Pixel 10 series :-(

My Garmin (Vivosmart 4) band tracks "stress" and "body battery" metrics, which are based on your Heart Rate Variability. For the first couple of days after my first mRNA shot there were no anomalies at all, but then out of nowhere my stress levels went through the roof (and my body battery completely flatlined) in a way that I've never seen before. This lasted for 6 full days, now everything seems to have returned to baseline..

I didn't feel anything about the whole ordeal though, apart from some sore muscles in the first days. Crazy interesting to quantify the amount of stuff going on in the background without you being aware of it.

EDIT: Specifically, during these 5 nights my stress level was reportedly _unmeasurable_ for about 50% of the time. Unmeasurable is common when you are physically active (making the PPG data too noisy to properly calculate normalized RR intervals) but very rare during sleep, so this probably indicated a very high amount of irregular/ectopic heartbeats.

They do: https://support.garmin.com/en-US/?faq=HfJ4xPchdD3cmZ2qtDpOR8...

But it currently only imports coarse data, e.g. your average heartrate on a given day. Not the granular minute-by-minute information.

Sleep statistics currently aren't imported at all.

I bought a Garmin the day Fitbit sold out and haven't touched the Fitbit since. I'm very happy with the switch, the Garmin (Vivosmart 4) app and device are actually better than Fitbit's on almost every account, so that's a double win :)

The only unfortunate consequence is that Garmin's import service only imports very coarse data from your Fitbit export, so all detailed historic records are lost unless you manually dig through your Fitbit export files. I hope Garmin will still provide a 100% complete importer in the future.

This is terrible news. As if Google didn't know enough about you already - they will now be supplied with a 24/7 live feed of your most sensitive health statistics.

I'll be switching to a competitor and closing down my account there as soon as possible to hopefully prevent years of my historic data from being merged into the (ghost) profile Google has on me.

But at this rate it won't be long before there are simply no more competitors to FAANG left anymore. Actually enforcing antitrust laws, anyone, pretty please?

Congrats! Perhaps start here: https://www.reddit.com/r/personalfinance/wiki/windfall

I tried to register for an account with N26 early this year. After uploading all my personal information and passport scans, I received a generic rejection notice almost immediately. Extensively talked to the customer service, but they couldn't possibly figure out the rejection reason and eventually just stopped replying.

N26 appears to be one of those modern companies built on automation and algorithms where human customer service is an afterthought. It'll work until it doesn't - and then you're on your own. Wouldn't recommend using them to handle significant amounts of money.

In many countries it's not (legally) possible to buy a SIM card without providing your ID.

Sure, you go ahead and buy an illegal burner number, then download Signal/Whatsapp from the Play Store and reverse engineer that binary to see if it "does what it says". Other people might find it useful to look at this comparison to discover alternatives that better fit the characteristics they find important.

I didn't say that Conversations from the Play Store is significantly more trustworthy in this regard than WhatsApp from the Play Store. I said that an app - such as Conversations - that you can build from source or download from F-Droid is more trustworthy than the Play Store version.

WhatsApp is a proprietary app and as such it's only available on the Play Store. Conversations is open source so you can download it from the Play Store, or from F-Droid, or compile it from source. So if you care, you can be significantly more sure that your version of Conversations "does what it says" than you can be of WhatsApp.

The difference of course being that WhatsApp is closed source, and they can push any kind of change without anyone noticing.

If the client is open source, you can verify exactly what it does. Compile the app yourself or download it from F-Droid and you can be sure that the binary you get matches those sources.

Sure you can argue this all the way down to "Trusting Trust", but that doesn't really make sense when comparing two apps/ecosystems that operate in the same real world's constraints.

Pidgin is barely maintained for the last couple of years and doesn't support most modern XMPP extensions. I'd definitely recommend Gajim on both Windows and Linux, which supports everything you need out of the box.

Fair enough, but this is kind of inherent for anything based on open standards. Was your email encrypted? It depends on whether the sending and receiving mailserver support TLS. Is your website visit perfect-forward-secret? Depends on whether your browser and the webserver support modern cipher suites. Is your DNS request encrypted? Only if your OS and your DNS server support DNSSEC or DoH.

These are valid challenges, but moving to propietary and centralized solutions instead is throwing away the baby with the bathwater. Was your WhatsApp conversation encrypted? You honestly can't know, and even if it is right now, Facebook could disable Whatsapp's e2e encryption at any time without you even noticing.

FWIW, OMEMO has been the (only) de facto encryption mechanism for modern XMPP clients in the last couple of years, and most clients that support it clearly distinguish encrypted and non-encrypted messages.

F-Droid supports reproducible builds and all APK's they serve are built from source.

Yes, Conversations (Android) and ConverseJS (web) are on par with - or better than - the commercial apps like Whatsapp. On ios, Chatsecure is pretty close.

From yesterday: https://news.ycombinator.com/item?id=18054574 :)

Isn't windows mobile the only platform where PWA's can be submitted to the app store?

Ah, that's perfect. A hardware token as the /only/ factor sounds like a bridge too far anyhow.

The difference between WebAuthn and U2F isn't really clear to me, but I hope the older generations will continue to work with common browser's FIDO2 implementations for a long time to come. YubiKeys are great, but too expensive to replace on a whim every year.

Looking great, thank you! I was previously using Candy, but it hasn't been maintained in a while. With a modern web client like this, XMPP can truly replace the likes of Slack.

I've been using Vultr for years and they've never charged me more than my monthly usage. A n=1 report from two years ago doesn't seem like a great reason to leave them out; I'm sure you can find complaints about every other provider's billing as well.

Insert between 5 and 6: CEO "fires" CTO (while simultaneously asking him to sign an employment agreement in the first place)

strncat seems to have conceded that despite the 50/50 ownership, "guy" has the ultimate power since he's a "director" and strncat is not. Does that even make sense? I'm no expert in American contract law, but usually the director(s) serve at the pleasure of the majority of stakeholders and if the stakeholders reach an impasse it's up to the bylaws or a court to figure it out. The way I see it, strncat is still 50% owner of Copperhead and could succesfully challenge all of guy's actions.

That's very good news! The knowledge that a large part of my internet usage is MITM'ed by a single entity is continuously making me uncomfortable.

By offering two different models and letting you choose between them for each hostname under Cloudflare.

1) Injecting themselves on the application layer (the current model)

2) Injecting themselves on the network layer, passing through only encrypted traffic between the client and your servers

Not every feature they currently offer would still be possible in model #2, but most of them (including DDOS protection) can still work in a limited fashion.

Using OMEMO on XMPP is a federated implementation of the Signal protocol. I believe Matrix' e2e encryption is also based on it.

Use a VPN client on your router, it'll protect you against WebRTC leaks and it'll automatically work for your phone and other devices. Asus routers have VPN support out of the box, for other routers you can use OpenWrt/DD-WRT etc.

FYI, apart from the kernel, OVH's "Ubuntu" image also adds their SSH key to the root user (http://help.ovh.co.uk/InstallOvhKey) and pre-installs some monitoring daemon.