It’s a decent approach but incomplete. Couple problems:
- Lemmy would not host youtube videos. YT transcripts could (and should) be part of the post, but then there is the same problem as the next bullet:
- w.r.t text content, some people (very few people) indeed copy the content. It’s failing because people are lazy. Too lazy to check whether the link is in a walled garden; too lazy to warn people of the walled garden; also too lazy to copy the text. Sometimes it’s more naivety than lazy, but same problem: you are relying on the masses to make individual decisions that are wise, inclusive, and higher effort.
A good system is designed with the assumption that users are lazy. As such, Lemmy is poorly designed.
1 lazy author can inconvenience thousands of readers. Lammy’s design fails to address that.
Down-voting every youtube link is indeed the only individual action that can be taken in the current system. It could theoretically lead to a YT link being folded or sunk lower. Tricky though because people should know why their YT links get down-voted. Ideally you would be able to tell them in a response. But I think I know how that would go: people with digital inclusion principles have actually become a diluted small minority in the fedi. A flood of lemmy.world folks who would follow the crowd off a cliff would down-vote your reply and up-vote the YT link in solidarity of their favorite walled gardens.
You could DM the reason for down-voting. But then the problem does not get the exposure it needs.
The fedi has evolved like Burning Man. The movement was true to its founding principles early on but as the crowd grew over the years it became enshittified faster than a digital rights subculture could take hold.
BTW, I should mention that sh.itjust.works is also a centralised Cloudflare node.
My point still stands.
Of course it doesn’t. Your point doesn’t even grasp the problem. You think the problem is that fedi users have (or have not) entitlement to content. It’s a red herring. You cannot begin to solve a problem you do not understand. It does not matter who is “entitled” to the content. The content is exclusive; locked inside a walled-garden with a gatekeeper. The problem is that exclusive access content is being linked on an open content platform and shoved in the face of readers who do not have access to the closed content.
The moment you are using someone else’s platform
Again, you still fail to grasp the problem. Using someone else’s platform is not a premise. You can either be on someone else’s node or you can be on your own self-hosted node. Either way, exclusive links are in the reader’s face.
How can you get so many things wrong.. then you claim using one platform inherently revokes rights outside that platform -- of course not. Irrelevant regardless, but rights granted on one platform do not diminish rights on another.
you loose the rights to the content outside of that platform.
It’s not about “rights”. That’s a legal matter. It’s about digital inclusion (a technical matter). People don’t want to see links that exclude them. It’s just pollution.
To reach the particular law office which has become a specialist in this particular case, yes you are trapped because they use MS Outlook. There is no way to exchange email with them without involving MS.
Victims can use any lawyer, but any other lawyer will need to research the case (at the victim’s cost).
better than what? I’m not understanding your comparison here.
You’ve misunderstood the problem. It’s not a fix to access content that’s needed. The question is how to fix the pollution: exclusive walled-garden links appearing outside of the walled garden (where not everyone has access or is part of the special club of Google/Facebook/Cloudflare patrons). How did you misunderstand when I mentioned a toggle? And the title... how could I make the title more clear?
Discuss. (But plz, it’s only interesting to hear from folks who have some healthy degree of contempt for exclusive corporate walled-gardens and the technofeudal system the fedi is designed to escape.)
And note that links can come into existence that are openly universally accessible and then later become part of a walled-garden... and then later be open again. For example, youtube. And a website can become jailed in Cloudflare but then be open again at the flip of a switch. So a good solution would be a toggle of sorts.
When Google sabotages network neutrality by blocking Tor and Invidious instances, is it wise for the fedi to facilitate the sharing of #Youtube links?
Fedi instance operators would probably not tolerate links into Facebook’s walled-garden if people were to start polluting an otherwise open community with them. So Youtube links should probably be treated with contempt during periods where Google’s DoS attack is underway.
But at some point to interact with any kind of large company .. You could also consider not interacting with large companies at all
Actually the large corps are more likely to hold the data in-house. Small companies cling to outsourcing. E.g. credit unions are the worst.. outsource every service they offer to the same giant suppliers. Everyone thinks only a small company has the data (and consequently that the small dataset does not appeal to cyber criminals) but it’s actually worse because they outsource jobs even as small as printing bank statements to the same few giants most other credit unions use. Then they do the same for bill pay with another company. It’s getting hard to find a credit union that does not put Cloudflare in the loop. So in the end a dozen or so big corps have your data and it’s not even disclosed in the privacy statement.
Of course it depends on the nature of the business. A large grocery chain is more likely to make sure your offline store purchase history reaches Amazon and Google than a mom & pop grocer who doesn’t even have a loyalty program.
Whether businesses get copies of information is usually included in a site’s privacy policy,
I have never seen a privacy policy that lists partners and recipients apart from Paypal, who lists the 600+ corps they share data with for some reason. Apart from bizarre exceptions privacy policies are always too vague to be useful. Even in the GDPR region. If you read them you can often find text that does not even make sense for their business because they just copied someone else’s sufficiently vague policy to use as a template.
If you really want to limit your information exposure, you either have to audit everyone you do business with this way (because most large companies do this) or hire someone (or a service) to do it.
The breach happened in a country where companies are not required to respond to audits. No company wants any avg joe’s business badly enough to answer questions about data practices. In the EU, sure, data controllers are obligated to disclose the list of parties they share with (on request, not automatically). And even then, some still refuse. Then you file an article 77 complaint with the DPA where it just sits for years with no enforcement action.
My approach is a combination of avoiding business entirely, or supplying fake info, or less sensitive info (mailing address instead of residential, mission-specific email, phone number that just goes to a v/m or fax). This is where the battle needs to be fought -- at data collection time. Countless banks needlessly demand residential address. That should be rejected by consumers. Data minimization is key.
In the case at hand, I’m leaning toward opting out of the class action lawsuit and suing them directly in small claims court. I can usually get better compensation that way.
cross-posted from: https://links.hackliberty.org/post/2667522
> Apparently some company I do business with shared my data with another corp without me knowing, then that corp who I did not know had my data was breached. > > WTF? > > Then the breached corp who could not competently secure the data in the first place offers victims a gratis credit monitoring services (read: offers to let yet another dodgy corp also have people’s sensitive info thus creating yet another breach point). Then the service they hired as a “benefit” to victims outsources to another corp and breach point: Cloudflare. > > WTF? > > So to be clear, the biggest privacy abuser on the web is being used to MitM a sensitive channel between a breach victim and a credit monitoring service who uses a configuration that blocks tor (thus neglecting data minimization and forcing data breach victims to reveal even more sensitive info to two more corporate actors, one of whom has proven to be untrustworthy with private info). > > I am now waiting for someone to say “smile for the camera, you’ve been punk’d!”. > > (update) > Then the lawyers representing data breach victims want you to give them your e-mail address so they can put Microsoft Outlook in the loop. WTF? The shit show of incompetence has no limit.
Apparently some company I do business with shared my data with another corp without me knowing,
WTF?
then that corp who I did not know had my data was breached.
WTF?
Then the breached corp who could not competently secure the data in the first place offers victims gratis credit monitoring services (read: offers to let yet another dodgy corp also have people’s sensitive info thus creating yet another breach point). Then the service they hired as a “benefit” to victims outsources to another corp and breach point: Cloudflare.
WTF?
So to be clear, the biggest privacy abuser on the web is being used to MitM a sensitive channel between a breach victim and a credit monitoring service who uses a configuration that blocks tor (thus neglecting data minimization and forcing data breach victims to reveal even more sensitive info to two more corporate actors, one of whom has proven to be untrustworthy with private info).
I am now waiting for someone to say “smile for the camera, you’ve been punk’d!”.
(update) Then the lawyers representing data breach victims want you to give them your e-mail address so they can put Microsoft Outlook in the loop. WTF? The shit show of incompetence has no limit.
Exit nodes are temporary unless you deliberately pin them for a particular connection, which I have not done for the DNS servers. The problem manifests without exception for weeks now, so it could not be attributed to a bad exit node. The tor microdescriptor db tracks the perms of every node, so I don’t think it would create a circuit for disallowed traffic. There could be an inconsistency between the microdesc and reality, but it would have to be a replicated inconsistency for every connection attempted with torsocks and yet not replicated on any connection made using the torsocks alternative (which works).
Which torsocks version? Yours is probably newer than mine. It seems to be a problem with torsocks 2.3.0 and only with dig. And indeed there is nothing wrong at the network level because I was able to do an MX lookup over tor using a different method than torsocks. I'm also able to use other apps with torsocks, just not dig all of the sudden.
To do an MX lookup over Tor, this command has worked for me for years:
$ torsocks dig @"$dns_server" -t mx -q "$email_domain" +noclass +nocomments +nostats +short +tcp +nosearch
In the past week or so it just hangs. My first thought was the DNS server I chose (8.8.8.8) started blocking tor. But in fact it does not matter what DNS server is queried. The whole Tor network is apparently blocking tor users from doing MX lookups.
Also notable that dig hangs forever. It does not timeout despite a default timeout interval of 5 seconds (according to the man page).
Dutch DPA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US.
The link is Cloudflare-free, popup-free and reachable to Tor users.
(edit) Some interesting factors--
from the article: > For a period of over 2 years, Uber transferred those data to Uber's headquarters in the US, without using transfer tools. Because of this, the protection of personal data was not sufficient. The Court of Justice of the EU invalidated the EU-US Privacy Shield in 2020.
Yes but strangely & sadly the US benefits from an adequacy decision, which IIRC happened after 2020. This means the US is officially construed as having privacy protections on par with Europe. As perverse as that sounds, no doubt Uber’s lawyers will argue that point.
> The Dutch DPA started the investigation on Uber after more than 170 French drivers complained to the French human rights interest group the Ligue des droits de l’Homme (LDH), which subsequently submitted a complaint to the French DPA.
Wow! I wonder what triggered so many drivers to consult a human rights group. I mean, consider that Uber users and drivers are all happy to run a closed-source Google-gated app.. this is not a demographic who cares about privacy. So what triggered 170 complaints? I wonder if the Dutch DPA would have taken any action had there not been 170 cross-border complainants.
The French DPA gives some interesting insight. Info to attempt to satisfy access requests were in English, not French, which breaks the accessibility rule. The French article gives more a feeling of not 170 proactive complaints, but maybe the human rights org complained on behalf of 170 drivers. I am quite curious from an activist point of view if 170 drivers proactively initiated a complaint.
The fourth breach is interesting: > by not explicitly mentioning the right to data portability in their privacy statement.
Is data portability even useful for Uber drivers in France? I’ve never used Uber (fuck Google), but I imagine drivers have feedback about how well they perform and maybe they want to port that data to an Uber competitor.. but there is no Uber competitor in France, is there? Is Lyft in France?
I normally grab a #youtube video via #invidious onion instances this way:
yt-dlp --proxy http://127.0.0.1:8118 -f 18 http://ng27owmagn5amdm7l5s3rsqxwscl5ynppnis5dqcasogkyxcfqn7psid.onion/watch?v="$videoID"
Now it leads to:
> ERROR: [youtube] $videoID: Sign in to confirm you’re not a bot. This helps protect our community. Learn more
There used to be a huge number of Invidious instances. Now the official list is down to like ½ dozen.
This email provider gives onion email addresses:
pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion
Take care when creating the username to pull down the domain list and choose the onion domain. That address you get can then be used to receive messages. Unlike other onion email providers, this is possibly the only provider who offers addresses with no clearnet variations. So if a recipient figures out the clearnet domain it apparently cannot be used to reach you. This forces Google and MS out of the loop.
It’s narrowly useful for some situations where you are forced to provide an email address against your will (which is increasingly a problem with European governments). Though of course there are situations where it will not work, such as if it’s a part of a procedure that requires confirmation codes.
Warning: be wary of the fact that this ESP’s clearnet site is on Cloudflare. Just don’t use the clearnet site and keep CF out of the loop.
Self hosting would mean I could control account creation and make many burner accounts. But there are issues with that:
- If there are several burner accounts then the admin would have to make it easy for others to create burner accounts or else it would be evident that all the burner accounts are just the admin’s, which does not solve the aggregation problem. It introduces complexities because the DNS provider and ISP would have the identity of the self-hoster. One could onion host but that greatly narrows the audience.
- It does not solve the problem for others. Everyone who has the same need would then be needlessly forced to independently solve all these same problems.
- I do not have high-speed unlimited internet, so I would have to spend more on subscription costs.
I think it complicates the problem and then each author has to deal with the same. If it’s solved at the fedi API level, then the existing infrastructure is ready to work.
(edit) I recall hearing about a fedi client application that operates in a serverless way. I don’t recall the name of it and know little about how it works, but it is claimed to not depend on account creation on a server and it somehow has some immunity to federation politics. Maybe that thing could work but I would have to find it again. It’s never talked about and I wonder why that is.. maybe it does not work as advertised.
Those do not obviate the use cases I have in mind. Secure drops are useful tools for specific whistle blowing scenarios. But they are not a one-size-fits-all tool.
I routinely use framadrop and then transmit the links to regulators or whoever I am targeting to act on a report. But what if the target audience is not a specific journalist or regulator but rather the entire general public? The general public does not have access to reports submitted to the Guardian’s dropbox or NYTimes’ dropbox. Those are exclusive channels of communication just for their own journalists. The report then only gets acted on or exposed if the story can compete with the sensationalisation level of other stories they are handling. If I’m exposing privacy abuses, the general public does not give a shit about privacy for the most part. So only highly scandelous privacy offenses can meet the profitable publication standards of Guardian and nytimes. The reports also cannot be so intense as to be on par with Wikileaks. There is a limited intensity range.
The fedi offers some unique reach to special interest groups like this one without the intensity range limitation.
NYtimes is also a paywall. So even if the story gets published it still ends up a place of reduced access.
They are great tools for some specific jobs but cannot wholly replace direct anonymous publication. Though I must admit I often overlook going to journalists. I should use those drop boxes more often.
(edit) from the guardian page:
Once you launch the Tor browser, copy and paste the URL xp44cagis447k3lpb4wwhcqukix6cgqokbuys24vmxmbzmaq2gjvc2yd.onion or theguardian.securedrop.tor.onion into the Tor address bar.
That theguardian.securedrop.tor.onion URL caught my attention. I did not know about onion names until now. Shame it’s only for secure drops.
I have lots of whistles to blow. Things where if I expose them then the report itself will be instantly attributable to me by insiders who can correlate details. That’s often worth the risks if the corporate baddy who can ID the whistle blower is in a GDPR region (they have to keep it to themselves.. cannot doxx in the EU, Brazil, or California, IIUC).
But risk heightens when many such reports are attributable under the same handle. Defensive corps can learn more about their adversary (me) through reports against other shitty corps due to the aggregation under one handle.
So each report should really be under a unique one-time-use handle (or no handle at all). Lemmy nodes have made it increasingly painful to create burner accounts (CAPTCHA, interviews, fussy email domain criteria, waiting for approval followed by denial). It’s understandable that unpaid charitable admins need to resist abusers.
Couldn’t this be solved by allowing anonymous posts? The anonymous post would be untrusted and hidden from normal view. Something like Spamassassin could score it. If the score is favorable enough it could go to a moderation queue where a registered account (not just mods) could vote it up or down if the voting account has a certain reputation level, so that an anonymous msg could then possibly reach a stage of general publication.
It could even be someone up voting their own msg. E.g. if soloActivist is has established a history of civil conduct and thus has a reputation fit for voting, soloActivist could rightfully vote on their own anonymous posts that were submitted when logged-out. The (pseudo)anonymous posts would only be attributable to soloActivist by the admin (I think).
A spammer blasting their firehose of sewage could be mitigated by a tar pit -- one msg at a time policy, so you cannot submit an anonymous msg until SA finishes scoring the previous msg. SA could be artificially slowed down as volume increases.
As it stands, I just don’t report a lot of things because it’s not worth the effort that the current design imposes.
That story is focused on #CloudSTRIKE but the bigger more remarkable demon here is #CloudFLARE.
This story demonstrates Cloudflare acting as a proxy bully of their own customer, on behalf of CloudStrike by pushing a frivilous #DMCA take-down demand. CF took the spineless route as it sees CloudStrike as having more muscle than their customer. After CF joins the Goliath side of the David vs. Goliath battle, CF ignores Senk’s responses and keeps proxying threats.
Senk bounced from Cloudflare and went to a provider who has his back. #ArsTechnica publishes Cloudflare’s conduct. As embarrassment hits Cloudflare and David (Senk) starts winning against Goliath (CloudStrike), CF changes their tune. Suddenly they are on Senk’s side, saying “come back, we’ll protect you -- we promise we didn’t get your messages”. LOL. Senk should do a parody site for Cloudflare too.
Senk’s mistake: leaving CF. He should have waited until CF actually booted him. Then that would have more thoroughly exposed CF’s shitty actions. Senk gave CF an easy out.
Interesting to note how a human on the side of civil rights who advocates decentralisation was treated with hostility by Cloudflare. Yet CF is fine with sheltering actual criminals.
Customers should take several proactive steps to protect their personal information and reduce potential risks: Be Wary of Phishing Attempts
Customers should rethink their stupid ass decision to use AT&T in the first place since it has been known for over a decade that AT&T is the most privacy abusive of all US telecoms, most notably their role in project Fairview (archive for clearnet users and wikipedia).
AT&T customers don’t give a shit about privacy. But I do have some sympathy for all the non-AT&T people who communicated with AT&T pawns.
BTW, the OP’s link avoids reclaimthenet’s shitty popup if proxied through 12ft.io:
https://12ft.io/https://reclaimthenet.org/nearly-all-at
Not sure it matters since the text is in the OP anyway.. guess if someone wants to share it around.
EU-based ATMs tend to charge a fee of ~€4—6 on non-EU cards. I’m fine with that because my bank rebates those fees anyway. However something seems off with some French ATMs.
France has a reputation for having the highest banking fees in Europe and their ATMs seem consistent with that reputation. Some French ATMs charge €6 and that gets printed on the ATM receipt. As expected my bank sees the fee on their side in that case and they credit it back to me -- so no problem there. But then other ATMs in France do not print any fee on the receipt. Consequently my bank sees no fee on the transaction so they rebate nothing back to me. Are those ATMs reeaaally giving up the opportunity to charge a fee to non-EU cards? Certainly no Dutch ATMs ever pass up that opportunity. When calculating the xe.com rate of that day and comparing to the money drawn from my bank account, there is a discrepancy of ~$5.50 USD.
So it looks like the ATM is adding their fee into the euro amount. E.g. I pull out €400 & decline DCC, and the ATM prints a receipt showing €400 but then draws something like €405. In principle it should be evident from the bank statement. But my bank lacks transparency and omits from the statement the euro amount and also withholds the exchange rate they applied (which the contract says is the straight interbank rate with 0% markup).
I see two possible theories here:
- my bank’s so called fee-free FX rate is really ~1%; OR
- the French ATMs add the fee to the amount charged and hiding the fee. They do not benefit from it but could be sloppy programming. Maybe they think it does not matter because they are still charging whatever the customer agrees to anyway.
While I struggle to believe that 3 different French ATMs would pass up the chance to take a fee, I ran the numbers on a transaction that actually does transparently take a fee and result in a rebate. I still paid almost 1% more than the xe.com rate.
All fees must be disclosed on the ATM screen by law. But my memory is not so reliable.
Folks, FedEx has always been on the extreme right. Some basic facts:
- FedEx is an ALEC member (extreme right lobby and bill mill), largely as an anti-union measure
- FedEx founded by an ex military serviceman
- FedEx gives discounts for NRA membership (though I heard this was recently discontinued). NRA is obviously an extreme right org who also finances ALEC.
- During the NFL take-a-knee protest, FedEx is one of very few die-hard corps that refused to give in to the boycott. FedEx continued supporting the NFL against all the Black Lives Matter athletes taking knees and getting punished.
- FedEx ships shark fins, slave dolphins and hunting trophies. Does not give a shit about harm to animals (even when endangered) or environment.
I have been boycotting FedEx for over a decade. Certainly being pro-surveillance is fitting with their history and should not be a surprise to anyone who is aware of this background.
The only moral inconsistency is that FedEx has a reputation for not snooping on your packages and seems to be favored by people shipping contraband. But to find the consistency it’s just about the bottom line. They make no money by ratting out their customers who break the law. But installing a surveillance system on their trucks is probably yielding revenue for FedEx.
Sounds mostly reasonable.. but I don’t see the alternate citizenship helping, unless you mean to go as far as renouncing because all FATCA regions (~130+ countries) look at the birthplace, not nationality, and you can never get a new birthplace. It’s probably hard to find a non-FATCA region where you can trust the banks. But indeed.. getting your 4th amendment rights has come to extremes.
That makes some sense.
In my case I think I have credit that I’ve never actually used; and I think I’ve also put on their file that I am unemployed. So in principle consumers who either don’t care for the credit, or are happy to be in the highest risk category, they should not be harassed with this. I will just ignore it and see what happens.
In the past I have only seen PayPal spontaneously demand at arbitrary/unexpected moments that I jump their their hoops – to login and give them more info about me. I reluctantly did what they wanted, and they kept my account frozen and kept my money anyway. So I’ve been boycotting PayPal ever since....
(cross-posting is broken on links.hackliberty.org, so the following is manually copied from the original post)
---
When your bank/CU/brokerage demands that you login to their portal to update KYC info soloActivist to Privacy@fedia.io ·
In the past I have only seen PayPal spontaneously demand at arbitrary/unexpected moments that I jump their their hoops -- to login and give them more info about me. I reluctantly did what they wanted, and they kept my account frozen and kept my money anyway.
So I’ve been boycotting PayPal ever since. Not worth it for to work hard to find out why they kept my account frozen and to work hard to twist their arm to so that I can give them my business.
Now an actual financial institution is trying something similar. They are not as hostile as PayPal was (they did not pre-emptively freeze my account until I dance for them), but they sent an email demanding that I login and update my employment information (even though it has not changed). Presumably they will eventually freeze my account if I do not dance for them to satisfy their spontaneous demand.
I just wonder how many FIs are pulling this shit. And what are people doing about it? Normally I would walk.. pull my money out and go elsewhere. But the FI that is pushing KYC harassment has a lot of power because they offer some features I need that I cannot get elsewhere, and I have some stocks through them, which makes it costly/non-trivial to bounce.
I feel like we should be keeping a public database on FIs who pull this shit, so new customers can be made aware of who to avoid.
I doubt it. It will probably show the clearnet address. I just now logged in via the onion, so this reply will be a test.
Replacement link to a privacy-respecting host:
This article seems to suggest the KYC rules only apply to foreign customers:
https://www.bankinfosecurity.com/commerce-proposes-rule-to-fight-foreign-cloud-cyber-threats-a-24219
but then you have to wonder how they will know you’re domestic without a bit of KYC on Americans as well.
BTW, a good way to find privacy-respecting links is to search using this service:
https://ombrelo.im5wixghmfmt7gf7wb4xrgdm6byx2gj26zn47da6nwo7xvybgxnqryid.onion/
That search tool will not return Cloudflare MitMd links.
The U.S. Department of Commerce (“Commerce”), Bureau of Industry and Security (“BIS”), recently issued a proposed rule aimed at preventing foreign actors from utilizing U.S.
Pushover consumers accepted “Know Your Customer” abuses to their 4th Amendment rights in the banking sector, so why wouldn’t the same work when it comes to internet service? I have no doubt that the privacy apathetic masses will accept this in a heartbeat.
I’m not on a good enough connection to watch videos but when I read “How the Religion called Atheism…” I know it cannot be coming from any sort of credible source. Atheism is absence of religion, not a religion in itself. It includes both agnostics and gnostics (both those who are convinced there is no god and those who are unconvinced either way). So I don’t suppose it’s worth it to note the URL and try to fetch the video when I have a good connection.
Lawmakers have figured out they can circumvent 4A by forcing the private sector and external governments to do their surveillance. It worked for banking KYC and it worked for FATCA. The industry is apparently not worried at all about losing customers. And they won’t. To circumvent 4A, just outsource governance to a non-government entity.
The bank requires customers who use their phone app to:
- buy a new recent smartphone, repeatedly (because the bank’s app detects when it is running on an Android emulator and denies service)
- subscribe to mobile phone service (which also costs money and also in some regions requires supplying national ID to the mobile carrier to copy for their records which customers then must trust them to secure)
- share their mobile phone number with a power abusing surveillance capitalist who promotes the oil industry (Google / Totaal)
- create a Google account and agree to their terms (which includes not sharing software that was fetched from the Playstore jail)
- share their IMEI# with Google
- share all their app versions with Google, thus keeping Google informed of known vulns for which they are vulnerable
- share with Google where they bank and trust Google not to sell that info to debt collectors
- install proprietary non-free software and trust the security of non-reviewable code
- share the mobile phone number with the bank
Why are so many people okay with this?
The state of medical privacy has become quite appalling lately. I started using a young doctor in a new office and they are gung ho on modern tech. That’s fine to some extent but they want to send me invoices and all correspondence via e-mail. No PGP of course. I did an MX lookup on their vanity email address & it resolves to an MS Outlook server.
I asked them for my test results. They offered to email them.
My response: I do not want sensitive medical info coming by e-mail via Microsoft’s servers. I did not give you a copy of my email address for that reason. It needs to be snail-mailed to me.
Perhaps of greater concern is that the receptionist acted like I am making a unusual request, and that they do not mail things. Apparently I am the only patient who has a problem with sensitive medical info going to Microsoft. So the receptionist is investigating whether she can get approval to mail me my results by post.
I wonder if someone in that clinic will have to run out and buy stamps because I have a problem with Microsoft.
Microsoft faces criticism for funding Israeli facial recognition company AnyVision, reportedly carrying out surveillance on Palestinians and working in Hong Kong and Russia.
cross-posted from: https://links.hackliberty.org/post/984895
> Microsoft finances #AnyVision to produce facial recognition technology that the Israeli military uses against the Palestinian people. > > So if you oppose Israel’s brutality then #Microsoft should be on your boycott list. > > If you are undecided, these stories might help with your decision: > > * snipers target a red-cross medic for execution (2018) → https://edition.cnn.com/2018/06/03/middleeast/razan-al-najjar-gaza-nurse-killed/index.html > * Hind Rajab (6 year old; 2024) → https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid.onion/world/2024/feb/10/im-so-scared-please-come-hind-rajab-six-found-dead-in-gaza-12-days-after-cry-for-help > > For Hind Rajab, my boycott is on until I die.
cross-posted from: https://links.hackliberty.org/post/125466
> My credit card issuer apparently never gets to know what I purchased at stores, cafes, & restaurants -- and rightfully so. The statement just shows the shop name, location, and amount. > > Exceptionally, if I purchase airfare the bank statement reveals disclosures: > * airline who sold the ticket > * carrier > * passenger name > * ticket number > * city pairs > > So that’s a disturbing over-share. In some cases the airline is a European flag carrier, so IIUC the GDPR applies, correct? Doesn’t this violate the data minimization principle? > > Airlines no longer accept cash, which is also quite disturbing (and illegal in jurisdictions where legal tender must be accepted when presented for PoS transactions). > > Has anyone switched to using a travel agent just to be able to pay cash for airfare? > > UPDATE > > A relatively convincing theory has been suggested in this other cross-posted community: > > https://links.hackliberty.org/comment/414338 > > Apparently it’s because credit cards offer travel insurance & airlines have incentive to have another insurer involved. Would be useful if this were documented somewhere in a less refutable form.
There is a common theme pushed by fanatics of capitalism that never dies: that a profit-driven commercial project ensures higher quality products than products under non-profit projects. Some hard-right people I know never miss the chance to use the phrase “good enough for government work” to convey this idea.
I’m not looking to preach to the choir here, but rather to establish a thread of scenarios that correspond to quality for the purpose of countering inaccurate narratives. This is the thread to share your stories.
In my day job I’m paid to write code. Then I go home write code I was not paid for. My best work is done without pay.
Commercial software development
When I have to satisfy an employer, they don’t want quality code. They want fast code. They want band-aid fixes. The corporate structure is too myopic to optimize for quality.
Anti-gold-plating:
I was once back-roomed by a manager and lectured for “gold plating”. That means I was producing code that was higher quality than what management perceives as economically optimal.
Bug fixes hindered:
I was caught fixing some bugs conveniently as I spotted them when I happened to have a piece of code checked out in Clearcase. I was told I was “cheating the company out of profits” because they prefer if the bugs each go through a documentation procedure so the customer can ultimately be made to pay separately for the bug fix. Nevermind the fact that my time was already charged anyway (but they can get more money if there’s a bigger paper trail involving more staff). This contrasts with the “you get what you pay for” narrative since money is diverted to busy work (IOW: working hard, not smart).
Bugs added for “consistent quality”:
One employer was so insistent on “consistent quality” that when one module was higher quality than another, they insisted on lowering the quality of the better module because improving the style or design pattern of the lower quality piece would be “gold plating”. This meant injecting bugs to achieve consistency. The bugs were non-serious varieties; more along the lines of needless complexity, reduced performance, coding standard non-compliances, etc, but nonetheless something that could potentially be charged to the customer to fix.
Syntactic dumbing-down:
When making full use of the language constructs (as intended by the language designers), I am often forced by an employer to use a more basic subset of constructs. Employers are concerned that junior engineers or early senior engineers who might have to maintain my code will encounter language constructs that are less common and it will slow them down to have to look up the syntax they encounter. Managers assume that future devs will not fully know the language they are working in. IMO employers under-estimate the value of developers learning on the job. So I am often forced avoid using the more advanced constructs to accommodate some subset of perceived lowest common denominator. E.g. if I were to use an array in bash, an employer might object because some bash maintainers may not be familiar with an array.
Non-commercial software development
Free software developers have zero schedule pressure. They are not forced to haphazardly rush some sloppy work into an integration in order to meet a deadline that was promised to a customer by a manager who was pressured to give an overly optimistic timeline due to a competitive bidding process. #FOSS devs are free to gold-plate all they want. And because it’s a labor of love and not labor for a paycheck, FOSS devs naturally take more pride in their work.
I’m often not proud of the commercial software I was forced to write by a corporation fixated on the bottom line. When I’m consistently pressured to write poor quality code for a profit-driven project, I hit a breaking point and leave the company. I’ve left 3 employers for this reason.
Commercial software from a user PoV
Whenever I encounter a bug in commercial software there is almost never a publicly accessible bug tracker and it’s rare that the vendor has the slightest interest in passing along my bug report to the devs. The devs are unreachable by design (cost!). I’m just one user so my UX is unimportant. Obviously when I cannot even communicate a bug to a commercial vendor, I am wholly at the mercy of their testers eventually rediscovering the same bug I found, which is unlikely in complex circumstances.
Non-commercial software from a user PoV
Almost every FOSS app has a bug tracker, forum, or IRC channel where bugs can be reported and treated. I once wrote a feature request whereby the unpaid FOSS developer implemented my feature request and sent me a patch the same day I reported it. It was the best service I ever encountered and certainly impossible in the COTS software world for anyone who is not a multi-millionaire.
Some Lemmy instances (e.g. Beehaw) do not support down votes. When an instance does support down-votes, authors often get zero feedback with the down votes which ultimately supports obtuse expression, shenanigans and haters. The status quo suffers from these problems:
- down voters do not need to read the comment they are down voting
- down votes empower non-moderators to suppress comments and posts
- some communities struggle to get content because of some malicious down voters who down vote every post to discourage activity and effectively sabotage the community; voting privacy shields malicious down-voters from discovery and supports their attack
- silent down votes are non-constructive
- some people make heavy use of down votes to suppress civil comments purely because of disagreement; other (more civil) users only use down votes to suppress uncivil dialog. This inequality ultimately manifests to reduce civility.
- transparency: kids and adults are accessing the same forums and adults are blind as to whether down votes are coming from kids (the rationale can reveal this)
The fix:
An instance admin should be able to flip a switch that requires every down vote to collect a 1-line rationale from the voter. These one-liners should be visible to everyone on a separate page. Upvotes do not need rationale. So instance owners should have 3 configuration options:
- down votes disabled (beehaw)
- down votes require rationale (proposed)
- down votes out of control (the most common status quo)
Perhaps overkill, but it might be useful if a moderator can cancel or suppress uncivil down votes.
---
BTW, the reason this enhancement request is not in the official bug trackers:
- Lemmy’s bug tracker is in MS Github (#deleteGithub)
- Kbin’s bug tracker is on codeberg, who silently deleted my account without warning or reason, and #Codeberg reg forces a graphical CAPTCHA (which fails on my non-graphical browser).
#lemmyBug #KbinBug
It would be useful to have more refined control over participation in a group. Someone should be able to create a group that gives permissions to specific individuals. A variety of permissions would be useful:
- permission to see that a community/mag exists (some groups may or may not want to be listed in searchable a public directory)
- permission to read the posts in a community/mag
- permission to vote in the community/mag
- permission to start a new thread in the community/mag
- permission to comment on an existing thread in the community/mag
A forum creator should be able to set the above perms on:
- individual accounts
- all users on an instance (e.g. users on an instance
@weH8privacy.commight be unfit for voting and writing comments in the community “fightForPrivacy”) - all users not on an instance (e.g. local users only for example)
- instance IP-based (e.g. users from Cloudflared instances might be unfit to participate in a group called “decentralizationAdvocacy”)
Settings for individuals should override instance-specific settings. So e.g. a “fightForPrivacy” forum might allow all forms of participation from an instance stop1984.org, but if antiprivacyMallory@stop1984.org is uncivil, a mod should be able to block all inputs from that user yet perhaps still allow antiprivacyMallory to just read the posts on the off chance of influencing the user to be more civil through exposure to civil chatter.
More background on the rationale - why the fedi needs this (click to expand)
The fedi has undergone a huge flood of new users, largely moderates from Twitter. The moderates dilute movements.
Consider the evolution of raves and Burning Man. The beginning was a rich subculture that briefly evolved in isolation apart from the ordinary world. These subcultures became more enriched within their own world whereby the core ideas spawned more culture. Then word got out and spread like brush fire. Masses of uninitiated crowds flooded into raves and Burning Man faster than they could be integrated. Commercialization took hold faster than people could be integrated. The scene became diluted with clubbers and conservatives who essentially turned raves into clubs. The way to promote raves that resembled the original experience was to selectively flyer party goers who overtly embraced the experience, who were not merely there to be seen. IOW, the fix was invite-only events.
The flood of moderates into the fedi has crippled the decentralization movement and corrupted the vision. The fedi is now swamped with people from huge instances that are centralized on Cloudflare (lemmy.world, sh.itjust.works, lemmy.ca, lemm.ee, programming.dev, zerobytes.monster) and lemmy.ml. People without a firm grasp on the meaning, purpose, and benefits of decentralization and privacy still find their way into “privacy” communities and make foolish remarks (e.g. not sharing personal correspondence with Google and Microsoft “is tinfoil-hattery”). Sure, it’s favorable that the “I have nothing to hide” crowd intermingle with more sophisticated privacy-aware folks. It’s important that there be a venue where ignorance can be reversed. But--
Moderates are a drag on activism. A “PrivacyAction” forum does not benefit from a mob of idiots who see those practicing established infosec principles as “tinfoil hat” nutters to heckle. Security-wise people with infosec degrees naturally and unavoidably appear “paranoid” to normies. These normies and hecklers can only get in the way in a workshop-centric forum with the mission of strategizing activist movements and protests. Fair enough if a “climate” forum has climate deniers butting heads with those who accept the climate-relevant science. That dialog is needed. But we don’t want climate deniers in a “climate ACTION” forum. They are only there to dilute and sabotage.. to side-track the discussion. A workshop is not interested in rhetoric from those who oppose their mission.
So the status quo of #Lemmy and #Kbin disservices activism.
---
Workaround 1 (Lemmy only):
Make an announcement community and make all participants a moderator. Bit crazy unless you really trust everyone involved.
Workaround 2 (Lemmy):
One community per instance using instance-specific registration control. Still too blunt, cumbersome, excludes mods who don’t have their own instance.
Question
Sometimes I click to subscribe to a community which then goes into a “subscription pending” state. What does that mean? As a moderator of some groups I never receive a signal that someone is requesting to subscribe.
---
BTW, the reason this enhancement request is not in the official bug trackers:
- Lemmy’s bug tracker is in MS Github (#deleteGithub)
- Kbin’s bug tracker is on codeberg, who silently deleted my account without warning or reason, and #Codeberg reg forces a graphical CAPTCHA (which fails on my non-graphical browser).
#lemmyBug #KbinBug
cross-posted from: https://links.hackliberty.org/post/609883
> This BBC interview has a #Cloudflare rep David Bellson who describes CF’s observations on internet traffic. CF tracks for example the popularity of Facebook vs. Tiktok. Neither of those services are Cloudflared, so how is CF tracking this? Apparently they are snooping on traffic that traverses their servers to record what people are talking about. Or is there a more legit way Cloudflare could be monitoring this activity?