Libraries
Peak inclusivity at public libraries was in 1995—2005. Exclusion is on the rise as libraries outsource tech
coffeeClean 4 months ago • 33%
Interesting perspective, but I’d tend to argue that the technologies such as WiFi have massively increased inclusiveness and accessibility for magnitudes more people than it has raised issues for.
Not in the slightest¹. It has reduced inclusiveness. The groups being excluded were previously given full and equal access. To argue that nighttime access is possible is to inherently advocate for exclusive access to those who would sit on the sidewalk with their device while people who need access by other means are denied. What a bizarre and obscure corner case. It’d be somewhat elitist to be selective like that. Human rights calls for equal access to public services (UDHR Art.21¶2). That means if a service cannot be offered to all demographics it should be offered to no one.
It’s really hair-splitting esoterics to be concerned about what library access there is at night time on the sidewalk. Maybe it’s fair enough to say outside of hours there is no sense of equal access. I don’t want to die on the nighttime access hill either way. My post concerns equality during the day when the library doors are open. If there really is a notable need for nighttime access from the sidewalk, that can also be deployed in an egalitarian way by mounting exterior ethernet ports and removing the captive portals.
(edit)¹ well, Wi-Fi in the 2000s was inclusive because it did not generally come with a captive portal and it was offered in parallel to ethernet. Having Wi-Fi is an essential part of being inclusive now that wi-fi-only devices exist. But the way they are doing it in 2024 is exclusive, depending on the library. Some libraries still today do not have captive portals but that’s becoming more rare as libraries prioritize a paperless agreement above equal access.
I am also concerned with outsourcing. But worried about cloudflare are pretty far down the list. Adobe controlled DRM on most ebooks, and even third party cloud based catalogues, are way more concerning.
You’re thinking about the barriers and inconveniences to you personally. But when I speak about exclusivity, I’m talking about different demographics of people getting different treatment and different service. It’s unacceptible for a public service to say “sorry, some people just do not make the cut for the profile of those we are including.. our public service is only for people who subscribe to private GSM service” (precisely the demographic less in need of public service). It’s better to pull the plug to ensure equality than to create unequal access.
The DRM problem is not a problem of exclusivity w.r.t the public library, AFAICT, because the library secures whatever DRM rights are needed equally for all patrons. DRM does not cause someone who cannot afford a mobile phone to be refused service. Unless a DRM mechanism were to require an SMS verfication -- then I would be with you on that because that would be discriminatory and exclusive. Although I’ve heard that some forms of DRM prevent reading a page more than once. I can imagine that someone with an impairment of some kind might need to read a page more times than someone else to absorb the same book. In that case, DRM would indeed be adding to the exclusivity problem and would need a remedy in that regard. If a library could not negotiate an egalitarian deal in that case, then the egalitarian remedy is to drop that book from the library’s catalog completely, as that would ensure equal access.
Lets face it, the half dozen people per million (if that) who care about the FLOSS status of thier WiFi hardware’s firmware, probably are technically capable enough to find a way to access library resources securely more than most people!
It’s not a technical problem. It’s an ethical problem. When a public funded service is forces people to run proprietary non-free software on their own devices, it’s an abuse of public funding to needlessly force people into the private sector. In the US, the American Library Association has a bill of rights that states people are not to be excluded from the library based on their views or beliefs. Designing a library to only cater for people who are ethically okay with running non-free proprietary software would undermine that principle. It would be comparable to a public service denying service to vegans because of their ethical viewpoints.
Libraries
Peak inclusivity at public libraries was in 1995—2005. Exclusion is on the rise as libraries outsource tech
coffeeClean 4 months ago • 50%
Wouldn’t direct access to a library’s network via Ethernet in an uncontrolled manner pose a security risk though?
You would have to detail why. Ethernet offers /more/ security by not exposing users’ traffic and by avoiding MitM to a reasonable extent. It’s far easier to spoof a Wi-Fi AP from next door or even a block away than it would be to to plant an ethernet attached MitM box, which means getting behind the drywall or breaking into a utility room. Not to mention the mass surveillance of all iOS devices collecting data, timestamps, location of every other WiFi device in range and feeding that to Apple. Ethernet is trivially immune to that collection, whereas Wi-Fi users are exposed without a countermeaure. They can dynamically change their MAC daily or whatever but that’s not the only data being collected by Apple.
(edit) It’s worth noting as well that the NSA actually advises people not to use Wi-Fi.
Also, while propriety Wi-Fi and other technology-related solutions are sometimes frustrating, many libraries are ultimately budget constrained, making the use of standardized solutions far more economical than custom ones.
Economics does not justify excluding some demographics of people¹. If a public funded service cannot offer service in an equitable way, it’s better to not offer the service at all. When a public library offers a service, assumptions are then made in other contexts that the whole public has that access. Governments operate on the assumption that people they serve have access, and they use that assumption to remove analog means of contact and service. Some government offices have already closed their over-the-counter service. How was it that they could afford it previously but not anymore? Those budgets are themselves set by assumptions, like assumptions that everyone carries a mobile phone.
¹ exceptionally, public funding cannot for example cover every heart transplant everyone needs. But the library does not face those kinds of extremes. Ethernet cable is cheap enough. Getting people to agree to terms of service the old fashioned way (paper) is cheap enough. Priorities have to be really screwed up to be willing to exclude someone from service to save money on paper agreements.
1913 - library established in Houston by a black community. Years later, the city disbanded the all 8 black board members and shut the library down 1939 - 5 black people thrown out of a Virginia library for “disturbing the peace” (they were quietly reading). 1961 - Geraldine Edwards Hollis and eight other students from historically-black Tougaloo College — a group known as the Tougaloo Nine — held a sit-in at a “whites-only” public library in Jackson, Mississippi, as an act of civil disobedience. 1970 - the first meeting of the Black Caucus of the American Library Association formed to address the fact that the ALA wasn’t meeting the needs of Black library professionals. The late 1990s started to become the sweet spot for library inclusion and governance. Everyone was welcome to access books and media without restriction. In the 2000s, technology emerged in public libraries in a quite inclusive way. There some libraries had PCs and some had ethernet and/or Wi-Fi (free of captive portals). Anyone could use any of those technologies. 2024: * Ethernet becomes nearly non-existent, thus excluding: * people running FOSS systems (which often lack FOSS Wi-Fi firmware) * people with old hardware * people who oppose the energy waste of Wi-Fi * people who do not accept the security compromise of Wi-Fi (AP spoofing/mitm, traffic evesdropping, arbitrary [tracking](https://www.scss.tcd.ie/doug.leith/apple_google.pdf) by all iOS and Android devices in range) * Wi-Fi service itself has become more exclusive at public libraries: * captive portals -- not all devices can even handle a captive portal, full stop. Some captive portals are already imposing TLS 1.3 so people with slightly older hardware cannot even reach the ToS page. Some devices cannot handle a captive portal due to DNS resolution being dysfunctional before the captive portal is passed and the captive portal itself is designed to need DNS resolution. * GSM requirement -- some public library captive portals now require patrons to complete an SMS verification. This of course excludes these demographics of people: * People who do not *own* a mobile phone * People who do not *carry* a mobile phone around with them * People who do not subscribe to mobile phone service (due to poverty, or for countless privacy reasons) * People who object to disclosing their mobile phone number and who intend to exercise their right to data minimisation (under the GDPR or their country’s version thereof) * Web access restrictions intensified: * e-books outsourced to Cloudflared services, thus excluding all demographics of people who Cloudflare excludes. * Invidious blocked. This means people who do not have internet at home have lost the ability to download videos to watch in their home. * Egress Tor connections recently blocked by some libraries, which effectively excludes people whose systems are designed to use Tor to function. So if someone’s email account is on an onion service, those people are excluded from email. There’s a bit of irony in recent developments that exclude privacy seekers who, for example, deliberately choose not to have a GSM phone out of protest against compulsory GSM registration with national IDs, because the library traditionally respects people’s privacy. Now they’re evolving to actually deny service to people for exercising their privacy rights. There needs to be pushback to get public libraries back on track to becoming as inclusive as they were in the 1990s. A big part of the problem is outsourcing. The libraries are no longer administrating technology themselves. They have started outsourcing to tech giants like Oracle who have a commercial motivation to save money, which means marginalising demographics of people who don’t fit in their simplified canned workflow. When a patron gets excluded by arbitrary tech restrictions, the library is unable to remedy the problem. Librarians have lost control as a consequence of outsourcing. One factor has improved: some libraries are starting to nix their annual membership fee. It tends to be quite small anyway (e.g. $/€ 5/year), so doesn’t even begin to offset those excluded by technology.
coffeeClean 4 months ago • 50%
Hate to be a party pooper but the author is a bit off. From the article:
It’s a place I can get free wifi and where I don’t have to explain myself to anyone in any way.
This is precisely where libraries demonstrate poor governance.
First of all by offering Wi-Fi and not ethernet the library discriminates against people with old hardware, people who oppose the non-FOSS firmware that Wi-Fi cards depend on as well as those who don’t want to expose their traffic to all eavesdroppers in range and those who prefer to avoid spoofed APs and those who would rather be less wasteful with energy. I do not think I’ve encountered any library in the past decade that intentionally offer ethernet. The very few I’ve encountered with open ethernet ports apparently offer it by accident (ports that were likely meant for the libraries own assets but unused and left inadvertently connected).
Even if you are in the included group who are happy to see ethernet users marginalised, among Wi-Fi users are those who are discrimated against because they do not have a mobile phone, thus cannot get past the Wi-Fi captive portal that demands SMS verification. Which also inherently discriminates against people whose devices cannot handle captive portals as well. So libraries are less of a refuge from corporate bullshit than they were in the past.
And that we can do it without a profit motive, simply because we think that’s the way it ought to be.
It’s great that the library itself is non-profit. But that only mitigates part of the problem brought by corporate commercial greed. The library needs to evolve to:
- help people find refuge from tech giants, which means not imposing mobile phones on the public and ideally go as far as offering access to FOSS PCs. It should be mostly FOSS PCs, and perhaps 1 or 2 Windows and MACs for those who have various special needs. Most libraries are 100% MS Windows with Chromium (possibly Firefox as an alternative) and the search engine default is Google. So library visitors are still being immersed in the same exploitive commercial environment that dominates homes and workplaces.
- the library blocks Youtube front-ends like Invidious but not Youtube, which ensures delivering an a profitable audience to Google. I realise the library has to avoid copyright violations, but Invidious is not a clear offender. It’s murky gray area but the library should be fighting for the people considering Invidious nodes are not being shut down which highlights the weakness of Google’s position.
- mention of lending out Rokus is a double-edged sword. Yes it’s keeping pace with the times to get people access to streams but Roku is a smart TV which doubles as spyware designed to enrich corporations. I’m not sure if there is a FOSS alternative. I’m tempted to say Kodi but it would then have to be installed on portable hardware that the library could lend.
- cut ties with all e-book suppliers who lock their books up into Cloudflare’s exclusive walled garden. Cloudflare should not be a gatekeeper for who gets access to e-books.
Our governmental structures and agencies should not be in the service of business,
Indeed. But when a library excludes those without mobile phones, they are serving the telephony industry and undermining the human right to equal access to public services.
The author himself, J.Hill, deployed this blog from a website that is inside an exclusive walled garden that discriminates against some demographis of people. I agree with his push to defend libraries from right-wing assholes and in that sense we are united. But a fight is also needed within the library systems to stop libraries from discriminating against some classes of people. They are outsourcing their technology to tech giants who have made library access exclusive.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 4 months ago • 100%
In that sense, it implies that we were encroaching on his space, when in fact he entered this thread (like his handle: a bulldozer) to demand that people recognize an approach to sysadministration that does not respect equal rights, privacy, or the environment, and ultimately undermines human rights and promotes consumerism to ease his job at his competency level, as if the public is expected to serve him. It’s not his lawn in either sense of the meaning.
He made it quite he expects everyone to go through hoops to make his job convenient when he said:
“That doesn’t change the fact that Networks and Systems are not configured for your convenience”
I can imagine that the guy wants to secure his network and is maybe paranoid about people breaking in which seems fair to me,
It would be a malpractice of security. Security is about confidentiality, integrity, and availability. To reduce availability needlessly is to work against security. If availability were not essential to security, then you would just unplug the all machines, making the internet unusuable to everyone, and call it “secure”. A competent admin can securely offer internet service to people without phones, and people without a wifi card.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 4 months ago • 100%
It’s a good point about the irrational Tor hostility. But note the more perverse absurdity with his comment: that a public library is “his lawn”. If his inability and unwillingness to equally serve the whole public would be just in the private sector, there would be no issue because everyone he disservices can refuse to do business with him.
What’s sickening here is he said “I’m someone in IT for a Public Library”. So he is operating a public service in an exclusive manner telling people /get off his lawn/, which was financed with public money. And ~7+ of 8 people are okay with that.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 33%
I see a lot of downvotes on your comments on this thread and I wonder if it’s due to differences in nationality/geography/jurisdiction.
Guess I should answer this. The enormous class of people with mobile phones (likely 100% of those in this channel) are happy to be in the included group and amid any chatter about expanding the included group to include those without a phone (a segment they do not care about), they think: “that extra degree of egalitarian policy to support a more diverse group will cost more and yield nothing extra to me; yet that extra cost will be passed on to me.”
Which is true. And very few people among them care about boycott power because it’s rarely used by willful consumerist consumers of tech and telecom svc. But the ignorance is widespread failure to realise that as mobile phones become effectively a basic requirement for everyone, the suppliers will have even less incentive to win your business. The duopolies and triopolies can (and will) increase prices and reduce service quality as a consequence of that stranglehold. Most people are too naïve to realise the hold-out non-mobile phone customers are benefiting them even from the selfish standpoint of the mobile phone customers. And the fact that they are paying an invisible price with their data doesn’t occur to most people either, or how that loss of privacy disempowers them.
They will pay more in the end than if they had supported diversity and egalitarian inclusion.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 33%
I see that the relevant websites (FCC and lifelinesupport.org) both block Tor so you can’t be poor in need of the Lifeline and simultaneously care about privacy. Many parts of the US have extremely expensive telecom costs. I think I heard an avg figure of like $300/month (for all info svcs [internet,phone,TV]), which I struggle to believe but I know it’s quite costly nonetheless. One source says $300/month is the high end figure, not an avg. Anyway, a national avg of $144/month just for a mobile phone plan is absurdly extortionate.
About Lifeline:
Lifeline provides subscribers a discount on qualifying monthly telephone service, broadband Internet service, or bundled voice-broadband packages purchased from participating wireline or wireless providers. The discount helps ensure that low-income consumers can afford 21st century connectivity services and the access they provide to jobs, healthcare, and educational resources.
So they get a discount. But you say free? Does the discount become free if income is below a threshold? Do they get a free/discounted hardware upgrade every 2-3 years as well, since everyone is okay with the chronic forced obsolescence in the duopoly of platforms to choose from? In any case, I’m sure the program gets more phones into more needy hands, which would shrink the population of marginalized people. That’s a double edged sword. Shrinking the size of a marginalized group without completely eliminating it means fewer people are harmed. But those in that group are further disempowered by their smaller numbers, easier to oppress, and less able to correct the core of the problem: not having a right to be analog and be unplugged (which is an important component of the right to boycott).
This topic could be a whole Lemmy community, not just a thread. In the US, you have only three carriers: AT&T, Verizon, and T-Mobile. I’ve seen enough wrongdoing by all 3 to boycott all 3. I would not finance any them no matter how much money I have. T-Mobile is the lesser of evils but it’s wrong to be forced to feed any of the three as an arbitrary needless precondition to using the library’s public wifi. It’s absolutely foolish that most people support that kind of bundling between public and private services.
US govs do not (AFAIK) yet impose tech on people. I think every gov service in the US has an analog option, including cash payment options. That’s not the case in many regions outside the US. There are already govs that now absolutely force you to complete some government transactions online, along with electronic payments which imposes bank patronisation, even if you boycott the banks for investing in fossil fuels and private prisons. And if you don’t like being forced to use their Google CAPTCHA (which supports Google, the surveillance advertiser who participates in fossil fuel extraction), that’s tough. Poor people are forced to use a PC (thus the library) to do public sector transactions with the gov, as are a segment of elderly people who struggle to use the technology. There is also a segment of tech people who rightfully object, precisely because they know enough about how info traverses information systems to see how privacy is undermined largely due to loss of control (control being in the wrong hands). It’s baffling how few people are in that tech segment.
So the pro-privacy tech activists are united with the low-tech elderly and the poor together fighting this oppression (called “digital transformation”) which effectively takes away our boycott power and right to choose who we do business with in the private sector. A divide and conquer approach is being used because we don’t have a well-organised coalition. Giving the poor cheaper tech and giving assistance to the elderly is a good thing but the side effect is enabling the oppression to go unchallenged. When really the right answer in the end is to not impose shitty options in the first place. It’s like the corp swindle of forced bundling (you can only get X if you also take Y). You should be able to get public wifi without a mobile phone subscription.
The UDHR prohibits discrimination on the basis of what property you have. The intent is to protect the poor, but the protection is actually rightfully bigger in scope because people who willfully opt not to have property are also in the protected class.
It’s all quite parallel to Snowden’s take. The masses don’t care about privacy due to not really understanding it.
“Ultimately, arguing that you don't care about the right to privacy because you have nothing to hide is no different than saying you don't care about free speech because you have nothing to say.” ― Edward Snowden
The idea that activists need both free speech and privacy in order to fight for everyone’s rights is lost on people making the /selfish/ choice to disregard privacy. All those mobile phone users who don’t give a shit about mobile phones being imposed on everyone are missing this concept. The choice to have a mobile phone is dying. It’s gradually and quietly becoming an unwritten mandate.
Banking is also becoming bound to having a mobile phone. There are already banks who will not open account for those without a mobile phone. So we are losing the option to have a bank account but not a mobile phone.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 33%
You edited in the “wait five or ten minutes” after I had already replied.
I know five min was in the original version. Not sure if I added the ten but certainly it was not after you posted this. You are seriously paranoid and should get help for that.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 33%
Why are you even in the library to begin with if you’re so opposed to how they manage their network?
How does one know how they manage their network before entering the library? The libraries that have ethernet /never/ advertise it. Only wi-fi is ever advertised. I have never seen a library elaborate on their wifi preconditions (which periodically change). This info is also not in OSMand, so if you are on the move and look for the closest library on the map, the map won’t be much help apart from a possible boolean for wifi. Some libraries have a captive portal and some do not. Among those with captive portals, some require a mobile phone with SMS verification and some do not. But for all of them, the brochure only shows the wifi symbol. You might say “call and ask”, but there are two problems with that: you need a phone with credit loaded. But even if you have that, it’s useful to know whether ethernet is available and the receptionist is unlikely to reliably have that info. Much easier to walk in and see the situation. Then when you ask what will be blocked after you get connected, that’s another futile effort that wastes time on the phone. It really is easier and faster to pop in and scope out the situation. Your device will give more reliable answers than the staff. But I have to wonder, what is your objection to entering a library to reliably discover how it’s managed in person?
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 33%
Stop lying.
I said “wait five or ten minutes”. I’m seeing a 9m1s span. I don’t really feel compelled to be more accommodating than that. Maybe you can write to Jerry and ask to configure it so edits are blocked after 1 minute if it really bothers you. Otherwise if you don’t like the policy of the node, you are free to leave.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 25%
My client says it was created at 21:24:02 GMT and modified at 21:25:12. Instead of using a stopwatch which you somehow screwed up, just mouse over the time. The popup will show you a span of 1 minute and 10 seconds.
(edit) strange; after I refresh the screen the /create/ timestamp changed. Surely that’s a bug in Lemmy. The creation timestamp should never change. nvm.. just realized I was looking at the wrong msg.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 25%
Calm down. It’s a new comment that just came in so of course I’m going to edit it a few times in the span of the first minute or two as I compose my answer. If you wait five or ten minutes you’ll get a more finished answer.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 33%
The proof is in the money trail. If the library’s funding traces to a tax-funded government, it is a public service that encompasses all services offered by that institution. It’s also in state or national law that legislates for libraries to exist, which differs from one state to another.
If you want to find a clause that says “only people with wifi hardware may access the internet, and only if they have a mobile phone”, I suspect you’ll have a hard time finding that. At best, I could imagine you might find a sloppily written law that says “libraries shall offer wifi” without specifying the exclusion of others. But if you could hypothetically find that, it would merely be an indication of a national or state law that contradicts that country’s signature on the UDHR. So it’s really a pointless exercise.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 50%
Yeah I’ve done the same in one case. Librarian green lit me plugging into the rj45 but it turned out to be a dead port. I might have been able to get permission to hijack an occupied port to an unoccupied machine but just opted to bounce instead.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 20%
The wifi is for public use. The Ethernet isn’t. How is that so hard to understand?
How is it hard to understand that those two undisputed facts are actually a crucial part of my thesis? Of course I understand it because it’s the cause for the problems I described and my premise. It’s why this thread exists.
If that weren’t the case, the only notable problem would be with the mobile phone precondition on captive portals.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 25%
Time to wake up to reality. Everyone has access, the method of access isn’t discriminating, nor do you have any say in it.
That’s not reality. The reality is everyone has partial access (Firefox on a shared Windows PC only), while some people have full access via both public resources.
If you want to gain anything from this conversation, try to at least come to terms with the idea that Firefox is not the internet. The internet is so much more than that. Your experience and information is being limited by your perception that everything that happens in a browser encompasses the internet.
In other words, it’s public, free for all, and the way they set it up.
It’s not free. We paid tax to finance this. The moment you call it free you accept maladministration that you actually paid for.
If you don’t like the free service, don’t use it. It not being how you like it isn’t wrong in any way, that’s your problem.
You’re confusing the private sector with the public sector. In the private sector, indeed you simply don’t use the service and that’s a fair enough remedy. Financing public service is not optional. You still seem to not grasp how human rights works, who it protects, despite the simplicity of the language of Article 21.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 14%
Could I be in the wrong? No, it must be literally everyone else in this entire thread / national library network.
Is your position so weak that you need to resort to a bandwagon fallacy?
Grow up.
and an ad hominem?
You demonstrate being a grown up by avoiding ad hominems in favor of logically sound reasoning.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 33%
Their terms require a phone so yes, on their terms.
I keep a copy of everything I sign. The ToS I signed on one library do not require a mobile phone. It’s an ad hoc implementation that was certainly not thought out to the extent of mirroring the demand for a mobile phone number into the agreement. And since it’s not in the agreement, this unwritten policy likely evaded the lawyer’s eyes (who likely drafted or reviewed the ToS).
Why would they make an exception for anyone?
Because their charter is not: “to provide internet service exclusively for residents who have mobile phones”.
And why would they want to deal with paper agreements for WiFi?
Paper agreements:
- do not discriminate (you cannot be a party to a captive portal agreement that you cannot reach)
- are more likely to actually be read (almost no one reads a tickbox agreement)
- inherently (or at least easily) give the non-drafting party a copy of the agreement for their records. A large volume of text on a tiny screen is unlikely to even be opened and even less likely to save it. Not having a personal copy reduces the chance of adherence to the terms.
- provide a higher standard of evidence whenever the agreement is litigated over
You don’t have to be a member to use WiFi, someone else could have given you the password if there even is one
That’s not how it works. The captive portal demands a phone number. After supplying it, an SMS verification code is sent. It’s bizarre that you would suggest asking a stranger in a library for their login info. In the case at hand, someone would have to share their mobile number, and then worry that something naughty would be done under their phone number, and possibly also put that other person at risk for helping someone circumvent the authentication (which also could be easily detected when the same phone number is used for two parallel sessions).
If someone is doing something illegal it’s gonna involve the library if you get caught (that’s why the phone number but maybe they are just being shitty with it). Not worth the risk.
Exactly what makes it awkward to ask someone else to use their phone.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 33%
You have, throughout your comments, repeatedly spoken down toward librarians and libraries.
Again, you’re not quoting. You’ve already been told it’s not the case. You need to quote. You replied to the wrong message.
but you’re certainly not painting them as “trying their best”
There are many librarians with varying degrees of motivation. I spoke to one yesterday that genuinely made an effort to the best of their ability. I cannot say the same for all librarians. When I describe a problem of being unable to connect, some librarians cannot be bothered to reach out to tech support, or even so much as report upstream that someone was unable to connect.
“worth having an adult conversation with instead of misrepresenting my situation intentionally”
This is a matter of being able to read people. I don’t just bluntly blurt out a request. I start the conversation with baby steps (borderline small talk) describing the issue to assess from their words, mood, and body language the degree to which they are likely to be accommodating whatever request I am building up to. Different people get a different conversation depending on the vibe I get from them. Even the day of week is a factor. People tend to be in their best mood on Fridays and far from that on Mondays.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 40%
You’ll have to quote me on that because I do not recall calling them baddies. I have spotlighted an irresponsible policy and flawed implementation. It’s more likely a competency issue and unlikely a case of malice (as it’s unclear whether the administration is even aware that they are excluding people).
If they are knowingly and willfully discriminating against people without mobile phones, then it could be malice. But we don’t know that so they of course have the benefit of any doubt. They likely operate on the erroneous assumption that every single patron has a mobile phone and functional wifi.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 12%
That’s a you and your hardware problem, not a public library IT problem. You need to purchase hardware that is adequately supported by your chosen Operating System.
Forcing people to buy more hardware is yet another variation of discrimination against the poor. Imposed needless consumerism is also reckless from an environmental standpoint. If you choose not to step your competency up to the level needed to serve the public without costing them more money, you’re only getting off the hook in the view of right-wing conservatives who are happy to have library service cheapened at the expense of equal rights.
Not being “your problem” is simply a problem of an ill-defined contract that allows irresponsible policy.
This is a you and your hardware problem. Buy hardware that is adequately supported by your chosen Operating System.
It’s not a hardware problem. It’s an ethics problem, and the problem is on your part whether you choose to acknowledge it or not. If you lack the higher level of competency needed to practice your trade ethically, you should try to gain the competency you need to be inclusive of people in different economic standings and diverse hardware.
This one is a semi-serious complaint however I’ve never seen a portal system where the Librarian’s didn’t have the ability to issue a day pass for use.
Not a single public library in my area has a day pass option as an alternative authentication. If the patron has no phone, the library helpless and the user is not getting online with their own device.
Aside from that you sound like someone who should be technically able to stand up an ephemeral phone number for the purpose of receiving SMS.
There is no way to get a phone or an active SIM chip gratis in my area. The only difference between a burner phone and a non-burner phone in my area is you quit using the burner phone early. It has all the same problems as a permanent phone. You can get a pinger number online, but it only works if you’re already online. Apart from that, your suggestion is absurd as an official policy in response to public complaint about phoneless people being officially excluded.
Same as above.
It fails here too, for the same reason.
What an absolutely petty complaint.
What an absolutely pathetic failure to support a claim to the contrary.
I’d bet that as soon as you enter a code your VPN stops being blocked. They’re not trying to block VPN they are preventing you from sidestepping their ToS.
This is not a /me/ problem. You are responding to a list of demographics of people who are excluded from a public service. If not every single person has a gratis VPN (and they don’t), this is a broken argument. To say every user must acquire a VPN because you cannot provide a means of access that thwarts the most trivial MitM possible is a reckless abandonment of duty.
I’ve dealt with Patrons like you before and the instant someone starts yammering at me about ClearNet / Tor I know exactly what kind of person I’m dealing with.
So your emotional bias adversely hinders your judgement and ability to service a diverse range of users. It shows.
You selected your path for whatever reasons you chose and the inconveniences that come with that path are yours to deal with. Suck it up buttercup, you weren’t promised that a privacy respecting internet lifestyle would be easy or convenient.
Inconveniences are borne out of the kind of incompetent infosec that you’re peddling. A competent tech firm can do this job without violating data minimisation principles and without violating Article 21 of the UDHR.
BTW if you’d plugged your laptop into one of my systems you’d have gotten vlan’d into the same Captive Portal System that the WiFi has which is precisely how any publicly available Ethernet port should function. Your little length of wires coated in vinyl with plastic shoved on the ends still wouldn’t have gotten you where you wanted to go.
And that would still be violating peoples’ Article 21 rights to equal access. Imposing a mobile phone is among the injustices I’ve mentioned. I would still favor the ethernet regardless of the captive portal for many of the reasons I’ve mentioned. In the very least it avoids discriminating against people without functioning wifi h/w.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 25%
I have to say I didn’t downvote you as you’ve been civil and informative so far. But I’m not sure how to cite/quote from the UDHR as though it’s not law. I named the article and pasted the text. For me whether the enforcement machinery is in force doesn’t matter w.r.t to the merits of the discussion. From where I sit, many nations signed the UDHR because it has a baseline of principles worthy of being held in high regard. When the principles are violated outside the context of an enforcement body, the relevance of legal actionability is a separate matter. We are in a forum where we can say: here is a great idea for how to treat human beings with dignity and equality, and here that principle is being violated. There is no court in the loop. Finger wagging manifests from public support and that energy can make corrections in countless ways. Even direct consumer actions like boycotts. Israel is not being held to account for Gaza but people are boycotting Israel.
I guess I’m not grasping your thesis. Are you saying that if a solidly codified national law was not breached, then it’s not worthwhile to spotlight acts that undermine the UDHR principles we hold in high regard?
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 14%
You can’t claim shit about equality for all and access without materials, when discussing byod. Make up your mind.
There is PC access, and then there is byod access. It’s a false dichotomy to demand choosing one or the other particularly when only one of the two is available to everyone, and harmful to people’s rights if you simultaneously design a system of workflow on the assumption that one replaces the other interchangeably.
They are different services for different purposes. Don’t let the fact that some tasks can be achieved with both services cloud the fact that some use-cases cannot.
Everyone has access
Everyone has access to a PC running Firefox. Not everyone has BYoD WAN service access.
byod is covered for 99% as extra convenience.
Firefox is not the internet.
It’s not just convenience. It’s the capability and empowerment of controlling your own applications. If the public PC doesn’t have a screen reader and you are blind, the public PC is no good to you and you are better served with BYoD service. If you need to reach someone on Briar, a Windows PC with only Firefox will not work.
You aren’t being treated poorly, instead, you have unreasonable expectations.
This remains to be supported. I do not believe it’s reasonable to only serve people with mobile phones. Thus I consider it a reasonable expectation that people without a subscribed mobile phone still get BYoD WAN service.
Data persists both in the cloud, or on a memory stick. Free options exist.
None of the PCs in any library I have used will execute apps that you bring on a USB stick (but even if they did, the app you need to run may not be compatible with Windows). Also some library branches disallow USB sticks entirely. So a restricted Windows PC cannot replace controlling your own platform, regardless of the convenience factor.
(edit) But strictly about convenience, I also would not say it’s fair for a public service to offer extra convenience exclusively to people who have a subscribed mobile phone and not to those without one. That would still be unequal access even if you disregard the factors not related to convenience. It’s still discriminating against a protected class of people.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 12%
That’s not equal access. Everyone has equal access to the PCs running Firefox, but not everyone has equal access to BYoD internet service.
Is someone claiming we only need Firefox? If so, then you won’t mind if we scrap wifi altogether, right? BYoD internet service enables people to keep a data store with them which then connects periodically to operate on the persistent data in a collaborative way, which also empowers people to control the applications that are installed. That’s a different public service for difference purposes than a shared PC where your data does not persist and you cannot control the apps.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 23%
After reading your post, I would say, no harm intended, just don’t do it again.
You may be misunderstanding the thesis. This is not really about staying out of trouble. Or more precisely, as an activist up to my neck in trouble it’s about getting into the right trouble. The thesis is about this trend of marginalising people with either no phone and/or shitty wifi gear/software and a dozen or so demographics of people therein who do not so easily give up their rights. It’s about exclusivity of public services funded with public money. Civil disobedience is an important tool for justice outside of courts.
The security matter is really about competency and cost. The main problem is likely in the requirements specification conveyed to the large tech firms that received the contract. From where I sit, it appears they were simply told “give people wifi”, probably by people who don’t know the difference between wifi and internet. In which case the tech supplier should have been diligent and competent enough to ask “do you want us to exclude segments of the public who have no wifi gear and those without phones?”
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 50%
The UDHR is not a treaty, so it does not create any direct legal bindings.
Sure, but where are you going with this? Legal binding only matters in situations of legal action and orthogonal to its application in a discussion in a forum. Human rights violations are rampant and they rarely go to The Hague (though that frequency is increasing). Human rights law is symbolic and carries weight in the court of public opinion. Human rights law and violations thereof get penalized to some extent simply by widespread condemnation by the public. So of course it’s useful to spotlight HR violations in a pubic forum. It doesn’t require a court’s involvement.
The judge who presided over the merits of the Israel genocide situation explained this quite well in a recent interview. If you expect an international court to single-handedly remedy cases before it, your expectations are off. The international court renders judgements that are mostly symbolic. But it’s not useless. It’s just a small part of the overall role of international law.
The article you quote may have been excluded, overwritten or rephrased in your jurisdiction.
I doubt it. It’s been a while since I read the exemptions of the various rights but I do not recall any mods to Article 21. The modifications do not generally wholly exclude an article outright. They typically make some slight modification, such as some signatories limiting free assembly (Art.20 IIRC) to /safe/ gatherings so unsafe gatherings can be broken up. I would not expect to see libraries excluded from the provision that people are entitled to equal access to public services considering there is also Article 27:
“Everyone has the right freely to participate in the cultural life of the community, to enjoy the arts and to share in scientific advancement and its benefits.”
The European HR convocations take that even further iirc.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 18%
I answered this in another reply. The PC room was closed.
In my area the PCs are closed part of the day for some reason (in several libraries), when the library is open for books and wifi. There are two sets of opening hours.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 7%
You set a great example of getting mad at a removed eating crackers.
I merely tried to get online using an ethernet cable. I didn’t get hostile. I was calm. And because I was calm, the librarian became calm. The only hostility was in the librarian’s single opening comment to me, and what you see in this thread.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 8%
I guarantee that a librarian would have helped you if you told them you didn’t have your phone on you.
I did tell the 1st librarian I did not have a phone. It’s what led up to green lighting my request to plugin.
I’ve run into this at other libraries because I do not carry my phone. Whenever I ask how to get online without a phone, the answer is to use their PCs (if they exist, and if they are open [as they are closed part of the day]). That’s it. There is no upstream support call. They apparently don’t even give feedback to management that someone was denied access for not having a phone.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 16%
That “right” is exclusively available to people who:
- have a mobile phone
- who carry it with them
- who have working wifi hardware
The Universal Declaration of Human Rights has no such limitation on Article 21.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 9%
You can use it but on their terms.
Not without a phone.
Captive portal is likely making you agree to not abuse the service.
Have you forgotten that an agreement can be made on paper?
Nothing about a captive portal requires wifi. There are many ways to get that agreement. Neglecting to make the agreement part of the ToS when you become a member is just reckless.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 14%
So the protected class they are discriminating against here is “doesn’t want to use wifi”?
The protected class is the poor. The UDHR specifically protects people from discrimination on the basis of property. You cannot treat someone different under the UDHR for owning less property than someone else with regard to all the rights enshrined in the UDHR. Only serving people who bought a mobile phone and paid for a subscription violates that provision.
You had the means to access the Internet, you chose not to use them.
I did not have a mobile phone on me. I could have gone home to fetch my phone because incidentally I happened to have a phone with service at home. But I would not have had time to return to the library and complete my task before it closed.
I’ve also gone over 6 months with no phone service at all sometimes. If I were in one of those time periods, connecting would have been impossible. My phone access is touch and go. I let my service die whenever nothing critical comes up that demands it for a period of time.
And I will do it again. Not having a phone is a goal I will continue to meet, off and on, because it’s important to periodically test whether we have a right to unplug. It’s especially important to test this if you live in a GSM registration part of the world.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 12%
Well, you were trying to bypass one of their security measures.
I was not carrying my phone. Thus bypassing the reckless policy of a tax-funded public resource to exclusively serve people who entered the private marketplace to obtain mobile phone service, in violation of article 21¶2 of the Universal Declaration of Human Rights:
“Everyone has the right of equal access to public service in his country.”
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 10%
Someone should let the IT staff know so they can properly block those services on ethernet as well.
Someone should let the IT staff know that wi-fi does not work for everyone, including:
- People running a free software platform that lacks support for a wifi NIC that needs a proprietary driver and firmware
- People running free software who ethically object to running the proprietary non-free driver and firmware their wifi NIC requires
- People without a mobile phone to perform the captive portal-mandated SMS verfication
- People with a mobile phone but who want to exercise their GDPR right to data minimization
- Climate activists who prefer not to spend 30 times more energy needed for wi-fi radios
- People who want the security of other wi-fi users not eavesdropping on their traffic by simply pointing a yagi antenna from a block away (on a network that blocks the VPNs that would protect them from that on wi-fi)
(edit)
- People who cannot get past the captive portal for other reasons, such as the captive portal imposing TLS 1.3 on older software (forced obsolescence), or anything else that fails technically, like DNS breakage preventing the captive portal’s hostname from resolving.
And because simply turning on Wi-Fi in public enables all iPhones in your range to automatically snoop, collect your wi-fi params including SSIDs your device looks for before sending it to Apple, along with GPS fix and timestamp (according to research), there are people who:
- for privacy reasons object to being snooped on generally in this way
- boycott Apple already for any number of reasons, and who have enough discipline and resolve to oppose feeding profitable data to Apple -- regardless of whether they actually care about the disclosure.
- boycott the fossil fuel industry, including Google who supplies AI to Totaal Oil to find drilling locations, and thus oppose feeding Google by way of Androids in range doing the same collection as Apple. (note it’s disputed whether Google actually mirrors Apple on this to the extent of Apple)
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 3%
The librarian who said it was okay to plugin (which they likely understood to mean plugin an A/C power cord) was young, not as senior as the edgy librarian. I’m not going to take down a kid and get them in trouble for not picking apart what it means when someone asks if they can “plug-in”.
People like Trump will throw his supporters under the bus when self-defense calls for it. I will not.
What would the point be? I didn’t need a defense. I got scolded and was walking out. Since I was calm, the librarian became calm. Police were not called and I was not detained. And if that had happened, I would have exercised my right to remain silent anyway.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 9%
Private libraries are quite rare. I think only one employer I worked for had an on-site private library where the assets are not publicly owned. It’s rare. Most libraries are public.
My post is about public libraries, which were financed with public money. It’s worth noting the Universal Declaration of Human Rights:
Article 21
¶2) Everyone has the right of equal access to public service in his country.
That includes public libraries. It’s disgusting that you endorse discriminating against people without mobile phones and private subscriptions in the course of accessing public resources.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 14%
I’ve asked librarians a full range of tech questions about what works, what’s blocked, what’s allowed.. they /never/ have a clue because of outsourcing. Their guess is as good as mine. In the 90s, I would say you are spot on. Librarians should have answers. Things have evolved to where the policy is decided non-transparently, it’s outsourced to an unreachable company, and librarians are simply as uninformed as the public. Trial and error. If you read the AUPs it never says Tor is banned at libraries, for example, but they simply block it. Experimentation is the way people get answers in my area.
So knowing that librarians don’t have deep tech info, or even basic tech info, and that they also cannot escalate questions, talking to them is really where time is wasted.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 0%
And what does trust have to do with it?
I think they mean trust in the librarian to genuinely know the policy and what should work. They tend not to in this case because ethernet has become obscure enough to be an uncommon question, if ever.
Another library had ethernet ports all down the wall next to desks. They were dead and no one used them. It was obvious that the librarian had no clue about whether the ports were even supposed to function. When I said they are dead and asked to turn them on or find out what’s wrong, they then figured that if the ports don’t work, it must be intentional. So the librarian’s understanding of the policy was derived from the fact that they were dysfunctional. Of course if they were intended to work but needed service, ethernet users are hosed because the librarian’s understanding of policy is guesswork. There is no proper support mechanism.
I asked a librarian at another library: I need to use Tor. Is it blocked? I need to know before I buy a membership. Librarian had no idea. They just wing it. They said test it. Basically, if it works, then it’s acceptable. The functionality becomes the source of policy under the presumption that everything is functioning as it should.
Since ethernet has been phased out, modern devices no longer include an ethernet NIC, and there are places to plug into A/C with no ethernet nearby, the librarians and the public are both conditioned to be unaware of ethernet. So the answer will only be either: no or test and see.
cybersecurity
Has ethernet become illegitimate? A librarian flipped out after spotting me using ethernet
coffeeClean 5 months ago • 13%
When I entered I spoke to a different librarian about the locked PC room (due to a holiday or something). They said I could use wifi but need to give a phone number to a captive portal, which I already knew. My phone was not on me so I said: is it okay if I plug in over there by the catalog PCs? They said yes. Revealing what I mean by "plugging in”, well, i was vague for a reason. I know the population has become ethernet-hostile¹ so indeed asking for forgiveness is better than asking for permission in this situation.
¹ Another library in the area has ethernet ports but they are just decoys (dead ports). I asked the librarian what the problem is, why they are disabled, and whether we can turn them on. Librarian was helpless, and said “use wifi”, which didn’t work for me for different reasons than the other library. But the librarian basically said in so many words “not our problem.. you can just use wifi.” At another library, I was able to connect but Tor was blocked. I tried to get support from the librarian. They had no clue but were also unwilling to lead me to someone who could give support. The way it works around here is the info systems are outsourced to some unreachable tech giant, and the librarians are rendered helpless. If the SSID does not appear, the librarian can send an email to someone to say it’s down, and that’s about the full extent of their tech capability.
I plugged into ethernet (as wifi w/captive portal does not work for me). I think clearnet worked but I have no interest in that. Egress Tor traffic was blocked and so was VPN. I’m not interested in editing all my scripts and configs to use clearnet, so the library’s internet is useless to me (unless I bother to try a tor bridge). I was packing my laptop and a librarian spotted me unplugging my ethernet cable and approached me with big wide open eyes and pannicked angry voice (as if to be addressing a child that did something naughty), and said “you can’t do that!” I have a lot of reasons for favoring ethernet, like not carrying a mobile phone that can facilitate the SMS verify that the library’s captive portal imposes, not to mention I’m not eager to share my mobile number willy nilly. The reason I actually gave her was that that I run a free software based system and the wifi drivers or firmware are proprietary so my wifi card doesn’t work¹. She was also worried that I was stealing an ethernet cable and I had to explain that I carry an ethernet cable with me, which she struggled to believe for a moment. When I said it didn’t work, she was like “good, I’m not surprised”, or something like that. ¹ In reality, I have whatever proprietary garbage my wifi NIC needs, but have a principled objection to a service financed by public money forcing people to install and execute proprietary non-free software on their own hardware. But there’s little hope for getting through to a librarian in the situation at hand, whereby I might as well have been caught disassembling their PCs.
coffeeClean 5 months ago • 100%
Thanks for digging into the problem. So in the end, it looks like you’ve worked it out that the content is getting archived but it’s just not rendering, correct? It used to render. Apparently the Mastodon JavaScript got too fancy and broke the use of archival.
I wondered at first if Mastodon was deliberately archive-hostile. The sensible ways to block archival are host-specific¹, so I guess it’s still unclear.
¹ (for lack of better phrasing… I don’t mean to imply it’s sensible to block archival to begin with)
IMO this is a #netneutrality issue due to lack of access equality. People with old phones are discriminated against. cross-posted from: https://infosec.pub/post/11021006 > … > TLS-encumbered captive portal (transit service) > --- > A transit service offered wi-fi but the network forcibly redirected me to a > captive portal that triggers this error: > ``` > net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH > ``` > I tried a couple browsers and tried rewriting the `https://` scheme as `http://` but SSL redirect was forced consistently. The error apparently [implies](https://web.archive.org/web/20240318220527/https://phoenixnap.com/kb/fix-err-ssl-version-or-cipher-mismatch) my phone’s browser can’t do TLS 1.3. > > It seems like a shitty move for a transit service to require passengers to use TLS 1.3 just to tick a fucking box that says “I agree” (to the terms no one reads anyway). Couple questions: > > * I’m generally in the /protect everything by default/ school of thought. But I cannot get my head around why a captive portal where people just tap “I agree” would warrant disclosure protection that could hinder availability. In reality, I don’t really know what the captive portal at hand requests.. maybe it demands people’s phone# or email, in which case it might make sense (though I would object to them collecting that info in a GDPR region in the 1st place). > > * Is there a good reason for a captive portal to require TLS 1.3? It seems either the network provider does not trust their own network, or they’re simply incompetent (assumes everyone runs the latest phones). But if I’m missing something I would like to understand it. > > I still have to investigate what limitation my browser has and whether I can update this whilst being trapped on an unrooted Android 5. > > Bypass methods > --- > I guess I need to study: > * ICMP tunnel (slow, but IIUC it’s the least commonly blocked) > * SSH tunnel > * others? > > Are there any decent FOSS tools that implement the client side of tunnels without needing root? I have openvpn but have not tested to see if that can circumvent captive portals. I’ve only found: > > * [MultiVNC](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.coboltforge.dontmind.multivnc/index.html.en) - VNC over SSH > * [AVNC](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.gaurav.avnc/index.html.en) - VNC over SSH > * [ConnectBot](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/org.connectbot/) - Can all traffic be routed over this SSH tunnel, or just a shell session? > * [VX ConnectBot](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/sk.vx.connectbot/index.html.en) - same as connectBot but expanded > > I’m curious if the VNC clients would work but at the same time I’m not keen to bring in the complexity of then having to find a VNC server. Running my own server at home is not an option. > > My to-do list of things to tinker with so far: > * [Captive Portal Controller](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/io.github.muntashirakon.captiveportalcontroller/) > * ~~[CaptivePortalLogin](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.juliansparber.captiveportallogin/)~~ (AOS 6+, and no Izzy archives on this) > * [Hotspot Login](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/net.sf.andhsli.hotspotlogin/) > > Legal options > --- > If a supplier advertises Wi-Fi but then they render it dysfunctional by imposing arbitrary tech requirements after consumers have already bought the product/service it was included with (coffee, train/bus/plane fare, etc), then they neglect to support it, doesn’t that constitute false advertising? Guess this is out of scope for the community but I might be ½ tempted to file false advertising claims with consumer protection agencies in some cases. > > And when a captive portal demands email or phone number, it would seem to be a GDPR violation. Some public libraries make wi-fi access conditional on sharing a mobile phone number which then entails an SMS verification loop.
This is likely a Lemmy bug but infosec.pub is related because there are so many Android communities that are federated from bad places so I thought I would mention it here as well. cross-posted from: https://infosec.pub/post/11060800 > The cross-post mechanism has a limitation whereby you cannot simply enter a precise community to post to. Users are forced to search and select. When searching for “android” on infosec.pub within the cross-post page, the list of possible communities is totally clusterfucked with shitty centralized Cloudflare instances (lemmy world, sh itjust works, lemm ee, programming dev, etc). The list of these junk instances is so long !android@hilariouschaos.com does not make it to the list. > > The workaround is of course to just create a new post with the same contents. And that is what I will do. > > There are multiple bugs here: > ① First of all, when a list of communities is given in this context, the centralized instances should be listed ***last*** (at *best*) because they are antithetical to fedi philosophy. > ② Subscribed communities should be listed first, at the top > ③ Users should always be able to name a community in its full form, e.g.: > * `!android@hilariouschaos.com` > * `hilariouschaos.com/android` > > ④ Users should be able to name just the instance (e.g. hilariouschaos.com) and the search should populate with subscribed communities therein.
The cross-post mechanism has a limitation whereby you cannot simply enter a precise community to post to. Users are forced to search and select. When searching for “android” on infosec.pub within the cross-post page, the list of possible communities is totally clusterfucked with shitty centralized Cloudflare instances (lemmy world, sh itjust works, lemm ee, programming dev, etc). The list of these junk instances is so long !android@hilariouschaos.com does not make it to the list. The workaround is of course to just create a new post with the same contents. And that is what I will do. There are multiple bugs here: ① First of all, when a list of communities is given in this context, the centralized instances should be listed ***last*** (at *best*) because they are antithetical to fedi philosophy. ② Subscribed communities should be listed first, at the top ③ Users should always be able to name a community in its full form, e.g.: * `!android@hilariouschaos.com` * `hilariouschaos.com/android` ④ Users should be able to name just the instance (e.g. hilariouschaos.com) and the search should populate with subscribed communities therein.
cross-posted from: https://infosec.pub/post/11021006 > The red padlock (at a cafe) > --- > The captive portal of a cafe simply rendered a red padlock on with a line through it. Essentially, it was apparently telling me I am being denied access arbitrarily without using any words. There was no other screen before that. Immediately after wifi handshaking Android’s built-in captive portal detection app just went straight to a padlock. I have never been in that cafe in my life and never use my device maliciously. > > Showed the screen to the staff who said “works for me on my phone”, who then noticed the airplane on my status bar and said “oh, you got the little airplane, that’s the problem”. Shit; so then I had to explain that wi-fi works in airplane mode. It was just a distraction for them. I couldn’t really convince them that the problem isn’t anything I’m doing wrong. There is no tech support for this situation -- like pretty much all captive portal scenarios. Being the customer of the customer is a very weak position to be in when the direct customer doesn’t really give a shit if it works or not. > > So, has anyone seen this kind of behavior? I run into shitty broken captive portals often enough that I guess I really need to get a better understanding of them, and ways to bypass them. > > TLS-encumbered captive portal (transit service) > --- > A transit service offered wi-fi but the network forcibly redirected me to a > captive portal that triggers this error: > ``` > net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH > ``` > I tried a couple browsers and tried rewriting the `https://` scheme as `http://` but SSL redirect was forced consistently. The error apparently [implies](https://web.archive.org/web/20240318220527/https://phoenixnap.com/kb/fix-err-ssl-version-or-cipher-mismatch) my phone’s browser can’t do TLS 1.3. > > It seems like a shitty move for a transit service to require passengers to use TLS 1.3 just to tick a fucking box that says “I agree” (to the terms no one reads anyway). Couple questions: > > * I’m generally in the /protect everything by default/ school of thought. But I cannot get my head around why a captive portal where people just tap “I agree” would warrant disclosure protection that could hinder availability. In reality, I don’t really know what the captive portal at hand requests.. maybe it demands people’s phone# or email, in which case it might make sense (though I would object to them collecting that info in a GDPR region in the 1st place). > > * Is there a good reason for a captive portal to require TLS 1.3? It seems either the network provider does not trust their own network, or they’re simply incompetent (assumes everyone runs the latest phones). But if I’m missing something I would like to understand it. > > I still have to investigate what limitation my browser has and whether I can update this whilst being trapped on an unrooted Android 5. > > Bypass methods > --- > I guess I need to study: > * ICMP tunnel (slow, but IIUC it’s the least commonly blocked) > * SSH tunnel > * others? > > Are there any decent FOSS tools that implement the client side of tunnels without needing root? I have openvpn but have not tested to see if that can circumvent captive portals. I’ve only found: > > * [MultiVNC](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.coboltforge.dontmind.multivnc/index.html.en) - VNC over SSH > * [AVNC](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.gaurav.avnc/index.html.en) - VNC over SSH > * [ConnectBot](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/org.connectbot/) - Can all traffic be routed over this SSH tunnel, or just a shell session? > * [VX ConnectBot](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/sk.vx.connectbot/index.html.en) - same as connectBot but expanded > > I’m curious if the VNC clients would work but at the same time I’m not keen to bring in the complexity of then having to find a VNC server. Running my own server at home is not an option. > > My to-do list of things to tinker with so far: > * [Captive Portal Controller](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/io.github.muntashirakon.captiveportalcontroller/) > * ~~[CaptivePortalLogin](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.juliansparber.captiveportallogin/)~~ (AOS 6+, and no Izzy archives on this) > * [Hotspot Login](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/net.sf.andhsli.hotspotlogin/) > > Legal options > --- > If a supplier advertises Wi-Fi but then they render it dysfunctional by imposing arbitrary tech requirements after consumers have already bought the product/service it was included with (coffee, train/bus/plane fare, etc), then they neglect to support it, doesn’t that constitute false advertising? Guess this is out of scope for the community but I might be ½ tempted to file false advertising claims with consumer protection agencies in some cases. > > And when a captive portal demands email or phone number, it would seem to be a GDPR violation. Some public libraries make wi-fi access conditional on sharing a mobile phone number which then entails an SMS verification loop.
The red padlock (at a cafe) --- The captive portal of a cafe simply rendered a red padlock on with a line through it. Essentially, it was apparently telling me I am being denied access arbitrarily without using any words. There was no other screen before that. Immediately after wifi handshaking Android’s built-in captive portal detection app just went straight to a padlock. I have never been in that cafe in my life and never use my device maliciously. Showed the screen to the staff who said “works for me on my phone”, who then noticed the airplane on my status bar and said “oh, you got the little airplane, that’s the problem”. Shit; so then I had to explain that wi-fi works in airplane mode. It was just a distraction for them. I couldn’t really convince them that the problem isn’t anything I’m doing wrong. There is no tech support for this situation -- like pretty much all captive portal scenarios. Being the customer of the customer is a very weak position to be in when the direct customer doesn’t really give a shit if it works or not. So, has anyone seen this kind of behavior? I run into shitty broken captive portals often enough that I guess I really need to get a better understanding of them, and ways to bypass them. TLS-encumbered captive portal (transit service) --- A transit service offered wi-fi but the network forcibly redirected me to a captive portal that triggers this error: ``` net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH ``` I tried a couple browsers and tried rewriting the `https://` scheme as `http://` but SSL redirect was forced consistently. The error apparently [implies](https://web.archive.org/web/20240318220527/https://phoenixnap.com/kb/fix-err-ssl-version-or-cipher-mismatch) my phone’s browser can’t do TLS 1.3. It seems like a shitty move for a transit service to require passengers to use TLS 1.3 just to tick a fucking box that says “I agree” (to the terms no one reads anyway). Couple questions: * I’m generally in the /protect everything by default/ school of thought. But I cannot get my head around why a captive portal where people just tap “I agree” would warrant disclosure protection that could hinder availability. In reality, I don’t really know what the captive portal at hand requests.. maybe it demands people’s phone# or email, in which case it might make sense (though I would object to them collecting that info in a GDPR region in the 1st place). * Is there a good reason for a captive portal to require TLS 1.3? It seems either the network provider does not trust their own network, or they’re simply incompetent (assumes everyone runs the latest phones). But if I’m missing something I would like to understand it. I still have to investigate what limitation my browser has and whether I can update this whilst being trapped on an unrooted Android 5. Bypass methods --- I guess I need to study: * ICMP tunnel (slow, but IIUC it’s the least commonly blocked) * SSH tunnel * others? Are there any decent FOSS tools that implement the client side of tunnels without needing root? I have openvpn but have not tested to see if that can circumvent captive portals. I’ve only found: * [MultiVNC](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.coboltforge.dontmind.multivnc/index.html.en) - VNC over SSH * [AVNC](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.gaurav.avnc/index.html.en) - VNC over SSH * [ConnectBot](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/org.connectbot/) - Can all traffic be routed over this SSH tunnel, or just a shell session? * [VX ConnectBot](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/sk.vx.connectbot/index.html.en) - same as connectBot but expanded I’m curious if the VNC clients would work but at the same time I’m not keen to bring in the complexity of then having to find a VNC server. Running my own server at home is not an option. My to-do list of things to tinker with so far: * [Captive Portal Controller](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/io.github.muntashirakon.captiveportalcontroller/) * ~~[CaptivePortalLogin](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/com.juliansparber.captiveportallogin/)~~ (AOS 6+, and no Izzy archives on this) * [Hotspot Login](http://fdroidorg6cooksyluodepej4erfctzk7rrjpjbbr6wx24jh3lqyfwyd.onion/en/packages/net.sf.andhsli.hotspotlogin/) Legal options --- If a supplier advertises Wi-Fi but then they render it dysfunctional by imposing arbitrary tech requirements after consumers have already bought the product/service it was included with (coffee, train/bus/plane fare, etc), then they neglect to support it, doesn’t that constitute false advertising? Guess this is out of scope for the community but I might be ½ tempted to file false advertising claims with consumer protection agencies in some cases. And when a captive portal demands email or phone number, it would seem to be a GDPR violation. Some public libraries make wi-fi access conditional on sharing a mobile phone number which then entails an SMS verification loop. update (phones bought last year already obsolete) --- TLS 1.3 was not introduced until Android OS 10 (sept.2019). That was the release date of AOS 10. Older devices like AOS 9 would still be sold at that time and continuing ***at least*** into 2023. Shops do not pull their stock from the shelves when the end of support arrives. This means people buying new COTS Android devices just last year or even this year are already too out of date for the TLS 1.3 captive portal to function. It’s seriously disgusting how many people expect consumers to upgrade this chronically fast.
There are apparently only two documented ways to reverse tether an Android via USB to a linux host: * [openVPN method](http://salutepc.altervista.org/usb-reverse-tethering-no-root-no-adb-android-all-versions-linux-quick-mode.html) * [Gnirehtet](https://www.ubuntubuzz.com/2019/09/android-reverse-tethering-with-ubuntu-1804.html) ***OpenVPN dead*** I really wanted the #openVPN method to work because I’m a fan of reducing special-purpose installations and using Swiss army knives of sorts. In principle we might expect openVPN to be well maintained well into the future. But openVPN turns out to be a shit show in this niche context. Features have been dropped from the Android version. ***Gnirehtet dying*** Gnirehtet works but it’s falling out of maintenance. ~~It’s also unclear if~~ #Gnirehtet really works without root. There is mixed info: * Ade Malsasa Akbar from Ubuntubuzz [claims](https://www.ubuntubuzz.com/2019/09/android-reverse-tethering-with-ubuntu-1804.html) root is ***not*** needed (and devs [agree](https://github.com/Genymobile/gnirehtet)). * OSradar [claims](http://web.archive.org/web/20230531011502/https://www.osradar.com/reverse-tether-from-linux-to-android/) root ***is*** needed. (edit: they are mistaken) If anyone has managed to reverse tether an unrooted Android over USB to a linux host using free software, please chime in. Thanks! update on Gnirehtet --- Gnirehtet indeed works without root. But some apps (like VOIP apps) fail to detect an internet connection and refuse to communicate. #askFedi
Question for people willing to visit Cloudflare sites: How do you determine whether to trust a login page on a CF site? A sloppy or naïve admin would simply take the basic steps to putting their site on Cloudflare, in which case the authentication traffic traverses CF. Diligent admins setup a separate non-CF host for authentication. Doing a view-source on the login page and inspecting the code seems like a lot of effort. The source for the lemmy.world login page is not humanly readable. It looks as if they obfuscated the URLs to make them less readable. Is there a reasonably convenient way to check where the creds go? Do you supply bogus login info and then check the httpput headers?
An HTML-only email from a gov agency has a logo referencing an URL that looks like this: `https://1wy1y.mjt.lu/tplimg/1wy1y/f/l9hl7/g3q3v.png` It’s not exactly that (apart from the domain) but of course it’s rather unique looking. They send email routinely. The initial emails had an obviously non-suspicious basic logo, like “(their office domain)/files/logo.png”. But then later they switched and every message from them is the URL in the mjt.lu domain. It’s not unique per message but it could be unique to the user, perhaps to keep tabs on when each person reads their messages. The output of `torsocks curl -LI` looks like this: ``` HTTP/2 200 date: (exactly now) content-type: image/png accept-ranges: bytes ``` That’s it. It’s the shortest HTTP header I’ve seen. There’s no content-length. I find that suspicious because if this is a service that facilitates tracker pixels, then they would want to withhold the length in order to dodge detection. Although from its usage in my case it wouldn’t just be a pixel -- it’s a logo. The date is also suspect. Shouldn’t the date be the date of the object, not the current time this second? Are there any other checks to investigate this?
infosec.pub
The technical mechanism: https://play.google.com/store/apps/details?id=com.google.android.apps.devicelock update --- To be clear, I am not the OP who experienced this problem. I just linked them from here.
There used to be no problem archiving a Mastodon thread in the #internetArchive #waybackMachine. Now on recent threads it just shows a blank page: https://web.archive.org/web/20240318210031/https://mastodon.social/@lrvick/112079059323905912 Or is it my browser? Does that page have content for others?
I received several machine-generate e-mails which are all mostly the same: a notification. They are HTML emails with no plaintext MIME part. Yikes! And to complicate matters further, the messages traversed my anonaddy forwarding account which PGP encrypts every message to me before forwarding it to my normal email account. The gov wants me to give them an “unaltered copy” of these e-mails. This gov office actually blocks my mail server so I am generally unwilling to send them email. This means I will be giving them the emails on paper hardcopy. So wtf, this is tricky. They want an “unaltered copy”. If I were to print the MBOX files, it would be useless to them because it’s a base64 blob that only I can decrypt. My mail client is mutt so the HTML is detected and piped through w3m to give me a text version that is readable enough. But in general, how do you give unaltered copies of an HTML email on paper form? This is not necessarily for a court but it could go down that path. Would a court want to see raw HTML tags? Or do courts prefer the HTML to be rendered for readability? Normally I copy the w3m-rendered text of email into LaTeX and typeset it to look pretty and copy-paste the useful headers into a well-styled header in a monospaced font. And I omit the useless headers. But I get the impression my way of working would not pass for “unaltered”. I could perhaps try to feed the HTML into `wkhtmltopdf`. In the end, HTML rendering always varies depending on the rendering tool. Normies use MS Outlook, and I have to figure that the gov is normally dealing with normies. So maybe I should install Evolution or Thunderbird. Any suggestions for a tool that is particularly good at making HTML email presentable on paper without looking too custom? #askFedi
Just like catcatnya, infosec.exchange just gives a black page. Up, but broken, at least in my browser. (update) browser issue. Downvoted myself on this to lessen the visibility although some may still find that interesting so I’ll let the thread live.
cross-posted from: https://infosec.pub/post/9936059 > I would like to collect the scenarios in which people are forced to enter Google’s #walledGarden (that is, to establish and/or maintain an account). > > If someone ***needs*** a Google service to access something essential like healthcare or education, that’s what I want to hear about. To inspire a list of things that are “essential” I had a look at human rights law to derive this list: > > * right to life > * healthcare > * freedom of expression > * freedom of assembly and of association > * right to education > * right to engage in work and access to placement services > * fair and just working conditions > * social security and social assistance > * consumer protection > * right to vote > * right to petition > * right of access to (government) documents > * right to a nationality (passport acquisition) > * right of equal access to public service in his country > > Below is what I have encountered personally, which serves as an example of the kind of experiences I want to hear about: > > * Google’s Playstore is a gate-keeper to most Android apps in the world and this includes relatively essential apps, such as: > * emergency apps (e.g. that dial 112 in Europe or 911 in the US) > * banking apps > * apps for public services (e.g. public parking) > * others? > * (education) Google docs is used by students in public schools, by force to some extent. Thus gdocs sometimes cannot be escaped in pursuit of education. When groups of students collaborate, sometimes the study groups impose use of gdocs. Some secondary school teachers impose the use of Google accounts for classroom projects. > * (education) A public university’s wi-fi network involved a captive portal and the only way to gain access was to supply credentials for a Google or Facebook account. > > I’ve noticed that when creating an account for a public service I often have the option to supply credentials for Google or Facebook to bypass the verification process. In all cases of this kind of registration shortcut being used for public service, there was an alternative Google-free way to open the account. But in the private sector, I’ve seen this style of registration that absolutely required a proxy login via some shitty walled garden (like the university wi-fi). So I wonder if there are any situations where a government (anywhere in the world) requires a Google account in order to get service. >
cross-posted from: https://infosec.pub/post/9936059 > I would like to collect the scenarios in which people are forced to enter Google’s #walledGarden (that is, to establish and/or maintain an account). > > If someone ***needs*** a Google service to access something essential like healthcare or education, that’s what I want to hear about. To inspire a list of things that are “essential” I had a look at human rights law to derive this list: > > * right to life > * healthcare > * freedom of expression > * freedom of assembly and of association > * right to education > * right to engage in work and access to placement services > * fair and just working conditions > * social security and social assistance > * consumer protection > * right to vote > * right to petition > * right of access to (government) documents > * right to a nationality (passport acquisition) > * right of equal access to public service in his country > > Below is what I have encountered personally, which serves as an example of the kind of experiences I want to hear about: > > * Google’s Playstore is a gate-keeper to most Android apps in the world and this includes relatively essential apps, such as: > * emergency apps (e.g. that dial 112 in Europe or 911 in the US) > * banking apps > * apps for public services (e.g. public parking) > * others? > * (education) Google docs is used by students in public schools, by force to some extent. Thus gdocs sometimes cannot be escaped in pursuit of education. When groups of students collaborate, sometimes the study groups impose use of gdocs. Some secondary school teachers impose the use of Google accounts for classroom projects. > * (education) A public university’s wi-fi network involved a captive portal and the only way to gain access was to supply credentials for a Google or Facebook account. > > I’ve noticed that when creating an account for a public service I often have the option to supply credentials for Google or Facebook to bypass the verification process. In all cases of this kind of registration shortcut being used for public service, there was an alternative Google-free way to open the account. But in the private sector, I’ve seen this style of registration that absolutely required a proxy login via some shitty walled garden (like the university wi-fi). So I wonder if there are any situations where a government (anywhere in the world) requires a Google account in order to get service. >
I would like to collect the scenarios in which people are forced to enter Google’s #walledGarden (that is, to establish and/or maintain an account). If someone ***needs*** a Google service to access something essential like healthcare or education, that’s what I want to hear about. To inspire a list of things that are “essential” I had a look at human rights law to derive this list: * right to life * healthcare * freedom of expression * freedom of assembly and of association * right to education * right to engage in work and access to placement services * fair and just working conditions * social security and social assistance * consumer protection * right to vote * right to petition * right of access to (government) documents * right to a nationality (passport acquisition) * right of equal access to public service in his country Below is what I have encountered personally, which serves as an example of the kind of experiences I want to hear about: * Google’s Playstore is a gate-keeper to most Android apps in the world and this includes relatively essential apps, such as: * major medical provider ([megathread](https://mastodon.social/@lrvick/112085186821900663)) * emergency apps (e.g. that dial 112 in Europe or 911 in the US) * banking apps * apps for public services (e.g. public parking) * others? * (education) Google docs is used by students in public schools, by force to some extent. Thus gdocs sometimes cannot be escaped in pursuit of education. When groups of students collaborate, sometimes the study groups impose use of gdocs. Some secondary school teachers impose the use of Google accounts for classroom projects. * (education) A public university’s wi-fi network involved a captive portal and the only way to gain access was to supply credentials for a Google or Facebook account. I’ve noticed that when creating an account for a public service I often have the option to supply credentials for Google or Facebook to bypass the verification process. In all cases of this kind of registration shortcut being used for public service, there was an alternative Google-free way to open the account. But in the private sector, I’ve seen this style of registration that absolutely required a proxy login via some shitty walled garden (like the university wi-fi). So I wonder if there are any situations where a government (anywhere in the world) requires a Google account in order to get service.
cross-posted from: https://infosec.pub/post/9930406 > I have never used Facebook. I’m trying to understand the ways in which people are getting trapped in there. Obviously there is an [addiction factor](https://en.wikipedia.org/wiki/Criticism_of_Facebook#Facebook_addiction), but I’m more interested in how someone who is (hypothetically) immune to addiction might still be forced into #Facebook. > > If someone ***needs*** Facebook to access something essential like healthcare, that’s what I want to hear about. To inspire a list of things that are “essential” I had a look at human rights law to derive this list: > > * right to life > * healthcare > * freedom of expression > * freedom of assembly and of association > * right to education > * right to engage in work and access to placement services > * fair and just working conditions > * social security and social assistance > * consumer protection > * right to vote > * right to petition > * right of access to (government) documents > * right to a nationality (passport acquisition) > * right of equal access to public service in his country > > I don’t imagine that Facebook has an essential role in supporting people’s human rights. I assume most gov offices have a Facebook presence, but there is always a way to access the same services outside of FB, correct? > > I can think of a couple situations where FB access is important to reaching something essential. E.g. > > * A police department recovered stolen bicycles and announced that theft victims could visit the FB page of the police dept. to see if their bicycle appears in the photos. Non-FB users were blocked from the page and there was no other means to reach the photos. Effectively, non-FB users were denied equal access to public services. > > * A Danish university has a Facebook page as well as just about every single student. Facebook was used exclusively to announce campus social events and even some optional classes. Students without FB were excluded. In a sense, they were being excluded from some aspects to public education, although strictly speaking the FB exclusive events were not required to obtain a degree. > > * Regarding freedom of assembly, there is an activist group in my local area fighting for the right to be offline. I wanted to join the group, but their sole presence is on Facebook, ironically. So my freedom of assembly in this case is conditioned on being trapped in Facebook. > > In any case, I would like to hear more examples of what essential information or services is compromised by leaving or neglecting to join Facebook. > > #askFedi #Meta #walledGarden
cross-posted from: https://infosec.pub/post/9930406 > I have never used Facebook. I’m trying to understand the ways in which people are getting trapped in there. Obviously there is an [addiction factor](https://en.wikipedia.org/wiki/Criticism_of_Facebook#Facebook_addiction), but I’m more interested in how someone who is (hypothetically) immune to addiction might still be forced into #Facebook. > > If someone ***needs*** Facebook to access something essential like healthcare, that’s what I want to hear about. To inspire a list of things that are “essential” I had a look at human rights law to derive this list: > > * right to life > * healthcare > * freedom of expression > * freedom of assembly and of association > * right to education > * right to engage in work and access to placement services > * fair and just working conditions > * social security and social assistance > * consumer protection > * right to vote > * right to petition > * right of access to (government) documents > * right to a nationality (passport acquisition) > * right of equal access to public service in his country > > I don’t imagine that Facebook has an essential role in supporting people’s human rights. I assume most gov offices have a Facebook presence, but there is always a way to access the same services outside of FB, correct? > > I can think of a couple situations where FB access is important to reaching something essential. E.g. > > * A police department recovered stolen bicycles and announced that theft victims could visit the FB page of the police dept. to see if their bicycle appears in the photos. Non-FB users were blocked from the page and there was no other means to reach the photos. Effectively, non-FB users were denied equal access to public services. > > * A Danish university has a Facebook page as well as just about every single student. Facebook was used exclusively to announce campus social events and even some optional classes. Students without FB were excluded. In a sense, they were being excluded from some aspects to public education, although strictly speaking the FB exclusive events were not required to obtain a degree. > > * Regarding freedom of assembly, there is an activist group in my local area fighting for the right to be offline. I wanted to join the group, but their sole presence is on Facebook, ironically. So my freedom of assembly in this case is conditioned on being trapped in Facebook. > > In any case, I would like to hear more examples of what essential information or services is compromised by leaving or neglecting to join Facebook.
cross-posted from: https://infosec.pub/post/8864206 > I bought a Silicondust HD Homerun back before they put their website on Cloudflare. I love the design of having a tuner with a cat5 port, so the tuner can work with laptops and is not dependent on being installed into a PC. > > But now that Silicondust is part of Cloudflare, I will no longer buy their products. I do not patronize Cloudflare patrons. > > I would love to have a satellite tuner in a separate external box that: > * tunes into free-to-air content > * has a cat5 connection > * is MythTV compatible > > Any hardware suggestions other than #Silicondust?
cross-posted from: https://infosec.pub/post/8864206 > I bought a Silicondust HD Homerun back before they put their website on Cloudflare. I love the design of having a tuner with a cat5 port, so the tuner can work with laptops and is not dependent on being installed into a PC. > > But now that Silicondust is part of Cloudflare, I will no longer buy their products. I do not patronize Cloudflare patrons. > > I would love to have a satellite tuner in a separate external box that: > * tunes into free-to-air content > * has a cat5 connection > * is MythTV compatible > > Any hardware suggestions other than #Silicondust?
catcatnya.com just gives a black page. Up, but broken, at least in my browser. (update) browser issue. Downvoted myself on this to lessen the visibility although some may still find that interesting so I’ll let the thread live.
Images do not get mirrored from one Lemmy instance to another. Understandably so. But there is a harmful side effect: if SourceNode is behind an access-restricted walled-garden and an image from that node is cross-posted to a DestinationNode that is not inside the same access-restricted walled-garden, then some readers on DestinationNode see posts where the image is inaccessible. All variants of walled gardens are can trigger this problem but the most common is Cloudflare. So posts that contain images coming from instances like `sh.itjust.works` and `lemmy.world` are exclusive and do not include all people who infosec.pub includes. How can this be fixed? 1. infosec.pub could defederate from all Cloudflare nodes. This would prevent CF pawns from *pushing* exclusive content onto infosec.pub, but infosec.pub users could probably still post links to the exclusive venues. 1. infosec.pub could block just cross-posts from CF nodes that contain images. 1. infosec.pub could mirror images when the image is in a known exclusive walled garden. 1. infosec.pub could accept posts that contain images in walled gardens and then immediately hide those posts. Perhaps a bot could populate a community designated for exclusive walled gardens with links to hidden posts so users not excluded by the walled garden can still reach the content. Some of those options might require changes to lemmy code.
cross-posted from: https://infosec.pub/post/9382315 > I have had no problem using VOIP over #protonVPN until recently. Connections happen but there is no audio. Anyone notice this? > > I wondered if maybe they decided to make VOIP a non-free feature, but their premium plans do not list VOIP as an extra feature.
I have had no problem using VOIP over #protonVPN until recently. Connections happen but there is no audio. Anyone notice this? I wondered if maybe they decided to make VOIP a non-free feature, but their premium plans do not list VOIP as an extra feature.
This may be an instance-specific problem because I’ve had no problem editing posts on other instances. When I try to exit the title and body of [this post](https://infosec.pub/post/9339866), I click save (or whatever) and without error it behaves as if my change was accepted. Most instances take a minute or two to re-render the screen to show my updates. If the wait is long, I sometimes do a hard refresh to make sure the change got accepted (and if I don’t do that and I do another update, the old content populates the form and causes the recent edit to be lost). Anyway, with infosec.pub my edits on the above-mentioned post just take no effect, confirmed by a hard-refresh showing no change.
What happens if an app uses UDP instead of TCP (or both UDP and TCP), and you use the `torsocks` wrapper script? Would the UDP connections all leak without the Tor user knowing?
cross-posted from: https://infosec.pub/post/9048075 > I simply make a GDPR request. Write to a Tor-hostile data controller making an Article 15 request for a copy of all your data. Also ask for a list of all entities your data is shared with. > > The idea is that if a website blocks Tor (or worse, uses Cloudflare to also share all traffic with a privacy offender), then they don’t give a shit about privacy. So you punish them with some busy work and that busy work might lead to interesting discoveries about data abuses. > > Of course this only works in the EU and also only works with entities that have collected your personal data non-anonymously. After getting your data it generally makes sense to also file an Article 17 request to erase it and boycott that company.
I simply make a GDPR request. Write to a Tor-hostile data controller making an Article 15 request for a copy of all your data. Also ask for a list of all entities your data is shared with. The idea is that if a website blocks Tor (or worse, uses Cloudflare to also share all traffic with a privacy offender), then they don’t give a shit about privacy. So you punish them with some busy work and that busy work might lead to interesting discoveries about data abuses. Of course this only works in the EU and also only works with entities that have collected your personal data non-anonymously.
tested from tor. Also reported down by downinspector.com. BTW, downinspector.com is the only Cloudflare-free service of its kind, but it’s notable that noscript reports XSS scripting attempts via Google. (edit) it came back online yesterday.
Language is important. The corporate propagandists are winning the language branding battle. In fact there is no battle because the pushover public just accepts their terms. We need to organize and define their garbage with our terms. E.g. * (**smart → dependent**) Homes and appliances *dependent* on a corporation and contract are perversely called *smart*. So we should refer to them as “contract-dependent” or simply “dependent”. It’s not a smart dryer or doorbell, it’s a *dependent* dryer or doorbell. Probably makes no progress to mess with “smartphone”, but anything that has an avoidable and needless dependency needs renaming. (smartphone is debatable.. maybe a degoogled or Postmarket OS phone is a smartphone while a stock Android is a dependent phone, but let’s not get too carried away). Initially it’s not effective to just start saying “dependent washer” because readers won’t understand. Say “‘smart’ (read: dependent) washer”. Credit for this terminology goes to [@dannym@lemmy.escapebigtech.info](https://lemmy.escapebigtech.info/u/dannym) for [this post](https://lemmy.escapebigtech.info/post/7395), which gives a bit [more detail](https://escapebigtech.info/posts/dependent-devices-are-not-smart/). * (**Meta→Facebook**) Meta hi-jacks a common English word to benefit a surveillance advertiser. We can’t allow this. IMO *Facebook* is understood and clear enough, but note that it’s not technically accurate because Meta is a parent company which has Facebook and Threads as subsidiaries IIUC (just like Alphabet owns Google). * (**Threads→fbThreads™/®?**) Since Threads is the original name of Facebook’s forum, there is no unambiguous past name to cling to. We must invent something here. Fuck those egocentric self-centered asshole fucks for hi-jacking a generic common word to describe their service. There are already confusing conversations where it’s unclear from context if someone means FB’s Threads or a generic forum (threads). It’s not just a confusion problem.. when you refer to a thread in the generic sense and it is understood, there is still a subconcious tie to that shitty company.. their brand benefits from conversation that does not even involve their brand. * (**X→Twitter**) This is an easy one. Just keep with the old term. * (**Cloudflare→CF walled garden**) I’ve not encountered a replacement term for Cloudflare that’s not overly hyperbolic. But we can often incorporate “walled garden” and “centralized” to stress the issues. Instead of just saying “it’s a Cloudflare site”, say some variant of “the site is jailed in Cloudflare’s exclusive centralized access-restricted discriminatory walled garden contrary to netneutrality principles of access equality”. It’s worth nothing that hyperbole doesn’t help. E.g. we might want: * Meta/Facebook→Fakebook * Microsoft Windows→Microsnot Winblows The problem is these terms are only accepted by fully committed digital rights folks. That’s not the crowd that needs to be swayed. Hyperbole does not catch on with moderates - the masses where it’s most important for rebranding to take hold. Good rebranding doesn’t deviate too much from neutrality. * (**user→pawn**) Exceptionally, I refer to “users” of surveillance capitalists as “pawns”. It’s probably too edgy to catch on, but it is what it is. *Users* is neutral and understood so it can’t easily be rebranded anyway. I will just say pawns to stress the point: who is using who? Anyway, this is just the start of a crowd-sourcing effort. Please contribute more rebrandings in this thread as well as improved alternatives to my effort above.
Suppose you’re fed up with being video surveilled in public and you object to your neighbor placing your home under 24/7 video surveillance which is fed to a surveillance advertiser (#Amazon). Or you want to kill the video surveillance [in vending machines](https://infosec.pub/comment/6866300). laser --- Is it practical and affordable to buy laser that can reach across the street and still have enough focus and power to burn a CCD? Can it be done from different angles without the CCD capturing the source before the damage manifests? There is some chatter [here](https://laserpointerforums.com/threads/do-i-destroy-the-ccd-in-the-camera-if-i-shine-directly-in-to-it.56824/) on power levels. Of course it must be precisely controllable as well; obviously no one wants to inadvertently hit an eyeball and blind someone. Which I suppose implies that the laser either needs a well calibrated scope or it needs to be in the visible spectrum so you can see where it lands. I would really love it if someone would rig up a drone to do this, which could then go down the street and knock out many Amazon Rings. cyber attack --- (Amazon Ring only) A simple cyber attack: if you can find out (social engineer?) the username of the Ring pawn¹, you can deliberately submit wrong passwords until the acct locks. When an Amazon account is suspended, the doorbell no longer functions. Funnily enough. So people with smart homes must constantly obey Amazon’s wishes if they want their home to continue to function. Would love to see that backfire. But it’s unclear if an account locked due to failed passwords goes into the same state of suspension that breaks the doorbell. I just recall a story where someone’s Amazon account was suspended due to some dispute or misunderstanding with Amazon which then broke their doorbell and probably other “smart” (read: dependent) appliances to go out of service. 1) I don’t say “user” because they are *being used by* Amazon. That means they are a “pawn”.
I bought a Silicondust HD Homerun back before they put their website on Cloudflare. I love the design of having a tuner with a cat5 port, so the tuner can work with laptops and is not dependent on being installed into a PC. But now that Silicondust is part of Cloudflare, I will no longer buy their products. I do not patronize Cloudflare patrons. I would love to have a satellite tuner in a separate external box that: * tunes into free-to-air content * has a cat5 connection * is MythTV compatible Any hardware suggestions other than #Silicondust? #AskFedi
cross-posted from: https://infosec.pub/post/8863199 > This post was composed with a link to a Wired article: > > https://lemmy.ohaa.xyz/post/1939209 > > Then in a separate step, the article was edited and an image was uploaded. The URL of the local image unexpectedly replaced the URL of the article. Luckily I noticed the problem before losing track of the article URL.
This post was composed with a link to a Wired article: https://lemmy.ohaa.xyz/post/1939209 Then in a separate step, the article was edited and an image was uploaded. The URL of the local image unexpectedly replaced the URL of the article. Luckily I noticed the problem before losing track of the article URL.
“Only because of that official investigation did Canadians learn that ‘over 5 million nonconsenting Canadians’ were scanned into Cadillac Fairview's database”. Wow. This Wired article is contradictory. The spokesperson says: “an individual person cannot be identified using the technology in the machines. The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface” I suppose it’s possible that a sloppy developer would name an executable `Invenda.Vending.FacialRecognitionApp.exe` which merely senses the presence of a face. But it seems like a baldfaced lie when you consider that: “Invenda sales brochures that promised ‘the machines are capable of sending estimated ages and genders’ of every person who used the machines—without ever requesting consent.” Boycott Mars --- I already boycott Mars because they are a GMA member and they spent ~$500k lobbying against #GMO labeling -- and they have been blackballed for using child slave labor -- and Mars supports Russia. This is another good reason to #boycottMars. Update --- Apparently a [LemmyBug](https://infosec.pub/post/8863199) replaced the article URL with a picture URL. The article is here: https://www.wired.com/story/facial-recognition-vending-machine-error-investigation/ The vending machine pic is here: https://infosec.pub/pictrs/image/2041d717-7cd7-4393-94f3-96aa87817aa7.jpeg
The mamot.fr website and web client seems to be up for everyone. But for the past few days the #mamot.fr API for 3rd-party apps has been unreachable. Unverified: whether Tor is a factor. It would be interesting to hear from a non-Tor user if they can reach #MamotFR from a 3rd party app. update --- mamot.fr has been unreliable for 2 weeks now for API access as well as normal web access. It’s hit or miss. Sometimes it’s up, sometimes down, slow to load, and slow to login. I’m on Tor every time so it could be some kind of tor defensive move. Like tar-pitting. I guess at this point we should consider this problem permanent. It’s much less convenient to use now.
The following fedi instances are perpetually exclusive because they sit inside Cloudflare’s walled garden: * lemmy.world * sh.itjust.works * zerobytes.monster * lemmy·ca * lemm·ee * programming.dev * lemmy.zip If you cannot reach these instances, there are many possible reasons: * you use a VPN * you use a browser Cloudflare discriminates against while also using Tor * you are using a public library PC * your ISP uses CGNAT to allocate your IP address (often in impoverished communities) * you have disabled image loading (because you are visually impaired, or you are on a capped uplink, or you are an environmentalist), which then triggers a false positive for being a robot. * you are a legitimate beneficial bot (Cloudflare treats beneficial bots the same as malicious bots) The listed sites will rarely be down for everyone but will often be unavailable to those in the above mentioned discriminated demographics of people.
cross-posted from: https://infosec.pub/post/5276026 > I have a hot water dispenser, which heats the water to the temp you specify, on-the-fly. Sometimes this technology is called “insti-heat”. Instead of filling a kettle and waiting, it pumps water from a tank and heats it inline as fast as it draws it. Likely similar to how Nespresso machines work. > > This means the limescale is hidden in the internal tubes. When descaling solution is put in the tank and the descaling program runs, there are no white chips of limescale like you would get in a water kettle. Yet it seems to be working because after descaling the water flows smoothly (as opposed to coughing and sputtering which is what happens when limescale is built up). > > So it’s a mystery- where did the limescale go? Does it actually dissolve into the descaling solution? I ask because I’d rather not be wasteful.. I’d like to reuse the descaling solution, if that’s sensible.