dirtfindr 2 years ago • 100%
The updated article is here:
http://techrights.org/2021/03/15/duckduckgo-in-2021/
There is too much censorship & shenannigans like concealing censorship from modlogs to trust lemmy.ml anymore. I just saw a post about how the admins removed a community creator and quietly put someone else in control.
dirtfindr 4 years ago • 40%
There's a lot of tor-hostile links in this post and references to untrustworthy sites and services.
It's bad advice. Sony and Motorola are terrible recommendations. See https://neoreddit.horobets.me/post/51
dirtfindr 4 years ago • 100%
wow what a blast from the past. I'm quite surprised Soulseek is still around and still actively maintained.
dirtfindr 4 years ago • 100%
Is there any way around this? As this would seem to defeat the purpose. Using it as 2FA means all your 2FA codes get sent publicly. Using it is a temporary messenger means anybody can read those messages, etc.
It's a race condition. They send a verification code, you use it to verify your account immediately, and then the one-time-use code is no longer usable. The others who see the codes coming in have no simple way of knowing which account the code is for, so the code is useless to them. Even if someone knows the number you used and how to reach the service, they would also have to know when you're going to receive the code and they would have to know your userid (and possibly pw).
In short, a highly skilled adversary would have to be in your threat model. And if the adversary is so skilled that they've penetrated your system and rooted it, then you're pawned anyway.
People who use the kinds of services that need your phone number aren't really committed to privacy as an activist, but they care about their own privacy from a selfish standpoint. E.g. they're willing to create a Google account and help a privacy abuser profit as long as their getting enough privacy for themselves (like not sharing their phone number).
I used to use pinger numbers to create accounts but evolved past that realizing that I was still feeding the privacy abuser by dancing for them and using their service. So I simply walk when asked for a phone number. It's really the best solution.
Exceptionally, there are some situations where you already have an account (e.g. for your bank, school, or even Twitter), and out of the pure blue Twitter says "we think you're a bot -- for 'your protection' you must verify your phone number." Then you're trapped. Access to the profile you've built over the years is suddenly threatened, and your data is being held hostage until you surrender a phone number. In that case, the pinger number is quite useful.. use it, download your data, and gtfo and don't come back.
Libre Culture
Have you ever considered moving the Lemmy repository out of Github into a more friendly site like Gitlab?
dirtfindr 4 years ago • 100%
This is why gitlab.com should be listed as a service to avoid, like MS Github.
dirtfindr 4 years ago • 100%
dirtfindr 4 years ago • 66%
While I appreciate your dismay for GitHub (which I share), I don’t think your “(shamefully)” concept would be constructive to our platform.
The precise word choice is immaterial to my thesis. The status quo needlessly promotes MS Github. One option is to use "shamefully" in cases where the project using it has core purpose to its mission that's undermined by its use of MS github. The word would be far-fetched for projects where privacy or the environment are orthogonal to their mission, in which case "unfortunately" would suffice.
One of the main facets of ReverseEagle is to educate people on alternatives, and why they’re so much better.
Of course it educates. Neglecting to link to page of Github harms is a missed opportunity to educate.
About Gitlab.com: we have decided not to list that, as it’s hosted on Google Cloud and Cloudflare. Instead, we thought it was wiser to direct uneducated users to a wide range of alternative hosts.
You list Github precisely because it is detrimental. Yet for the very same reason, you're choosing *not* to list Gitlab.com. Why the inconsistency? Gitlab.com is even more harmful than Github. They should both be listed and condemned together.
While I was creating the article listing alternatives to Visual Studio, I felt that the best approach to listing alternatives was to list other developer environments. It wouldn’t be appropriate to say “learn a different language”.
The stated purpose of the project is "Privacy-conscious, ethical and safer alternatives to software for developers." Because "ethical" is mentioned, promoting unethical languages (i.e. languages that hinder free society and feed unethical tech giants) is counter-productive. To be very precise, learning the offending languages is not in itself where the harm is done. If Bob's C# program only runs on his machine and is never distributed, and he never uses MS products to develop it, no harm is done. The harm is done when a tool in an MS-controlled language is publicly distributed because it empowers Microsoft and adds to the dominance and demand of an exclusive and oppressive language. Of course it's appropriate to condemn polluting the commons with software that works against Reverse Eagle's stated mission.
Who learns a language with intent to keep the works they create internal? It's very unlikely outside the non-free software context, so learning C# will generally propagate the spread of it.
The thing is, there’s a lot of research that’s gone into UX work that makes your suggestion hard. For example, it might have the opposite effect: less people would click the link, as that’s an extra step.
Two cases:
- They click the link-- they discover Lemmy and they make a move to it. That's also less time that they are on Reddit, feeding Reddit and making Reddit's ads profitable.
- They don't click the link-- a moment of their time was spent making their Reddit UX worse. The more frustrations experienced by Reddit users, the more the Reverse Eagle mission cause benefits.
It's a win either way.
If I were an uninformed user on Reddit, I would much rather have the text on the page.
Are you actually trying to add value to Reddit, and make the Reddit UX positive enough to keep ppl there?
So bear this in mind: we’re a young community, we still might need to rely on platforms like Reddit to ‘spread the word’. We’ll see.
That being said, we do continue to link people to our Lemmy, from Reddit. I think I speak for everyone on the ReverseEagle team when I say: Lemmy is unanimously preferred over Reddit.
Then there's no reason to link into Reddit from outside of Reddit. All links outside of Reddit of this kind should reference a Lemmy post.
Of course, and we don’t blindly trust them. They even say you should seek advice from other platforms on their page.
In principle it's good that they do that, but PTIO and PRISM Break are terrible recommendations that far too often undermine their own cause. Neither of those projects have integrity and it's harmful to mention them.
What platforms would you recommend for this? I heavily doubt immature FOSS projects have enough donations to be able to self-host a discussions platform like Discourse.
There is a huge list of alternatives, but I see no reason not to stick with git.sr.ht and framagit.org. Git is inherently decentralized, but there is a project that takes the idea further which is perhaps worth mention.
I think you’re proving a point I made the other day. As we continue to be more influential, and make waves in the FOSS world, we need to be very careful of which products we actually recommend.
I did not suggest recommending Patreon, Liberapay, and Open Collective. I suggest condemning them. Of course condemning these services is not risky, unless you consider advocating for your own mission risky.
If you want to find an alternative to endorse, there is a raw list here (some good, some bad) to review.
There is also freedomsponsors.org and villages.io. Both are hosted by Amazon but perhaps a lesser of evils.
Especially where money is concerned. Then, it gets hairy. Doesn’t Liberapay use PayPal too?
IIRC, Liberapay accommodates Paypal if a project discloses their PP acct. You should look further in case I'm confusing the three. But I think there is no choice with Patreon -- it's Paypal or nothing.
Are you offering to provide an improved version?
I did. I've got more dirt on MS than that, but it's a start. Since the project is on framagit, I might be willing to contribute more directly.
If you have any more suggestions, and if you are in possesion of a Matrix account, please join our Matrix room.
Matrix seems to have a high-level dependency on CloudFlare, so I've not even been motivated to investigate using it yet.
dirtfindr 4 years ago • 100%
I applaud your effort overall. We need more of these kinds of efforts. I do see ways to improve:
| tool/service | comment |
|---|---|
| Reddit is bad. There's a lot of censorship shenanigans there, privacy abuse & it's hosted on Amazon. It should be avoided. If you post there anyway, it's better to put your content on Lemmy and simply post the Lemmy link on Reddit. You went in the other direction. It's better to lead Redditers to Lemmy not the other direction. | |
| github | You give one-line on the evils and probably not enough detail to be persuasive. There's an enumeration of issues here, but note that's on GH so I suggest copying it rather than linking to it from your page. Also, most of the projects you recommend have a line "source code: github". Consider linking to the source code in a way that shames the project, otherwise your site promotes GH more than it discourages it. Not everyone will read the GH section. Perhaps express it this way "source code: github (shamefully)". Also, prefix "Github" with "MS". (edit) There is a Github link at the bottom of your page. You should certainly not be linking to it from your public website because it leads visitors in the wrong direction. It also hurts your perceived credibility because many readers won't follow that link; they will just think "what a hypocrit". You should set the GH issues to external and link to the framagit issues. Your readme is too short. You should use that space as an opportunity to detail all the Github issues I linked you to. |
| gitlab | The GH page does well to condemn Gitlab service while endorsing the s/w. I would also point them to this page or cover those issues, and make sure gitlab.com is mentioned on the landing page next to github because it's easy to miss. |
| visual studio | Visual Studio, C#, .net, et al are all languages designed to feed Microsoft's dominance. Even though people have hacked together free tools for them, those tools will never take the lead and projects that use those tools still end up boosting Microsoft's influence. It's important to condemn those languages entirely. But there's nothing wrong with supplementing the condemnation with alternatives for those who won't or can't get away from MS-controlled languages. |
| donations | FOSS projects often need donations and they're all sending people to socially irresponsible platforms inside of privacy-abusing walled-gardens. Consider adding a section that condemns Patreon, Liberapay, and Open Collective. They are all CloudFlare sites that expose sensitive financial data to CF (the Monsanto of the web). Open Collective even allows CF to use their platform to ask for donations. It's quite despicable that a tech giant corp is asking for donations. IIRC, Patreon forces everyone to use Paypal. Paypal should also be loudly condemned. |
Most FOSS projects are vaguely aware of MS Github's controversy, but they lack the constitution and integrity needed to abandon Github. Proponents of social responsibility are blocked from contributing bug reports to FOSS projects because they cannot or will not enter the private walled-gardens of Microsoft and Gitlab.com. So it's important to tell developers that if they insist on using Github or Gitlab.com, they put the bug tracker in a non-controversial publicly accessible place. I find bugs that I often don't report because of this problem. They should also be advised to at least mirror their project on a free and open alternative.
Regarding Switching Software as a partner and your plug for tycrek/degoogle: you can get good and bad advice from them. Check out my review of Switching S/w. E.g. DuckDuckGo is a terrible alternate to suggest to people. The tools Switching SW endorses need further analysis; you can't blindly trust them. For tycrek/degoogle, there are a few lousy search engine recommendations. I suggest plugging them this way: "tycrek/degoogle (but disregard the search engine advice)".
dirtfindr 4 years ago • 100%
The wording would have to account for the fact that some regions have (will have?) privacy laws that force DNT to be honored. California may be one such place though I'm vague on this. I think the next revision of the CCPA will force DNT respect, IIRC.
dirtfindr 4 years ago • 100%
Condemning DNT on the basis that some ppl don't respect it is not sound rationale. DNT was never designed with an expectation that all websites would honor it. Some honor it, some do not. Ecosia.org is an example of a website that honors DNT. To disable DNT is to give up privacy for nothing. Two cases:
- Website respects DNT-- You obviously have the benefit of privacy by sending a DNT signal. If you don't send a DNT signal, you give up privacy for nothing.
- Website does NOT respect DNT-- You gain nothing by using DNT, but you also lose nothing. It's a wash; makes no difference either way.
Exceptionally, there is one reason not to use DNT: fingerprinting. Poorly designed browsers ship with DNT disabled by default. Users who proactively change their DNT setting are in a minority and thus have a more unique browser print. The asinine brain-dead decision of some browser developers to disable DNT by default ensures that those who don't care (who don't alter the setting) fail to serve to unify the browser print for those who do care. The users who care enough to change the DNT setting are the ones who are forced to compromise protection from one privacy intrusion (browser printing) to gain protection from another privacy intrusion (optional tracking).
So when assessing the privacy-fitness of a browser and the competency of the developers, browsers that enable DNT by default are the ones to favor.
dirtfindr 4 years ago • 100%
As I understand it, the LibreSignal issue was a matter of trademark enforcement (specifically, the trademark “Signal”). Signal did try to get LibreSignal to stop using Signal’s servers, but it’s unclear to me (IANAL) if Signal had the legal or technical ability to block LibreSignal from using Signal’s servers (and I don’t think you’d accomplish this with a trademark suit).
The trademark case was the easy legal tool that OWS lawyers could intimidate LibreSignal with. The lawyers threatened F-Droid and F-Droid folded. F-Droid removed LibreSignal, and LibreSignal did not have the resources to fight OWS lawyers. Trademark infringement of course wasn't the real reason for OWS threats. The real reason was that LibreSignal made it possible for users to violate OWS's network protectionist ToS. OWS has no direct case against LibreSignal for that, because it's users of LibreSignal that violate the ToS, not the LibreSignal project. The LibreSignal project isn't bound by the ToS -- only users who agree to the terms can be subject to them. OWS would have to sue each of their own users who make use of LibreSignal independently, which is highly impractical. This is why they pushed the trademark angle. It was a legal hack to impose their network protectionism.
LibreSignal was abandoned voluntarily, not because Signal forced them to.
It wasn't ordered by a judge, but force comes in many forms. LibreSignal was abandoned because they couldn't finance the legal battle. That's force. To be unable to finance the cost of freedom is to not have the freedom.
It’s also unclear how much of this is relevant to Lemmy. I’m unaware of the Lemmy developers threatening any lawsuits over forks, or expressing a wish to block forks from federating with Lemmy.
It's relevant to your claim that free software = freedom to use the network how you wish. Whether the Lemmy project would actually make good on enforcement of their Antifa agenda remains a question. But certainly they can if they want. They can trademark "Lemmy" if they want, and they can create a ToS that bans unauthorized Lemmy mods if they want. So it's wrong to claim GPL'd s/w is the end of the story as you did.
(Edit: It’s also worth noting, Signal’s developer is openly hostile to the idea of federation and wishes to control every aspect of “his product.” I see no indication that the developers of Lemmy share that view. If they did, they would not have designed Lemmy to be federated to begin with.)
It's also worth noting that the Lemmy project openly hostile to non-supporters of Antifa. It's also worth noting that the Antifa has no restraint in pushing their ideology -- they don't even renounce violent protest.
It’s not clear to me that other ActivityPub servers need “permission” to federate with Lemmy at all.
Using a network without permission is trespassing. Permission need not be express; it can be implied, but ultimately the owner of a server has a right to control access to their resource.
An instance of Lemmy using a hard-coded slur filter != That instance of Lemmy assuming other peers are using the exact same slur filter
This is a bad assumption. You cannot assume that a hard-coded elements are not relied on in a design. Such an assumption is perversely stupid. If you must assume something, you should assume that a project may rely on hard-coded behaviors. This is why (as I pointed out) it's a poor design to hard-code the slur filter.
It’s more a synonym for anti-fascist,
Antifa is far more than that.
As mentioned before, while the developers of Lemmy are communists and this particular instance is an explicitly anti-fascist instance, the slur filter targets expressions of hate, not discussion of capitalism or liberalism.
Where was this "mentioned before"? You'll need to quote that. This instance is not simply anti-fascist -- it's actually Antifa.
I’m not sure what valuable discussion is being suppressed by this filter.
Suppression is not a significant problem with the slur filter. Other problems arise out of the poor design of the filter, like users having to become programmers to change the filter, and the interoperability risks I detailed (both legal and technical).
As I see it, with few exceptions, anyone using such language is not participating in good faith.
Not if they're using the language to discuss the language. e.g. "I was minding my own business and someone called me a k-i-k-e". Suppressing that would be to suppress the victim of hate. It's profoundly short-sighted to think those words are only directly inflicted on others.
dirtfindr 4 years ago • 100%
sorry, you're right it's not Google's captcha. I wrote about it here but then I had forgotten: https://lemmy.ml/post/31487
dirtfindr 4 years ago • 100%
As a Tor user, the CAPTCHAs from Qwant are frequent enough to be unusable and they're implemented in a particularly abusive manner. That is, Qwant presents the query page without CAPTCHA every time, thus giving users an opportunity to waste their time as they compose a search query, then after submitting the search query the CAPTCHA manifests.
It's a dark pattern. So after the user has invested some effort, the choice is throw away your effort so far or play the CAPTCHA game. If you walk, you've helped feed Qwant's & Microsoft's analytics and left with no reciprocity in return.
The CAPTCHA is actually worse than CloudFlare's. CF uses hCAPTCHA while Qwant-Microsoft uses Google reCAPTCHA (which is more privacy abusive). (corrected- see below)
dirtfindr 4 years ago • 66%
It seems like you’re arguing from a point of unfamiliarity with federated social media like Mastodon. When you’re talking about “syncing the message” being able to “crash” an instance of Lemmy, this is not based on how anything ActivityPub actually works.
I don't know what Lemmy does, and I'm not sure how much clearer I could have been that the possible outcomes mentioned were speculative, having seen no other Lemmy code than the slur filter. I saw just one line of code and it was lousy.
Mastodon nodes certainly *do* store copies of msgs from other nodes, which is precisely why I would envision Lemmy having msg redundancy.
Below you’ve construct a straw man about how if a slur filter has been implemented one way, then that means that it must programmatically break federation if it’s variant between instances
You don't know what a straw man is. A straw man is obviously *not* speculating on risks and outcomes. To construct a straw man is to misrepresent someone else's argument. My reply was to @adrianmalacoda@lemmy.ml . I did not even present his arguments, so there was obviously no opportunity to misrepresent them.
Pretty radical semantic versioning you’ve got going on there if every modification requires a different project name. 🙄
This ^ is an example of a straw man. I neither said nor implied that a modification "requires a different project name", yet you're implying that this is my stance.
When you fork a project and modify it, and the mods are not to be integrated upstream, the new software is different and the project is yours regardless of what you name it. If the original project name isn't trademarked and you don't care about causing confusion, you can name it the same if you want, and even choose conflicting version numbers. The authorship is likely different as well (it's the set of all upstream authors plus yourself).
The way these instances will interact has probably not yet been specified, so it’s ridiculous to start getting up in arms about it.
You're apparently implying here that you think it's wise to ignore the production of code that will likely cause a conflict in the future and wait until the problem manifests during operation time. As opposed to thinking in advance "hey, hard-coding an English slur filter for the world maybe isn't the smartest way forward"?
This is *precisely* the time to get the design right on this-- if not sooner.
Please do not start spreading pseudotechnical FUD about the properties of this software without reference to fact.
I'm afraid state of the art software design principles are not "fact". Sorry you have to hear this from me, but competent design prior to implementation is a subjective opinion. It's an opinion that's widely held in high regard across the most prestigious academic institutions in the world and has far more merit than the sloppy and reckless approach you've suggested. And how dare you present your "personal opinion" and then demand facts -- without so much as stating what factual information you're in need of.
dirtfindr 4 years ago • 100%
No, but it creates the potential for someone else to create it if they wish.
No it doesn't. That software doesn't execute in a vacuum. It needs to interact with other software. A recent proven disaster is with the Signal's so-called "free software". It's GPL'd but if you modify it, it is something else, and that something else is legally prohibited from connecting to the Signal network. Someone created "Libresignal" and Open Whisper Systems threatened lawsuit. Libresignal shut down and abandoned their work.
It's a similar situation here. You can modify Lemmy all you want, which makes it something else, but that doesn't give you permission to connect to Lemmy instances. And even if you get permission, that doesn't mean it will function. I already detailed why.
Not to mention the software doesn't exist. The failure to design Lemmy well puts *users* in a position of having to be *developers*, in the best case. If a *user* needs to write code, it's a bad design. It absurdly restricts users to those with expertise and skills that a software user shouldn't need to have.
but I hope it doesn’t assume this
Of course it does. It's hard-coded. It's a valid assumption, and the assumption simplifies the design. Why would they do extra work to assume the code isn't what it is? If the design assumption is that the slur filter is changeable, then it's a bad idea to hard-code the slur filter in the first place. You don't hard-code something that's presumed mutable.
that it’s possible or even desirable to be “non-political” or “neutral”
It's actually trivial to create a communication tool like Lemmy without political bias. You simply don't hard-code things like slur filters and you give moderation freedom to the instance operators not the developers.
or that catering to an anti-antifa audience is a worthy goal.
Let's not conflate "anti-antifa" with "non-antifa".
Perhaps you have the misconception that Antifa is simply a synonym for being anti racist. They are also anti-capitalist and anti-government, and they do not renounce violent protest. This makes them a relatively small fringe group. For example, most Americans (conservative and liberal) endorse capitalism and condemn violent forms of protest. That's probably roughly ~300 million ppl who aren't onboard with Antifa ideology. Why shouldn't they have a voice?
dirtfindr 4 years ago • 100%
Bingo. Boycotting is the real answer. Otherwise if you dance for them, you serve as an enabler. It's not worth it.
And when it's the public sector (i.e. talking to a government office that you can't boycott), I write an old-fashioned letter, print it out on paper, put a fucking stamp on it, and go to the fucking mailbox like it's the 1980s. There is satisfaction in knowing that someone has to open that shit up and perhaps manually do some data entry or scanning.
dirtfindr 4 years ago • 100%
I used to think it was purely Tor users getting most of the mistreatment, but recently normies are reportedly getting hit with CAPTCHAs from Bing-sourced search engines (e.g. Qwant, Ecosia, Swisscows, etc).
dirtfindr 4 years ago • 100%
Being free s/w does not automatically make s/w appear out of nowhere. Find a fork that:
- Has removed or soft-coded the slur filter
- Attests that the changes to their fork do not break compatibility with other federated nodes. (What happens when they hack the filter to allow the word "salt-w-a-ter", and then one node tries to sync the msg with an instance that uses the stock slur filter? For all we know, it could crash in a nasty way, or it could simply circumvent the filter. Or if the filter gets applied and one copy of the msg differs from that of another node, will the next sync re-copy the msg? Could this start a loop between different instances trying to sync the same msg with different text? Will instances with a different slur filter have to sever connectivity with nodes of different slur filters? Because it was poorly designed with the absurd assumption that everyone wants the same English-based slur filter, we have to assume there would be a chain of problems. Obviously the current design wasn't thought through.)
If you can find such a fork then you're on to something -- and whatever it is, it's not "Lemmy", because once you change it it's something else. This thread is about Lemmy and you're effectively using an "argument to the future" fallacy by bringing up software that doesn't exist.
Had they soft-coded it, then these matters would be moot because the design would have to accommodate slur filter variation. But they didn't. They decided to micro-dictate moderation. So the design can assume everyone is using the same slur filter. It's their choice to do so but reflects poorly on credibility. And I happen to concur with most of the bad-word list (not the design or implementation, but simply the words).
Of course this raises the question: what else is inappropriately hard-coded as a result of this biased authoritarian tendency, and how will that break the network when ppl hack it to be politically neutral or reasonable for a wider audience than Antifa?
dirtfindr 4 years ago • 100%
Peekier, Gomu, and Joshwho are all CloudFlare sites. And if that's not embarrassing enough, Peekier and Gomu simultaneously claim to be privacy-respecting. So I won't be looking any further at those two unless something else brings me to them. It's appalling that they claim to offer privacy while letting the biggest privacy abuser of the web see the queries and all traffic to those sites. Either it's profound ignorance or it's intellectual dishonesty.
Runnaroo seems to be garbage.
Swisscows sources from MS Bing and like many engines that do that, they treat Tor users with hostility (just like Qwant and Ecosia).
Runaroo.com makes the following [claim](https://www.runnaroo.com/privacy): > "The Runnaroo search engine was designed from the ground up to > protect the privacy of its users." So I poked around and this is what I found: # poor transparency * They don't say who they are * They don't say where they are * They make no mention of GDPR * They don't say who their advertising partners are # Runaroo feeds privacy abusers * They source data from Google and Yelp (possibly Bing too\*) * They use Google's cloud service (that's according to my ASN check, yet the *Cloud Firewall* FF plugin flags it as AWS, which would be even worse) * The first ***four*** results of an arbitrary search were privacy-abusing Tor-hostile CloudFlare sites. Each result consumes enough screen space for four results to consume the whole screen of some users. So essentially filling the screen with CF links. They must be paying Google for cloud service, and they're very likely paying both Google and Yelp for API access. Financially feeding privacy abusers is a non-starter. An amusing side-effect of their meta-search is that if "Runnaroo" is in the search query, the results want to correct it. I was asked "Did you mean bonnaroo bing?" when I searched for "Runnaroo Bing". The reason for that search was to try to confirm a rumor that Runnaroo also sources from Bing. (\*) I have in my notes that Runnaroo sources from MS Bing, but I lost track of where I got that information so I don't know if it's true. If anyone knows plz say something. # Features (paywall flags) One cool and novel feature of Runnaroo is that they flag paywalls. E.g. next to Washington Post hits, it says "content may be behind a paywall". # Anti-features They lack links to cached or proxied versions of websites. # Conclusion: Ss is still king They're not [as bad](https://dev.lemmy.ml/post/31321) as DuckDuckGo, but [Ss](https://ss.wodferndripvpe6ib4uz4rtngrnzichnirgn7t5x64gxcyroopbhsuqd.onion) is still the most privacy-respecting search engine in the world.
dirtfindr 4 years ago • 100%
from the article:
"Reddit’s source code uses bundling and minification"
Would be nice if uMatrix could detect obfuscation on any j/s it retrieves, and have 2 separate switches: one for retrieval & one for execution. Users have to guess on what to trust and this would help ppl make more informed decisions.
BTW, I will not upvote the OP b/c it sends ppl to a CloudFlare site. This is a replacement link.
dirtfindr 4 years ago • 100%
If you want to have that, this
instancenetwork is not for you.
(correction mine)
The filter is hard-coded. It's designed to control all instances.
There's nothing wrong with having a slur filter if well designed, but Lemmy's slur filter is not well-designed.
dirtfindr 4 years ago • 100%
DDG is not "good enough".
Most search engines are better than that.
dirtfindr 4 years ago • 75%
Also, yeah. It is easily circumventable.
Yes, easy to circumvent for bigots who actually use those words (b/c they likely know what word will be triggered and they probably have the energy to game it) -- yet it's difficult to legit users who might unwittingly write salt-w-a-ter or k-i-k-epa.
At least now the Lemmy server simply does a substitution. They used to block the ability to submit the article and you'd have to throw away your work. Substitution is still a problem though b/c legit users don't always notice part of a word getting replaced with "removed" and then readers have to guess what word the author intended.
dirtfindr 4 years ago • 72%
The code is open source. If you have a look at it, there's a nasty regular expression in it that matches in unexpected ways. E.g. the word t-w-a-t matches if you use the word sal-t-w-a-t-er. They may have fixed that word match by now but you get the idea. Someone who uses the word salt-w-a-ter would have no idea that that's the offending word.
It's a poor design for several reasons:
- It's a regex with false positives
- It's not coded in a way that makes it feasible to present in a readable way to normies in a policy statement
- The user is not told what word the site thinks is offensive
- It's hard-coded, which means if someone else runs a Lemmy instance, the code is pre-packaged with policy. It's a bad idea. Should be soft-coded in the config. It shouldn't be bundled with the code.
- And look how easy it is to circumvent.. i just had to add some dashes.
ReverseEagle [DEPRECATED]
*Permanently Deleted*
dirtfindr 4 years ago • 100%
This headline lies. (hence the down vote)
Aurora Store still uses the Google API, which is subject to copious tracking. You must have a Google acct (which in itself entails privacy abuse), you must login, and from there Google still tracks everything you do. Google still knows all the versions of all the apps you have, and thus knows everything you're vulnerable to.
Google also records your IMEI number on file. If the API enforces that you're hosed.
F-Droid is indeed the answer. If you don't have the discipline or self-control to avoid Google, then Blackmart is still better than Aurora Store b/c you don't need a Google acct.
DeGoogle Yourself
*Permanently Deleted*
dirtfindr 4 years ago • 75%
That page is a mixed bag of good and bad info. Mostly useful, but we should highlight the bad info:
- DuckDuckGo is evil in many ways -- avoid them
- Ecosia is harmful to both privacy and the environment (she is aware of the issues with Ecosia, and in fact not open to discussion)
- gitlab.com is a terrible recommendation-- the worst possible recommendation (worse than Github).
- Telegram forces ph# reg and IIRC it uses AWS; it's unworthy of endorsement
- notable mentions that are unworthy as such: Signal, Qwant, Startpage
Neglecting CloudFlare is a big oversight. Most people are aware of GAFAM, FAANG, and all those companies. But CloudFlare is the least known and most destructive. It's important to target it high on the campaign for freedom, netnetrality and privacy.
dirtfindr 4 years ago • 100%
Philips Sonicare app grabs your clipboard - wtf - is that a toothbrush app?
dirtfindr 4 years ago • 100%
It's worth noting that DDG has conveniently ignored this "bug" for a year, and it isn't a one-off incident. DDG has a history of wrongdoing:
They're only addressing it now because suddenly there is more press on it, and it has reached a point where they'd lose some serious marketshare if they continued looking the other way. It's disgusting that they were able to collect data for a year after the report was filed.
DeGoogle Yourself
Why deGoogle? Why isn't this a "deMACFANG" movement?
dirtfindr 4 years ago • 100%
Abuses of privacy, network neutrality, & environmental harm to name a few.
DeGoogle Yourself
Why deGoogle? Why isn't this a "deMACFANG" movement?
dirtfindr 4 years ago • 100%
I don’t think it should be company specific.
Agreed. It should cover more companies; MACFANG in particular.
To me, the deGoogle movement is about fighting against lock-in.
It's a lousy name. "deGoogle" is about boycotting Google. You can internalize it to mean other things all you want, but boycotting MACFANG is not what the masses understand "deGoogle" to be - and that's the problem. When you look at all the "deGoogle" articles out in the wild, it's clear that it's a strictly anti-google movement.
I see a lot of people praise Apple for whatever reason and think they’re high and mighty for switching to Apple from Google, but they completely miss the point.
When you say they "miss the point", they miss your internalized philosophy (which fixates on lock-in). But in fact your "point" is not captured by the "deGoogle" movement, which calls out just one company.
You're fixated on vendor "lock-in", and disregard surveillance capitalism, privacy abuses, and a whole host of social injustices, so it's no wonder that you would perceive Apple as being worse than Google. Once you consider environmental destruction (partnerships with oil companies like Total, cheap phones that masquerade as "open source" but actually still can't be upgraded w/out buying new hardware [which then go to landfills in higher numbers]), the artificial intelligence that tracks people with great precision, xenophobic participation with human rights compromising private prisons/ICE, Google is a clear loser compared to Apple, if one must choose between them.
I say boycott both. Boycott MACFANG.
I don’t see the problem with a specific company, I see the problem as relying on any company and being at mercy to their policies.
There are specific companies that are particularly good at disempowering and controlling the people (MACFANG). Underdogs not so much. Underdogs can't take market share from the tech giants if they're going to be equally evil -- they don't have the leverage. If you neglect to identify specific bad players, call out the worst of them, and boycott them, you're not really working against them to the extent needed.
dirtfindr 4 years ago • 100%
Depending on your needs/threat model, Signal and Telegram are both good options
Everyone's threat model should include mass surveillance and surveillance capitalism. Signal is a very poor choice in that regard. See also: https://resist.berlin/goodbye_signal.txt
Google is evil but there are greater evils, like Amazon and Microsoft. The fixation with fighting Google (the "deGoogle movement") can actually worsen things if ppl turn to a competing tech giant. MACFANG is: * Microsoft (\*) * Amazon (\*) * CloudFlare (\*) * Facebook (\*) * Apple * Netflix * Google I've marked with "\*" the scumbag corps that I consider substantially more evil who have a more detrimental impact on the world than Google (all things considered- social injustice, tech freedom, privacy, environmental destruction, etc).
Why Github is harmful: [comprehensive article](https://github.com/privacytoolsIO/privacytools.io/issues/843), [Stallman's PoV](https://stallman.org/archives/2019-jul-oct.html?fbclid=IwAR06rNPjpH3Sdmiyt4F9e26dWxo45wieoCPTSaf9n0bvR0vGsae2Ty5SCyM#27_October_2019) Why Gitlab ***.com service*** is harmful: [article](https://dev.lemmy.ml/post/30312/comment/2239) S/W vs. service: It must be emphasized that there are no notable privacy or ethical issues with Gitlab's free software package. It's quite fine to host your own Gitlab instance. If you respect privacy and have a strong ethical constitution then you would not use the gitlab.com *service*. | site | implied endorsement (by example) | site's position & mission are inconsistent | notes | |---|---|---|---| | [de-Google-ify](https://markosaric.com/surveillance-capitalism/) | no | no | n/a | | [Frama](https://framasoft.org/en/) | no(\*) | no | n/a | | [PRISM-Break](https://prism-break.org/en/) | [uses gitlab.com](https://gitlab.com/prism-break/prism-break) | yes | In fact they [explicitly endorse](https://prism-break.org/en/all/#collaboration) gitlab.com despite being [well aware](https://gitlab.com/prism-break/prism-break/-/issues/2109) of the problems. ([2nd ref](https://github.com/prism-break/prism-break/issues/2033)) | | [PTIO](https://privacytools.io/) | [uses github.com](https://github.com/privacytoolsIO/privacytools.io)(\*) | yes | Very big ad on their page saying "The complete website source code is available on GitHub. Join our developer team!" despite being [aware](https://github.com/privacytoolsIO/privacytools.io/issues/843) of the issues. | | [Security Checklist](https://securitycheckli.st/) | [uses github.com](https://github.com/brianlovin/security-checklist) | yes | They urge visitors to join their github project. | | [Surveillance Self-Defense](https://ssd.eff.org/en) | [uses Github](https://github.com/EFForg/privacybadger) | yes | They neglect to condemn Github when [addressing it](https://ssd.eff.org/en/blog/moving-your-site-not-secure-secure), and in fact they say "if you’re a developer and would like to help, check us out on Github". | | [Stallman](https://stallman.org) | no | no | RMS [condemns](https://stallman.org/archives/2019-jul-oct.html?fbclid=IwAR06rNPjpH3Sdmiyt4F9e26dWxo45wieoCPTSaf9n0bvR0vGsae2Ty5SCyM#27_October_2019_(Urgent:_Stop_working_for_deportation_thugs)) Github. | | [Switching Software](https://switching.software) | no | no | They [lead](https://switching.software/support/) people to Codeberg. | | [ThinkPrivacy](thinkprivacy.ch) | [yes](https://www.thinkprivacy.ch/contact) | yes, users give up control in the registration process. | site withholds wrongdoing. | (*) Framasoft and PTIO both host their own Gitlab instances. Framasoft actually uses their own instance as a primary development tool. PTIO uses Github despite running a Gitlab instance. Shame on PTIO for not eating their own dog food, particularly when they've [been informed](https://github.com/privacytoolsIO/privacytools.io/issues/843) of the long list of Github issues. ([part 1: web search engines (DDG & Qwant)](https://dev.lemmy.ml/post/31487)) ([part 2: messaging services (Signal & Keybase)](https://dev.lemmy.ml/post/32542))
dirtfindr 4 years ago • 100%
Wickr has two gren checks and is green lit across the board except jurisdiction. And yet was closed-source s/w last time i checked.
Signal has a green cell for "puddle test", but that's changing. OWS has announced making data recoverable.
The raw data is mostly usefuly, but some of the overall recommendations are lousy. Ignore the checkmarks.
dirtfindr 4 years ago • 66%
Insecurity due to bribery can manifest in many ways. Snowden revealed (and Bruce Schneier elaborated) that the mass surveillance strategies are largely carried out by paying bribes to enlist cooperation from key organizations. E.g.
- backdoors -- This is completely trivial for non-free s/w. It still happens with free s/w but it requires a bit more effort, like compromising the few developers whose eyes are going to be on the piece of code under attack. Signal is non-free masquerading as free. It's GPLd, but OWS uses network protectionism to block users from actually benefiting from free s/w. OWS threatened the makers of Libre Signal with a lawsuit. So if there is something you don't like in the code, you can't fix it. Your choice is to take-it-or-leave-it. Since you can't effectively change it and make it your own, are you really going to take the time to read the code? Unlikely. When OWS renders software freedom useless, there are fewer eyes on the code and this can even be more dangerous than closed-source s/w b/c it includes the false sense of security that someone who looks at the code is looking after your interests. The big openssl bug emerged due to this snowdrift dilemma.
- bugs -- Who needs a backdoor when hackers exploit bugs? Bugs can be planted just as a backdoor, and in fact it's easier to plant a bug in than it is a backdoor. Existing bugs can be ignored as well. The adversary (opentechfund) could spot a bug and either pressure OWS not to fix it, or they can make requests that guide developers eyes away from the bug. It's so easy; I plant bugs all the time and get away with it. The only difference is that when I do it, it's an accident. When an adversary does it, it's an "accident".
- weak design -- The project may have a design idea that makes the app more secure, but they simply opt not to take that direction b/c an important donor wouldn't like it. Or if you consider the topic of this thread, it's quite possible that Signal is looking to weaken the design -- to get keys into the cloud in order to set users up for compromise. Government bribes are not often to cause outright blatant backdoors, but rather to weaken security in ways that their highly skilled hackers can come up with a clever attack that works in not-so-obvious ways. I don't mean to push a conspiracy theory but you must consider the timing of this putting the keys in the cloud with the "Earn IT Act". At the same time, they can keep users interest by claiming this is a precursor to eliminating ph#.
Technology
Your Equifax settlement $125 isn’t coming, but banks get their $5.5M | Ars Technica
dirtfindr 4 years ago • 100%
The 1st sneaky thing they did was screw ppl by default. These were your choices:
- take no action (default choice) -- if you took no action, you get zero and yet you are still considered part of the class that took action, so you're blocked from taking action later.
- file a claim -- if you file a claim, maybe you get a fraction of a dollar payout or maybe you get free credit monitoring, but only if you understood the rules. You're only entitled to the 50 cents or whatever it works out to if you already bought credit monitoring. If you didn't already have credit monitoring, the only reward was free credit monitoring. It's a lousy option because the credit monitoring needlessly exposes your file to the 3rd party who is doing the monitoring.. so you must trust them with your data. And all you get out of it is a fast warning about issues, and insurance. Since you are already protected by law from fraud, the insurance really just means you get a free lawyer to ease your cleanup effort. It's like you get a janitor in the event of a mess.
- opt out -- if you proactively opted out of the class action, then you are not bound by the lousy deal struck by the class action lawyers. This is the best place to be. You can bring your own small claim. Some people have reported winning $8k in small claims simply for being breached (not for a real identity theft). Your milage will vary depending on your situation, but EFX doesn't want to finance lawyers for every small claim. It's easy to get a low-ball settlement.
The default take no action option is foolishly arranged. It should be: you are in the class or not, and if you are in the class then you should get compensated automatically.
If the lawyers were reasonable, they would have said "if you don't file a claim by the deadline, then you are automatically outside of the class so you can take your own action."
Open Source
Steve Ballmer formerly said that 'Linux is a cancer' and that it contaminates all other software with Hippie GPL rubbish
dirtfindr 4 years ago • 66%
Is that due to OTF not offering money, or due to OWS not accepting the money? I'm assuming it's the former.
When a US politician accepts a bribe from a US lobby like the NRA, how long does it buy loyalty for? Perhaps just as long as the term for the elected office, but with OWS Signal there are no term limits.
dirtfindr 4 years ago • 100%
The PIN cannot be the identifier directly because the article states the PINs are primarily used for data recovery. If PINs were also your identifier then anyone could trivially do a recovery op on your data.
dirtfindr 4 years ago • 100%
OWS has finally realized the huge shitshow that arises from requiring phone numbers. Note that this is merely a positive step toward eliminate ph#s -- they ultimately still have not fixed the problem.
The article was written by someone with marketing in mind, because they omit an important detail: where does the key storage move to if they're protecting it with a PIN? In their phone to toilet example, they're assuming the keys are forever lost (nevermind that an advanced user can possibly recover their data). So it's essentially implied that OWS is moving key storage into the cloud. It's not likely an accident that OWS omits this from their article. Resist.Berlin points out (in the article below) that OWS is quite happy to transmit sensitive PINs over an insecure phone line. So if they don't also change that attitude this is a recipe for disaster.
For the moment, you should still be avoiding Signal. These two articles give extensive rationale:
- Problem with Signal (PTIO ignored critic)
- Goodbye Signal (Resist - Berlin)
And this article covers which privacy advice sites you can and can't trust in this regard.
[According](https://dev.lemmy.ml/post/30590/comment/4779) to /u/diorama, Lemmy is making use of archive.is. This site is particularly insideous and destructive to Tor users. Archive.is is a CloudFlare site, which in itself aligns it with privacy and netneutrality abuses. But worse, the usual tools Tor users use to reach the content are useless against archive.is. That is, Tor Browser normally gets past the Google reCAPTCHA on CloudWalled sites, but archive.is is an exception. Archive.org refuses to access archive.is, so Tor users also can't use archive.org to reach content held by archive.is. I'm not sure what circumstance causes Lemmy to use archive.is, but Lemmy should go a step further. That is, when anyone posts a link to a CloudFlare site, Lemmy should regard this as a link that leads from the free world into an exclusive walled-garden where access inequality arises. When a user submits a post with an offending link, they should get a warning. Whether the user has the option to override the warning should be configurable & controlled by the node admin. When such posts are made, logged-in readers should additionally have a config option to hide such posts.
dev.lemmy.ml is unreachable most of the time. Which is fair enough since it's a test system, but in principle it should be possible to access articles via archive.org during down moments. So I went to this archived page: https://web.archive.org/web/20200319191703/dev.lemmy.ml/post/31321 and it's blank. Some will call this a feature; I call it a bug.
Startpage tries to position itself as a privacy-respecting search engine that gives you Google results. They do shield users from Google but after being bought by an ad company their credibility has become shakey. Not only should users expect exploitation by ad companies, but Startpage also *pays* Google for API access. So Google still profits from startpage.com queries, which means you still contribute by proxy to privacy abuse as well as climate denial (Google has [been caught](https://www.theguardian.com/environment/2019/oct/11/google-contributions-climate-change-deniers) financing climate denial). Anyway, the screenshot attached shows how Startpage now treats Tor users *after* entering a search query. This isn't just a DoS but it also shows disrespect for Tor users time to let them enter the query before denying access. They likely do this because the query itself has value for their data collection.
someone sent me a DM and my reply is being blocked. I consistently get a "operation cancelled" popup. So all the text I wrote is just trapped in the text box. I've tried for a day now to push it through. Would someone plz DM u/Panzerfaust for me and say that I cannot reply, so he doesn't think I ignored his msg? Developers: please find the code for the "operation cancelled" popup and rewrite to state exactly ***why*** the operation is being canceled. (update) I think he got the message despite the error, because he thanked me for the msg. So it's a false error. So he probably got flooded with dupes as I kept trying to send it.
# Harmful endorsement: Signal Why it's harmful: * "[Problem with Signal](https://github.com/privacytoolsIO/privacytools.io/issues/779)" by a PTIO critic * "[Goodbye Signal](https://resist.berlin/goodbye_signal.txt)" by Resist.Berlin * (unchecked) Will Signal keys be stored in the cloud? ([ref](https://dev.lemmy.ml/post/33136/comment/4909)) | site | Signal endorsement | site's position & mission are inconsistent | endorsement contains misinfo or withholds pitfalls | |---|---|---|---| | [de-Google-ify](https://markosaric.com/surveillance-capitalism/) | no (but suggests another poor choice: Telegram) | no | n/a w.r.t Signal, but Telegram imposes mobile phone svc. | | [Frama](https://framasoft.org/en/) | no | no | n/a | | [PRISM-Break](https://prism-break.org/en/) | [yes](https://prism-break.org/en/projects/signal/) | yes | site withholds OWS Signal wrongdoing | | [PTIO](https://privacytools.io/) | [yes](https://www.privacytools.io/software/real-time-communication/) | yes | PTIO cautions about requiring ph#, but neglects to say non-mobile phone users are excluded and withholds most of OWS's wrongdoing & pitfalls. PTIO leads users to a page that hides the existence of an APK download. | | [Security Checklist](https://securitycheckli.st/) | yes | yes | site withholds OWS Signal wrongdoing | | [Surveillance Self-Defense](https://ssd.eff.org/en) | [yes](https://ssd.eff.org/en/module/how-use-signal-android) | yes | misinfo: "Signal is a free and open source software" ([proof](https://directory.fsf.org/wiki/Signal)) site withholds OWS Signal wrongdoing but ironically [admits](https://ssd.eff.org/en/module/problem-mobile-phones) to the harm of mobile phones. | | [Stallman](https://stallman.org) | no | no | n/a | | [Switching Software](https://switching.software) | [yes](https://switching.software/replace/facebook-messenger/) | yes, if you consider Signal an unethical alternative | site withholds OWS Signal wrongdoing | | [ThinkPrivacy](thinkprivacy.ch) | [yes](https://www.thinkprivacy.ch/messengers) | yes, users give up control with Signal as a result of OWS's network protectionism & Signal's use of Google reCAPTCHA. OWS also pushes users into a mass surveillance trap (Google Playstore) | site withholds OWS Signal wrongdoing. | ## Harmful endorsement: Keybase Why it's harmful: [article](https://github.com/privacytoolsIO/privacytools.io/issues/740#issuecomment-460076395) (May 2020 update: Zoom acquired Keybase) | site | endorsement | site's position & mission are inconsistent | endorsement contains misinfo or withholds pitfalls | |---|---|---|---| | [de-Google-ify](https://markosaric.com/surveillance-capitalism/) | no | no | n/a | | [Frama](https://framasoft.org/en/) | no | no | n/a | | [PRISM-Break](https://prism-break.org/en/) | no | no | n/a | | [PTIO](https://privacytools.io/) | [yes](https://www.privacytools.io/software/real-time-communication/) | yes | the warning is esoteric & insignificant compared to all the [serious issues](https://github.com/privacytoolsIO/privacytools.io/issues/740#issuecomment-460076395) that PTIO has actually been told of and recklessly fails to warn users about. | | [Security Checklist](https://securitycheckli.st/) | no | no | n/a | | [Surveillance Self-Defense](https://ssd.eff.org/en) | [yes](https://ssd.eff.org/en/module/key-verification) | yes | site withholds Keybase wrongdoing, and sets users up for leaky and lost communications. | | [Stallman](https://stallman.org) | no | no | n/a | | [Switching Software](https://switching.software) | no | no | n/a | | [ThinkPrivacy](thinkprivacy.ch) | [yes](https://www.thinkprivacy.ch/messengers) | yes, users give up control with Keybase, which takes copious liberties once it's installed on your system. And if you don't install the server messages to you will be black-holed. This is the opposite of giving the user control over their data. | site withholds Keybase's most significant wrongdoing and merely flags the Zoom acquisition | ([part 1: web search engines (DDG & Qwant)](https://dev.lemmy.ml/post/31487)) ([part 3: s/w repositories (Github & Gitlab)](https://dev.lemmy.ml/post/35452))
Qwant sometimes hits Tor users with this puzzle ***after*** they submit a query. Then after solving the puzzle, they're brought back to an empty form so they must re-type their query.
I created this before realizing the following communities already exist: * https://dev.lemmy.ml/c/lemmy_support * https://dev.lemmy.ml/c/asklemmy So, it's here for now but posts may get more notice in the above communities.
[This post](https://dev.lemmy.ml/post/31321) demonstrates the bug. When a bit of text is <!-- commented out -->, Lemmy shows it anyway.
Has something changed in the past couple days to make dev.lemmy.ml a memory hog? There was never a performance issue in the past months, but now it's as fat as pleroma. I cannot use pleroma because of it's absurd amount of RAM consumption. If this doesn't improve, does anyone know of a client app that would enable users to avoid the web app?
This is an examination of the integrity and credibility of the following projects that attempt to advise privacy-focused consumers. | site | mission statement of purpose | |---|---| | [de-Google-ify](https://markosaric.com/surveillance-capitalism/) | "*These ethical alternatives will help you de-Google-ify your life, have a calmer and far less intrusive online experience.*" | | [Frama](https://framasoft.org/en/) | "*promotion, dissemination and development of free software, enhancement of open source culture, and an online platform of open services.*" ([full charter](https://framasoft.org/en/charte/)) | | [PRISM-Break](https://prism-break.org/en/) | "*Help make mass surveillance of entire populations uneconomical! We all have a right to privacy, which you can exercise today by encrypting your communications and ending your reliance on proprietary services.*" | | [PTIO](https://privacytools.io/) | "*You are being watched. Private and state-sponsored organizations are monitoring and recording your online activities. PrivacyTools provides services, tools and knowledge to protect your privacy against global mass surveillance.*" | | [Security Checklist](https://securitycheckli.st/) | "*An open source checklist of resources designed to improve your online privacy and security. Check things off to keep track as you go.*" | | [Surveillance Self-Defense](https://ssd.eff.org/en) | "*our [EFF's] expert guide to protecting you and your friends from online spying.*" | | [Stallman](https://stallman.org) | (advice is tech freedom centric but RMS also has a respectible stance on privacy issues) | | [Switching Software](https://switching.software) | "*Ethical, easy-to-use and privacy-conscious alternatives to well-known software*" | | [ThinkPrivacy](thinkprivacy.ch) | "*It's your data. It's time you take control of it.*" # Harmful endorsement: DuckDuckGo ("DDG") Why it's harmful: [article](https://dev.lemmy.ml/post/31321) | site | DuckDuckGo endorsement | site's position & mission are inconsistent | endorsement or condemnation contains misinfo or withholds pitfalls | |---|---|---|---| | [de-Google-ify](https://markosaric.com/surveillance-capitalism/) | [yes](https://markosaric.com/surveillance-capitalism/#replace-google-search-with-duckduckgo) | yes, if you consider DDG an unethical alternative | site withholds DDG wrongdoing, and makes a positive claim that DDG has no filter bubble (which is disputed) | | [Frama](https://framasoft.org/en/) | no (and in fact DDG [blacklisted](https://contact.framasoft.org/wp-content/uploads/newsletters/newsletter10.html) Framabee) | no | n/a | | [PRISM-Break](https://prism-break.org/en/) | [yes](https://prism-break.org/en/projects/duckduckgo/) | yes, by economically supporting privacy abusing surveillance capitalists (direct adversaries of the PRISM-Break mission) | site withholds DDG wrongdoing | | [PTIO](https://privacytools.io/) | [yes](https://www.privacytools.io/providers/search-engines/) | yes, financing privacy abusers works against PTIO's mission. | site cautions about UKUSA, but withholds most DDG wrongdoing | | [Security Checklist](https://securitycheckli.st/) | yes | depends on user's previous tool whether DDG is an improvement | site withholds DDG wrongdoing and also makes unverifiable\* claims | | [Surveillance Self-Defense](https://ssd.eff.org/en) | [almost](https://ssd.eff.org/en/module/how-use-tor-macos) | meh, you decide | Endorsement is kind of implied by TB advocacy & presentation of default search engine without caution | | [Stallman](https://stallman.org) | [no](https://stallman.org/articles/duckduckgo-censorship.html) | no | page overlooks most DDG issues, but it was only meant to expose one issue | | [Switching Software](https://switching.software) | [yes](https://switching.software/replace/google-search/) | yes, if you consider DDG an unethical alternative | site withholds DDG wrongdoing and also makes unverifiable\* claims | | [ThinkPrivacy](thinkprivacy.ch) | [yes](https://web.archive.org/web/20200326231847/www.thinkprivacy.ch/search) | yes, financing privacy abusers works against TP's mission. | site withholds DDG wrongdoing and also makes unverifiable\* claims | (\*) DDG *claims* they do not track users, but they cannot prove it. So when a third party like [Switching Software](https://switching.software) or [ThinkPrivacy](thinkprivacy.ch) states DDG does not track you, they are asserting something they can't. They should not be endorsing DDG in the first place, but if they insist, then they should instead say something like "DDG claims not to track you" so as to avoid deceiving people about the verifiability of the claim. It's particularly interesting to note that ThinkPrivacy gives the highest endorsement to [Startpage](https://www.thinkprivacy.ch/checklist.html), which was bought by US advertising company "System1". Yet ThinkPrivacy [loudly condemns](https://www.thinkprivacy.ch/cutting-the-wire) for the very same reason. Why? Dan Arel works for Startpage. This arose out of a scandal where Mr. Arel was advising the privacytools.io project at the time PTIO was considering pulling their endorsement of Startpage. To be fair, DuckDuckGo has a much more extensive history of undermining privacy both directly and by proxy through partnerships with privacy abusers than Startpage. ## Harmful endorsement: Qwant While Qwant has some privacy strengths that make it substantially more trustworthy and privacy-respecting than DuckDuckGo, it still has noteworthy issues that undermine privacy: 1. Privacy 1. Tor hostility -- Tor users are sometimes forced to [solve a CAPTCHA](https://dev.lemmy.ml/post/31645), and it's implemented in a destructive manner. That is, the search query is collected ***before*** Qwant decides to push a CAPTCHA. Since the user has already invested effort in typing the query, the user is coerced to solve the puzzle in order to not throw away their effort to that point. Then after successfully solving the puzzle, the query is wiped out anyway and the user is forced to retype their query. 1. No proxy feature. Some search engines like Searxes and Metager give an alternative proxy or cached link that avoids directly connecting to the site in the results. This is useful for all users but it's important to Tor users because many sites block or mistreat Tor users, in which case Tor users must visit the site indirectly. Qwant neglects to accommodate. 1. Qwant's [swag store](http://store.qwant.com/) accepts Paypal, who then shares customers data with [600 companies](https://www.schneier.com/blog/archives/2018/03/the_600_compani.html) amid [other abuses](https://dev.lemmy.ml/post/30880). 1. Qwant's [swag store](http://store.qwant.com/) says "follow us on Facebook", leading users into mass surveillance and makes no mention of their [Mastodon account](https://social.privacytools.io/@Qwant). 1. Microsoft [partnership](https://betterweb.qwant.com/en/how-microsoft-tools-strengthen-qwant/) has been ongoing. 1. Qwant patronizes Microsoft for its [advertising network](https://en.wikipedia.org/wiki/Qwant) 1. Qwant claims they no longer use Bing search results, but this is disputed. (And then they [admit](https://mastodon.social/@Qwant/103692143045274520) to it) 1. Qwant [uses](https://betterweb.qwant.com/en/how-microsoft-tools-strengthen-qwant/) Microsoft Azure cloud services. 1. Qwant's [swag store](http://store.qwant.com/) sells apparel made of cotton, which is bad for the environment. 1. Qwant has [ties](https://social.privacytools.io/@Qwant/102945184291956539) to [Fight for the Future Inc](https://dev.lemmy.ml/post/31655), an organization that claims to fight for net neutrality yet uses CloudFlare themselves. We won't document all of Microsoft's wrongdoing here, but MS has a long history of privacy abuse and still today they are embroiled in privacy scandals such as financial facial recognition technology to AnyVision and violating the GDPR. | site | Qwant endorsement | site's position & mission are inconsistent | endorsement misinforms or withholds pitfalls | |---|---|---|---| | [de-Google-ify](https://markosaric.com/surveillance-capitalism/) | no | no | n/a | | [Frama](https://framasoft.org/en/) | no | no | n/a | | [PRISM-Break](https://prism-break.org/en/) | no | no | n/a | | [PTIO](https://privacytools.io/) | [yes](https://www.privacytools.io/providers/search-engines/) | yes | site withholds Qwant wrongdoing | | [Security Checklist](https://securitycheckli.st/) | no | no | n/a | | [Surveillance Self-Defense](https://ssd.eff.org/en) | no | no | n/a | | [Stallman](https://stallman.org) | no | no | n/a | | [Switching Software](https://switching.software) | [yes](https://switching.software/replace/google-search/) | yes, if you consider Qwant unethical | site withholds Qwant wrongdoing and also makes unverifiable\* claims | | [ThinkPrivacy](thinkprivacy.ch) | no | no | n/a | (\*) Qwant *claims* they do not track users, but they cannot prove it. So when a third party like [Switching Software](https://switching.software) states Qwant does not track you, they are asserting something they can't. They should not be endorsing Qwant in the first place, but if they insist, then they should instead say something like "Qwant claims not to track you" so as to avoid deceiving ppl about the verifiability of the claim. OTOH, Qwant would be violating the GDPR if they did track you contrary to their privacy policy, so perhaps it's fair enough for Switching Software to make this assertion (unlike DDG, who is bound only contractually & they've shown to violate it already). It's worth considering that sites that endorse DuckDuckGo and nothing else are actually more harmful than sites that list other alternatives like Qwant, b/c there is more likeliness that users opt to use DDG when it's the only endorsed choice. ([part 2: messaging services](https://dev.lemmy.ml/post/32542)) ([part 3: s/w repos](https://dev.lemmy.ml/post/35452))
Privacytools ("PTIO") is a project with the noble mission to "*provide knowledge and tools to protect your privacy against global mass surveillance*" Sounds useful, no? Sadly, their [website](http://privacy2zbidut4m4jyj3ksdqidzkw3uoip2vhvhbvwxbqux5xy5obyd.onion/) does the opposite of its claim: it leads people straight into mass surveillance centers through endorsements of bad players. The site is rife with entities that privacy seekers should be avoiding. They not only show poor judgment by endorsing privacy abusers who work directly against their mission, but they also neglect to enumerate the traps and pitfalls on the endorsement pages. Apart from the transparency problem, security experts expose lots of privacy abuses in the website bug tracker which have little influence on decisions made by the staff that's in control of commits. # Dangerous and misinformed endorsements * ***Signal*** PTIO claims to "*provide knowledge and tools to protect your privacy against global mass surveillance*", yet PTIO [knowingly and willfully](https://github.com/privacytoolsIO/privacytools.io/issues/779) sends privacy seekers directly into several mass surveillance traps via OWS Signal. * ***Keybase*** PTIO endorses Keybase despite [reckless and malicious wrongdoing](https://github.com/privacytoolsIO/privacytools.io/issues/740#issuecomment-460076395) -- which PTIO is aware of. * ***DuckDuckGo*** ("DDG") is falsely marketed (but very well marketed) as privacy-respecting. It's a popular choice among naive users. Experts know better. Sadly, PTIO does not. [Copious privacy abuses](https://dev.lemmy.ml/post/31321) are linked to DDG. PTIO betrays the public trust through this reckless and uncautioned endorsement. PTIO down plays the non-controversial and superior [alternatives](https://dev.lemmy.ml/post/29179). * ***Qwant*** Has a history of hostility toward Tor users. e.g.:  Metager and Mojeek have never mistreated Tor users, and yet they rank low in PTIO endorsements. # Incompetence and deception * ***Searx*** PTIO has a fundamental misunderstanding of what Searx is. It's smart to [endorse](https://www.privacytools.io/providers/search-engines/) searx, but not as a search "provider". Searx is not a service. Searx is free ***software*** search engine. PTIO erroneously claims "No logs, no ads and no tracking". It's a deception. Anyone can run a public searx instance and implement logs, ads, tracking, and any other anti-feature they want. There are [many instances](https://searx.space/). And some searx instances do in fact push ads to pay their bills. All but one searx instance will push privacy abusing CloudFlare results to users -- and at least half a dozen of them are evil to the extent of proxying through CloudFlare themselves. It only makes sense to endorse particular searx instances. There is one searx instance that is uniquely above all privacy respecting, which filters out CloudFlare results: searxes.eu.org. * Corruption scandal: PTIO member [met with Startpage reps](http://techrights.org/2020/01/23/relisting-for-money/) to discuss something that would personally benefit him when Startpage endorsement was being dropped. He attended the meeting without informing other PTIO insiders and only admitted to it afterwards after being probed. Of course if PTIO when opts to put their repo on Microsoft Github, the kind of talent they attract are sell-outs. # Hypocrisy- refusal of PTIO to eat their own dog food PTIO is totally blind on the importance of setting an ethical example that is consistent with their own mission. If PTIO cannot handle ethical privacy-respecting tools themselves, how can they possibly expect to give novices confidence? PTIO's credibility is in the shitter as it proudly displays branding for the following on their website: | *shameful example* | *why it's a problem* | |---|---| | **Microsoft Github** | PTIO uses a Microsoft Github repo to manage bug reports. There are [copious problems](https://github.com/privacytoolsIO/privacytools.io/issues/843) with this foolish choice. PTIO makes a failed attempt to reason that they want to be where the most people are. With that kind of rationale, they've self-defeated their mission. | | **Twitter** | PTIO [claims](https://github.com/privacytoolsIO/privacytools.io/issues/843#issuecomment-486891131) Twitter is "for outreach". If PTIO needs to reach Twitter users, they can have a Twitter account. But to ***link into Twitter*** from their website takes the hypocrisy beyond outreach. Users who land on their clearnet website have already been reached. It's both foolish and reckless to lead people from the open web back into Twitter. | | **Facebook** | Richard Stallman gives [good advice](https://stallman.org/facebook-presence.html) to those who refuse to accept the reality that they don't really need Facebook. If you believe you cannot live without Facebook, you still cannot justify linking into FB from the free world. To link from FB to the open web is sensible. To link the other direction is to be an excessive and needless enabler of privacy abuse.| | **Microsoft LinkedIn** | same issue as Twitter and Facebook | | **Reddit** | Amazon-hosted. Same issue as Twitter and Facebook | It’s plainly evident when navigating privacytools.io that there’s a serious credibility problem.
There are substantial privacy and civil liberty issues with DuckDuckGo. Here they are spot-lighted: * ***Nefarious History of DDG founder & CEO***: * DDG's founder (Gabriel Weinberg) has a [history](https://www.reddit.com/r/privacy/comments/aqz3q8/the_history_of_duckduckgos_founder_is_disturbing/) of privacy abuse, starting with his founding of [Names DB](https://en.wikipedia.org/wiki/Names_Database), a surveillance capitalist service designed to coerce naive users to submit sensitive information about their friends. (2006) * Weinberg's [motivation](http://web.archivecrfip2lpi.onion/web/20181116102800/https://www.eyerys.com/articles/people/search-engine-and-privacy-gabriel-weinberg) for creating DDG was not actually to "spread privacy"; it was to create something big, something that would compete with big players. As a privacy abuser during the conception of DDG (Names Database), Weinberg sought to become a big-name legacy. Privacy is Weinberg's means (not ends) in that endeavor. Clearly he doesn't value privacy -- he values perception of privacy. * ***Direct Privacy Abuse***: * DDG [was caught](http://web.archivecrfip2lpi.onion/web/20130627082930/http://www.alexanderhanff.com/duckduckgone) violating its own privacy policy by issuing tracker cookies. * DDG's app [sends every URL](https://github.com/duckduckgo/Android/issues/527) you visit to DDG servers. ([reaction](https://cmpwn.com/@sir/104444543789319623)). * DDG is currently collecting users' operating systems and everything they highlight in the search results. (to verify this, simply hit F12 in your browser and select the "network" tab. Do a search with javascript enabled. Highlight some text on the screen. Mouseover the traffic rows and see that your highlighted text, operating system, and other details relating to geolocation are sent to DDG. Then change the query and submit. Notice that the previous query is being transmitted with the new query to link the queries together) * DDG is accused of [fingerprinting](https://betanews.com/2019/01/07/duckduckgo-fingerprinting-accusation/) users' browsers. * When clicking an ad on the DDG results page, all data available in your session is sent to the advertiser, which is why the Epic browser project [refuses](https://www.epicbrowser.com/FAQ.html) to set DDG as the default browser. * DDG [blacklisted](https://contact.framasoft.org/wp-content/uploads/newsletters/newsletter10.html) Framabee, a search engine for the highly respected framasoft.org consortium. * ***Censorship***: Some people replace Google with DDG in order to avoid censorship. DDG is not the answer. * DDG is [complying](https://stallman.org/articles/duckduckgo-censorship.html) with the "celebrity threesome injunction". * ***CloudFlare***: DDG promotes one of the largest [privacy abusing](https://github.com/privacytoolsIO/privacytools.io/issues/374#issuecomment-460077544) tech giants and adversary to the Tor community: CloudFlare Inc. DDG results give high rankings to CloudFlare sites, which consequently compromises privacy, net neutrality, and anonymity: * Anonymity: CloudFlare DoS attacks Tor users, causing substantial damage to the Tor network. * Privacy: All CloudFlare sites are surreptitiously MitM'd by design. * Net neutrality: CloudFlare's attack on Tor users causes access inequality, the centerpiece to net neutrality. * DDG T-shirts are sold using a [CloudFlare site](https://duckduckgo.merchmadeeasy.com/), thus surreptitiously sharing all order information (name, address, credit card, etc) with CloudFlare despite their statement at the bottom of the page saying "DuckDuckGo is an Internet privacy company that empowers you to seamlessly take control of your personal information online, without any tradeoffs." (2019) * DDG hired CloudFlare to host spreadprivacy.com (2019) * ***Harmful Partnerships with Adversaries of Privacy Seekers***: * DDG patronizes privacy-abuser **Amazon**, using AWS for hosting. * Amazon is making an astronomical investment in facial recognition which will destroy physical travel privacy worldwide. * Amazon uses Ring and Alexa to surveil neighborhoods and the inside of homes. * Amazon [paid](https://arstechnica.com/tech-policy/2018/04/facebook-donated-200000-to-kill-a-privacy-law-but-now-its-backtracking/) $195k to fight privacy in CA. (also see http://cal-access.sos.ca.gov/Campaign/Committees/Detail.aspx?id=1401518&view=late1) * Amazon runs sweat shops, invests in climate denial, etc.. the list of non-privacy related harms is too long to list here. * DDG feeds privacy-abuser **Microsoft** by patronizing the Bing API for search results and uses Outlook email service. * Microsoft Office products violate the GDPR (the Dutch government discovered numerous violations) * Microsoft finances AnyVision to equip the Israeli military with facial recognition to be used against the Palestinians who they oppress. * Microsoft [paid](https://arstechnica.com/tech-policy/2018/04/facebook-donated-200000-to-kill-a-privacy-law-but-now-its-backtracking/) $195k to fight privacy in CA. (also see http://cal-access.sos.ca.gov/Campaign/Committees/Detail.aspx?id=1401518&view=late1) * DDG hires Microsoft for email service: `torsocks dig @8.8.8.8 mx duckduckgo.com +tcp | grep -E '^\w'` ==> "...duckduckgo-com.mail.protection.outlook.com" * DDG is [partnered](https://www.ghacks.net/2016/07/01/duckduckgo-yahoo-partnership/) with **Yahoo** (aka Oath; plus **Verizon** and **AOL** by extension). DDG helps Yahoo profit by patronizing Yahoo's API for search results, and also through advertising. The Verizon corporate conglomerate is evil in many ways: * Yahoo, Verizon, and AOL all supported CISPA (unwarranted surveillance bills) * Yahoo, Verizon, and AOL all use DNSBLs to block individuals from running their own mail servers, thus forcing an over-share of e-mail metadata with a relay. * Verizon and AOL both drug test their employees, thus intruding on their privacy outside of the workplace. * Verizon supports the TTP treaty. * Yahoo voluntarily ratted out a human rights journalist (Shi Tao) to the Chinese gov w/out warrant, leading to his incarceration. * Yahoo recently recovered "deleted" e-mail to convict a criminal. The deleted e-mail was not expected to be recoverable per the Yahoo Privacy Policy. * Verizon received $16.8 billion in Trump tax breaks, then immediately laid off thousands of workers. * (2014) Verizon fined $7.4 million for [violating customers’ privacy](https://www.huffingtonpost.com/2014/09/03/verizon-privacy_n_5760132.html) * (2016) Verizon fined $1.35 million for [violating customers’ privacy](https://www.cnet.com/news/verizon-racks-up-1-35-m-bill-for-violating-consumer-privacy/) * (2018) Verizon paid $200k to [fight privacy in CA](https://arstechnica.com/tech-policy/2018/04/facebook-donated-200000-to-kill-a-privacy-law-but-now-its-backtracking/). See also [this page](http://cal-access.sos.ca.gov/Campaign/Committees/Detail.aspx?id=1401518&view=late1) * (2018) Verizon caught [taking voice prints](https://www.reddit.com/r/privacytoolsIO/comments/ac8p1x/verizon_voice_fingerprinting_on_customer_support/)? * [more dirt](https://old.reddit.com/r/privacy/comments/62ezji/which_american_mobile_carrier_is_the_most_privacy/) (scroll down to Verizon) * (2016) Yahoo [caught](https://www.theguardian.com/technology/2016/oct/04/yahoo-secret-email-program-nsa-fbi) surreptitiously monitoring Yahoo Mail messages for the NSA. * ***Advertising Abuses & Corruption***: * DDG consumed a room at FOSDEM 2018 to deliver a sales pitch despite its proprietary non-free server code, then dashed out without taking questions. Shame on FOSDEM organizers for allowing this corrupt abuse of precious resources. * Tor Project accepted a $25k "contribution" (read: bribe) from DDG, so you'll find that DDG problems are down-played. This is why Tor Browser defaults to using DDG and why Tor Project endorses DDG over [Ss](https://ss.wodferndripvpe6ib4uz4rtngrnzichnirgn7t5x64gxcyroopbhsuqd.onion) -- and against the interests of the privacy-seeking Tor community. The EFF also pimps DDG -- a likely consequence of EFF's close ties to Tor Project. For the record, this is how Tor Project responds to criticism about their loyalty toward DuckDuckGo (their benefactor) in IRC: > 18:20 < psychil> if torbrowser is going to be recommended, it should also be open to scrutiny. in the absence of that transparency, you create an untrustworthy forum. > 18:20 < psychil> we've seen a loyalty from TB toward duckduckgo, but DDG is in partnership with Verizon, Yahoo, AOL et. al. > 18:21 < psychil> all CISPA-sponsoring companies > 18:22 < psychil> if ppl choose to trust them fair enough, but this trust shouldn't be pushed on every user weighing their choice of browsers > 18:26 -!- mode/#tor [-b psychil@*!*@*] by ChanServ > 18:27 < YY_Bozhinsky> psychil: i am using Tor (thanks to Tor Devs)... PLUS brain - good bundle. I am happy. And please, don't rush to change Reality (do it slowly with love and respect). Because it's home for many ppl. They construct their lives in it. Think twice before ruining that. Please. > 18:27 -!- mode/#tor [+b psychil!*@*] by ChanServ > 18:27 -!- psychil was kicked from #tor by ChanServ [wont stop the FUD] Indeed, Tor Project is notoriously fast to censor any discourse (no matter how civil) when it supports a narrative that doesn't align with their view / propaganda.
# Keybase, we have a problem. The Keybase software and service are both littered with severe bugs that create a security and legal nightmare. Here are some of the issues: * Deception: Their software is a server masquerading as a client app. They simply call it an "app" on this page: https://keybase.io/docs/the_app/install_linux but it's actually a surreptitious *server* that runs continuously in the background as a daemon. * Deception: Tor mode serves only to mislead users. The tool actually surreptitiously phones home to the central server of Keybase, Inc. without using Tor at all. This is not the usual DNS leak that Tor users are accustomed to, the connection itself takes place outside of the #Tor network. It's not incidental. This is in their _privacy policy_: "When you access or use the Service,we automatically collect and store information about your browsing habits and your use of the Service (“Usage Information”),including: a. Your computer’s IP address.. f. Session times and lengths" * Malice: Keybase is designed to reverse users' edits to the `run_keybase` script. So users who try to patch the leaks by introducing torsocks wrappers in that script will learn who really owns that tool on the next upgrade or downgrade, when the script is overwritten. The overwriting is also silent, so some users will be unaware when their traffic becomes exposed. This also means adding firejail sandboxing to that script will also be reversed. It's no accident, they enforce it in the ToS that you agree to: "We may automatically check your version of the Software. We may also automatically download to your computer or device new versions of the Software." * SoftwareFreedom: The javascript on www.keybase.io is non-free software (it fails the #LibreJS test). * Malice: There are so many security bugs that keybase developer Jack O'Connor ("oconnor663") is outright deleting some of the more embarrassing security-critical bug reports. This censorship is the most malicious variety because it blocks other users from becoming aware of pitfalls in software that they have trusted. (Hence this article, which is out of reach for Jack O'Connor to censor) * Malice: The login webform is coded as a pop-up to force users to disable their ad blockers. * Malice: Users who are wise enough to distrust the keybase server have no way to receive messages that are collected through the _Keybase Chat_ mechanism. * Deception: People who send messages using _Keybase Chat_ are not given feedback on non-delivery. So humans are actually composing messages that are silently black-holed! Nothing is more reckless and irresponsible than a messaging service that fails to deliver without telling the sender. What's even more perverse is that non-delivery is not a rare event-- it's simply a matter of the recipient not running their junk software. So it's designed to cause widespread harm, the scale of which that could provoke a class action. So they've actually written a clause in their ToS to attempt to block class actions: 'Any Claim must be brought in the respective party’s individual capacity, and not as a plaintiff or class member in any purported class, collective,representative, multiple plaintiff, or similar proceeding (“Class Action”).' They also have: INDEMNIFICATION, LIMITATION OF LIABILITY, ARBITRATION, and NO WARRANTY clauses to block all actionability of their malice. * Bug: Further exacerbating the previous two issues is the fact that the "Keybase Chat" button cannot be disabled. Users not running the dodgy software are still forced to have this blackhole-feeding mechanism on their profiles. * Hypocrisy: Keybase sends all notifications in-the-clear as plaintext despite having the recipients pubkey and having built their own software to use it. Keybase, Inc does not eat their own dog food. * Bug: If you disable the (insecure) notifications and you are not running their (insecure) software, then you have no way of knowing that someone has tried to send a message. So human-written messages are not only black-holed, but both sender and recipient are unaware of the non-delivery. * Bug: The Keybase installer creates the directory "/keybase" with all world privileges (and yes, they root it in "/"). The keybase developers have said they believe that mounting a filesystem to that directory blocks access to it (so they are unaware of bind mounts). * Malice: advertising is opt-out, not opt-in. From their ToS: "we may send you communications..promotional information and materials..We give you the opportunity to opt-out of receiving promotional electronic mail from us by following the opt-out instructions provided in the message." They are encouraging users to use an unsubscribe link in a spam message. Informed users know is a bad idea, as it signals that an e-mail address is actively in use. * Bug: Keybase does not sign their e-mail messages, thus exposing their users to phishing attacks. Keybase, Inc again demonstrates they don't eat their own dog food. * Deception: They say files are end-to-end encrypted, but this legal loophole gives them immunity for any shenanigans in that regard: "We collect and store files and information that you transmit to other parties using the Service or that you elect to store on the Service." * Deception: This appears on the Keybase website: "The Keybase website is ok, but the Keybase app is faster, safer, and more powerful than doing it in a browser." When they say the "website is ok", it's a gross oversight to imply that you can rely on the website alone when doing so entails forfeiting access to inbound messages (for which the collection cannot be disabled). And when they say the "app is safer", it's a lie.
This is why people should abandon Reddit in favor of Lemmy. This post exposes the rampant Reddit censorship problem. The following posts are an example of civil on topic rule-conforming posts that were censored in r/enviroaction without cause. ----- In response to [this post](https://www.reddit.com/r/enviroaction/comments/dr2f9a/tell_yang_his_campaign_tshirt_is_a_bad_idea_made/f6e2gyt/), I [wrote](https://www.reddit.com/r/enviroaction/comments/dr2f9a/tell_yang_his_campaign_tshirt_is_a_bad_idea_made/f6ehncw/) the following (which was censored): >> So just a note, all cotton is organic: C6H5O9 > > Either you're attempting [equivocation](https://www.thoughtco.com/equivocation-fallacy-term-1690672), or perhaps you're unaware of [sustainable cotton](http://aboutorganiccotton.org/faq/) which has taken the name "organic cotton". ("at present, approximately 0.51% of global cotton production is organic.") > > But thanks for mentioning Amazon's packaging waste.. I overlooked that. In response to [this post](https://www.reddit.com/r/enviroaction/comments/dr2f9a/tell_yang_his_campaign_tshirt_is_a_bad_idea_made/f6fz58s/), I [wrote](https://www.reddit.com/r/enviroaction/comments/dr2f9a/tell_yang_his_campaign_tshirt_is_a_bad_idea_made/f6g14ha/) the following (which was censored): > I was actually half tempted to criticize Amazon for using FedEx. > > FedEx is an NRA-supporting ALEC member, so using FedEx supports climate denial (among [other evils](https://www.reddit.com/r/Boycott_Boeing/comments/dr0ax7/rationale_for_boycotting_boeing/)). FedEx also ships shark fins, hunting trophies, and slave dolphins. So the toll on the environment by FedEx is quite extensive (while they advertise with claims to have a low carbon footprint to capture business from uninformed but pro-environment consumers). > > UPS is also an ALEC member but not as harmful as FedEx. > > USPS is slightly evil for blocking Tor. But in the big scheme of things any alternative to FedEx and UPS at least avoids the worst of them. Can anyone cite a legitimate reason to censor these posts under r/enviroaction rules?
In response to [this comment](https://www.reddit.com/r/Banking/comments/cbxcdy/any_banks_email_images_of_cleared_checks/etjazco/), I [wrote](https://www.reddit.com/r/Banking/comments/cbxcdy/any_banks_email_images_of_cleared_checks/eu4fv1d/): > It is not a security problem. It's actually ***more*** secure to send data via PGP-encrypted email than HTTPS (which can be MitMd). > > I believe the problem is that not enough people are PGP capable to be interesting enough for banks to take the risk of doing something different. US banks are extremely risk averse. There are a couple banks outside the US that send PGP email but they don't deal with checks. ----- That comment was censored.
This [original post](https://www.reddit.com/r/CrappyDesign2/comments/dr22yo/political_campaign_tshirt_for_a_progressive_party/) in r/CrappyDesign2 was not censored, but the following two comments in that thread were censored: ----- In response to [this comment](https://www.reddit.com/r/CrappyDesign2/comments/dr22yo/political_campaign_tshirt_for_a_progressive_party/f6g95gp/), I [wrote](https://www.reddit.com/r/CrappyDesign2/comments/dr22yo/political_campaign_tshirt_for_a_progressive_party/f6gjclt/): >> In terms of products we need to minimize to save the earth, pretty sure "Shirts" are waaaaaaay down the list. > > The Extinction Rebellion movement has copyrighted their logo so that they can [declare](https://rebellion.earth/): > >"*We do not endorse or create any merchandise and we will pursue and prosecute anyone who does.*" > > And rightly so. Eco-activists quite rightly oppose the foolish production of unneeded clothing that outlasts its useful purpose - even when it promotes their own agenda. Hopefully they sue [these scumbags](https://www.teepublic.com/gifts-and-merchandise/extinction-rebellion) who are not only making XR clothes but they're also doing so with unsustainable material. > > By comparison, the XR movement will long outlive the absurdly short Yang 2020 campaign. > > You imply that there's a triage, whereby sensible clothing design is somehow in competition with other climate actions. It's nonsense. Did Yang save enough time on his shirt design to do something more important for climate change? What more important activity will not be accomplished if clothing is designed to be sustainable? > >> Even the shirts made congratulating super bowl losers get used somewhere. > > Those are slightly less ridiculous because the intent is for them to be appreciated /after/ the event -- unlike a POTUS campaign involving ~20 candidates, 19 of whom won't make it to the general election. In response to [this comment](https://www.reddit.com/r/CrappyDesign2/comments/dr22yo/political_campaign_tshirt_for_a_progressive_party/f6fzwqa/), I [wrote](https://www.reddit.com/r/CrappyDesign2/comments/dr22yo/political_campaign_tshirt_for_a_progressive_party/f6g2bqr/): > The design flaw is actually orthogonal to political bias. The problem is the political ideology of the politician is misaligned with the design, thus making the design unfit for purpose. > > If this shirt were a Trump shirt, there would actually be no problem with the design as there would be no conflict of interest (the orange guy is a climate denier). > > The design flaws are objectively evident regardless of our personal political leans. ----- I believe those posts were civil, and in fact more civil than the uncensored posts they are replying to.
This graphic (linked by the title) was [censored](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/) in r/Brussels. The moderator [alleges](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2nom2/) that wrongdoing of Argenta bank is irrelevant to r/Brussels. It's a bogus claim because Argenta has several branches in Brussels. This moderator has a history of generally opposing activism, yet fails to create a rule against politics or activism. So he's enforcing rules that do not exist to control the dialog and bias the narrative to fit into his world views. In that thread, a number of posts were removed, all civil and answering questions. In response to [this post](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2kh11/), I [wrote](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2lk48/): > I assume the source you're after is the Argenta-JPM ties. It's in the fine print of their pension plans, and also here: > > https://www.argenta.be/content/dam/argenta/documenten/beleggen/fondsen/arvestar/Subcustodians%20overzicht.pdf > > Argenta does not give pensioners a choice of investments. Opening a pension account at Argenta automatically entails opening it at JP Morgan with no way to opt-out. Investors should be informed where their money goes. > > If you need a source on any other relationship in the chart let me know. It's all easy to find public info. In response to [this post](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2lrow/), I [wrote](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2mm2o/): > The chart is my own original work. This thread is the first publication of it. So far it's the sole publication of it. I created that after reading these articles: > > * https://www.dailykos.com/stories/2019/3/11/1841225/-Big-banks-back-away-from-Trump-s-immigration-policies-but-tech-giants-are-still-on-board > * https://boingboing.net/2018/04/20/something-something-invisible.html > * https://www.bloomberg.com/features/2018-palantir-peter-thiel/ > * https://www.businessinsider.nl/security-pro-at-jpmorgan-spied-on-employees-using-palantir-2018-4?international=true&r=US > * https://www.politicususa.com/2018/03/28/peter-thiel-company-helped-cambridge-analytica-steal-facebook-data.html > > I already knew some of the data so let me know if you need a source for anything specifically not covered by those articles and i'll dig it up. In response to [this post](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2k6ch/), I [wrote](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2oi36/): > Argenta has several branches in Brussels. In response to [this post](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2q8lu/), I [wrote](https://www.reddit.com/r/brussels/comments/cehec4/how_argenta_a_family_bank_contributes_to_family/eu2szj6/): >> You mean, how JP Morgan contributes to family separation? > > I mean ***Argenta Bank*** contributes to family separation by way of all entities in the supply chain, including JP Morgan. > >> Most banks have services that are dependent on JP Morgan directly for example for cross border payment) or for example with settlement of financial products. > > Apart from the bandwagon fallacy (one bank's evil justifies another), most banks give investors an election on where to direct funding. Argenta does not. Argenta's CEO has JP Morgan [ties](https://www.argenta.be/content/dam/argenta/over-argenta/jaarverslagen/2017/bank-en-verzekeringsgroep/Activities%20and%20sustainability%20report%202017.pdf) and Argenta also buries JPMs involvement in fine print that only the most diligent pensioners bother to read. > > It's also unclear why you would consider Argenta's voluntary participation in JP Morgan investments somehow justified by JP Morgan's SWIFT membership for cross-border payments. There are 6 US banks capable of IBAN transfers, and it's the recipients of those transfers who control that. Of course it makes no sense to hold banks accountable for transactions outside of their control. ----- All of the replies above were censored by u/octave1. I believe they were civil and relatively unemotional.
The following was posted in r/Boycott_Boeing with the title "How to Boycott Boeing", which was censored, ironically. The moderator, who has his own post showing ways to avoid Boeing, is strangely intent on suppressing methods of boycotting other than his own. ----- Suppose you want to boycott Boeing. A Boeing aircraft is probably not on your shopping list, so you can't simply scratch Boeing off your shopping list as easily as you can with a company like Dell, for example. But there are some things you can do to reduce money that ultimately feeds Boeing. Boeing has a duopoly with Airbus (detailed on [wikipedia](https://en.wikipedia.org/wiki/Competition_between_Airbus_and_Boeing)). Most airlines own both Boeing and Airbus products, so it would be impractical to extend the boycott to all airlines that have Boeings in their inventory. But there is a bias. Some airlines have a strong majority of Boeings in their fleet compared to Airbus. Here is a sampling of some of the large carriers: | **Airline** | **Active Boeing assets (%)** | **Notes** | |--|--|--| | Aer Lingus | 7.8% (4/51) | [source](http://www.airfleets.net/flottecie/Aer%20Lingus.htm) | | Air Berlin | 0.0% (0/84) | [source](http://www.airfleets.net/flottecie/Air%20Berlin.htm) | | Air Canada | 36.9% (62/168) | [source](http://www.airfleets.net/flottecie/Air%20Canada.htm) | | Air China | 51.7% (200/387) | [source](http://www.airfleets.net/flottecie/Air%20China.htm) | | Air France | 31.6% (71/225) | [source](http://www.airfleets.net/flottecie/Air%20France.htm) | | Alitalia | 9.8% (10/102) | [source](http://www.airfleets.net/flottecie/Alitalia.htm) | | American Airlines | 48.7% (452/928) | [source](http://www.airfleets.net/flottecie/American%20Airlines.htm) | | British Airways | 47.0% (126/268) | [source](http://www.airfleets.net/flottecie/British%20Airways.htm) | | China Eastern Airlines | 3.7% (16/428) | [source](http://www.airfleets.net/flottecie/China%20Eastern%20Airlines.htm) | | Delta | 57.0% (479/840) | [source](http://www.airfleets.net/flottecie/Delta%20Air%20Lines.htm) | | Finnair | 0.0% (0/47) | [source](http://www.airfleets.net/flottecie/Finnair.htm) | | Iberia | 0.0% (0/78) | [source](http://www.airfleets.net/flottecie/Iberia.htm) | | Japan Airlines |100.0% (163/163) | [source](http://www.airfleets.net/flottecie/Japan%20Airlines.htm) | | KLM | 88.8% (103/116) | [source](http://www.airfleets.net/flottecie/KLM.htm) | | Korean Air | 75.3% (119/158) | [source](http://www.airfleets.net/flottecie/Korean%20Air.htm) | | Lufthansa | 13.7% (37/271) | [source](http://www.airfleets.net/flottecie/Lufthansa.htm) | | Swiss Global Air Lines | 33.3% (6/18) | [source](http://www.airfleets.net/flottecie/Swiss%20Global%20Air%20Lines.htm) | | United Airlines | 78.6% (578/735) | [source](http://www.airfleets.net/flottecie/United%20Airlines.htm) | | Virgin Atlantic | 56.8% (21/37) | [source](http://www.airfleets.net/flottecie/Virgin%20Atlantic.htm) | I recommend boycotting airlines with a Boeing inventory over ~40%. In addition to avoiding Boeing-dominant airlines, it's also a good idea to exclude flights on Boeing aircraft from your air travel search. Here's how: 1. Go to itasoftware.com 1. Fill out the search form as you normally would 1. Click on "Advanced routing codes", and noticed that a new box appears to enter outbound and return routing codes. 1. In all the advanced routing codes boxes, paste this: ` /-aircraft t:703 t:707 t:70F t:70M t:717 t:721 t:722 t:727 t:72B t:72C t:72F t:72M t:72S t:72X t:72Y t:731 t:732 t:733 t:734 t:735 t:736 t:737 t:738 t:739 t:73C t:73F t:73G t:73H t:73J t:73M t:73W t:73X t:73Y t:741 t:742 t:743 t:744 t:747 t:74C t:74D t:74E t:74F t:74H t:74J t:74L t:74M t:74N t:74R t:74T t:74U t:74V t:74X t:74Y t:752 t:753 t:757 t:75F t:75M t:75T t:75W t:762 t:763 t:764 t:767 t:76F t:76W t:76X t:76Y t:772 t:773 t:777 t:77F t:77L t:77W t:788 t:789 t:B72 ` That will exclude all flights that make use of a Boeing aircraft from the search results. Why is that a good idea? A pilot is either a Boeing pilot or an Airbus pilot. Rarely is a pilot trained in both. Riding on a Boeing aircraft feeds Boeing pilots, who exclusively cator for Boeing products. Commandline nerds who want to know how to derive that syntax may want to run this: ` $ lynx -dump -nolist https://www.flugzeuginfo.net/table_accodes_iata_en.php | awk 'BEGIN{ORS=" ";} tolower($0) ~ /boeing/{print "t:"$1}' ` Don't forget to prefix the `/-aircraft `. Why boycott Boeing and General Electric? ======================================== See the [rationale chart](https://pasteboard.co/IEYLY8l.png). Boeing has made a deal with General Electric to ensure that some Boeing aircraft can only be fitted with GE engines. It turns out that General Electric (a former ALEC member) is itself very boycott-worthy anyway because it's involved with the same evils as Boeing. Also note that Airbus does not contribute to any of the problems in the rationale chart. It will not be immediately obvious to everyone why drug testing is such a bad idea. I suggest [this article](https://steemit.com/marijuana/@apertus-cogitari/employer-imposed-drug-testing-why-it-s-a-bad-idea) for more detail.
In response to [this post](https://www.reddit.com/r/unpopularopinion/comments/djri68/we_as_consumers_should_completely_boycott_boeing/f47ka3d/) by u/Poison1990 in r/unpopularopinion, I [wrote](https://www.reddit.com/r/unpopularopinion/comments/djri68/we_as_consumers_should_completely_boycott_boeing/f6d99at/): > +1 for humor. But in all seriousness, it is possible for travelers to boycott Boeing. See the [How to Boycott Boeing](https://www.reddit.com/r/Boycott_Boeing/comments/dr0jpy/how_to_boycott_boeing/) article. In response to [this post](https://www.reddit.com/r/unpopularopinion/comments/djri68/we_as_consumers_should_completely_boycott_boeing/f47ivgh/), I [wrote](https://www.reddit.com/r/unpopularopinion/comments/djri68/we_as_consumers_should_completely_boycott_boeing/f6cpvir/): > [Rationale](https://www.reddit.com/r/Boycott_Boeing/comments/dr0ax7/rationale_for_boycotting_boeing/) for boycotting Boeing (for me) is all the right-wing policy it supports financially as well as the politicians it backs." > > If only we get them to make planes without a right wing ;) In response to [this post](https://www.reddit.com/r/unpopularopinion/comments/djri68/we_as_consumers_should_completely_boycott_boeing/f6d1lls/), I [wrote](https://www.reddit.com/r/unpopularopinion/comments/djri68/we_as_consumers_should_completely_boycott_boeing/f6d632h/): > *Climate change* is a *scientific* theory. The climate denial propaganda is to [spin](https://www.scientificamerican.com/article/just-a-theory-7-misused-science-words/) climate change as "just a theory" in hopes that most people are not knowledgeable enough to know the difference between a ***scientific** theory* and a "theory" in laypersons terms -- effectively making climate change sound as if someone is wildly guessing. > > A scientific theory is very well supported by evidence from a significant collection of supported hypothesis and not even close to mere guesswork -- and guesswork cannot be passed off as a "scientific theory". Darwin's theory of evolution is also a scientific theory. Would you also regard the theory of evolution as "propaganda"? > > So no, you cannot "both sides" this. Propaganda is on one side; science is on the other." When viewed from a logged-out browser, the above three comments are reported "missing". I personally and exclusively can still see them when logged in. It's a bit insideous that this censorship occured in r/unpopularopinion, where we expect to be able to express these sort of ideas in a civil manner. The third post was censored mid-conversation with u/arewetodayman, which is quite disruptive as Reddit has effectively interefered with a conversation between two people. You would think a forum meant to accommodate "unpopular opinions" would not suppress a civil boycott on Boeing, but a moderator there is censoring posts critical of Boeing. I posted a comment similar to the censorship summary above in r/Boycott\_Boeing, and was appalled that they censored this post (like cops, Reddit moderators side with each other regardless of integrity). Then I posted the same summary message to r/censorship\_uncensored and was censored there. The moderator (u/nonpushoverconsumer) said they did not (and would not) censor that post. So the 3rd instance was censored by a robot.