[–] 1 point 14 hours ago (1 child)

I guess to me, passing this seemed like a no-brainer and there isn't any amount of propaganda that could sway me on that. How people are so confused about voting in their interests is surprising to me. But I think you have an interesting point.

  • source
  • parent
  • context
  • [–] 2 points 14 hours ago*

    I'm not bootlicking anything. I have no relationship with the Graphene project and the only time I tried to find out more about the project I was quickly banned for some reason. I think being pissed at open source developers who give away software for free is crazy as fuck.

  • source
  • parent
  • context
  • [–] -1 points 16 hours ago (3 children)

    So many of you are being so irrational and ungrateful. Do you know how much work the Graphene team likely did to make this happen? This means Graphene is less dependent on Google hardware in order to exist (ie, if Google decides to lock bootloaders in future Pixel models it won't end the project). An expensive high-end phone brings along rich people and corporate users who will hopefully donate to the project. The engineers at the Graphene project work so much and it would be nice to see more appreciation.

    No one is being forced to buy this highest end model. There are plenty of Pixels they support and will continue to support and they likely they will support other models that will be much cheaper over time. If you don't want to buy a $2K phone, don't buy this model. Problem solved! Or wait for more people to be selling this phone used and buy a used version of this model. Also, having this much RAM means that it's more likely this can run virtualized ARM operating systems and can work like a desktop when plugged in, although I am not sure if it can do that.

  • source
  • [–] 1 point 5 days ago (2 children)

    https://discuss.privacyguides.net/t/cbc-tutanota-tuta-is-a-honeypot/14978/9

    Why would a government employee, being charged with a crime, randomly make up lies about tutanota, now Tuta?

    The likely answer is he didn't make up lies and wanted to expose an operation as revenge for them charging him with a crime, which he thought he would likely be convicted of.

    Cameron Ortis did actually get 14 years in prison. So if this were merely a disinformation campaign, why did he end up in prison?

    For this accusation to be false, you need it to be true that Ortis randomly decided to lie about Tutanota (now Tuta) during a trial or had some incentive to lie during trial to spread misinformation about Tuta. However, there was no plea deal in this case. He was granted day parole in September of 2026, but I don't know that much about Canadian prisons or law and if this would be considered unusual.

    The fact that Tutanota rebranded to Tuta nearly immediately after this (to make it harder for regular people searching for this to discover it) is also suspicious.

  • source
  • parent
  • context
  • [–] 1 point 5 days ago

    This is a good point. AI vibe-coded stuff that hasn't been pentested being pushed in a product promising security and privacy is genuinely terrible. Perhaps that one thing is so terrible it should rightfully overshadow everything else because of the risks involved.

  • source
  • parent
  • context
  • [–] 2 points 6 days ago

    This is terrible and really bad news. They are trying to make it impossible for people to only exist with a flip phone.

    If this gets implemented and sites start using it, I hope that someone creates a DNS blocklist of any site that uses it so it can just be avoided.

  • source
  • [+] -11 points 1 week ago* (last edited 6 days ago) (2 children)

    I sort of get where he is coming from. AI has made shockingly fast rapid advances in being able to code. AI code should definitely be pentested, even if it's just with more AI.

    There are many developers and tech privacy enthusiasts who hate AI coding for whatever reason, and I get his perspective. He just isn't being very strategic because he's acting like a normal CEO and not caring that much about emotional impact because he's in a leadership position, forgetting that a privacy-focused user base will not tolerate typical CEO behavior.

    I already have real fears regarding Proton. What sort of privacy company doesn't accept Monero?????? What sort of privacy company uses US-based Zendesk which could be required to cooperate with a police state with a secret dragnet warrant???? Proton has a very active fraud/abuse detection system. Even if it is necessary, how could that be technically possible if messages are encrypted???

    But we should also remember that if you are a poor person in a repressed regime, you can get free Proton services to help get you more access to information. They are very nice about that. Who made that choice so that a poor person in a poor country can get these services for free if they are poor? Andy Yen made that decision.

    People make mistakes and if Andy Yen realizes he needs to be more emotionally intelligent and aware and tries to change, perhaps people should be willing to forgive him. Proton does a lot of good overall despite recent concerning behavior.

    I will also add that it's concerning that their AI Lumo is integrated into so much potentially and it's not clear where the processing occurs, if the processing itself is encrypted during the processing, and what models are used. For example, if Lumo is using US-based company data centers in the US and the model has to be given unencrypted data to process, then in theory if there's a gag-order demand on the data center, all of that information can be extracted. I see very little information about that, which is concerning.

  • source
  • [–] 13 points 1 week ago (2 children)

    There's only 1 solution: Persona

    Also google Play Integrity API, shutting down old.reddit.com for some reason and blocking all browsers except Chrome and Safari. Also retinal scans for new accounts, karma farming bots only allowed for old accounts with stolen credentials, and blocking anyone who refers to war crimes against Palestinians as genocide.

    Also, a new helpful AI assistant called Reddy that replaces interacting with other users and recommends products and collects user data.

  • source
  •  

    Before everyone hates me and responds with "Fuck AI," I sometimes find AI to be something that saves me time and like AI. I don't like my data not being private.

    I can run AI locally, but I would like AI to be able to run within a local word processor itself.

    So for example, I want to be able to tell AI: "AI, I wrote this 100 page document and there are numerous references to how the earth is flat. I realize that's not true and need to scan the entire document, remove every example of that, and make it so it still makes sense."

    That's a very weird example of some things I want to do but real examples are too private to post.

    Other examples could include: "AI, I didn't create any headers in this document. Can you please create headers where appropriate and make them all bold?"

    This is the sort of AI stuff that potentially saves me 45 minutes here and there and it doesn't seems like I can easily do it in open source software. Instead, I have to copy everything to Jan or GPT4ALL and then go from there. I'd rather do this within an open source word processor itself.

    Is this possible?

     

    I have been testing Tor Browser and Mullvad Browser using fingerprint.com. I get unique persistent identifiers that are unique per machine and persist over rebooting sessions. Javascript was on during this test.

    This could be very dangerous to people using Tor Browser and Mullvad Browser.

    For example, if someone visits Rainbow Railroad, an organization for leaving repressive countries with hostile LGBT policies, and then watches a video about the organization on YouTube, and then also does something, like create a Discord Server, and use Tor Browser to get around geoblocking but link it to their personal phone number, then a hostile regime buying data from data brokers could possible determine that user is considering using rainbow railroad. Even if this exact example isn't realistic or plausible (although governments do buy form data brokers), users should be aware that persistent identifiers in Tor Browser and Mullvad Browser allow for continuous tracking of a user using the same machine.

    I posted this information on privacyguides forum and they deleted my account after, leading me to wonder if the forum is a giant honeypot that curates acceptable privacy discussions and unacceptable private discussions. I honestly wonder if they are infiltrated by the government. They repeatedly delete the posts of other people as well and the whole thing is starting to not sit well with me.

     

    I really liked LM Studio and then I realized it's closed source.

    When LM Studio contacts external servers, is what sent clear or encrypted? Is there any proof there is not really telemetry forced by the government providing information on what I type?

    One of the reasons I fear closed source software is because of backdoors. Another reason is that the US government can require backdoors using court orders and force corporations to lie about backdoors existing or telemetry when it's closed source code and can't be reviewed.

    In other words, if they were sending my discussion with an AI femboy "CyberPunk Gemi" to a server, which could flag me as Trans or LGBT friendly "threat" under a Christian Nationalist government at the rate the US country is going, could I see that in the packets being transmitted by the program via wireshark or would I just not know because anything going to their server has encrypted packets from https?

    Does this present any sort of real risk with LM Studio?

    Would it be possible for the government to order LM Studio to upload data only when certain keywords are used (like "Cyberpunk Femboy" or "Leftist on Lemmy")?

    LM Studio is based out of New York so backdoors could already forced and I would never know.

     

    Github has made it impossible to create an account when using a VPN and a privacy browser with fully spoofed hardware identifiers. (Use Firefox or Firefox-based Privacy Browser, VPN, install Canvasblocker to test this.) I create an account with Google or Apple (both requiring hardware identifiers and numbers and birthdates) or I can use an email. When I use an email, it comes back with this horrible test, and even if I do it completely correctly, it tells me after I didn't do the test right, gaslighting me with a picture of what I chose (which I didn't choose) and showing me the correct picture (which I did choose and it claims I didn't select).

    It's fucking bullshit and it's more corporate control of open source software. For people who have their discussion or issue tracker, I can't even participate without hardware identifiers likely linked to me some other way and phone numbers. It's fucking bullshit. If anyone from Microsoft is reading this, FUCK YOU!!!!!!!!!!

    I am so tired of this bullshit. I just want to post an issue about a piece of software. You don't need my fingerprint, hardware or personal, or biometric shit. This is a slippery slope. Fuck them.

    I really hope more developers just get the fuck off Github. Honestly, if you are developing privacy-oriented software and using github, there's a mistmatch and it's bullshit, and I know it's time consuming and annoying to move, but please do. This is fucking bullshit and it's not like it's going to become LESS annoying over time. FUCK THIS.

     

    (Don't click that before reading more.) If you check out Upsolve.org because you are considering bankruptcy due to any sort of reason, there is a tool to help you evaluate whether bankruptcy is appropriate at my.upsolve.org/bankruptcy-screener.

    Bankruptcy is a difficult choice. Sometimes people pursue it as a result of medical debt or other extremely personal reasons.

    Upsolve.org bills itself as an organization that help the poor. Unlike a lawyer's office, it can help people without charging a lot and unlike a lawyer's office, there is no duty of confidentiality or privilege.

    However, someone taking a screening tool might be providing information just to see if bankruptcy is even possible. And Upsolve.org sells or gives this information to Facebook. Even if it's not selling the screener results, just someone landing on this page, combined with IP gives Facebook valuable information.

    The user who goes there without their IP protected could later get ads for predatory financial companies to "help" debtors and importantly, this information can be sold to data brokers to determine that the people viewing the site are a credit risk.

    For example, if someone gets into a car accident and needs 90,000 worth of medical care over two weeks. They get the bill after the two weeks of medical care. They are going to be unable to work for a while and they are considering bankruptcy. The 90,000 has not gone to collections. This person is technically still employed but will need a lot of time off. They may not even be able to go back to work.

    Normally, if this person decided not to declare bankruptcy and to wait 4 months and hopefully go back to work, they might be able to get a loan from a bank. But if Facebook has sold their info (person with this IP identified is a person interested in bankruptcy information) to data brokers, and the bank has access to that information, that loan will be denied.

    Real consequences can happen from selling shit like this to Facebook. Worst of all, the Facebook analytics aren't on the main page and instead are hidden in the screener.

    Although Upsolve.org probably just wants to target users online with ads about how great its service is, and it's actually a service that can help many save a ton of money, it may be overlooking the privacy risk. I hate seeing scripts like this in pages for things that should be confidential, things like abortion clinics, addiction treatment clinics, financial help pages, and pages related to mental health. All of that fucking info gets monetized the second someone hits the page if there are analytics in the page. It would be one thing if that info only resulted in helpful services being sold, but it also is given to companies building profiles on people which can wind up in the hands of surveillance state government officials, financial industry decision makers, and others that classify people based on browsing habits.

    I may be wrong about this and facebook doesn't sell that specific "looking at possible bankruptcy" data to data brokers. I can't be sure. But I wish I didn't have to wonder. And they probably do. And it probably does go to financial institutions somehow, ultimately hurting some people who were merely considering bankruptcy but don't ultimately do it.

     

    After immigrants are detained by ICE, there are probably records somewhere of who has an attorney, and who is calling family members or an attorney.

    For the immigrants who aren't calling any family or lawyers, the poorest of the poor, people with little to no connection to anyone, who may not even say which country they are from, if the administration were actually trying to kill as many disconnected immigrants as possible in secret, would society know?

    For example, if the administration was composed of all types of conservative people, but 30 percent were secretly Nazis or wanted racial genocide, could there be a campaign to not just remove, but kill, immigrants, and the public doesn't find out?

     

    I have different technical questions I want to ask. I went to Stack Overflow and they blocked registration with a VPN. It's really fucking annoying. I can buy a residential IP to bypass this, but I'd rather just not use these enshitified platforms that are so hostile to VPNs.

    Is there any decent alternative to Stack Overflow? I have tried getting AI answers to the technical question but they are not good.

    And no, I can't just create a github ID using VPN to login, they block github logins based on IP also.

     

    The situation in Iran, with no internet and jamming set up to try to even block Starlink, seems exactly the situation for which Briar was made.

    Is Briar technically feasible to use in Iran or is this too problematic because of jamming of WiFi and other signals?

    Is this the sort of thing where someone with access to a Starlink could download Briar from F-droid and share the apk via USB or is that not possible with Iranian cell phones?

    I am asking as someone who isn't sure whether jamming can also block bluetooth signals.


    Warning - use caution. Using Bluetooth or sideloaded apps like Briar may work where internet and Starlink are jammed, but jamming, detection, or device inspection can still expose users. Sharing or installing such apps could put people at serious legal or physical risk. This post only asks whether using Briar in these conditions would be helpful; it is not a recommendation or endorsement. Assess local risks before acting.

    هشدار - احتیاط کنید. استفاده از بلوتوث یا نصب جانبی برنامه‌هایی مثل بریر ممکن است در شرایطی که اینترنت و استارلینک پارازیت‌دار شده‌اند کارایی داشته باشد، اما پارازیت، کشف یا بازرسی دستگاه‌ها می‌تواند کاربران را لو دهد. به‌اشتراک‌گذاری یا نصب چنین برنامه‌هایی ممکن است افراد را در معرض خطر قانونی یا جسمی جدی قرار دهد. این پست صرفاً می‌پرسد آیا استفاده از بریر در این شرایط مفید خواهد بود یا نه؛ توصیه یا تایید آن نیست. پیش از اقدام، خطرات محلی را ارزیابی کنید.***

    Would the following be helpful if the information could get to Iranians or would they already know about stuff like this?

    وضعیت در ایران، با قطع اینترنت و ایجاد پارازیت به‌گونه‌ای که حتی تلاش می‌شود استارلینک هم مسدود شود، دقیقاً همان وضعیتی است که برای آن بریر ساخته شده است.

    آیا از نظر فنی استفاده از بریر در ایران ممکن است یا اینکه پارازیت روی وای‌فای و سایر سیگنال‌ها این کار را بیش از حد مشکل می‌کند؟

    آیا این‌طور است که کسی که به استارلینک دسترسی دارد می‌تواند بریر را از F‑Droid دانلود کند و فایل apk را از طریق USB به دیگران منتقل کند، یا این با گوشی‌های ایرانی ممکن نیست؟

    من این را می‌پرسم چون مطمئن نیستم که پارازیت بتواند سیگنال‌های بلوتوث را هم مسدود کند.

    در اینجا یک راهنمای گام‌به‌گام به فارسی برای دانلود و نصب (sideload) فایل APK بریر از طریق Starlink یا انتقال از طریق USB/کارت حافظه، همراه با چک‌های لازم برای معماری CPU و مجوزها:

    گام 1 — آماده‌سازی دانلود

    1. از طریق دستگاهی که به اینترنت (مثلاً Starlink) دسترسی دارد، به یکی از منابع رسمی بروید:
    2. دانلود نسخه APK متناسب با نسخه بریر (نسخه پایدار را انتخاب کنید).

    گام 2 — بررسی معماری CPU اندروید

    1. راه ساده: روی گوشی مقصد اپلیکیشن CPU‑Z یا Droid Hardware Info را نصب کنید (در صورت امکان) و در بخش CPU معماری را ببینید (ARM64, armeabi-v7a, x86 و غیره).
    2. اگر امکان نصب اپ دیگر نیست، بیشتر گوشی‌های مدرن اندروید امروز ARM64 (aarch64) هستند — اگر گوشی جدیدتر است احتمالاً ARM64 است.
    3. در F‑Droid معمولاً نسخه‌های عمومی برای معماری‌های رایج عرضه می‌شود؛ فایل APK معمولی اغلب با اکثر گوشی‌های ARM سازگار است، اما اگر نسخه مجزا وجود داشته باشد، APK مناسب را انتخاب کنید.

    گام 3 — انتقال APK به گوشی بدون اینترنت گزینه A — انتقال از طریق USB:

    1. با کابل USB گوشی را به کامپیوتر متصل کنید.
    2. در گوشی حالت اتصال را روی “File Transfer (MTP)” قرار دهید.
    3. فایل APK را در پوشه Downloads یا یک پوشه دلخواه کپی کنید.
    4. از اتصال امن (قابل اعتماد) استفاده کنید و پس از انتقال کابل را جدا کنید.

    گزینه B — کارت حافظه (microSD):

    1. فایل APK را روی کارت microSD کپی کنید.
    2. کارت را در گوشی قرار دهید و فایل را از برنامه Files یا File Manager پیدا کنید.

    گزینه C — انتقال مستقیم بین اندروید‌ها:

    1. از Bluetooth فایل را ارسال کنید (اگر کار کند) یا از کابل USB‑OTG و فلش USB با آداپتور استفاده کنید.

    گام 4 — فعال‌سازی نصب از منابع نامعلوم

    1. در اندرویدهای جدید: تنظیمات → Apps → Special app access → Install unknown apps → برنامه‌ای که فایل APK را باز می‌کنید (Files/Browser) را انتخاب و “Allow from this source” را فعال کنید.
    2. در اندرویدهای قدیمی: Settings → Security → تیک “Unknown sources” را بزنید.

    گام 5 — نصب APK

    1. با File Manager به محلی که APK قرار دارد بروید.
    2. فایل APK را لمس کنید و دستور نصب را دنبال کنید.
    3. اگر پیغام امضا/نسخه قدیمی‌تر ظاهر شد، اجازه دهید نصب جایگزین شود (یا بهتر است از نسخه رسمی و به‌روز استفاده کنید).

    گام 6 — بررسی امضا و منبع (امنیت)

    1. ترجیحاً APK را از وب‌سایت رسمی یا F‑Droid بگیرید تا مطمئن شوید فایل دستکاری نشده است.
    2. اگر با F‑Droid کار می‌کنید، بهتر است ابتدا خودِ اپ F‑Droid را نصب کرده و از طریق آن Briar را مدیریت کنید (بروزرسانی و اعتبار بسته).

    گام 7 — مجوزها و تنظیمات Briar

    1. پس از نصب، به مجوزهای مورد نیاز (Bluetooth، Nearby devices، Storage در صورت نیاز) دقت کنید و فقط مجوزهای لازم را بدهید.
    2. فعال‌سازی Bluetooth و/یا Wi‑Fi Direct وقتی می‌خواهید همگام‌سازی محلی انجام دهید.

    نکات عملی و احتیاط‌ها

    • اگر گوشی قفل‌شده یا مدیریت شده (MDM) باشد ممکن است نصب APK از منابع نامعلوم غیرفعال باشد. در این حالت نیاز به دسترسی بیشتر یا مدل گوشی متفاوت دارید.
    • اگر نگران شنود یا شناسایی هستید، Bluetooth/Wi‑Fi را فقط هنگام نیاز روشن کنید و پس از انتقال خاموش کنید.
    • برای بروزرسانی‌ها، اگر دسترسی اینترنت دارید از داخل F‑Droid یا سایت رسمی به‌صورت دوره‌ای نسخه جدید را دانلود کنید.
    • اگر نمی‌دانید معماری CPU، اغلب ARM64 را امتحان کنید (بیشترین احتمال سازگاری با گوشی‌های جدید).

    اگر می‌خواهید، می‌توانم:

    • متن دقیق پیام برای توضیح نحوه فعال کردن “Install unknown apps” برای نسخه خاص اندروید (مثلاً Android 12 یا 13) بنویسم، یا
    • لینک مستقیم به صفحه دانلود Briar برای شما آماده کنم.

    در اینجا یک راهنمای گام‌به‌گام به فارسی برای دانلود و نصب (sideload) فایل APK بریر از طریق Starlink یا انتقال از طریق USB/کارت حافظه، همراه با چک‌های لازم برای معماری CPU و مجوزها:

    گام 1 — آماده‌سازی دانلود

    1. از طریق دستگاهی که به اینترنت (مثلاً Starlink) دسترسی دارد، به یکی از منابع رسمی بروید:
    2. دانلود نسخه APK متناسب با نسخه بریر (نسخه پایدار را انتخاب کنید).

    گام 2 — بررسی معماری CPU اندروید

    1. راه ساده: روی گوشی مقصد اپلیکیشن CPU‑Z یا Droid Hardware Info را نصب کنید (در صورت امکان) و در بخش CPU معماری را ببینید (ARM64, armeabi-v7a, x86 و غیره).
    2. اگر امکان نصب اپ دیگر نیست، بیشتر گوشی‌های مدرن اندروید امروز ARM64 (aarch64) هستند — اگر گوشی جدیدتر است احتمالاً ARM64 است.
    3. در F‑Droid معمولاً نسخه‌های عمومی برای معماری‌های رایج عرضه می‌شود؛ فایل APK معمولی اغلب با اکثر گوشی‌های ARM سازگار است، اما اگر نسخه مجزا وجود داشته باشد، APK مناسب را انتخاب کنید.

    گام 3 — انتقال APK به گوشی بدون اینترنت گزینه A — انتقال از طریق USB:

    1. با کابل USB گوشی را به کامپیوتر متصل کنید.
    2. در گوشی حالت اتصال را روی “File Transfer (MTP)” قرار دهید.
    3. فایل APK را در پوشه Downloads یا یک پوشه دلخواه کپی کنید.
    4. از اتصال امن (قابل اعتماد) استفاده کنید و پس از انتقال کابل را جدا کنید.

    گزینه B — کارت حافظه (microSD):

    1. فایل APK را روی کارت microSD کپی کنید.
    2. کارت را در گوشی قرار دهید و فایل را از برنامه Files یا File Manager پیدا کنید.

    گزینه C — انتقال مستقیم بین اندروید‌ها:

    1. از Bluetooth فایل را ارسال کنید (اگر کار کند) یا از کابل USB‑OTG و فلش USB با آداپتور استفاده کنید.

    گام 4 — فعال‌سازی نصب از منابع نامعلوم

    1. در اندرویدهای جدید: تنظیمات → Apps → Special app access → Install unknown apps → برنامه‌ای که فایل APK را باز می‌کنید (Files/Browser) را انتخاب و “Allow from this source” را فعال کنید.
    2. در اندرویدهای قدیمی: Settings → Security → تیک “Unknown sources” را بزنید.

    گام 5 — نصب APK

    1. با File Manager به محلی که APK قرار دارد بروید.
    2. فایل APK را لمس کنید و دستور نصب را دنبال کنید.
    3. اگر پیغام امضا/نسخه قدیمی‌تر ظاهر شد، اجازه دهید نصب جایگزین شود (یا بهتر است از نسخه رسمی و به‌روز استفاده کنید).

    گام 6 — بررسی امضا و منبع (امنیت)

    1. ترجیحاً APK را از وب‌سایت رسمی یا F‑Droid بگیرید تا مطمئن شوید فایل دستکاری نشده است.
    2. اگر با F‑Droid کار می‌کنید، بهتر است ابتدا خودِ اپ F‑Droid را نصب کرده و از طریق آن Briar را مدیریت کنید (بروزرسانی و اعتبار بسته).

    گام 7 — مجوزها و تنظیمات Briar

    1. پس از نصب، به مجوزهای مورد نیاز (Bluetooth، Nearby devices، Storage در صورت نیاز) دقت کنید و فقط مجوزهای لازم را بدهید.
    2. فعال‌سازی Bluetooth و/یا Wi‑Fi Direct وقتی می‌خواهید همگام‌سازی محلی انجام دهید.

    نکات عملی و احتیاط‌ها

    • اگر گوشی قفل‌شده یا مدیریت شده (MDM) باشد ممکن است نصب APK از منابع نامعلوم غیرفعال باشد. در این حالت نیاز به دسترسی بیشتر یا مدل گوشی متفاوت دارید.
    • اگر نگران شنود یا شناسایی هستید، Bluetooth/Wi‑Fi را فقط هنگام نیاز روشن کنید و پس از انتقال خاموش کنید.
    • برای بروزرسانی‌ها، اگر دسترسی اینترنت دارید از داخل F‑Droid یا سایت رسمی به‌صورت دوره‌ای نسخه جدید را دانلود کنید.
    • اگر نمی‌دانید معماری CPU، اغلب ARM64 را امتحان کنید (بیشترین احتمال سازگاری با گوشی‌های جدید).

    اگر می‌خواهید، می‌توانم:

    • متن دقیق پیام برای توضیح نحوه فعال کردن “Install unknown apps” برای نسخه خاص اندروید (مثلاً Android 12 یا 13) بنویسم، یا
    • لینک مستقیم به صفحه دانلود Briar برای شما آماده کنم.
    view more: next ›