soloActivist

joined 1 year ago
 

The bank requires customers who use their phone app to:

  1. buy a new recent smartphone, repeatedly (because the bank’s app detects when it is running on an Android emulator and denies service)
  2. subscribe to mobile phone service (which also costs money and also in some regions requires supplying national ID to the mobile carrier to copy for their records which customers then must trust them to secure)
  3. share their mobile phone number with a power abusing surveillance capitalist who promotes the oil industry (Google / Totaal)
  4. create a Google account and agree to their terms (which includes not sharing software that was fetched from the Playstore jail)
  5. share their IMEI# with Google
  6. share all their app versions with Google, thus keeping Google informed of known vulns for which they are vulnerable
  7. share with Google where they bank and trust Google not to sell that info to debt collectors
  8. install proprietary non-free software and trust the security of non-reviewable code
  9. share the mobile phone number with the bank

Why are so many people okay with this?

I’ve been out of the loop on games for a while but ReactOS may be worth a look.

[–] soloActivist@links.hackliberty.org 5 points 8 months ago (1 children)

The 1st ½ of your comment sounds accurate. But...

And also in Foss there are highly opinionated software where the devs completely ignore users, ban them from GitHub when they post issues,

Right, but to be clear non-free s/w is worse - you can’t even reach the devs, generally, and there is no public bug tracker. FOSS is an improvement in this regard because at least there is a reasonable nuclear option (forking). The nuclear option for non-free software is writing it yourself from scratch.

That all sounds accurate enough to me.. but thought I should comment on this:

However - in larger enterprises there’s so much more, you get the whole SDL maturity thing going - money is invested into raising the quality of the whole development lifecycle and you get things like code reviews, architects, product planning, external security testing etc. Things that cost time, money and resources.

It should be mentioned that many see testing as a cost, but in fact testing is a cost savings. In most situations, you only spend some money on testing in order to dodge a bigger cost: customers getting burnt in a costly way that backfires on the supplier. Apart from safety-critical products, this is the only business justification to test. Yet when budgets get tightened, one of the first cuts many companies make is testing -- which is foolish assuming they are doing testing right (in a way that saves money by catching bugs early).

Since the common/general case with FOSS projects is there is no income that’s attached to a quality expectation (thus testing generates no cost savings) - the users are part of the QA process as free labor, in effect :)

81
submitted 8 months ago* (last edited 8 months ago) by soloActivist@links.hackliberty.org to c/foss@beehaw.org
 

There is a common theme pushed by fanatics of capitalism that never dies: that a profit-driven commercial project ensures higher quality products than products under non-profit projects. Some hard-right people I know never miss the chance to use the phrase “good enough for government work” to convey this idea.

I’m not looking to preach to the choir here, but rather to establish a thread of scenarios that correspond to quality for the purpose of countering inaccurate narratives. This is the thread to share your stories.

In my day job I’m paid to write code. Then I go home write code I was not paid for. My best work is done without pay.

Commercial software development

When I have to satisfy an employer, they don’t want quality code. They want fast code. They want band-aid fixes. The corporate structure is too myopic to optimize for quality.

Anti-gold-plating:I was once back-roomed by a manager and lectured for “gold plating”. That means I was producing code that was higher quality than what management perceives as economically optimal.

Bug fixes hindered:I was caught fixing some bugs conveniently as I spotted them when I happened to have a piece of code checked out in Clearcase. I was told I was “cheating the company out of profits” because they prefer if the bugs each go through a documentation procedure so the customer can ultimately be made to pay separately for the bug fix. Nevermind the fact that my time was already charged anyway (but they can get more money if there’s a bigger paper trail involving more staff). This contrasts with the “you get what you pay for” narrative since money is diverted to busy work (IOW: working hard, not smart).

Bugs added for “consistent quality”:One employer was so insistent on “consistent quality” that when one module was higher quality than another, they insisted on lowering the quality of the better module because improving the style or design pattern of the lower quality piece would be “gold plating”. This meant injecting bugs to achieve consistency. The bugs were non-serious varieties; more along the lines of needless complexity, reduced performance, coding standard non-compliances, etc, but nonetheless something that could potentially be charged to the customer to fix.

Syntactic dumbing-down:When making full use of the language constructs (as intended by the language designers), I am often forced by an employer to use a more basic subset of constructs. Employers are concerned that junior engineers or early senior engineers who might have to maintain my code will encounter language constructs that are less common and it will slow them down to have to look up the syntax they encounter. Managers assume that future devs will not fully know the language they are working in. IMO employers under-estimate the value of developers learning on the job. So I am often forced avoid using the more advanced constructs to accommodate some subset of perceived lowest common denominator. E.g. if I were to use an array in bash, an employer might object because some bash maintainers may not be familiar with an array.

Non-commercial software development

Free software developers have zero schedule pressure. They are not forced to haphazardly rush some sloppy work into an integration in order to meet a deadline that was promised to a customer by a manager who was pressured to give an overly optimistic timeline due to a competitive bidding process. #FOSS devs are free to gold-plate all they want. And because it’s a labor of love and not labor for a paycheck, FOSS devs naturally take more pride in their work.

I’m often not proud of the commercial software I was forced to write by a corporation fixated on the bottom line. When I’m consistently pressured to write poor quality code for a profit-driven project, I hit a breaking point and leave the company. I’ve left 3 employers for this reason.

Commercial software from a user PoV

Whenever I encounter a bug in commercial software there is almost never a publicly accessible bug tracker and it’s rare that the vendor has the slightest interest in passing along my bug report to the devs. The devs are unreachable by design (cost!). I’m just one user so my UX is unimportant. Obviously when I cannot even communicate a bug to a commercial vendor, I am wholly at the mercy of their testers eventually rediscovering the same bug I found, which is unlikely in complex circumstances.

Non-commercial software from a user PoV

Almost every FOSS app has a bug tracker, forum, or IRC channel where bugs can be reported and treated. I once wrote a feature request whereby the unpaid FOSS developer implemented my feature request and sent me a patch the same day I reported it. It was the best service I ever encountered and certainly impossible in the COTS software world for anyone who is not a multi-millionaire.

I agree.

One of the reasons no one gives a shit is there is never news about CF making use of that MitM position. But I know they hire data scientists and what corp can resist the urge to monetize data they have access to? So I think it’s just a matter of time before they get caught abusing the vast amount of valuable data they have visibility on.

Sorry I do not know if BBC interviews are transcribed.

But FWIW it will air again on BBC World Service at 02:32 GMT tomorrow and the next day (which could be useful for those on limited internet connections)

11
submitted 8 months ago* (last edited 8 months ago) by soloActivist@links.hackliberty.org to c/privacy@programming.dev
 

cross-posted from: https://links.hackliberty.org/post/609883

This BBC interview has a #Cloudflare rep David Bellson who describes CF’s observations on internet traffic. CF tracks for example the popularity of Facebook vs. Tiktok. Neither of those services are Cloudflared, so how is CF tracking this? Apparently they are snooping on traffic that traverses their servers to record what people are talking about. Or is there a more legit way Cloudflare could be monitoring this activity?

 

Some banks will annually mail a paper “welcome” letter to all customers purely for the purpose of collecting bounced mail ultimately to verify if anyone has moved without telling them. The letters never state that’s the purpose.. they take that opportunity to talk about their service in arbitrary ways. Some banks even charge customers a fee for their cost in doing that. If you ask the banker about it they readily admit that it’s an address verification technique.

That’s it.. just a PSA so folks are aware, as it is a bit sneaky.

Some national postal services (e.g. USPS) sell your mail forwarding information which is how you get tracked to your new location by various entities even when you did not inform them of your new address. So obviously a good defensive measure is to never use the mail forwarding service. Select the entities you want to know your new address and inform them directly. But then to get some immunity to the sneaky trick in the 1st paragraph, perhaps give the next resident a stack of addressed envelopes and stamps and ask the next resident to forward for you.. or just ask them to trash your mail instead of returning it.

[–] soloActivist@links.hackliberty.org 2 points 9 months ago* (last edited 9 months ago) (1 children)

Regarding the two suggested search services which are both Microsoft syndicates:

  • #DuckDuckGo: hosted by Microsoft and searches are outsourced to Microsoft, so MS gets to see your queries and your IP, among other DDG problems

  • #Qwant: tor-hostile (CAPTCHAs), MS profits from your searches.

[–] soloActivist@links.hackliberty.org 1 points 9 months ago (1 children)

So does that mean jlai.lu is blocked by lecho.be? I figured it was more likely that lecho.be was blocking Tor, thus blocking my connection.

 

When I visit this post:

https://jlai.lu/post/2250911

the embedded short abstract intro to the article is “403 Blocked www.lecho.be” When I try visiting the link directly I get “403 bot detection”. This suggests that everyone who opens that thread independently visits that webpage by way of some javascript that’s not under the user’s control. If 1000 people open that thread, then 1000 separate fetches are made. That’s a poor design. The server could do that job just once and the results would be more reliable. As opposed to everyone getting different results.

This is also a #privacy #security bug. Someone who opens a thread does not necessarily intend to fetch the linked article. Non-tor users are under surveillance in some countries (e.g. the US, where Trump enacted law s.t. ISPs can collect data on users without consent). So they should have control over what sites they visit. Merely opening a thread is an abuse because it makes users actions instantly trackable. IOW, users share information with their ISP without their knowledge or control.

Note that the example thread shows the full text of the article because the author was diligent about copying it. But that’s not the general case.

#bug #lemmyBug

[–] soloActivist@links.hackliberty.org 2 points 10 months ago* (last edited 10 months ago)

Yeah this article caught me by surprise. Natural gas is naturally odorless so that probably works against awareness.

I tend to be lazy about turning on the loud fans which downgrades the ambiance. But I need to change something because grease cakes up on everything near the oven and on the cabinets. My range hood is also the ventless style, which must be totally useless against the benzine byproduct.

I will certainly put more thought into kitchen design in the future. The gas appliances should probably be in the corner of the room so there are fewer directions to control, and the hood should probably be big, industrial, and vented outside. It’s a shame because I might prefer the gas stove to be in an island layout or at least centrally located.

[–] soloActivist@links.hackliberty.org 1 points 10 months ago* (last edited 10 months ago)

It depends on what you’re baking. You wouldn’t want your cake to have a crispy hard crust on the outside, but you would want that with bread and pizza.

[–] soloActivist@links.hackliberty.org 2 points 10 months ago* (last edited 10 months ago) (2 children)

That’s interesting but it seems like an incomplete answer. I’ve read that it’s very common for people to install a range hood that’s too small. If it’s true that range hoods are often under-sized, then it naturally follows that they would often be ineffective. So I would like to know the answer in terms of a high-end well-designed & /big/ range hood. I would also expect a low hood to be more effective than one installed high above the stove.

[–] soloActivist@links.hackliberty.org 1 points 10 months ago* (last edited 10 months ago)

Many coils pulse full heat to simulate different heat levels. Gas gives you very precise control over exact heat levels and it is instantly responsive to change.

You’ve got the precision factor backwards. Gas is a clear loser on that.

When you have knob levels 0—9, if you set the knob to 3 on electric you get exactly ½ the heat energy that you get from level 6. It’s perfectly linear. This is not true in the slightest with gas. A gas flame is non-linear as you go from 0 to 9. All you can do is eye-ball the flame and guess. Even when you have a flame size in mind, it’s not reproduceable because you’re still eye-balling it every time. You can’t trust the levels on a gas knob either because they’re so non-linear that you can get a big flame difference in certain points along the scale.

Gas also has less precision of control because of the reduced range at both ends. The lowest possible gas setting is still too hot for some tasks. So the best you can do is manually mimic the pulsing of electric by turning the burner off and reigniting periodically. The highest temp on gas is also less than the highest temp electric can achieve.

The only “precision” task that gas wins at is at the zero (off) level, and speed, AFAICT, which is related to precision. Both of those factors can be discarded for the most part when comparing induction because it adjusts temp demand fast enough.

[–] soloActivist@links.hackliberty.org 2 points 10 months ago (2 children)

Indeed. And it’s a needlessly destructive form of sanitization. That is, sanitizing properly normally means replacing the special characters with an encoding to ensure literals render.

 

After submitting an HTML sample in this post, #Lemmy gutted the content silently and destructively without telling me. The original text is totally lost and not recoverable. I only noticed because more than half the code was discarded.

This is terrible. It’s perhaps understandable that raw HTML might have security issues if it appears as-is, so of course the angle brackets should be automatically encoded as literals by the submission processing modules. The status quo is obviously a #LemmyBug because authors are not even warned about the destruction and given a chance to preserve their work. It just gets trashed.

 

cross-posted from: https://fedia.io/m/disabled/t/346115

Banks have started capturing customers voice prints without consent. You call the bank and the robot’s greeting contains “your voice will be saved for verification purposes”. IIUC, these voice prints can be used artificially reconstruct your voice. So they could be exfiltrated by criminals who would then impersonate you.

I could be wrong about impersonation potential.. just fragments of my memory from what I’ve read. In any case, I don’t like my biometrics being collected without my control.

The countermeasure I have in mind is to call your bank using #Teletext (TTY). This is (was?) typically a special hardware appliance. As a linux user, TTY is what the text terminal is based on. So I have questions:

  1. can a linux machine with a modem be used to convert a voice conversation to text?

  2. how widespread are TTY services? Do most banks support that, or is it just a few giant banks?

  3. if street-wise privacy enthusiasts would theoretically start using TTY in substantial numbers, would it help the deaf community by increasing demand for TTY service, thus increasing the number of businesses that support it?

3
voting out of sync (kbin→lemmy) (links.hackliberty.org)
submitted 10 months ago* (last edited 10 months ago) by soloActivist@links.hackliberty.org to c/lemmy_support@lemmy.ml
 

Directly visiting a Kbin thread on the server hosting it shows some positive number of votes. If the URL of that kbin thread is used is queried in lemmy so a copy local to the lemmy instance is made, the number of votes is zero.

Edit-- this also happens when the source article is another lemmy instance.

 

I filled out a form to crosspost to !assistive_technology@lemmy.sdf.org, clicked create, and the create button turns into a spinner. Forever.

F12 » console gives:

Source map error: Error: request failed with status 400

Resource URL: https://links.hackliberty.org/css/themes/darkly-red.css

Source Map URL: darkly-red.css.map

#lemmyBug

 

In this comment my use of the “b” word was overzealously suppressed, silently without telling me. I only discovered it when re-reading my post.

There are THREE #LemmyBug cases here:

  1. when the “b” word is used as a verb, it’s not a slur. And when it’s used as a noun, it’s only a slur if not literally referring to a dog.

  2. my post was tampered with without even telling me. Authors should be informed when their words are manipulated and yet still presented to others as their own words.

  3. The word “removed” cannot simply replace any word. It makes my sentence unreadable. In the very least, the word should be “REDACTED”, and there should be a footnote added that explains /why/ it was redacted.

 

cross-posted from: https://links.hackliberty.org/post/125466

My credit card issuer apparently never gets to know what I purchased at stores, cafes, & restaurants -- and rightfully so. The statement just shows the shop name, location, and amount.

Exceptionally, if I purchase airfare the bank statement reveals disclosures:

  • airline who sold the ticket
  • carrier
  • passenger name
  • ticket number
  • city pairs

So that’s a disturbing over-share. In some cases the airline is a European flag carrier, so IIUC the GDPR applies, correct? Doesn’t this violate the data minimization principle?

Airlines no longer accept cash, which is also quite disturbing (and illegal in jurisdictions where legal tender must be accepted when presented for PoS transactions).

Has anyone switched to using a travel agent just to be able to pay cash for airfare?

UPDATE

A relatively convincing theory has been suggested in this other cross-posted community:

https://links.hackliberty.org/comment/414338

Apparently it’s because credit cards offer travel insurance & airlines have incentive to have another insurer involved. Would be useful if this were documented somewhere in a less refutable form.

GDPR question still outstanding.

 

cross-posted from: https://links.hackliberty.org/post/125466

My credit card issuer apparently never gets to know what I purchased at stores, cafes, & restaurants -- and rightfully so. The statement just shows the shop name, location, and amount.

Exceptionally, if I purchase airfare the bank statement discloses:

  • airline who sold the ticket
  • carrier
  • passenger name
  • ticket number
  • city pairs

So that’s a disturbing over-share. In some cases the airline is a European flag carrier, so IIUC the GDPR applies, correct? Doesn’t this violate the data minimization principle?

Airlines no longer accept cash, which is also quite disturbing (and illegal in jurisdictions where legal tender must be accepted when presented for PoS transactions).

Has anyone switched to using a travel agent just to be able to pay cash for airfare?

UPDATE

A relatively convincing theory has been suggested in this other cross-posted community:

https://links.hackliberty.org/comment/414338

Apparently it’s because credit cards offer travel insurance & airlines have incentive to have another insurer involved. Would be useful if this were documented somewhere in a less refutable form.

view more: next ›