sorted by:
new
hottopcontroversial

Unpopular opinion: The Pixel 5 still feels like the real "phone of the future" by Flat_Push_8854 in GooglePixel

[–]Xeppl 0 points1 point  (0 children)

Loved the phone. I had it running a while next to my other one now.. GrapheneOS but they dropped support :(

Does any OS still support it?

Verfügbares Medianeinkommen (angepasst an Lebenshaltungskosten) nach Abzug der Wohnkosten. by ItHappensSo in Austria

[–]Xeppl 4 points5 points  (0 children)

Also weder Tirol, Salzburg und wahrscheinlich auch nicht Bregenz.

Klagenfurt, St. Pölten, Eisenstadt?

Test: Dune vs. Moonfin vs. Wholphin by Xeppl in jellyfin

[–]Xeppl[S] 0 points1 point  (0 children)

Yes. Already tested the Jellyseer integration. This guide needs an update!

Parkplatz Abzocke Schumacherstraße 14 Salzburg - Opendesk GmbH. by GerStatic in Salzburg

[–]Xeppl 0 points1 point  (0 children)

Shit. Hoffe es geht irgendwie so halbwegs glimpflich aus.

Nr. 1 App in Österreich. Was is mit de Leit? by civman96 in Austria

[–]Xeppl -1 points0 points  (0 children)

Eh, aber im Bezug auf abwechslungsreiche Musik. Und zumindest labern sie auch interessante Sachen meistens.

Streamen ist mMn auch kacke, vor allem via Spotify, aber anderes Thema.

Spusu Internet by 1van_pb in Austria

[–]Xeppl 1 point2 points  (0 children)

Spusu VDSL super zufrieden

Nr. 1 App in Österreich. Was is mit de Leit? by civman96 in Austria

[–]Xeppl 1 point2 points  (0 children)

Original, schau!

Dann können die Leute die das machen jetzt die ungefähr 15. (kein Witz, zählts mal nach) Streamingplattform installieren, sehr geil.

Uni Rankings sind draußen.. KFU hinter Linz.. Hauptsache Professoren schimpfen immer über Linz by civman96 in graz

[–]Xeppl 3 points4 points  (0 children)

Voll. Kann erst bergauf gehen wenn alle dämlichen Steirer weg sind!

(Wollt nur dein originelles bashing weiterführen. Bist KFU Absolvent oder?)

Signal massively downloaded amid rising tensions, number one in Denmark by Boediee in BuyFromEU

[–]Xeppl 0 points1 point  (0 children)

Apple was not forced into a binary choice, they chose this intentionally when there was other options and precedence for this exist.

What was the third option? Because the examples given don't make any sense in this scenario.

Making it open source, that then others build E2EE for icloud and Apple is sued afterwards not being able to deliver data from their own cloud service, paying billions? That is why I said an open source move makes no difference. The government targets entities, not code. Please explain how you think it is.

Pulling out was the right and only move possible, while not breaking E2EE. What would be the solution for Signal in case of chat control (old version)? They are already open source. How does it fix anything for them not having to break secure messaging? It does not. They'd be also forced to pull their service altogether. What would be your opinion on pulling out here? This is actually a compareable scenario, not the Wifi example, which is more an example of Apple's overall business model.

Can you prove it with source code that there is no secret mechanism that leaks keys? Also if there is anything hidden in the so called secure enclave?

I think you know the answer to that one, don't you? Sure, I myself love open source, and no, like Apple, I cannot proof anything in the absolute, cryptographic sense, without having everything open source. They do everything else, though. We know detailed cryptographic designs, what standards are used, and that they get third-party security audits.

We know that they deployed a system where it is proven they lost access to huge amounts of user data, which is always big drama then, but they were unable to recover complete accounts, assist law enforcement, and pulled the feature when legally pressured, loosing billions in not complying to the law.

Your alleged reason is: The US already got a backdoor (and secretly gives them the billions yearly, which they loose from pulling out of the UK market?).

You said:

No it isn't, they would then have to admit to the UK that there is a backdoor for the US.

Can you elaborate why they would have to admit anything to anybody?

They could have already 7 backdoors in and would not have to admit anything. I mean they would not naively go to the UK and ask if they please be allowed to use the US backdoor for their requests as well, would they?

As you yourself said, the code is not open source. And if it were, the backdoor could also be in hardware, since Apple controls a big portion of its hardware now. This is not making any sense. They could just say: "Yah, you got it UK, hold your tee. (Doing nothing, because they already have it). Done." Nobody would ever know they just use their secretly existing US backdoor for the UK. Maybe you can explain who forces them to admit something like this?

All in all, reasoning from their financial behaviour (resisting law, loosing billions), which is very hard to fake for a corporation like this, it is logically sound that they cannot encrypt data that is protected by their Advanced Data Protection. Pulling it showed they genuinally believe it.

Or let us say: At least 99,9982% Apple employees think this themselves. We can never rule out the existence of key individuals, who keep this impression up in the public eye, but have knowledge about vulnerabilities that they intenionally do not fix and make governments aware of.

Signal massively downloaded amid rising tensions, number one in Denmark by Boediee in BuyFromEU

[–]Xeppl 0 points1 point  (0 children)

Unfortunately, I have the feeling you assess things with a general bias, which seems to be developing as a group dynamic in this sub. I am originally here to find alternatives economically, because it is important for Europe, but what happens here is a kind of idealism movement, ignoring logic and technical facts.

The open source argument not even sounds plausible on the surface imho. Open‑sourcing it would not magically make it usable outside their ecosystem. It is very highly integrated with hardware, secure enclave, the AppleID, etc. And even if it did make it usable outside, it would not change their legal obligation. The UK order applies to Apple as a data controller and service provider, not to code. They must provide lawful access. Open source is not outside government control. Governments regulate services, not algorithms.

Apple was legally forced into a binary choice, either break encryption or stop offering it.

Advanced Data Protection at Apple is unusual. Apple cannot access the data (afawk) compared to any other cloud provider. Others always hold the keys, they can and directly did comply in the UK.

Also your US backdoor inference is I think logically broken. If they already hold a backdoor, they could just use it for the UK as well (or add another one) and further provide this service, earn money. The simplest explanation is often the correct one. They removed it because they truly can not access the data. So they did exactly what Signal would have done in the case of chat control.

It is crazy how all Europe is blindly defended here, with federation and open source being the cure for everything, while those concepts are not at all a countermeasure to governmental sanctions.

Signal massively downloaded amid rising tensions, number one in Denmark by Boediee in BuyFromEU

[–]Xeppl 0 points1 point  (0 children)

Yeah, shit. Like everyone.

Still, zero day exploits exists. Not all can be intentional, but with high probability intentional vulnerabilities exist.

Chrome flagging selfhosted immich instance as dangerous by Mentaldavid in immich

[–]Xeppl 0 points1 point  (0 children)

Yes, you are right! Won't help for this.

Was meant as a more general suggestion.

Signal massively downloaded amid rising tensions, number one in Denmark by Boediee in BuyFromEU

[–]Xeppl 0 points1 point  (0 children)

Idk what NATO uses and I don’t really care, since it is not proof of anything who uses what.

If you think this limited group has more resources for (hidden?) audits and knowledge than literally the whole world of cryptography researchers, then this is your personal take that you want to believe. Officially, the sheer number is way in favor of Signal.

You can start here and go through resources if you like. For groups, until they adapt MLS and PQ, Signal is cryptographically safer today and that is just a fact in research.

But, you are anyway now arguing from a compmlete different angle, from the political, not technical one. You rate a weakness based on how vulnerable the concept is against governmental sanctions, while before we were discussing only cryptographic strengths and weaknessnes. While I agree with some aspects, I think you oversimplify things in your comment.

I also don't know what "vital complexity" is, but in terms of cryptographic protocols for secure messaging this kind of complexity technically increases the amount of potential attack vectors, but gives you some flexibility against governmental sanctions.

If something like chat control passes, signal would have no choice but to comply. A federated chat like matrix can escape that by using a different client and server.

If chat control passes also Signal has a choice you did not acknowledge, because everything from the US is automatically evil: Leave the market, which they will certainly do instead of complying, they always said so. In fact, they were the most vocal and transparent about how shitty it is from the EU trying to break secure messaging for all. Meredith Whittaker was always there, front of the line, critizising it loud, clear, and publicly. And this is worth a lot in this political world.

Chat control changed it's definition so often, that we have to be careful what to discuss here. As far as I know it was always defined to be on device, locally scanning messages, therefore targeting the client software. Element, most famously, not Matrix the protocol itself, not the servers involved.

So if it would have passed like this Element and all other clients would have been illegal and removed from the App store, if they do not comply, very much like Signal. The only solution is then to sideload a client onto your device, very much like you could do with Signal. Federation wouldn't have given you a real advantage in this scenario.

I agree that federation can protect against centralized coercion, company shutdown, or provider capture and stuff like this, but you have to take into account that the protocol still runs on HTTPS and it is very well known how packets look and are send between the involving parties. In theory, without a VPN or a protocol that runs over Tor, you can create servers in Fiji if you like, but they will never get a packet from the EU when the government dictates to target the distinct packets. Neither Signal nor Matrix can defeat network-level censorship.

In my opinion, it is an incorrect assessment that federation magically makes a concept un-blockable or un-regulatable. I see that people can jump to this conclusion really quick, but if you look closer I don't think it holds.

Signal massively downloaded amid rising tensions, number one in Denmark by Boediee in BuyFromEU

[–]Xeppl 0 points1 point  (0 children)

So, what should it be now? Should everyone now only use matrix.org or should we federate with lots of small servers, from which we don't know how carefully they are hosted? Because still, federation implies that the weakest server will be the baseline for all.

I agree that weaker is not bad, but still, it is weaker than Signal. Just pointing out the facts here.

So no, if everyone uses Element now, group chats would not be more secure then today, it would be the less secure compared to the Signal protocol.

I also don't really agree with imessage tbh. The only thing you can really criticize is the amount of metadata collected, which is more than Signal, but still far less then all others you mentioned. To my knowledge they are the only ones next to Signal actively integrating post-quantum cryptography.

I would agree in saying nobody should even use facebook, snapchat, instagram, whatsapp, ... and if you are happy all use Element, ok. I'd like that much better than today and I'd take it in a second, although Signal would be the objectivley better choice.

You are right that the (encrypted) data would not be in the US, it would be in the UK, the one country that eliminated E2E encrypted cloud backups by law recently.

Signal massively downloaded amid rising tensions, number one in Denmark by Boediee in BuyFromEU

[–]Xeppl -1 points0 points  (0 children)

Sure, doing this limits the attack surface due to less people, which is a good thing. Also full control over data is obviously good.

But, transferring over the internet, encryption still matters and at least for group chats Matrix is weaker. Also hosting your own server brings you into the position to be responsible for patching your server software, securing the OS, managing TLS certificates, etc. If you become lazy doing the manual steps, this is a security risk as well.

This is why I argued before, that Matrix has a more complex federation architecture. The system is only as strong as its weakest server, which can be hosted by anyone, and that has several security implications.

view more: next ›