Last month I tried to unlock a Motorola phone. Guess what: There is no option to unlock the bootloader because it’s one of the models that can’t.

The year before a Huawei phone: I had to disassemble half the device to shortcircut something while running a custom made software on the PC.

Yeah now try to get an average user doing this… good luck.

And I’m not even scratching the part where some of your devices hardware is not working properly because the closed source firmware is not available.

A quick look at which recent phones (since 2022) can install LineageOS: https://wiki.lineageos.org/devices/ Just 35 phones (Pixels exluded), including only a single Samsung phone!

Now compare that to installing Windows/Linux on a PC where you literally plugin a USB and hit install…

I would probably hold off on buying a phone specifically for the purposes of installing a custom ROM on it… Custom ROM installation is generally extremely simple…

Hahaha, nice joke:

https://en.wikipedia.org/wiki/Bootloader_unlocking#Android

A yes, a public dns resolver funded by taxpayers money and nothing of it is open source…

Sounds like a massive waste of money to me. Just give someone like Mullvad (they already have a DNS service that is open source) that money instead of trying to be another shitty DNS Resolver.

Also the company behind this looks incredibly scummy and their products are mostly buzzword-bullshit. The whole company is based on selling a DNS blocklist for as much money as possible.

Also: https://www.whalebone.io/aura-for-consumers

People want to be safe online. They are even willing to pay for it. They just want their telco to offer them a smooth way to get there. Common cybersecurity products struggle with low adoption rates due to the need for downloads. Whalebone Aura requires no installation or updates and activates with a single click.

That’s sounds a lot like the ISP is implementing some kind of deep network inspection “to protect you from the internet”… aka censoring.

Check that “Filter lists > Privacy > Block outsider intrusion into LAN” is enabled and you should be fine

You can already do that:

Get-AppxPackage "Microsoft.XboxApp" | Remove-AppxPackage
Get-AppxPackage "Microsoft.XboxIdentityProvider" | Remove-AppxPackage -ErrorAction SilentlyContinue
Get-AppxPackage "Microsoft.XboxSpeechToTextOverlay" | Remove-AppxPackage
Get-AppxPackage "Microsoft.XboxGameOverlay" | Remove-AppxPackage
Get-AppxPackage "Microsoft.XboxGamingOverlay" | Remove-AppxPackage
Get-AppxPackage "Microsoft.Xbox.TCUI" | Remove-AppxPackage
Set-ItemProperty -Path "HKCU:\Software\Microsoft\GameBar" -Name "AutoGameModeEnabled" -Type DWord -Value 0
Set-ItemProperty -Path "HKCU:\System\GameConfigStore" -Name "GameDVR_Enabled" -Type DWord -Value 0
If (!(Test-Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR")) {
	New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" | Out-Null
}
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\GameDVR" -Name "AllowGameDVR" -Type DWord -Value 0

You’re welcome

Lemmy is open source, so feel free to go back to Reddit

Just keep using Remote Desktop Connection aka mstsc.exe?

It’s even recommended by Microsoft:

Although replacements have been released, as of the release of the Windows App, Remote Desktop Client is still recommended for use.

https://en.m.wikipedia.org/wiki/List_of_Remote_Desktop_Protocol_clients

Can’t wait for all the other horror stories getting posted here :D

With F-droid you trust F-droid to build the binary from the developers’ source code

Not when using a self-hosted F-Droid Repo - which is the case for Ironfox.

because it takes a like 3 or 4 minutes to boot

What kind of PC is this? Does it have an SSD?

saying there are unspecified “known vulnerabilities” within Signal

His source: Trust me bro

There are some more privacy friendly forks of “Firefox for Android”, which have sponsored shortcuts disabled or minimized by default. For example:

• https://gitlab.com/relan/fennecbuild
• https://gitlab.com/ironfox-oss/IronFox

Feel free to give them a try :)

The same apps that have access to more of your data (because they’re not sandboxed in a browser), use electron (ships a browser) and include trackers that one can’t simply block with an extension?

Short answer: Google Play

Long answer: Google Play and/or people with special requests like https://lemmy.ml/post/12332630

Well from my personal PoV there are a few problems with that

1. You can’t detect all credentials reliably, they could be encoded in base64 for example
2. I think it’s kind of okay to commit credentials and configuration used for the local dev environment (and ONLY the local one). E.g. when you require some infrastructure like a database inside a container for your app. Not every dev wants to manually set a few dozen configuration entries when they quickly want to checkout and run the app

I also personally ask myself how a PyPI Admin & Director of Infrastructure can miss out on so many basic coding and security relevant aspects:

• Hardcoding credentials and not using dedicated secret files, environment variable or other secret stores
• For any source that you compile you have to assume that - in one way or another - it ends up in the final artifact - Apparently this was not fully understood (“.pyc files containing the compiled bytecode weren’t considered”)
• Not using a isolated build process e.g. a CI with an isolated VM or a container - This will inevitable lead to “works on my machine” scenarios
• Needing the built artifact (containerimage) only locally but pushing it into a publicly available registry
• Using a access token that has full admin permissions for everything, despite only requiring it to bypass rate limits
• Apparently using a single access token for everything
  • When you use Git locally and want to push to GitHub you need an access token. The fact that article says “the one and only GitHub access token related to my account” likely indicates that this token was at least also used for this
• One of the takeaways of the article says “set aggressive expiration dates for API tokens” - This won’t help much if you don’t understand how to handle them properly in the first place. An attacker can still use them before they expire or simply extract updated tokens from newer artifacts.

On the other hand what went well:

• When this was reported it was reacted upon within a few minutes
• Some of my above points of criticism now appear to be taken into account (“Takeaways”)

Just for further clarification, the API works like this:

• time is the local (client) time (in this case UTC-7)
• servertimezone is the time zone where the server is located
• timezoneoffset is the offset of the local time relative to the servertimezone (offset from the servers PoV)

To get the UTC date you have to do something like this:

time.minusHours(timezoneoffset).atZone(servertimezone).toUTC()

Well if it’s a 32bit timestamp you’re screwed after 19 January 2038 (at 03:14:07 UTC)

So just for additional context:

This meme was brought to you by the following API response scheme:

{
  "time": "2007-12-24 18:12",
  "servertimezone": "Europe/Vienna",
  "timezoneoffset": -8
}

when it could have just been

{
  "date": "2007-12-24T18:21:00-07:00"
}