No, warrant canaries don’t work.

You gotta look at things that have happened.

I post it all the time but mullvad doesn’t have port forwarding anymore because Interpol got together with all the cdns and blacklisted their servers after the company was unwilling to backdoor their systems to catch csam traders and raids didn’t turn anything up. The police had wanted to surveil the company’s systems so they could identify people using port forwarding to trade files using windows file sharing (bonkers). When that failed they turned to a cdn block of all their server ips so either the company would discontinue port forwarding or dissolve, flushing the csam trading into less private or secure channels.

Mullvad ended up ditching port forwarding rather than work with the police. They took a huge hit for it too, lots of people left for ivpn or air.

What the other person is saying about trust is true. Ultimately you’re trusting the provider of the service. I trust mullvad because they don’t have port forwarding anymore.

No.

Different services offer different things for different customers.

Proton offers everything under one banner, a turnkey replacement for google. Seems great until you consider the person who doesn’t want kyc pii for all that stuff under one roof.

Mullvad has no password and keeps as little information about the user as possible. Seems great till you consider the user who wants to gate access by accounts with passwords.

People want different things out of the services they use.

In the case that my safety relied on a vpn I would accept the fraction of my $5 per month that could be traced to insane Europeans.

Every person is different. I consider alternatives to mullvad to be unacceptable in terms of operation, simplicity, functionality, reliability and of course track record.

It’s perfectly fine with me if someone chooses to use a different vpn than I do, but I want people to understand that they aren’t all the same.

As a broad parallel example to illustrate my thought process, I own firearms, cars and many other things manufactured or marketed by companies whose executives hold and materially support right wing politics.

Mullvads multi hop is often automatically used when a person wants their anti dpi (daita) feature but has chosen a server without that functionality.

Multihop is a useful tool when trying to access geofenced content, often my own.

The problem is that there are more ways for it to fail. Jurisdictions aren’t a huge deal if the provider has a well tested system. Bear in mind that almost everywhere in the world kyc data can be ordered to be given up by a judge. A provider with less knowledge of who you are is safer in any jurisdiction than one with a whiz bang system who has your pii. Use cash.

I recommend you don’t choose ivpn over mullvad.

The apps are worse if you end up using the apps, the config file generator has more limitations(that I found) if you use config files, there are more ways to screw up and leave pii lying around in the user account, there are in general more little errors you can make if you’re not careful managing your ivpn account, it’s significantly slower and higher latency than mullvad with fewer servers in fewer locations and has not been tested by law enforcement to the extent that mullvad has.

I am replying to you and not the person who said to choose ivpn because I don’t want to fight anyone about this and only want to pass along my experience with both services to a person trying to make a choice.

When you look at the rule list for the lemmy.world asklemmy community it says post titles need to end in a question mark. You were told in that thread that it didn’t have one and didn’t take any steps to remediate it. You have the capacity to edit the body and title of posts you make.

Here are some ways you could have rephrased your post title as a question in compliance with the rules: Is youtube doing some shady stuff? Has anyone else noticed shady stuff going on with youtube? I think youtube is doing some shady stuff, does anyone else?

You had a post removed because you didn’t follow the rules, not because of your opinions.

You were not banned. Having a post removed isn’t a ban. I bet if you made the same post with one of the rule following titles I suggested, it would stay up.

No one is judging and punishing you for your opinions.

You can probably not worry about this and be fine. Email is insecure to begin with.

I’m not gonna fight anybody about this but the proton ceo is making the right call telling everyone to just spam fixes out there without testing. The security environment has gone from the old way of making sure the hole is patched perfectly to the new way of making patches live immediately.

The reason is that ai automation makes exploitation of a vulnerability incredibly fast. Used to be if you and the opp both found something at the same time they’d have to spend a long while figuring out where it goes, what it can be chained to (this was a big one because they had to carefully interact with someone whose knowledge domain was different from their own to hook their php deserialization fuck up to someone else’s use after free etc), what that gets them and how theyre gonna use it to accomplish what. So there was plenty of time for you to patch the bug while they get their ducks in a row. Now that’s all automatable and they don’t have to deal with a different criminal in a careful and safe way.

Idk how much computer security news you get, but it’s been non stop insane banger one after another and proton has a target on its back. I’d tell people to get in line and ship the fixes too.

My recommendation is that you stop doing that.

The tools you’re using to stay private and secure online need to be chosen for functionality first and foremost. Do not be driven away from effective tools by controversy.

There is no ethical consumption under capitalism.

I’m not trying to troll.

Do you have any examples of apple turning keys over to the cops? I’m interested if there’s more than simple correlation attacks like what happened when that persons proton account was subpoenaed and the cops matched their recovery email with the account they already had.

I know there’s precedent for that kind of thing where basic account information is given up but no actual “data” is shared.

We are way offtopic though I think even if a person is using a wide open default samsung a vpn is protecting them from surveillance via the lawful intercept backdoor in the cell system.

E: and I want to be clear, the post I replied to said backdoor to the os and so that’s what piqued my interest. Cloud services are their own fucked up thing.

I generally think about a backdoor in an os as a way to bypass a device’s lock, not as a backdoor to an encryption process. It’s the same mark of age that caused me to see no problem with the articles statement that turning off telemetry only turned off crash reports and whatnot. That made sense because those are the thing the user turned off and iOS has other controls for the other stuff.

Which is why I brought up the physical security and bfu points.

I also don’t know of any examples of Apple giving up customers data that isn’t along the lines of the proton example where the user set their proton recovery email to their firstname.lastname@icloud account and the cops used that to tie datasets together with the phone the user unlocked for them (if memory serves, that was a little bit ago).

I think people have a severe misconception about the (lack of ) security of Apple devices and tend to look at how a default iphone works as some egregious violation of trust when the vast overwhelming majority of users wouldn’t accept the limitations that being secure on a phone put upon them.

Ios lockdown mode is a great example. 99% of the time it’s fine but when people try to share contacts you’re shit out of luck and they gotta copy and paste it into a message to you.

As I said before, I don’t think the majority of people would accept the knowledge that their data is unsoupoenable (sp I’m sure) in exchange for account lockouts or forgotten passwords meaning loss of all cloud data. It’s why adp isn’t the default.

Was it netbsd who used to brag about no exploits in the default install? And then you actually do a default install and there’s no services and you think “yep, it’s pretty hard to get into a server that’s not running anything”.

It’s not quite that egregious but graphene is a good relatively secure by default setup while ios is pretty wide open so you can airdrop naked pictures to everyone on the bus and link your location data to your Facebook account, which is honestly what most phone users want. But those gates are closeable and strong in ios.

I uh also want to point out that the metadata cops use against you is your push notifications and I don’t even know any other in person fellow graphene users who disable those.

Broadly, having a phone is dangerous and if everyone understood that radio, television and the internet are propaganda and military c&c networks they’d be much less likely to buy the products to use them.

There’s a lot in that article but thankfully they put a breakdown at the top saying disabling telemetry only disables what has usually been called telemetry, which is to say crash reports and analytics.

Not evidence of a backdoor.

The way to enable e2ee with no chance of unlocking on server side is to enable advanced data protection. It’s not on by default because people get locked out and need access to their stuff. The resolution that makes a cloud customer happy (they get access to the data again) isn’t possible with adp on.

Apple also famously fought the government in court to avoid giving up user data and the paradigm after that incident is the cat and mouse of intelligence agencies and cutouts like greykey and cellebrite. Ios almost always fares better than everything but graphene in those conditions.

Regardless things like periodic restarts and knowing the panic combination for rebooting into bfu are important.

Neither here nor there in the context of a reply to a self professed cry for help comment.

Of course neither you nor I nor the combination of every person either one of us has ever laid eyes on possesses the ability to perform the actions necessary to achieve what you suggest.

Even if what you said were possible it’s neither forward thinking or just, excepting a regressive, retributive conception of justice.

Additional thoughts: deepseek is running a 3x profit on their gpu/hours so there is no salvation in a bubble pop (we’re not getting that, the whole us economy is built on ai now so when things go south it’s gonna be commercial and residential real estate and energy conditions that counteract the effects of a pop and lead to much more controlled deflation instead) because it’s already worth it and economically sustainable to develop at deepseek capacity and prices, which if you have not tried it is a fucking hoot.

So anyone telling you to hold on and wait for the pop doesn’t know what they’re talking about.

It was a meme a few years ago but look into public sector work and old obsolete languages. If you have t got a pass through llc and tax id you can use to pick up contracts then get on that. It’s like ~$200 a year and makes you safer and able to mass apply for contracts.

Do not keep trying to do everything by hand. Learn to use some kind of harness in your dev environment. You probably got trained on vscode with its tab completion. That’s ai. You’re already using it.

If it makes you feel better they were selling you a bill of goods from the jump. Programming hasn’t been a stable or good career for ten years and the writing was on the wall twenty years ago. The fix was in when “learn to code” became commonplace.

The prevalence of the h1b program would have made your course of study a dead end in a few years even without llms.

Get an electricians certification and be a lineman. There will always be construction and storms. We’re building new houses so shitty that it’s guaranteed and there isn’t a weather control gun yet (even if there was, no one would use it to protect the people who live in tornado alleys or floodplains). You can’t get into that job in middle age so start young and avoid the temptation to buy a duramax, it’s how 20 year olds making 150k get fucked over. When everyone gives you shit for not having a truck, buy that old 6.0 and have a good mechanic fix it up.

If you really need the validation of typing instructions to a computer, go into embedded systems. Everyone will make fun of you because they’re twice your age but it’s a job. Those controllers aren’t going away because it’s a multi ten to hundred million dollar contract to replace them and it’s a few tens of thousands of couple hundred thousand to update them.

Stay in white collar work if you ever plan to get into it again. There’s a one way check valve on that so the moment you drive a truck you’re never getting hired for any entry level office position again no matter your qualifications. You can move back into office work at the management level though. The move is to make management on a work crew and then move back into an office.

Consider joining the brain drain. There’s lots of foreign companies happy to suck up discounted domestic talent.

Your work isn’t your identity no matter the job.

Being flexable in the coming years will mean having a savings you can fall back on and pumping it back up after you do. Learn how to set a budget and how to stick to it.

Your modlog is public. Scroll to the bottom, click modlog and search your name. Removed posts are listed there with the reasons for removal. 12 now days ago your post about YouTube was removed from the lemmy.world asklemmy community because its title didn’t have a question mark.

I am not able to successfully link removed posts but I can look through your comment log by clicking on your name and scrolling down.

Nothing I’m saying is imagined or hidden. In my comment you replied to I said all the same things.

This is not an attack. I am explaining to you why the things you brought up are happening because you erroneously believe changing servers would change the situation.

Consider changing your behavior to avoid this problem in the future.

You might be looking at the wrong thing. The problem isn’t likely to be the medium over that time period, it’s much more likely to be the perception of the value and use of the thing.

I have 100+ year old records, furniture, art, electronics, documents etc. a few were built to last but most are normal consumer grade stuff from times before.

They are still kicking around not because of their uniquely good quality or archival construction but because someone before me thought to keep ahold of them.

So you probably have three new problems to solve: how to get your message on something that people won’t just throw out, how to get it on as much stuff as possible to minimize the changes it’ll be thrown out and what format will actually be recognized as an indicator of something worth investigating as opposed to just another dead link to a Chinese user manual.

As a daily user of both graphene and ios I’m interested to see evidence of a backdoor in ios.

Not what I asked but let’s explore this:

No thank you, I will instead use every tool at my disposal to get a job I want. If a software package can more reliably alleviate the brain farts and social discomfort associated with zoom meetings I’ll use it over taping a list of reminders or a mind map to the edge of my monitor any day.

The point of a tool like this is the non-technical part of the interview process.

It’s not a problem that it only applies to that component.

That’s like saying the problem with a Phillips head screwdriver is that it doesn’t turn torx head bolts. Of course it doesn’t. It’s not meant to do that.

My Phillips driver isn’t deficient because it can’t remove the torx bolts that hold my nvme tray to the frame of my laptop, its job is to get me past the Phillips head screws securing the bottom cover in place so I can access those Torx bolts with the correct tool.

How should a person implement a stt prompter for use in remote interviews without using llms?

I’m genuinely interested in hearing the alternative.