HackerTrans
TopNewTrendsCommentsPastAskShowJobs

nervuri

no profile record

Submissions

Show HN: TLS client configuration test (TLS Client Hello Mirror)

tlsprivacy.nervuri.net
1 points·by nervuri·3 anni fa·0 comments

An analysis of the /e/OS app installer

nervuri.net
1 points·by nervuri·5 anni fa·0 comments

comments

nervuri
·3 anni fa·discuss
> It also seems like this type of obfusction probably never was particularlly effective.

It actually is effective - at least it was a few years ago. See these tests:

https://www.johnplummer.com/javascript/email-obfuscation-wor...

https://web.archive.org/web/20160304042853/http://techblog.t...
nervuri
·4 anni fa·discuss
Also 061C, E0001, E0020...E007F. And probably others, yes. The list at https://invisible-characters.com/ might contain more.

> Unicode is a deep dark forest.

Oh, indeed.
nervuri
·4 anni fa·discuss
Zero-width characters can be used to covertly watermark text and to figure out who copied text from a page and pasted it somewhere else. Server software can encode a hidden number between every few words, which corresponds to a server log entry with your username (if logged in), IP address, browser fingerprint, etc. I wrote more about this here:

https://nervuri.net/stega

I think the best solution to this type of problem would be a clipboard utility that warns you when you copy text which contains hidden characters, homoglyps, rarely used whitespace characters, etc.
nervuri
·4 anni fa·discuss
Vim does not display them all. The only program I checked which displays all such characters is `less -U`. You can test using this file:

https://gitlab.com/nervuri/nervuri.net/-/raw/master/gopher/z...
nervuri
·4 anni fa·discuss
You can disable all phoning home. Have a look at https://support.mozilla.org/en-US/kb/how-stop-firefox-making...

Having a single setting that does all of this would indeed be nice.
nervuri
·4 anni fa·discuss
The ECASH act is so far my favorite initiative for private online payments. A government-issued open-source anonymous digital dollar, functional both online and offline, no blockchain involved, no transaction fees. I hope they can make it work technically. And I hope Americans support this. It would also pave the way for other countries.

Official site: https://ecashact.us/

Rohan Grey explaining the ECASH act: https://www.youtube.com/watch?v=BStXZH5PX1I

It would also be great for GNU Taler to take off.
nervuri
·4 anni fa·discuss
The ability to make large anonymous digital transactions do make corruption and tax evasion easier to get away with. As for sanctions, I imagine they can mostly be enforced by looking at the flow of goods. The money transfers can't be traced, but the weapon shipments can be.
nervuri
·5 anni fa·discuss
> - With the exception of e/OS, all of the handset manufacturers examined collect a list of all the apps installed on a handset.

/e/OS is no exception. I looked at the requests made by its "Apps" app. Every time it checks for updates, it tells the server what applications you have installed. These requests are made with a User-Agent header revealing your device model, build ID and Android version. Installed languages are also sent via the Accept-Language header. And there is no option to disable update checks; the closest you can get is to set the interval to monthly.

Contrast that with F-Droid, which downloads the package index in advance (like apt does), so it doesn't need to send the server a list of installed apps in order to check for updates.
nervuri
·5 anni fa·discuss
Advertising is pollution for the environment in which our minds breathe. While it may not be possible to ban completely, the idea is worth exploring and pushing towards.

Maybe relegate ads to a small number of dedicated spaces, like product catalogues and trade expos, where people can look at offers when they wish, rather than wade through hundreds of attacks on their rationality every single day.

That being said, banning surveillance-based advertising is by far the highest priority, and perhaps the lowest-hanging fruit.

PS: Check out Adblock Bristol [1] and the broader Adfree Cities movement [2].

[1] https://adfreecities.org.uk/bristol/ [2] https://adfreecities.org.uk/
nervuri
·5 anni fa·discuss
Bombadillo: a non-web browser - https://news.ycombinator.com/item?id=25223184 - Nov 2020 (50 comments)