freedomPusher

joined 3 years ago
MODERATOR OF
[–] freedomPusher@sopuli.xyz -1 points 6 months ago* (last edited 6 months ago) (1 children)

That is 100% what im saying, yes.

Okay, so AFAICT you’ve not said anything that prevents individual users from using an onion FROM address, so long as the sending server is authorized via all the shitty spf, dkim, dmarc, dane hoops. This is what I’m after. In fact, I’m even less demanding. I don’t care if a service provider doesn’t bother with dkim and gets rejected by some servers. Email is in such a broken state anyway.. I just need the option to set the FROM field to an onion address. The reason my own server is insufficient is the residential IP is very widely rejected.

[–] freedomPusher@sopuli.xyz -1 points 6 months ago

I’m not surprised. Google took an anti-RFC posture when they broke email and brought in their own rules under the guise of anti-spam (the real reason is domination). The whole point of RFCs existence is interoperability. That was broken when servers reject RFC-compliant messages.

I’m not interested in bending over backwards to accommodate. Satisfying Google’s dkim reqs requires the server admin to solve a CAPTCHA. That’s a line I personally will not cross. So at the moment I simply do not email gmail users (or MS Outlook users, same problem).

[–] freedomPusher@sopuli.xyz -1 points 6 months ago (5 children)

The server is checking that the EHLO domain matches that of the IP of the sending server. Whatever is in the FROM: field is entirely irrelevant to that. The RFC even allows multiple email addresses in the FROM field. It’s rarely practiced, but it’s compliant. So if you have FROM: bob@abc.com, bob@xyz.onion, bob@xyz.org, are you saying the receiving server would expect the domain of all FROM addresses to match that of the sending server? What happens when a sender has a gmail account but uses a vanity address? Instead of bob@gmail.com, he has bobswidgets@expertcorp.com. Are you saying expertcorp.com ≠ gmail.com, so the receiving server will reject it? I think not. Google offers the ability of their users to use an external address last time I checked.

[–] freedomPusher@sopuli.xyz 0 points 6 months ago* (last edited 6 months ago) (2 children)

If you monitor IRC channels on email servers, you’ll find there are plenty of email admins unwilling to even go through the dkim and dmarc hoops. An fqdn check not on the sending server but on the FROM field of a msg is over-zealously above and beyond dkim and dmarc. I’m quite fine with not reaching these fringe servers. I can always decide from the bounce msg whether it’s worth my effort to dignify their excessive hoops with a transmission to their persnickety liking.

[–] freedomPusher@sopuli.xyz -1 points 6 months ago (7 children)

How do you expect to receive replies from clearnet users, or are you okay not receiving replies?

Indeed that’s the idea. If you’ve ever received a message where the sender’s address is “noreply@corp.xyz”, it’s similar. But in fact the onion address is slightly more useful than a “noreply” address because the responder would at least have the option of registering with an onion-capable email server to reply.

Imagine you want to email a gmail user. You can ensure that the message contains nothing you don’t mind sharing with a surveillance advertiser, but you cannot generally control what gets shared in the response. An onion address ensures that replies will be outside of Google’s walled garden, for example. That’s just one of several use cases.

Also most mail hosts these days toss emails that dont match dmarc/dkim/spf, which would be especially hard to do for an onion email

Those are server to server authentication protocols, not something that validates the functionality of a sender’s disclosed email address. Otherwise how would a bank send an announcement from a “noreply” address?

[–] freedomPusher@sopuli.xyz 2 points 6 months ago* (last edited 6 months ago) (2 children)

Do you know who does care? The email server you’re sending messages to, because spammers and scammers love to try and send email with fake from addresses.

The receiving servers do not generally care what’s in the FROM field. They care that the sending server they are connected to is authorized and has their SPF, DKIM, and DMARC shit together. It’s not for the receiving server to control the email aliases of individual senders. Some rare over-zealous servers will look at the FROM field and expect the domain to match but if I encounter that, the collateral damage is what it is. I can always still decide from there whether it’s worthwhile to go through extra hoops.

[–] freedomPusher@sopuli.xyz 1 points 6 months ago* (last edited 6 months ago)

People are pushovers and tend not to give a shit about banks excessively following the know-your-customer protocol well beyond what the law even requires. So why not mirror that success in the telecom domain? Followed by grocery stores and car mechanics next…

[–] freedomPusher@sopuli.xyz 1 points 6 months ago* (last edited 6 months ago)

Are you wanting to have a .onion TLD email address,

Yes, and that much exists. There are onion email providers, but when you email a clearnet recipient, they typically convert your onion email address to a clearnet address. That’s useful in most situations but there are also several use cases for not doing the conversion. But finding a service that accommodates the other use cases is hard, considering onion email is rare in itself.

and be able to communicate with non-TOR web servers?

No, nothing to do with the web. Just email.

The host needs to be able to look up addresses, and resolve them to a location.

Only for replies. But not all messages need a reply. See my other msg.

It would require having clearnet servers also connected to the TOR network which I would imagine is incredibly unlikely.

Those exist already (danwin, riseup, onionmail, etc). But they operate on the assumption that senders always want replies from the recipient to be possible via their receiving server. That’s not always desirable.

In the same way you can browse non onion sites through TOR but not the other way around,

There is a service that enables clearnet users to reach onion services (onion.to, onion.cat, etc), but this is unrelated. Web is unrelated.

you would likely be able to send email but not receive them

Bingo. That’s the point in some of the use cases.

[–] freedomPusher@sopuli.xyz 1 points 6 months ago

Delete hosted cloud. Move back to hosting your own.

How does that address the problem or promote privacy? Self-hosting makes it even more trivially easy to identify you. E.g. if I run my own Lemmy server, it would transact on an IP address that points to me. By anonymously creating an acct sopuli.xyz and using Tor, doxxing becomes harder.

[–] freedomPusher@sopuli.xyz 0 points 6 months ago* (last edited 6 months ago) (4 children)

Not really an option

Sure it is. I can theoretically¹ do it myself with my mail server. If you use a mail client like (neo)mutt, you can literally free type whatever you want to put in the FROM field. IIRC, this contradicts no RFCs so long as there is a syntactically valid email address.

Ever get an email with a bogus address like “noreply@corporation.xyz”? It’s essentially the same. Not all e-mail addresses in the FROM field go to valid inboxes -- nor are they required to.

footnote 1The reason I say “theoretically” is that some exceptional SMTP servers check that the domain portion of the FROM email passes an MX lookup or that the DNS lookup matches the sending server. It’s a rare configuration. I have no domain name so my mail server always sends msgs with a “spoofed” email address (which is often valid but not related to my IP). I also write in completely bogus email addresses in some cases where no reply is needed. Very few servers reject on that basis. The other complication is that many mail services disallow outbound messages with a different address than what they assigned to a user.

since the onion TLD isn’t accessible to clearnet servers. How are email servers supposed to reach out the onion domain name and mail server if they can’t resolve it?

You’re talking about using the FROM address for replying purposes. The point of having this option is to make replies very difficult, but still possible.

Mail servers can be configured to handle onion addresses. I’ve configured postfix to do that. But indeed most servers are not configured to handle onions, which any users who make use of the feature would need to be aware of. It’s a useful scenario because it can be used to force recipients out of Google’s and Microsoft’s walled gardens, and give them incentive to join the free world away from surveillance advertisers, for example. They must join an onion-capable email service if they want to reply.

[–] freedomPusher@sopuli.xyz 1 points 6 months ago* (last edited 6 months ago)

Law is driven by philosophy. When discussing high-level laws at the constitutional level and above (international/human rights), “law” loses effectiveness as such and becomes more of a philosophical guide. It’s not concrete when specific scenarios are not pinned down, and rarely enforced as a consequence. There is an abstract human right that we have freedom of religion, but national law can often contradict human rights.

There are no Amish communities in Europe (and AFAIk, no notable religions that oppose the digital transformation). So there would be not likely be national law that protects them. The question is hypothetical. Answering it requires understanding the meaning, purpose, and history of the freedom of religion, which itself would never be elaborated in law. The law is clean, hard and fast, without history and usually without rationale.

It’s an inherently philosophical question but with legal interplay. So it’s a 10,000 foot view question of how freedom of religion gets implemented in Europe. The philosophy cannot be neglected because it’s the driver.

Namely: Does Belgium law require agencies and companies to provide offline interfaces if a religion requires not using digital services/technology.

I would guess unlikely because there are no such religions in Belgium, AFAIK. The Amish would be in for a struggle. They would have to bring a complaint to court about digital transformation excluding them with no concrete law covering them, and try to cling to that rarely enforced body of human rights law. They might prevail in a high court, but what about someone who is not Amish, but who has the same moral objections? The Amish are Christians who morally object to lots of technology but strictly speaking the anti-tech is not really driven by Christianity. It’s more of a culture that is fused with their religion, which enables them to benefit from religious protections despite Christianity not being the driver. So a non-religious person who finds the forced use technology to be as unconscionable as an Amish practicioner would be equally oppressed, but would a court recognize this? Probably not, but if Amish were to arrive, then the question is would the law be written specifically to protect the Amish or would it be generalized enough that non-religious people would benefit? It’s all a question/prediction based on philosophy, psychology, law, and history.

[–] freedomPusher@sopuli.xyz 1 points 6 months ago

StreetComplete shows me no map, just quests on a blank canvas. OSMand shows my offline maps just fine, but apparently StreetComplete has no way to reach the offline maps. I suppose that’s down to Android security -- each app has it’s own storage space secure from other apps.

In principle, we should be able to put the maps on shared SD card space and both apps should access it. But StreetComplete gives no way in the settings of specifying the map location. And apparently it fails to fetch an extra copy of the maps as well in my case.

 

The flagship instance for Matrix demonstrates the use of Cloudflare, which was found to be necessary to defend against DoS attacks. This CaaC (Cloudflare-as-a-Crutch) design has many pitfalls & problems, including but not limited to:

  • digital exclusion (Cloudflare is a walled garden that excludes some groups of people)
  • supports a privacy hostile tech giant
  • adds to growth and dominance of an oppressive force
  • exposes metadata to a privacy offender without the knowledge and consent of participants
  • reflects negatively on the competence, integrity, and digital rights values of Matrix creators
  • creates a needless dependency on a tech giant

#CaaC needs to be replaced with a #securityByDesign approach. Countermeasures need to be baked into the system, not bolted on. The protocol should support mechanisms such as:

  • rate limiting/tar pitting
  • proof-of-work with variable levels of work and a prioritization of traffic that’s proportional to the level of work, which can be enabled on demand and generally upon crossing a load threshold.
  • security cookie tokens to prioritize traffic of trusted participants

Sadly, #Matrix is aligned with another nefarious tech giant, and has jailed its project in Microsoft Github. And worse, they have a complex process for filing bugs/enhancements against the spec:

https://github.com/matrix-org/matrix-spec-proposals/blob/main/README.md

Hence why this bug report is posted here.

 

cross-posted from: https://sopuli.xyz/post/8702045

(⚠ Enshitification warning: The linked article has a cookie wall; just click “reject” and the article appears)

Google is ending the public access to the cache of sites it indexes. AFAICT, these are the consequences:

  • People getting different treatment due to their geographic location will lose the cache they used as a remedy for access inclusion.
  • People getting different treatment due to having a defensive browser will lose access.
  • The 12ft.io service which serves those who suffer access inequality will be rendered useless.
  • Google will continue to include paywalls in search results, but now consumers of Google search results will be led to a dead-end.
  • The #InternetArchive #WaybackMachine will take on the full burden of global archival.
  • Consumers will lose a very useful tool for circumventing web enshitification.

Websites treat the Google crawler like a 1st class citizen. Paywalls give Google unpaid junk-free access. Then Google search results direct people to a website that treats humans differently (worse). So Google users are led to sites they cannot access. The heart of the problem is access inequality. Google effectively serves to refer people to sites that are not publicly accessible.

I do not want to see search results I cannot access. Google cache was the equalizer that neutralizes that problem. Now that problem is back in our face.

(cross-posting to privacy forums because cache access enables privacy seekers to reach content that otherwise requires them to step outside of Tor)

1
submitted 9 months ago* (last edited 9 months ago) by freedomPusher@sopuli.xyz to c/netneutrality@sopuli.xyz
 

(⚠ Enshitification warning: The linked article has a cookie wall; just click “reject” and the article appears)

Google is ending the public access to the cache of sites it indexes. AFAICT, these are the consequences:

  • People getting different treatment due to their geographic location will lose the cache they used as a remedy for access inclusion.
  • People getting different treatment due to having a defensive browser will lose access.
  • The 12ft.io service which serves those who suffer access inequality will be rendered useless.
  • Google will continue to include paywalls in search results, but now consumers of Google search results will be led to a dead-end.
  • The #InternetArchive #WaybackMachine will take on the full burden of global archival.
  • Consumers will lose a very useful tool for circumventing web enshitification.

Websites treat the Google crawler like a 1st class citizen. Paywalls give Google unpaid junk-free access. Then Google search results direct people to a website that treats humans differently (worse). So Google users are led to sites they cannot access. The heart of the problem is access inequality. Google effectively serves to refer people to sites that are not publicly accessible.

I do not want to see search results I cannot access. Google cache was the equalizer that neutralizes that problem. Now that problem is back in our face.

 

cross-posted from: https://sopuli.xyz/post/8557194

This is a FOSS tool that enables people to check a website for #GDPR compliance.

 

This is a FOSS tool that enables people to check a website for #GDPR compliance.

 

cross-posted from: https://sopuli.xyz/post/8481789

#poll

1
submitted 9 months ago* (last edited 9 months ago) by freedomPusher@sopuli.xyz to c/gdpr@sopuli.xyz
 

#poll

 

Every 4 years the Commission is willing to hear from individuals as to whether the GDPR is working. It’s obviously not working one bit for those of us who actually attempt to exercise our #GDPR rights.

That link goes to a PDF which contains a link to another PDF which is a questionaire that can be emailed to the Commission. The email address they give is not on a Google or MS server, thus apparently usable.

Note that the questionaire mentions a deadline of 18 November 2023, but that was for feedback from select groups. The deadline for the general public is 8 Feb.

 

cross-posted from: https://sopuli.xyz/post/7625705

According to the linked article, 72 studies suggest that wi-fi radiation harms/kills #bees -- and by some claims is a threat to their continued existence. I suppose if extinction were really a likely risk there would be widespread outrage and bee conservationists taking actions. It seems there is a lack of chatter about this. This thread also somewhat implies disinterest in even having wi-fi alternatives.

In any case, does anyone think this is a battle worth fighting? Some possible off-the-cuff actions that come to mind:

  • ban the sale of wi-fi devices bigger than a phone in Europe¹ if they do not also comply with these conditions:
    • include an ethernet port as well. So e.g. macbooks would either have to bring back the ethernet port or nix wi-fi (and obviously Apple wouldn’t nix Wi-Fi).
    • have a physical wi-fi toggle switch on the chassis (like Thinkpads have)
  • force public libraries with Wi-Fi to give an ethernet port option so library users at least have the option of turning off their own wi-fi emissions.
  • ban the sale of Wi-Fi APs that do not have:
    • a configurable variable power setting that is easily tunable by the user; maybe even require a knob or slider on the chassis.
    • bluetooth that is internet-capable
  • force phones that include wi-fi to also include bluetooth as well as the programming to use bluetooth for internet. Bluetooth routers have existed for over a decade but they are quite rare.. cannot be found in a common electronics shop.

Regarding bluetooth, it is much slower than wi-fi, lower range, and probably harder to secure. But nonetheless people should have this option for situations where they don’t need wi-fi capability. E.g. when a phone is just sitting idle it could turn off wi-fi and listen over bluetooth for notifications.

I suspect the 1st part of this quote from the article explains the lack of concern:

“The subject is uncomfortable for many of us because it interferes with our daily habits and there are powerful economic interests behind mobile communication technology.”

  1. I say /Europe/ because it’s perhaps the only place where enough people would be concerned and where you also have the greatest chance of passing pro-humanity legislation (no “Citizens United” that human needs have to compete with).
 

cross-posted from: https://sopuli.xyz/post/7625705

According to the linked article, 72 studies suggest that wi-fi radiation harms/kills #bees -- and by some claims is a threat to their continued existence. I suppose if extinction were really a likely risk there would be widespread outrage and bee conservationists taking actions. It seems there is a lack of chatter about this. This thread also somewhat implies disinterest in even having wi-fi alternatives.

In any case, does anyone think this is a battle worth fighting? Some possible off-the-cuff actions that come to mind:

  • ban the sale of wi-fi devices bigger than a phone in Europe¹ if they do not also comply with these conditions:
    • include an ethernet port as well. So e.g. macbooks would either have to bring back the ethernet port or nix wi-fi (and obviously Apple wouldn’t nix Wi-Fi).
    • have a physical wi-fi toggle switch on the chassis (like Thinkpads have)
  • force public libraries with Wi-Fi to give an ethernet port option so library users at least have the option of turning off their own wi-fi emissions.
  • ban the sale of Wi-Fi APs that do not have:
    • a configurable variable power setting that is easily tunable by the user; maybe even require a knob or slider on the chassis.
    • bluetooth that is internet-capable
  • force phones that include wi-fi to also include bluetooth as well as the programming to use bluetooth for internet. Bluetooth routers have existed for over a decade but they are quite rare.. cannot be found in a common electronics shop.

Regarding bluetooth, it is much slower than wi-fi, lower range, and probably harder to secure. But nonetheless people should have this option for situations where they don’t need wi-fi capability. E.g. when a phone is just sitting idle it could turn off wi-fi and listen over bluetooth for notifications.

I suspect the 1st part of this quote from the article explains the lack of concern:

“The subject is uncomfortable for many of us because it interferes with our daily habits and there are powerful economic interests behind mobile communication technology.”

  1. I say /Europe/ because it’s perhaps the only place where enough people would be concerned and where you also have the greatest chance of passing pro-humanity legislation (no “Citizens United” that human needs have to compete with).
 

According to the linked article, 72 studies suggest that wi-fi radiation harms/kills #bees -- and by some claims is a threat to their continued existence. I suppose if extinction were really a likely risk there would be widespread outrage and bee conservationists taking actions. It seems there is a lack of chatter about this. This thread also somewhat implies disinterest in even having wi-fi alternatives.

In any case, does anyone think this is a battle worth fighting? Some possible off-the-cuff actions that come to mind:

  • ban the sale of wi-fi devices bigger than a phone in Europe¹ if they do not also comply with these conditions:
    • include an ethernet port as well. So e.g. macbooks would either have to bring back the ethernet port or nix wi-fi (and obviously Apple wouldn’t nix Wi-Fi).
    • have a physical wi-fi toggle switch on the chassis (like Thinkpads have)
  • force public libraries with Wi-Fi to give an ethernet port option so library users at least have the option of turning off their own wi-fi emissions.
  • ban the sale of Wi-Fi APs that do not have:
    • a configurable variable power setting that is easily tunable by the user; maybe even require a knob or slider on the chassis.
    • bluetooth that is internet-capable
  • force phones that include wi-fi to also include bluetooth as well as the programming to use bluetooth for internet. Bluetooth routers have existed for over a decade but they are quite rare.. cannot be found in a common electronics shop.

Regarding bluetooth, it is much slower than wi-fi, lower range, and probably harder to secure. But nonetheless people should have this option for situations where they don’t need wi-fi capability. E.g. when a phone is just sitting idle it could turn off wi-fi and listen over bluetooth for notifications.

I suspect the 1st part of this quote from the article explains the lack of concern:

“The subject is uncomfortable for many of us because it interferes with our daily habits and there are powerful economic interests behind mobile communication technology.”

  1. I say /Europe/ because it’s perhaps the only place where enough people would be concerned and where you also have the greatest chance of passing pro-humanity legislation (no “Citizens United” that human needs have to compete with).
view more: ‹ prev next ›