_jomo

I made https://fahrplan.cc where you can filter the [not] recorded sessions, categories, and titles.

I've mostly made it for myself to skip the recorded sessions when on-site and to see what's coming up at the current time of day. It therefore tries to include all the self organized sessions, workshops, meetups, music programs, etc. I've been running it for a few years and people use it for all kinds of use cases, including sitting at home and watching the streams.

This seems to affect users from the EU, but not from the US.

> reproducible build available at F-Droid

It's not available at F-Droid. They have an F-Droid compatible repository that you can manually add to your F-Droid client where they ship binaries.

I also can't find any mention of reproducible builds on their website, and their builts seem to include proprietary binaries.

The issue [0] to publish the app on F-Droid is still open.

0: https://github.com/oxen-io/session-android/issues/73

Any service that claims to be "free" and doesn't have a very obvious business model gets me very suspicious. I usually start reading the service's privacy policy.

This website's "Privacy Policy" states:

> We collect [personal information] by fair and lawful means, with your knowledge and consent. We also let you know why we’re collecting it and how it will be used.

Yet personal data is collected through Google Analytics without being mentioned anywhere and without my consent. The policy is also the linked privacy policy for the Android and iOS app. It doesn't let the reader know why personal information is collected and how it's used, as it claims. Is that different in the actual apps? Also, what data does the website and the app collect?

This is a "feature", not a bug. Twitter keeps asking for phone numbers all the time and then suggests you also allow others to discover your account via phone number.

So this guy merely enumerated a lot of phone numbers and found accounts of users who agreed to have their phone number publicly match their account.

I'd like to point out that GDPR compliant sites don't need to ask permission for strictly necessary cookies.

I also recommend using Cookie AutoDelete for Chrome [0] or Firefox [1]. You can define a whitelist of websites where you actually need Cookies (because you want to stay logged in), and the rest will be forgotten when you close the tab. It even allows different rules in Firefox Containers.

0: https://chrome.google.com/webstore/detail/cookie-autodelete/...

1: https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

Also, in my experience address locations on Google Maps are often very inaccurate, so it's not even a good source.

I keep wondering why people who seemingly care about their privacy continue to use Google products/services, doing all their online activity while logged in to their Google account.

Useful website, but years out of date and unmaintained.

The actively maintained community fork can be found at https://justdeleteme.xyz.

Repo: https://github.com/jdm-contrib/jdm

Please don't rely on the Referer being present (ever). It's an optional header to send in a request and you can configure your browser — at least Firefox — to not send it for privacy reasons.

Logout (or anything else that triggers changes of any kind) shouldn't be a GET request.

Comcast has even published an informational RFC describing how to inject crap into HTTP requests:

https://tools.ietf.org/html/rfc6108

I think most VPNs use NAT, so many users share the same IP address. Otherwise the VPN would be mostly pointless.

You seem to ignore that this constrains abusers as much as it does legitimate users. Collective punishment in order to mitigate abuse by a few is the wrong way to go.

They have been doing this for any account registered from a VPN or Tor. However, you can simply appeal the block and tell them you haven't tweeted and not broken any rules.

They will send you an automated mail, offering to validate your phone number, or reply to the mail if your problem is not solved. Just reply to the mail.

Unfortunately, processing the request takes anywhere between 10 minutes and 2 weeks; usually a couple days at least. I assume this is on purpose to make it cumbersome for spammers.

They always reply with the same boilerplate, but the account will be unlocked:

  Your account is now unlocked, and we’re sorry for the inconvenience.
   
  Twitter has automated systems that find and remove automated spam accounts and it looks like your account got caught up in one of these spam groups by mistake. This sometimes happens when an account exhibits automated behavior in violation of the Twitter Rules (https://twitter.com/rules).

  Again, we apologize for the inconvenience. Please do not respond to this email as replies will not be monitored.

You can get most of this by analyzing server logs with IP addresses. No cookies required. You might need some JavaScript tracking for more detailed analytics, but there is absolutely no need for external tracking by Google or the likes.

Examples for self-hosted analytics include GoAccess (server log analyzer) [0] or Matomo (JavaScript tracking, formerly Piwik) , although I think it uses tracking cookies by default [1]

0: https://github.com/allinurl/goaccess

1: https://matomo.org

I rarely type in duckduckgo.com. I just enter the search keyword into the URL bar and it takes me to DDG.

Containers are a feature built into Firefox. There are extensions that let you use them more generally with any given website. It's also quite useful to log into websites with multiple accounts at the same time.

However, to prevent tracking I mostly use CookieAutoDelete [0] which only stores Cookies for sites that I have whitelisted after the tab is closed. It's really just a handful of sites I visit frequently and don't want to log in every time. Cookies aren't required for anything else.

Also, not having a Google account comes in handy to prevent tracking by Google. My default search engine is DuckDuckGo.

0: https://addons.mozilla.org/de/firefox/addon/cookie-autodelet...

Interesting, but the commit that introduced the malicious changes wouldn't be signed by the alleged author's key.

Also I'd trust anyone who denies adding a backdoor like this. Why would anyone do this with their name attached to the change?

What you'd actually do is change the author to "Anonymous Coward <[email protected]>" ;)

https://android.googlesource.com/platform/packages/apps/Glob...

From RFC8483 [0] "Yeti DNS Testbed", which was published a few hours ago:

> Yeti DNS is an experimental, non-production root server testbed that provides an environment where technical and operational experiments can safely be performed without risk to production root server infrastructure.

In section 5 they publish experience with their IPv6-Only operation.

For example:

> There are reports of a notable packet drop rate due to the mistreatment of middleboxes on IPv6 fragments. One APNIC study reported that 37% of endpoints using IPv6-capable DNS resolvers cannot receive a fragmented IPv6 response over UDP.

Or:

> It was observed that Yeti-Root servers running Knot 2.0 would compress the zero-length label (the root domain, often represented as ".") using a pointer to an earlier example. Although legal, this encoding increases the encoded size of the root label from one octet to two; it was also found to break some client software -- in particular, the Go DNS library. Bug reports were filed against both Knot and the Go DNS library, and both were resolved in subsequent releases.

0: https://tools.ietf.org/html/rfc8483