a bit of context:

• I Still Know What You Visited Last Summer

• https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_selectors/Privacy_and_the_visited_selector

• https://www.theregister.com/2025/04/07/chrome_135_history_sniffing/

When it’s libre software, we’re not banned from fixing it.

Signal is a company and a network service and a protocol and some libre software.

Anyone can modify the client software (though you can’t actually distribute modified versions via Apple’s iOS App Store, for reasons explained below) but if a 3rd party actually “fixed” the problems I’ve been talking about here then it really wouldn’t make any sense to call that Signal anymore because it would be a different (and incompatible) protocol.

Only Signal (the company) can approve of changes to Signal (the protocol and service).

Downvoted as you let them bait you. Escaping WhatsApp and Discord, anti-libre software, is more important.

I don’t know what you mean by “bait” here, but…

Escaping to a phone-number-requiring, centralized-on-Amazon, closed-source-server-having, marketed-to-activists, built-with-funding-from-Radio-Free-Asia (for the specific purpose of being used by people opposing governments which the US considers adversaries) service which makes downright dishonest claims of having a cryptographically-ensured inability to collect metadata? No thanks.

(fuck whatsapp and discord too, of course.)

it’s being answered in the github thread you linked

The answers there are only about the fact that it can be turned off and that by default clients will silently fall back to “unsealed sender”.

That does not say anything about the question of what attacks it is actually meant to prevent (assuming a user does “enable sealed sender indicators”).

This can be separated into two different questions:

1. For an adversary who does not control the server, does sealed sender prevent any attacks? (which?)
2. For an adversary who does control the server, how does sealed sender prevent that adversary from identifying the sender (via the fact that they must identify themselves to receive messages, and do so from the same IP address)?

The strongest possibly-true statement i can imagine about sealed sender’s utility is something like this:

For users who enable sealed sender indicators AND who are connecting to the internet from the same IP address as some other Signal users, from the perspective of an an adversary who controls the server, sealed sender increases the size of the set of possible senders for a given message from one to the number of other Signal users who were online from behind the same NAT gateway at the time the message was sent.

This is a vastly weaker claim than saying that “by design” Signal has no possibility of collecting any information at all besides the famous “date of registration and last time user was seen online” which Signal proponents often tout.

False.

edit: it’s funny how people downvoting comments about signal’s sealed sender being a farce never even attempt to explain what its threat model is supposed to be. (meaning: what attacks, with which adversary capabilities specifically, is it designed to prevent?)

You can configure one or more of your profiles’ addresses to be a “business address” which means that when people contact you via it it will always create a new group automatically. Then you can (optionally, on a per-contact basis) add your other devices’ profiles to it (as can your contact with their other devices, after you make them an admin of the group).

It’s not the most obvious/intuitive system but it works well and imo this paradigm is actually better than most systems’ multi-device support in that you can see which device someone is sending from and you can choose to give different contacts access to a different subset of your devices than others.

You can just make a group for each contact with all of your (and their) devices in it.

this is a good meme

deleted by creator

it’s among the many OSes you can run in an emulator in your web browser at https://copy.sh/v86/

The network never went down.

You say that but, everything I ever posted on identica (and also on Evan’s later OStatus site Status.Net, which i was a paying customer of) went 404 just a few years later. 😢

When StatusNet shut down I was offered a MySQL dump, which is better than nothing for personal archival but not actually useful for setting up a new instance due to OStatus having DNS-based identity and lacking any concept for migrating to a new domain.

https://identi.ca/evan/note/6EZ4Jzp5RQaUsx5QzJtL4A notes that Evan’s own first post is “still visible on Identi.ca today, although the URL format changed a few years ago, and the redirect plugin stopped working a few years after that.” … but for whatever reason he decided that most accounts (those inactive over a year, iiuc, which I was because I had moved to using StatusNet instead of identica) weren’t worthy of migrating to his new pump.io architecture at all.

Here is some reporting about it from 2013: https://lwn.net/Articles/544347/

As an added bonus, to the extent that I can find some of my posts on archive.org, links in them were all automatically replaced (it was the style at the time) with redirects via Evan’s URL shortening service ur1.ca which is also now long-dead.

imo the deletion of most of the content in the proto-fediverse (PubSubHubbubiverse? 😂) was an enormous loss; I and many other people had years of great discussions on these sites which I wish we could revisit today.

🪦

The fact that ActivityPub now is still a thing where people must (be a sysadmin or) pick someone else’s domain to marry their online identity to is even more sad. ActivityPub desperately needs to become content addressable and decouple identity from other responsibilities. This experiment (which i learned of via this post) from six years ago seemed like a huge step in the right direction, but I don’t know if anyone is really working on solving these problems currently. 😢

Lmao that my pedanticism could be perceived as BSD advocacy - fwiw, I primarily use GNU/Linux, I develop GPL-licensed software, and I think GPLv3 or AGPLv3 are good choices for many new projects starting today.

My opinions about the history and future of copyleft are somewhat complicated but I didn’t mention any opinions in the comment you’re replying to - I was just correcting your factual misunderstandings about the accepted definitions of these terms.

sometimes a footprint represents humanity

sometimes, but in GNOME’s case i think it is not intended to be a human foot but rather the foot of a mythological creature (a gnome). note that it has a squashed aspect ratio compared to a human foot, and also has only four toes.

apparently it’s also problematic in some cultures: https://wiki.gnome.org/Engagement/FootAndCulturalIssue

Is this a spam campaign?

Five of the eleven comments so far (including one from OP) are all recommending the same service; all five are from accounts less than 2 months old with a one or two digit number of comments 🤔

Why memorize a different command? I assume sudoedit just looks up the system’s EDITOR environment variable and uses that. Is there any other benefit?

I don’t use it, but, sudoedit is a little more complicated than that.

When invoked as sudoedit, the -e option (described below), is implied.

       -e, --edit
               Edit one or more files instead of running a command.   In  lieu
               of  a  path name, the string "sudoedit" is used when consulting
               the security policy.  If the user is authorized by the  policy,
               the following steps are taken:

               1.   Temporary  copies  are made of the files to be edited with
                    the owner set to the invoking user.

               2.   The editor specified by the policy is run to edit the tem‐
                    porary files.  The sudoers policy  uses  the  SUDO_EDITOR,
                    VISUAL  and  EDITOR environment variables (in that order).
                    If none of SUDO_EDITOR, VISUAL  or  EDITOR  are  set,  the
                    first  program  listed  in the editor sudoers(5) option is
                    used.

               3.   If they have been modified, the temporary files are copied
                    back to their original location and the temporary versions
                    are removed.

               To help prevent the editing of unauthorized files, the  follow‐
               ing  restrictions are enforced unless explicitly allowed by the
               security policy:

                •  Symbolic links  may  not  be  edited  (version  1.8.15  and
                   higher).

                •  Symbolic links along the path to be edited are not followed
                   when  the parent directory is writable by the invoking user
                   unless that user is root (version 1.8.16 and higher).

                •  Files located in a directory that is writable by the invok‐
                   ing user may not be edited unless that user is  root  (ver‐
                   sion 1.8.16 and higher).

               Users are never allowed to edit device special files.

               If  the specified file does not exist, it will be created.  Un‐
               like most commands run by sudo, the editor is run with the  in‐
               voking  user's  environment  unmodified.  If the temporary file
               becomes empty after editing, the user will be  prompted  before
               it is installed.  If, for some reason, sudo is unable to update
               a file with its edited version, the user will receive a warning
               and the edited copy will remain in a temporary file.

tldr: it makes a copy of the file-to-be-edited in a temp directory, owned by you, and then runs your $EDITOR as your normal user (so, with your normal editor config)

note that sudo also includes a similar command which is specifically for editing /etc/sudoers, called visudo 🤪

The primary purpose of those buttons is of course to let those sites track everyone’s browsing activity across every site that uses them, which does not require that anyone ever click on them.

Even if less than 0.0001% of people click them, anyone with an SEO/spammer “grindset” will assure site operators that the potential benefit of someone sharing a link they otherwise wouldn’t have is still at least theoretically non-zero. And, since there is absolutely no cost at all besides an acceptable number of extra milliseconds per pageload, really, it would be downright irresponsible not to have them there!

By “solar power in operation” (in GW) i think they mean maximum output capacity rather than actual production, since these numbers add up to 923 GW while wikipedia says in 2024 there was 2.13 petawatt-hours (243 GW on average) actually produced by solar.

These articles were stolen, by the paywall operators. Elbakyan rescued them from the thieves. 🎉

what do you mean you haven’t installed it yet, just curl | sudo bash what’s your problem

encryption would prevent the modem from seeing it when someone sends it, but such a short string will inevitably appear once in a while in ciphertext too. so, it would actually make it disconnect at random times instead :)

(edit: actually at seven bytes i guess it would only occur once in every 72PB on average…)