Shamar @Shamar@qoto.org

@fsfe

I wonder how proud he will feel looking at the huge amount of money that #FSFE got from #Google since 2013.

More than 10% of its budget.
But hey! Less than 20%!

🤦‍♂️

https://fsfe.org/donate/thankgnus.en.html

@mala

In the #Thunderbird #privacy notice that nobody is expected to read: https://www.mozilla.org/en-US/privacy/thunderbird/

```
Thunderbird May Disclose Information To:

Amazon Web Services: Thunderbird uses Amazon Web Services (AWS) to host its servers and as a content delivery network. Your device’s IP address is collected as part of AWS’s server logs.
```

I assume they receive and manage the crash reports on "their" servers that accidentally are owned by #Amazon.

@rysiek@mastodon.technology

@jmw150

"Good distros"... these days I wonder if #Debian gives a shit, tbh.

So sad...

@rysiek@mastodon.technology @mala

@b6hydra

No, indeed I surprised myself by being surprised by #Mozilla's bad faith.

I mean: ok, #Firefox is a surveillance tool marketed as a privacy friendly browser, but it's a "just" a browser.

But I was STILL thinking that good old #Thunderbird (that I do not use since decades but still suggested to others) was safe!

It's not.

#Telemetry is not just on by default and all data are received by #Mozilla through #AWS servers.

I really think such kind of defaults should be forbidden by law. And in fact they are forbidden by #GDPR as all data collection must be opt-in not opt-out.

Curiously, crash reports are disabled by default (as far as I can read online) so at least people are less likely to send them cryptographic keys in clear in a memory dump.

But the fun fact is that if you enable crash reports in the hope to let them improve a privacy friendly MUA, you sacrify your security (and your peer's security, exposing them to social engineering) to improve a surveillance software.

Indeed Thurderbird is sending back your interactions activities, so the fact that mails sent without #E2EE can be intercepted, is totally irrelevant.

@rysiek@mastodon.technology @mala

I wonder how I can be surprised to learn that #Mozilla's #Thunderbird collect telemetry infos (including your mail domain) and share them with partners such as #Amazon.

It's obvious they spy on your mails! 🤦‍♂️

Indeed, in case of crash, they even send to "their" #AWS servers a memory dump that contains sensitive data crash reports.

This likely include, your emails in clear, your private encryption keys¹ and everything else the program has loaded and kept in memory.

What does this means for an hypothetical attacker that can access such reports?

I mean... like a #USA agency arguing that you might be a terrorist or something.

Oh but sure... they shall do no evil...

https://www.mozilla.org/en-US/privacy/thunderbird/

#Privacy #Freedom #hypocrisy #Security #infosec
_____

1) Since version 68, Thunderbird does not use the #GPG suite via #Enigmail, but directly do encryption "to avoid licensing issues" 🤷‍♂️

@rysiek@mastodon.technology @mala

@rysiek@mastodon.technology

Does derivative tools like #Seamonkey or #LibreWolf count as #Mozilla tools?

What about #Rust?

@fffitalia

Leggendo l'articolo appare chiaro che avete dei token da vendere prima che il prezzo crolli e cercate dei polli che li acquistino.

Definire "inutili" le criptovalute è come definire "inutili" gli strozzini.

Qualcuno ci fa GRANDI utili.

Certamente inquinano molto, ma anzitutto la #blockchain è una scam-factory su scala globale.

@minimalprocedure@mastodon.uno

```
More interesting in is the "real code" that handles English but it doesn't seem to be available.
```

What do you mean?

The code is available in the zip: "the compiler" + "the noodle" that is a sort of portability layer.

Unfortunately, it's neither free software or opensource...

```
I don't have particularly care about it on any educational or practical level, actually.
```

I find it very through provoking: it's not just a DSL for a specific purpose, it's a turing complete programming language that can be used for anything and is very readable on first sight (to anyone who knows the language).

The problem is that it would be perfect if all we wanted from informatics was to program computers.

But I think we should use programming/debugging like writing/reading, to enhance human communication and thinking ability.

@rysiek@mastodon.technology

It's not that simple.

In the article you liked #OCCRP explains

```
This is normally done through the target’s mobile operator, which some governments can access or control.
```

How many CA are state-run agency? How many CDNs (behind HTTPS) can be subject to similar impositions?

If a state can impose to a mobile operator to track a citizen, why do you think it cannot impose to serve certain DNS records, certain TLS certificate and so on to certain people only?

Also, HTTPS leaks a lot of information about every visitor to the site owner (IP, cookies) and you are assuming the hosting/cloud provider is not malicious, while often it is.
And these leaks apply to everybody, not just to targetted victims.

You just need to control/compromise a single hosting/cloud provider and attract the victim on one of its HTTPS websites to install the same malware without the website owner knowing anything AND without the victim suspecting anything (it's HTTPS, so it's safe, isn't it?)

On the other hand, HTTP proxies can cache requests and hide you from the server.

It's dumb to blame http website owner for the victims killed by criminals and governments: it's the whole Web that is broken and insecure at heart, HTTPS or not.

We need people to understand how it works in depth so that they can foresee the risks.

A false sense of security is MORE dangerous than a known state of insecurity.

@rysiek@mastodon.technology

I mostly agree about what you wrote (see http://www.tesio.it/2020/09/03/not_all_hackers_are_americans.html for another non-US perspective on #hacking).

Note however that hacking INCLUDES, sometime, violating the law (think about Phineas Fisher, for example https://www.exploit-db.com/papers/41913 ).

The fundamental difference between #hackers and data burglars (either private or governs' ones) is the reason behind their actions: hackers follow their own #curiosity and look for new knowledge to share, data bulgars look for power (either directly or in monetary form).