This would require the main proxy running as root or with some other sort of elevated privileges to allow cross-user network access though, right? If so, wouldn’t that essentially make the user-specific reverse proxy unnecessary in most cases?
I think this is what OP was originally trying, but this approach breaks when each service’s Podman service runs on its own localhost user.
This is due to a security design deicison of Podman. Each user’s network(s) is only available to that user. This is great for most services, but can cause issues for some services - especially reverse proxies. Unfortunately, I’m not aware of an ideal solution. The only solution I’ve seen is moving the reverse proxy to another host and exposing the services’ ports on the localhost. I hope someone can provide a better solution!
Invidious is more private than using YouTube directly or even most other 3rd party services, but it may not completely prevent Google from tracking you depending on it’s hosting, configuration, and usage.
There is also the possibility that Invidious makes the recommendations itself, independently of YouTube. Clearing Invidious cookies and all site data should mitigate this, but if you are signing into Invidious then doing that won’t accomplish much.
Additionally, Invidious may make the recommendations based on all its users’ activity. If you’re using an instance with little activity then the recommendations may be more heavily skewed to your activity. There’s also the possibility that other users of your Invidous instance share interests with you.
Lastly, it is also possible that YouTube’s recommendations are based on unrelated factors.
All of this, including several other possibilities not mentioned, is far more likely than Framework shipping a hardware/firmware backdoor that hasn’t been caught yet which allows Framework to monitor your Invidious acitivity so Framework can sell/share your data back to YouTube. This is a very niche use case that would be extremely expensive, difficult, and risky for Framework (or any other computer manufacturer) to accomplish. Any money Framework makes from this would likely not even cover the cost to do this.
The Framework “backdoor” that you heard about is likely the data breach that recently impacted Framework. This data breach occurred due to a phishing attack on an employee of the accounting firm contracted by Framework.
That’s correct, but the XMPP portion of this communication chain is just your device to the JMP service. Any messages sent or received to another phone number are delivered via SMS/MMS. As a result, those messages can be read by unrelated 3rd parties. I assume something similar is possible for voice calls as well (or at the very least the call start/stop times and the other number on the call can be determined).
Essentially this just shifts trust from a mobile phone carrier to JMP. However, I understand that it may be more challenging to hack a VOIP number than perform a SIM swap attack. Another benefit of JMP for privacy is the more challenging tracking of location for a JMP phone number.
I’m not saying that using JMP is bad. I am saying if you need a secure and private way of messaging someone then this is not the best solution.
It depends on what your threat model is. For example, do you want to mitigate the ability to easily link accounts and other information to you based on a single phone number? If so, then this will help with that assuming you (at least temporarily) use multiple numbers through JMP. On the other hand, if you want your communication to be private then there are better alternatives.
Ultimately, this is similar to using a privacy respecting email provider over gmail. Unless you take some additional precautions, your communications have a similar security/privacy exposure. It can be an improvement (assuming you trust JMP), but it is not the best means of communication in terms of privacy.
I’m not too sure - I’m not too familiar with any of these services (including PinePods 😂). I know this type of feature is a common request for any audio related services though. I imagine that this is something that could be added at some point, but I’m not sure what the effort would be.
I don’t see anything about it on the roadmap for v1 or anywhere else on Pinepods’ issues. Perhaps the developer/maintainer @madeofpendletonwool@lemmy.world can chime in or an issue on Github can be created with more information about this feature request?
The biggest benefits are likely:
The first two may not apply to you in particular, but I’m sure if you have other users that use the services you support then I’m sure they would appreciate having to learn/use a single app/interface for podcasts instead of having to learn one for searching/downloading (if they care about that at all), one for listening on mobile, one for listening on web, and another for managing their download/play sync.
Lots of good suggestions in this thread! A few additional ones that I don’t think I’ve seen yet:
I recommend that you think hard and properly access your threat profile. You are likely going to have to pay with either your wallet (eg: some sort of company incorporation, lawyer fees, forwarding services, and other privacy protection services), your time (eg: using “inconvenient” services, managing separate accounts, etc.), or both. It can be draining (in more than one way) and take away some of the joy that you’re intending this to bring you if you do too much to protect yourself. On the other hand, if you do too little then you can overexpose yourself leading to pricey or dangerous situations.
At a minimum, I would recommend incorpating and making sure your name is not publicly tied to the company in any way. You will likely need a person/company/lawyer to be publicly listed as an agent of some sort for the company. You should be able to have someone do this for you for a small-medium sized fee. Once you have that, do everything in the company’s name and ideally with separate phone numbers, email addresses, online accounts, bank accounts, and physical addresses as anything tied directly to you.
Some of that is to protect yourself financially and legally, but there are some obvious privacy benefits as well. Anything beyond that should be dictated by your threat profile.
As always though, follow best practices when it comes to security! Use strong passwords and use multi-factor authentication when possible (or ideally, use passkeys). Don’t reuse passwords (and ideally, don’t reuse email addresses for multiple accounts). Avoid clicking links in messages when possible. Don’t open suspicious documents (especially if they are unexpected). Verify the authenticity of any new person/business you interact with (especially if they contact you first). Be vigilant of all forms of phishing attacks.
Another piece of advice (that you didn’t ask for, sorry!) - if the process of making art is the thing that brings you joy and the materials are not too expenses, then just focus on making the art without selling it (at least for a while). At worst, you will realize that maybe this isn’t as enjoyable as you thought it would be with the added benefit of not needing to deal with all the troubles of working through all the legal/financial/privacy protections. At best, if you decide to get serious about selling it then you’ll have a larger product inventory and better understanding of what you like making most. It may also help you understand what you should price everything at (assuming you’ve made some of the items in larger quantities).
I think that any guides you find for Gitea + Renovate should work still for Forgejo + Renovate.
I believe the process is:
RENOVATE_GIT_PRIVATE_KEY (SSH private key value), RENOVATE_TOKEN (Forgejo token value), RENOVATE_PLATFORM (gitea), RENOVATE_ENDPOINT (Forgejo API base URL), and any other Renovate settings that you may find helpful/necessary to configure (eg: GITHUB_COM_TOKEN, RENOVATE_AUTODISCOVER, etc.)It is not clear that this is the app that will be used for the new watches. I imagine it will support the new RePebble watches, but I believe that app was intended for the original Pebble watches.
The thing that makes it so unclear to me is that this is a repo owned by the Rebble team, not the RePebble team. I do not know how much overlap there is between the two teams, but the RePebble team does not have any open source repos that I could find. Any mention of open source software by RePebble (including the OS) are links to repos owned by other teams, which is a little concerning.
I understand that the watch operating system is open source. However, it seems that the watch will connect to a companion smartphone app. Do you know if the app is a requirement and/or if the app will be open source?
If you know your VPN’s DNS server, you can change your local DNS so that it redirects your specified domains/subdomains to the appropriate, local IP address and all other requests would then use your VPN’s DNS.
If you don’t know your VPN provider’s DNS server information, you may be able to still do something similar to the above depending on your setup. Otherwise, you could run your own DNS resolver or use a different DNS provider. I guess doing so could potentially be used to further fingerprint you, but the concern about “DNS fingerprinting” is moreso DNS leaks where your DNS queries are accessible to unintended parties due to improper configuration.
I believe the only other option would be to change your hosts file on each device you want to use to connect to your services, which is probably not the best approach and may be challenging/impossible for certain devices.
Also, unless you setup the self signed certs to be trusted on a network/domain level (or again on each individual device), you will likely get a warning/error about the self signed certs when accessing your services. You may need to work through this process each time the certs renew.
I recommend buying a domain if you do not already have one and finding a service that provides wildcard certification challenges. This would allow you to setup a valid, trusted certificate that you could reuse for all of your services. The only thing that you would need to provide is an email address (can be any email address) and your domain name (in addition to other information that may be required to setup an account at the cert provider, but you may already have an account there as it could be the domain name registrar or other services like VPS providers, Cloudflare, etc.). Since it is a wildcard cert, each subdomain does not need to be set publicly and if you only use the domain within your network, the domain does not need to be publicly associated with any IP address.
If you do go forward with that approach, you could use the wildcard cert directly within NginxProxyManager or other reverse proxies. They will also automatically update/maintain the cert for you.
There is no one-size-fits-all solution and there likely isn’t a solution that works for everyone even in specific situations due to different threat models. Purchasing and using a custom domain is often listed as a good practice for maintaining a person’s privacy. However, it can be even more detrimental to a person’s privacy than just using a trusted email masking/forwarding service and trusted email provider. For example:
Please note that I am not saying that this is not a good option, but I just wanted to note some of the things that should be considered if a person decides to use a custom email domain to improve their digital privacy.
How would UnifiedPush support work? In addition to Thunderbird supporting it, wouldn’t each account’s email server require UnifiedPush support? Assuming that’s accurate and Thunderbird supported UnifiedPush, would the benefits of UnifiedPush be negated in situations where a user has 3 email accounts configured in Thunderbird and the server of one of those accounts does not support UnifiedPush?
My beef with them is that they’re either pushed by scammer to empty honest but gullible people’s bank accounts, or they’re used to pay for illegal activities because they’re totally opaque and unregulated.
Scammers also use gift cards, checks, wires, cash, bank accounts, investment funds, and many other means to accomplish this. Several of them are tightly regulated and it does not seem to deter or prevent the scams from occurring.
My other beef is that they’re really securities and they’re not subject to the rules on securities for a reason that totally escapes me.
Admittedly, I am not well versed in this area. Do you foresee a way to properly subject cryptocurrencies to the same/similar regulations as other securities while still providing many/all of cryptocurrencies’ benefits, including anonymity? Are the legitimate cryptocurrency exchanges (eg: Coinbase) not subject to those regulations? How different is this from individuals being taxed on gains/losses from cryptocurrencies?
I don’t do cryptocurrencies both out of self-financial preservation, and also because I refuse to participate - and thus promote - stuff that’s generally bad for society as a whole.
The first part is in relation to investing in cryptocurrency moreso than using cryptocurrency.
What makes cryptocurrency generally bad for society as a whole? While I am not familiar enough with the current estimates, I know there are environmental concerns (eg: water/electricity usage, required hardware, etc.). I concede that the environmental impacts may be (and likely are) worse than traditional fist currencies, I am unaware of other reasons that make cryptocurrency generally bad for society as a whole.
Trump loves em
Many privacy advocates also love cryptocurrency. Two different people or groups of people (no matter how similar or different) can have one or more shared interests, even if the reasons or motivations are drastically different. It is likely best to avoid politics on this topic.
Cryptocurrency
Hard no. I don’t partake in scams, even for the sake of privacy.
Is this in relation to the monetary value of cryptocurrency or the anonymity of cryptocurrency?
The list included cryptocurrency as a channel for anonymous payments, not an investment opportunity. The two cryptocurrencies listed are two of the more well established cryptocurrencies that are more widely accepted than many other cryptocurrencies (granted, one or both of them are still not accepted by a large number of merchants). Additionally, the list also mentions some of the considerations necessary to help ensure the cryptocurrency is obtained anonymously.
If the list only included insert_newly_created_obscure_cryptocurrencies then this would definitely be more concerning.
However, if the cryptocurrency is both obtained and used “properly” where the person is ultimately anonymously exchanging cryptocurrency for a desired good(s) or service(s), is it truly a scam?
This is awesome! I wonder how it will compare to the competition when it’s generally available.
Does anyone have any information about the other offerings mentioned in the blog post?
In the future, we intend for Appointment to be part of a wider suite of helpful products enhancing the core Thunderbird experience. Our ambition is to provide you with not only a first-rate email application but a hub of productivity tools to make your days more efficient and stress-free.
I’m not aware of anything that meets these requirements, which is really unfortunate because many of these items are important features that many users would want. Even if some of the requirements were removed (eg: Linux support, nin-Electron app, disabling read receipts), the number of available options doesn’t change much. Hopefully some options become available soon that meet all these requirements and more (eg: Matrix RTC, spaces/threads, multi-account)!
Sorry, I know this comment doesn’t help much, but I wanted to at least post this for whatever additional visibility this may provide. I’m really hopeful this part of the Matrix ecosystem grows because while there are many Matrix client options, there aren’t really many (or any) that align with Matrix 2.0’s goals and have mass market appeal.