Emanuel

emanuel@labonneheure.ch

Ich bin Musiker, Improvisationskünstler, Sprachlehrer und Ingenieur. I am a musician and artist - focused on improvisation - a language teacher and an engineer.

Location:: Basel, Schweiz

Activitypub not working anymore on our Hubzilla hub

Emanuel

Basel, Schweiz, Sun, 19 Jan 2020 14:38:03 +0100

Some time (maybe 6 month) ago our #hubzilla hub ( https://labonneheure.ch/siteinfo.json) had the #pubcrawl addon installed, and connection to #mastodon did work. In the meantime, the addon has been removed. In the meantime we also changed our directory server to https://hub.netzgemeinde.eu.

About a week ago I installed the pubcrawl addon again (as hub admin), and the app is also installed on a channel. In connections, the previously added mastodon connection is still listed. But when clicking on "latest activities", the listed activities are all older than 6 months, even though this mastodon user is posting every day public toots.

Now when trying to add new connections to mastodon users from this channel (on which the pubcrawl addon is installed), these users are not found. I tried with many different users from different mastodon servers.

Also when trying to connect to this channel from a mastodon user interface, the channel is not found.

Could this be related to the fact that the pubcrawl addon has been turned off and on again? Or to the change of the directory server? What do you propose for debugging? #Activitypub !Hubzilla Support Forum

show all 4 comments

RockyIII

Sun, 19 Jan 2020 17:28:31 +0100 last edited: Mon, 20 Jan 2020 08:15:03 +0100

@Emanuel
I had this kind problems with AP too... I deactivated ALL Add-ons as Admin in Administration - Addons... and activated all Add ons again... after this AP was working again...

Emanuel

Tue, 21 Jan 2020 08:38:56 +0100

@RockyIII thanks, even though is seems not to be logic, I did as you said and it worked.
@Mario Vavti Are the addons connected somehow (see Rockys answer)? The channel I did enable AP for was a regular public channel (social networks - federation).

Mario Vavti

Tue, 21 Jan 2020 08:54:38 +0100

@Emanuel

Are the addons connected somehow

They can have dependendies on each other and they can be not compatible with each other. So make sure you only install addons you actually need and you know what they do.
Sometimes some addons require reloading after a major system upgrade. If this is the case it is announced in the release notes...

Skype: Gespräche wurden aufgezeichnet und ausgewertet

Emanuel

Basel, Schweiz, Sun, 12 Jan 2020 11:39:32 +0100

Tarnkappe.info wrote the following post Sat, 11 Jan 2020 11:02:07 +0100

?Skype: Gespräche wurden aufgezeichnet und ausgewertet? https://tarnkappe.info/skype-gespraeche-wurden-aufgezeichnet-und-ausgewertet/ #Microsoft #Spionage #Artikel #google #Apple #China #Skype

Ich möchte noch anmerken, dass Skype als Produkt auch in vielen Firmen als Telefon Ersatz genutzt wird. Hoffentlich hatte MS keinen Zugriff auf diese Daten.

Please note Skype is very often also als a telephone solution in use in serveral companies. I hope that MS had no access to that data.

#dataprotection #datenschutz #telephon #telefon #spionage

Mitarbeiter des Microsoft-Konzerns in China werteten aufgezeichnete Cortana- und Skype-Gespräche aus, ohne jegliche Sicherheitsvorkehrungen zu treffen. Bekannt wurde dies durch einen ehemaligen Mitarbeiter Microsofts.

Skype-Gespräche auf privatem Laptop ausgewertet

Die Aufnahmen, sowohl absichtliche als auch versehentliche Aktivierungen des Sprachassistenten sowie  Skype-Telefonate, wurden laut dem Microsoft-Mitarbeiter über eine Webanwendung im Google Chrome-Browser auf ihren persönlichen Laptops über das chinesische Internet abgerufen. Die Mitarbeiter trafen keine Sicherheitsvorkehrungen, um die Daten vor kriminellen oder staatlichen Hackern zu schützen. Man wies sie sogar an, die Arbeit mit neuen Microsoft-Konten zu erledigen, die alle dasselbe Passwort haben, um die Verwaltung zu erleichtern, so der ehemalige Mitarbeiter.

    „Es gab keine Sicherheitsmaßnahmen, ich kann mich nicht einmal daran erinnern, dass sie bei mir eine ordnungsgemäße Überprüfung durchgeführt haben. Ich glaube, sie haben nur meine chinesischen Bankdaten genommen“ – sagte er dem Guardian.

Ist Datenschutz ein Fremdwort für Microsoft?

Während der Prüfer zunächst in einem Büro arbeitete, sagte er,  dass man ihm nach einer Weile erlaubte, von zu Hause aus zu arbeiten. Er wertete die Daten britischer Nutzer aus, da er selbst Brite sei. Er hörte also Leuten zu, die ihr Microsoft-Gerät auf britisches Englisch eingestellt hatten, und hatte Zugang zu all dem von seinem Laptop aus, ohne jegliche Sicherheitsvorkehrungen. Sowohl der Benutzername als auch das Passwort wurden im Klartext per E-Mail an neue Kollegen geschickt. Ersteres war nach einem einfachen Schema und letzteres für jeden Mitarbeiter, der in einem bestimmten Jahr dazu kam, gleich.

    „Sie gaben mir einfach per E-Mail ein Login und ich hatte dann Zugang zu den Aufnahmen von Cortana. Diese hätte ich theoretisch mit jedem teilen können. Ich hörte alle Arten von ungewöhnlichen Gesprächen, einschließlich dessen, was häusliche Gewalt hätte sein können. Es klingt jetzt ein bisschen verrückt, aber nachdem ich mich über das Thema Computersicherheit schlau gelesen habe, hat es mich gewundert, dass sie mir die URL, den Benutzernamen und das Passwort einfach per E-Mail geschickt haben.“

Neben den Risiken, dass ein abtrünniger Mitarbeiter Benutzerdaten selbst speichert oder auf Sprachaufzeichnungen auf einem kompromittierten Laptop zugreift, ist die Gefahr umso höher, dass der chinesische Staat Zugang zu den Aufzeichnungen erhält.

    „Wenn man in China lebt und in China arbeitet, ist man bereits kompromittiert“ – so der ehemalige Mitarbeiter.

Auswertungsprogramm von Aufzeichnungen ist fortgeschrittener als das von Amazon, Apple und Google

Das Bewertungsprogramm, über das Vice erstmals im August berichtete, ging einen Schritt weiter als die Programme anderer Technologieunternehmen wie Amazon, Apple und Google. Eine experimentelle Funktion, die eine Live-Übersetzung von Skype-Anrufen ermöglicht, überprüften Menschen, so Vice. Microsoft hat den Nutzern mitgeteilt, dass das Unternehmen zwar die Anrufe analysieren könnte, aber nicht, dass sie es von Mitarbeitern auswerten lassen würde. Vice berichtete damals, dass die Arbeit „zumindest teilweise zu Hause“ stattfinden würde. Das Ausmaß der damit verbundenen potenziellen Sicherheitsrisiken hat man jedoch bisher nicht bekannt gegeben. Microsoft sagte in einer Erklärung, dass seit der Berichterstattung von Vice, die Auswertungsprogramme für Skype und Cortana beendet wurden. Den Rest der Auswertungen hätte man in „sichere Einrichtungen“ verlegt – keine davon in China.

    „Wir überprüfen kurze Schnipsel von Sprachdaten aus einem kleinen Kundenkreis. Um die sprachaktivierten Funktionen zu verbessern, engagieren wir manchmal Partnerunternehmen für diese Arbeit“

!Privacy Issues #Skype #Microsoft

hEARt PhoniX

Sun, 12 Jan 2020 12:41:43 +0100

Leena Simons Vortrag "Aus Sicherheitsgründen muss das Grundgesetz leider abgeschafft werden"

Emanuel

Basel, Schweiz, Sat, 11 Jan 2020 12:37:18 +0100

cb7f604332cf39 wrote the following post Mon, 06 Jan 2020 10:27:59 +0100

Zusatz, falls noch nicht bekannt und #AusSicherheirsgründen :
https://media.ccc.de/v/36c3-99-aus-sicherheitsgrnden-muss-das-grundgesetz-leider-abgeschafft-werden-schluss-mit-dem-sicherheitstheater

Die Gleichsetzung von Sicherheit und Repression ist gefährlich. Erstens werden damit Grundrechtseinschnitte gerechtfertigt, die uns in Gefahr bringen. Zweitens unterbleiben wichtige Maßnahmen, die wirklich der Sicherheit dienen würden. Was in Politik und Wirtschaft als „Sicherheit“ verkauft wird, ist reines Puppentheater. Menschen wird Angst eingeredet, um diese Angst sodann mit Repression und Überwachung zu „beruhigen“. Sicherheit und Freiheit bedingen sich gegenseitig. Eine Politik, die Freiheit angreift und scheibchenweise verhökert, verdient nicht „Sicherheitspolitik“ genannt zu werden. Sie ist reines Theater und einer Demokratie nicht würdig. Schlimmer noch: Sie leistet einem autoritären Gedankengut Vorschub, das uns garantiert nicht sicher macht. Der Vortrag widmet sich einerseits der Erklärung, weshalb diese Gleichsetzung gefährlich ist: Überwachung hilft gar nicht, hat gefährliche Nebenwirkungen und zersetzt den größten Garanten für unsere Sicherheit, die Freiheit. Zum anderen geht es um die Frage, welche Maßnahmen wirklich sinnvoll wären. Das fängt bei einem echten Kampf gegen den Faschismus an, geht über unabhängige Kontrolle der Polizei, Klimaschutz, Verkehrspolitik und endet nicht erst in der Forderung nach einer besseren Regulierung von Antibiotika. Es ist wichtig, dass der Wunsch nach Sicherheit nicht weiter instrumentalisiert wird. Repression ist gefährlich und dient nun wirklich nicht der Sicherheit. Besonders wütend sollte uns das machen, wenn gleichzeitig lange nötige Maßnahmen, beispielsweise beim Kampf gegen Rechts oder gegen digitale Gewalt unterbleiben. Denn hier sind wir wirklich in Gefahr. Dieses ewige "aus Sicherheitsgründen" muss endlich ein Ende haben. Wir können mithelfen, indem wir uns einen Spaß machen und die Begründung genau so inflationär benutzen, wie die Politik. Einfache Begründungen können wir schließlich alle gebrauchen. Und wenn es um Sicherheit geht, wird ja wohl niemand diskutieren wollen. Wir üben das mal gemeinsam: Aus Sicherheitsgründen sollten sich alle diesen Vortrag ansehen.

!Privacy Issues #AusSicherheitsgründen

"The Federation" ist der geeignete Ort

Emanuel

Basel, Schweiz, Wed, 08 Jan 2020 17:50:52 +0100

PepeCyB wrote the following post Tue, 07 Jan 2020 16:43:46 +0100

DDP: Ja dann zieht doch um!
Ja dann zieht doch um!

E-Dampfen im Walled Garden Ob es nun um YouTube geht, oder um Facebook, Instagram etc., die Jammerei wird immer lauter… vor allem in Dampfer-Kreisen. Konten bei diesen Diensten werden gesperrt, Videos müssen gelöscht werden, man fliegt raus und wird in...
Mehr Lesen

#dampfdruck-presse #ddp #e-zigarette #e-dampfgerät #liquidverdampfer #vape

„The Federation“ ist der geeignete Ort. Damit sind die dezentralen freien Netzwerke gemeint, die YouTube, Instagram, Facebook, Twitter und etliche andere zentrale Dienste ersetzen können. Der Vorteil dabei ist, dass die verschiedenen Dienste eben nicht zentral auf einem Server laufen, sondern auf zahlreichen Servern, die untereinander interagieren, sodass man die Inhalte aller Instanzen sehen kann, wenn man auf einem beliebigen Server angemeldet ist. Man sieht die Inhalte aller (ziemlich aller), kann sie direkt anschauen und auch darauf reagieren. Das besondere ist, dass sogar die unterschiedlichen Plattformen in weiten Teilen miteinander interagieren… also z.B. der Twitter-Ersatz Mastodon mit dem Facebook-Ersatz Hubzilla…

Es gibt für alle diese Dienste schon sehr viele Server, bei denen man sich anmelden kann. Und wenn der Server nicht gefällt, vielleicht abgeschaltet werden soll etc., dann ist bei den meisten Plattformen ein Umzug auf einen anderen Server, der diesen Dienst anbietet, nicht problematisch. Es gehen einem weder die Kontakte, noch die Inhalte verloren.

Außerdem ist es einfach geworden und entspricht dem dezentralen, föderierten Gedanken am meisten, dass man selbst eine Instanz betreibt. Wer also schon ein Webhosting-Paket hat, sollte einfach mal schauen, ob die Möglichkeit besteht, eine dieser Plattform-Anwendungen dort zu installieren. Nach meiner Erfahrung ist Hubzilla in der Hinsicht am einfachsten umzusetzen. Das geht sogar ohne unmittelbaren Zugang mittels SSH. Wobei z.B. Softaculous das auch schon zur Installation anbietet und viele Services mit Softaculous arbeiten. Peertube, die YouTube-Alternative ist da schon etwas umständlicher und da braucht man dann die Konsole. Das gilt für Mastodon auch.

Wenn man sich nur alleine, oder mit sehr wenigen fremden Nutzern auf seinem eigenen Server herumtreiben möchte, dann kann man sich den auch zu Hause hinstellen. Für nicht zu umfangreiche Föderations-Projekte reicht ein Raspi mit USB-Stick als zusätzlicher Massenspeicher völlig aus, sofern man eine halbwegs flotte Internetanbindung hat. Mein Garaberry (mit einem Hubzilla-Hub) läuft nun seit ziemlich genau einem Jahr nahezu unterbrechungsfrei… und immer noch wie geschmiert.

Der eigene Server oder Hub hat den Vorteil, dass man nun wirklich nicht von dritten abhängig ist und trotzdem Teil des Gesamtnetzwerks ist. Aber für den Anfang muss man das echt nicht machen. Die öffentlichen Instanzen sind überwiegend zuverlässig und es gibt ausreichend davon.

Wer sich von Instagram lösen möchte, sollte einmal Pixelfed ins Auge fassen. Es ist, wie alle Projekte aus der Föderation, ein noch wachsendes Projekt, dass immer weiterentwickelt wird. Pixelfed bietet das, was man von Instagram her kennt.

Als Alternative zu YouTube, was wohl mit die größte Relevanz zurzeit hat, bietet sich Peertube an. Bei der Auswahl des Servers sollte man auf eventuelle Speicherbegrenzungen achten und auch, ob hochgeladene Videos per Hand „moderiert“ (also freigeschaltet) werden. Peertube bietet dem YouTuber das, was er erwartet. Die Oberfläche und die Bedienung sind einfach und für erfahrene YouTuber ein Klacks.

Ich gehe hier jetzt noch auf Hubzilla ein, weil das die eierlegende Wollmilchsau unter den dezentralen föderierten Netzwerken ist. Es kann als Alternative zu Facebook fungieren, ist aber auch für einen Video-Kanal und natürlich auch für Foto-Blogging à la Instagram geeignet. Man kann Kanäle eröffnen, die völlig öffentlich sind, teil-öffentlich oder komplett privat, womit man geschlossene Gruppen nachbilden kann. Und solange man sich an die gesetzlichen Regelungen (Werbeverbot, Jugendschutz etc.) hält, sind dort auch Tausch- oder Privatverkaufs-Börsen möglich, man kann Foren bilden, Fotoalben zur Verfügung stellen, Webseiten und sogar ein Wiki anbieten. Eine Kalender-/Terminfunktion ist ebenfalls vorhanden.

Ich werde in den nächsten Wochen in meinem anderen Blog, PepeCyB‘s Welt, ein paar Tutorials anbieten, wo z.B. beschrieben ist, wie man bei Hubzilla seinen eigenen Video-Kanal anbieten kann.

Airbnb will mit KI Social-Media-Profile von Gästen auswerten

Emanuel

Basel, Schweiz, Wed, 08 Jan 2020 17:39:39 +0100 last edited: Wed, 08 Jan 2020 17:43:24 +0100

hoergen on Friendica wrote the following post Wed, 08 Jan 2020 15:42:58 +0100

Aus der Reihe "Wir habens ja gesagt, aber keiner wollte hören"

♲ Nachrichtenkanal - 2020-01-08 11:03:36 GMT
https://www.derstandard.at/story/2000113021607/psycho-check-airbnb-will-mit-ki-social-media-profile-von

#Privacy #Danteschutz

Wer in Social Media über Pornos, Alkohol oder in "negativer Sprache" postet, könnte ausgesperrt werden

[Foto]

So freundlich wie in diesem Pressefoto stellt sich #Airbnb seine perfekten Gäste vor. Neurotiker, Psychopathen, aber auch Menschen mit bestimmten Lastern sollen draußen bleiben.

Der Unterkunftsvermittler Airbnb boomt – macht aber auch regelmäßig schlechte Schlagzeilen. In vielen Städten regt sich Widerstand gegen den Ausverkauf von Wohnraum, immer mehr Städte weisen Airbnb-Vermieter in die Schranken. Immer wieder kommt es außerdem in Unterkünften zu Gewalttaten. Nach Schüssen in einem über Airbnb vermieteten Haus in Kalifornien im Herbst kündigte Firmenchef Brian Chesky an, sämtliche Häuser – das sind sieben Millionen Stück – und Vermieter auf Airbnb zu überprüfen und sogenannte "Partyhäuser" aus dem Angebot zu nehmen.

Aber auch Mieter sollen stärker unter die Lupe genommen werden. Wie der "Evening Standard" berichtet, ist etwa in London eine 2,5 Millionen Pfund teure Innenstadtwohnung von Ravern verwüstet worden. Vermietet habe die Frau ihre Wohnung eigentlich für eine Babyparty. Mit künstlicher Intelligenz (KI) will Airbnb solche Fälle künftig verhindern. Wie aus einem Patentantrag hervorgeht, will das Unternehmen künftig potenzielle Gäste auf Merkmale wie "Offenheit" oder "Gewissenhaftigkeit" überprüfen. Dazu will sich das Unternehmen bei "sicheren Drittanbieter-Datenbanken" bedienen. Neben Social Media und Bonitätsprüfern sollen auch Strafregister abgefragt werden.
Negative Punkte für negative Sprache

Die potenziellen Mieter sollen mithilfe eines Punktesystems bewertet werden. Abzug gibt es für "falsche oder irreführende Informationen" in Onlineprofilen oder wenn die Person mit Alkohol, Drogen, Sexarbeit, Pornografie oder "negativer Sprache" in Zusammenhang steht. Auch Anzeichen von Narzissmus, Psychopathie oder Neurotizismus soll der Algorithmus bewerten können.

Mithilfe von maschinellem Lernen soll der Algorithmus anschließend vorhersagen, wie wahrscheinlich die Person "ein positiver Akteur in einer interpersonellen Interaktion ist", heißt es in dem Patent. Dabei soll der Punktestand einer Person auch die Bewertung von Freunden und Bekannten beeinflussen können.

Airbnb sagte dem "Evening Standard", dass das Patent vom Start-up Trooly stammt, das Background-Checks durchführte und 2017 von Airbnb übernommen wurde. Ob der Algorithmus bereits bei Airbnb-Gästen eingesetzt wird, wollte Airbnb nicht beantworten. Laut der Website des Unternehmens wird jede Reservierung vor der Bestätigung bewertet und mit Behörden- und Terrorlisten abgeglichen. (red, 8.1.2020)

!Privacy Issues

hEARt PhoniX

Wed, 08 Jan 2020 18:19:28 +0100

hEARt PhoniX

Wed, 08 Jan 2020 18:19:28 +0100

Emanuel

Sat, 11 Jan 2020 11:14:59 +0100

@h.ear.t Genau, und ganz ohne China-Bashing

How Police Departments Try to Force Google to Hand Over Data on Anyone Near a Crime Scene

Emanuel

Basel, Schweiz, Fri, 03 Jan 2020 12:30:53 +0100

Marshall Sutherland wrote the following post Fri, 22 Feb 2019 01:13:05 +0100

How Police Departments Try to Force Google to Hand Over Data on Anyone Near a Crime Scene

Police departments across the country have been knocking at Google’s door for at least the last two years with warrants to tap into the company’s extensive stores of cellphone location data. Known as “reverse location search warrants,” these legal mandates allow law enforcement to sweep up the coordinates and movements of every cellphone in a broad area. The police can then check to see if any of the phones came close to the crime scene. In doing so, however, the police can end up not only fishing for a suspect, but also gathering the location data of potentially hundreds (or thousands) of innocent people. There have only been anecdotal reports of reverse location searches, so it’s unclear how widespread the practice is, but privacy advocates worry that Google’s data will eventually allow more and more departments to conduct indiscriminate searches.

On the night of March 16, 2017, the city of Raleigh, North Carolina suffered its biggest fire in a century. The flames scorched 10 buildings, including churches and businesses. A seven-story apartment complex, then under construction, was reduced to ashes. The fire ultimately caused $50 million in damages.

Over the next year, authorities investigated the fire but seemed to struggle to determine its cause. According to a report by local NBC affiliate WRAL, the Raleigh police went to extreme lengths to find out if an arsonist may have set the blaze. Investigators served a search warrant to #Google, asking that the company to provide the coordinates of any phones that were in the area between 7:30 p.m. and 10:30 p.m. on the night of the fire. It was likely for naught—police ended up classifying the cause of the fire as “undetermined.”

Police departments across the country have been knocking at Google’s door for at least the last two years with warrants to tap into the company’s extensive stores of cellphone location data. Known as “reverse location search warrants,” these legal mandates allow law enforcement to sweep up the coordinates and movements of every cellphone in a broad area. The police can then check to see if any of the phones came close to the crime scene. In doing so, however, the police can end up not only fishing for a suspect, but also gathering the location data of potentially hundreds (or thousands) of innocent people. There have only been anecdotal reports of reverse location searches, so it’s unclear how widespread the practice is, but privacy advocates worry that Google’s data will eventually allow more and more departments to conduct indiscriminate searches.

Google didn’t respond to Slate’s request for comment on how the company handles requests. The company told Forbes last year: “We always push back on overly broad requests for our users’ data.” [Update: Google sent Slate a statement after this article was published, which read, “We have an established process for managing requests for data about our users, and in these particular instances, require a search warrant. We always push back on overly broad requests to protect our users’ privacy.”]

WRAL was able to uncover four instances in which the Raleigh Police Department sought reverse-location data in 2017 for investigations into murder, sexual battery, and the suspected arson. Police were able obtain data for crimes that occurred as far back as 2015. Only one of the cases has resulted in arrest. In their warrants, police have instructed Google to keep the data requests secret for up to three months. The department reportedly got the idea to use reverse location searches after learning that the State Bureau of Investigation in Orange County, California, had also employed the technique.

In Minnesota, police departments have obtained at least 22 reverse-location search warrants since August, according to reporting by Minnesota Public Radio. The warrants have, at times, sought location data in 33-hour windows, potentially giving officers information on tens of thousands of people. The warrants have sought to gather identifying data in crimes ranging from home invasions to a theft of $650 worth of tires. In one case, the reverse-location data was requested to help solve a fatal shooting from 2013.

It’s not just local police departments that have requested location data dumps from Google: Forbes discovered that the FBI also used the technique in Virginia to investigate a string of robberies at a Dollar Tree between last March and September. The bureau requested the identifying information of all Google account holders in two areas with a 375-meter radius, and another with a 300-meter radius, during the times that the robberies took place.

The government has long applied a broad dragnet approach to cellphone location data. Law enforcement at the local, state, and federal levels have made thousands of requests for “cell tower dumps” since 2010, which involves collecting information on every phone connected to a cell tower at a certain time. Police have also been known to use StingRays, which are devices that send out broadcast signals stronger than those coming from actual cell towers, thus tricking cellphones into connecting to the device. The StingRay operator can then locate all connected phones.

However, Google’s location-tracking capabilities are more powerful than either of these methods. When authorities request cell tower data, they can see the approximate locations of any phone connected to a nearby tower. But they can retrieve much more reliable data from users of Android phones or certain Google apps. Google’s location-tracking functions are often more precise than those of cell towers for tools like Maps and even Gmail. Plus, the company collects tracking data from phones that aren’t connected to cell towers, such as those using GPS satellites or Wi-Fi. When police request location data from Google-connected devices, they’ve also been known to ask for more personal information, like browsing history and past purchases.

Many privacy advocates argue that these sort of indiscriminate data sweeps are prohibited under the Fourth Amendment, which generally dictates that searches by law enforcement need to be specific and limited only to what’s necessary. “[Law enforcement] needs to suspect a particular person or criminal activity, not just go, for example, search every home in a given area,” says Jennifer Lynch, who serves as the surveillance-litigation director for the Electronic Frontier Foundation. Minnesota also has a statute dictating that police must name a person of interest in tracking warrants, so it would seem that reverse location searches should be technically illegal in the state.

One of the main concerns with these generalized searches is that the data of unsuspecting innocent people inevitably falls into the hands of police. Even though these people might not be breaking any laws, the information that such methods dredge up could still be revealing and sensitive. “What if this type of location-based collection is occurring in our red light district and you’re finding out everyone who was there, or some sort of shady establishment? Or what if you’re targeting at a medical facility or religious house of worship?” says Jake Laperruque, who serves as senior counsel at the Constitution Project. “It gets really bad really fast.”

Some police departments have tried to implement limits on the amount of data accessible at one time in order to preserve privacy. Maine police officers asked Google in August to retrieve information only on users who were in at least two of the locations of interest during certain periods of time. Minnesota police officers have defended reverse location searches by pointing out that investigators follow a process whereby Google first assigns anonymized ID numbers to each phone when it hands the data over. Once investigators pinpoint a device that seems suspicious, they then request another warrant from the court to retrieve its identifying information.

However, Jerome Greco, a staff attorney for the Legal Aid Society, says these safeguards are inadequate. “Just because one police department does it this way doesn’t mean that the jurisdiction next to it is going to the same,” Greco said. “For us to have to rely upon an internal policy of a particular police department that could change at any time is not sufficient.” Greco also points out that there do not seem to be any publicly known policies about deleting the data after a certain amount of time. It’s plausible, then, that police departments might retain data even on bystanders, which could then be cross-referenced in future investigations.

Privacy advocates are encouraging judges to be more discerning in approving warrant applications. Because this is a relatively new technique, some worry that the courts do not understand the true invasiveness of what police departments are requesting, or much how much precise location data Google has stored. These warrant application also often only list GPS coordinates, potentially making it difficult for judges to discern the breadth of the area from which police are requesting location data—whether they’re approving a search of the area around a store, or around a whole shopping center. There have been further reports that judges have reviewed such warrants for as little as four minutes before signing them. “Thus far ,the courts have not been really great at narrowing to the ability of police to get these large swaths of information,” says Teresa Nelson, legal director for the American Civil Liberties Union of Minnesota. “We need the court to weigh in and put limits, to say, ‘Actually, no, this warrant was too broad and we’re not going to allow it.’ ”

There’s hope, though, that judges will soon catch on to what exactly is being asked in these warrants. As activists brought more awareness to cell tower dumps and StingRays, judges began to become more discerning and demand more limits when reviewing such requests from law enforcement. While it’s not a perfect fix—legislation would be much more effective—raising general awareness may be the best course of action in the short term.

Future Tense is a partnership of Slate, New America, and Arizona State University that examines emerging technologies, public policy, and society.

These Apps Reportedly Shared Sensitive Personal Information With Facebook

Emanuel

Basel, Schweiz, Fri, 03 Jan 2020 12:27:47 +0100

Marshall Sutherland wrote the following post Sat, 23 Feb 2019 20:37:30 +0100

These Apps Reportedly Shared Sensitive Personal Information With Facebook

Sometimes, Facebook isn’t the one you should blame for privacy violations involving Facebook. For example, an investigation by the Wall Street Journal found 11 popular apps that routinely transmit potentially sensitive personal data like body weight and menstrual cycles to Facebook—sometimes in violation of the social network’s own guidelines.

In the world of Facebook-related scandals, this one ranks pretty low on the outrage meter. But it does, once again, illustrate that you don’t even have to be a Facebook user to find out you’ve been unwittingly handing over data to the tech giant. It’s also an important reminder that users should be careful when it comes to sharing health information—especially at a time when insurance companies are looking to social media and data analytics to determine premiums.

Sometimes, #Facebook isn’t the one you should blame for privacy violations involving Facebook. For example, an investigation by the Wall Street Journal found 11 popular apps that routinely transmit potentially sensitive personal data like body weight and menstrual cycles to Facebook—sometimes in violation of the social network’s own guidelines.

At issue is an analytics tool that Facebook offers to developers called App Events. It’s a plug-and-play SDK that helps developers setup custom trackers of user activity that can translate into ad targeting data. Facebook isn’t the only company offering this kind of tool but according to the Wall Street Journal, it’s been implemented in “thousands” of apps.

In order to get an idea of how this SDK is being used, the Journal used software to analyze the internet communications of over 70 apps. “The tests found at least 11 apps sent Facebook potentially sensitive information about how users behaved or actual data they entered,” the report says. For some reason, the paper decided to only identify five of the apps by name. They are:

    Instant Heart Rate: HR Monitor - Transmitted heart rate data.
    Flo Period & Ovulation Tracker - Shared when a user was having their period.
    Realtor.com - Transmitted the location and price of listings that a user viewed.
    BetterMe: Weight Loss Workouts - Shared users’ weights and heights.
    Meditation app Breethe - Shared the email address users used to log in to the app and the name of the meditations the user completed.

Flo seems to be the most obviously personal example of sharing information that users’ may not be aware of and the company’s response to questions did not inspire confidence that they’re taking the issue seriously. From the report:

    Flo initially said in a written statement that it doesn’t send “critical user data” and that the data it does send Facebook is “depersonalized” to keep it private and secure.

    The Journal’s testing, however, showed sensitive information was sent with a unique advertising identifier that can be matched to a device or profile. A Flo spokeswoman subsequently said the company will “substantially limit” its use of external analytics systems while it conducts a privacy audit.

Facebook did not respond to Gizmodo’s request for comment but told the Journal that it tells developers not to share “health, financial information or other categories of sensitive information.” The Journal tested the top 10 finance apps in Apple’s U.S. app store and found that none appeared to be sharing sensitive information with Facebook. But health information like period cycles, heart rates, and body weight fluctuations were all being shared in apps that were reviewed. Facebook said that it would inform the offending apps’ developers to stop transmitting prohibited information and if they continue to violate its rules, “it may take additional action.”

Some of the developers quickly changed their policies after being contacted by the Journal, others didn’t respond.

In the world of Facebook-related scandals, this one ranks pretty low on the outrage meter. But it does, once again, illustrate that you don’t even have to be a Facebook user to find out you’ve been unwittingly handing over data to the tech giant. It’s also an important reminder that users should be careful when it comes to sharing health information—especially at a time when insurance companies are looking to social media and data analytics to determine premiums.

We also may find out that abuse of Facebook’s SDK is more widespread than we realized. The office of New York Governor Andrew Cuomo announced this afternoon that it is directing the Department of Financial Services and other state agencies to immediately open an investigation into Facebook’s practices with third parties.

!Privacy Issues

Facebook says it 'unintentionally uploaded' 1.5 million people's email contacts without their consent

Emanuel

Basel, Schweiz, Fri, 03 Jan 2020 12:24:56 +0100

Marshall Sutherland wrote the following post Sun, 21 Apr 2019 02:58:24 +0200

So, remember the other day when Facebook got called out for asking for email passwords which they were supposedly only going to use to automatically confirm your email address? Apparently, while doing that they also "unintentionally" slurped up all the user's contacts. Apparently, they think "unintentional" means "do something until we get caught."

Facebook says it 'unintentionally uploaded' 1.5 million people's email contacts without their consent

Facebook harvested the email contacts of 1.5 million users without their knowledge or consent when they opened their accounts.

Since May 2016, the social-networking company has collected the contact lists of 1.5 million users new to the social network, Business Insider can reveal. The Silicon Valley company said the contact data was "unintentionally uploaded to Facebook," and it is now deleting them.

The revelation comes after pseudononymous security researcher e-sushi noticed that Facebook was asking some users to enter their email passwords when they signed up for new accounts to verify their identities, a move widely condemned by security experts. Business Insider then discovered that if you entered your email password, a message popped up saying it was "importing" your contacts without asking for permission first.

At the time, it wasn't clear what was happening — but on Wednesday, Facebook disclosed to Business Insider that 1.5 million people's contacts were collected this way and fed into Facebook's systems, where they were used to improve Facebook's ad targeting, build Facebook's web of social connections, and recommend friends to add.

#Facebook harvested the email contacts of 1.5 million users without their knowledge or consent when they opened their accounts.

Since May 2016, the social-networking company has collected the contact lists of 1.5 million users new to the social network, Business Insider can reveal. The Silicon Valley company said the contact data was "unintentionally uploaded to Facebook," and it is now deleting them.

The revelation comes after pseudononymous security researcher e-sushi noticed that Facebook was asking some users to enter their email passwords when they signed up for new accounts to verify their identities, a move widely condemned by security experts. Business Insider then discovered that if you entered your email password, a message popped up saying it was "importing" your contacts without asking for permission first.

At the time, it wasn't clear what was happening — but on Wednesday, Facebook disclosed to Business Insider that 1.5 million people's contacts were collected this way and fed into Facebook's systems, where they were used to improve Facebook's ad targeting, build Facebook's web of social connections, and recommend friends to add.

A Facebook spokesperson said before May 2016, it offered an option to verify a user's account using their email password and voluntarily upload their contacts at the same time. However, they said, the company changed the feature, and the text informing users that their contacts would be uploaded was deleted — but the underlying functionality was not.

Facebook didn't access the content of users' emails, the spokesperson added. But users' contacts can still be highly sensitive data — revealing who people are communicating with and connect to.

While 1.5 million people's contact books were directly harvested by Facebook, the total number of people whose contact information was improperly obtained by Facebook may well be in the dozens or even hundreds of millions, as people sometimes have hundreds of contacts stored on their email accounts. The spokesperson could not provide a figure for the total number of contacts obtained this way.
Users weren't given any warning before their contact data was grabbed

The screenshot below shows the password entry page users saw upon sign up. After they entered their password and clicked the blue "connect" button, Facebook would begin harvesting users' email contact data without asking for permission.

After clicking the blue "connect" button, a dialog box (screenshot below) popped up saying "importing contacts." There was no way to opt out, cancel the process, or interrupt it midway through.

Business Insider discovered this was happening by signing up for Facebook with a fake account before Facebook discontinued the password verification feature. In our test, after the authentication loading screen finished, a new box popped up saying it didn't find any contacts, and then took us to the homescreen of the social network.

A user might have been able to infer from this that their contacts were being accessed — but there was no way to stop it happening, or advance notice ahead of time.

From one crisis to another

The incident is the latest privacy misstep from the beleaguered technology giant, which has lurched from scandal to scandal over the past two years.

Since the Cambridge Analytica scandal in early 2018, when it emerged that the political firm had illicitly harvested tens of millions of Facebook users' data, the company's approach to handling users' data has come under intense scrutiny. More recently, in March 2019, the company disclosed that it was inadvertently storing hundreds of millions of users' account passwords in plaintext, contrary to security best practices.

Facebook now plans to notify the 1.5 million users affected over the coming days and delete their contacts from the company's systems.

"Last month we stopped offering email password verification as an option for people verifying their account when signing up for Facebook for the first time. When we looked into the steps people were going through to verify their accounts we found that in some cases people's email contacts were also unintentionally uploaded to Facebook when they created their account," the spokesperson said in a statement.

"We estimate that up to 1.5 million people's email contacts may have been uploaded. These contacts were not shared with anyone and we're deleting them. We've fixed the underlying issue and are notifying people whose contacts were imported. People can also review and manage the contacts they share with Facebook in their settings."

!Privacy Issues

Google Stored G Suite Users' Passwords in Plain-Text for 14 Years

Emanuel

Basel, Schweiz, Fri, 03 Jan 2020 12:20:27 +0100

Hackernews (unofficial) wrote the following post Wed, 22 May 2019 10:00:04 +0200

Google Stored G Suite Users' Passwords in Plain-Text for 14 Years

After Facebook and Twitter, #Google becomes the latest technology giant to have accidentally stored its users' passwords unprotected in plaintext on its servers—meaning any Google employee who has access to the servers could have read them.

In a blog post published Tuesday, Google revealed that its G Suite platform mistakenly stored unhashed passwords of some of its enterprise users on internal servers in plaintext for 14 years because of a bug in the password recovery feature.

G Suite, formerly known as Google Apps, is a collection of cloud computing, productivity, and collaboration tools that have been designed for corporate users with email hosting for their businesses.

It's basically a business version of everything Google offers.

The flaw, which has now been patched, resided in the password recovery mechanism for G Suite customers that allows enterprise administrators to upload or manually set passwords for any user of their domain without actually knowing their previous passwords in order to help businesses with on-boarding employees and for account recovery.

If the admins did reset, the admin console would store a copy of those passwords in plain text instead of encrypting them, Google revealed.

    "We made an error when implementing this functionality back in 2005: The admin console stored a copy of the unhashed password," Google says.

However, Google also says that the plain text passwords were stored not on the open Internet but on its own secure encrypted servers and that the company found no evidence of anyone's password being improperly accessed.

    "This practice did not live up to our standards. To be clear, these passwords remained in our secure encrypted infrastructure," Google says. "This issue has been fixed, and we have seen no evidence of improper access to or misuse of the affected passwords."

Google also clarifies that the bug was restricted to users of its G Suite apps for businesses and that no free version of Google accounts like Gmail were affected.

Though the company did not disclose how many users might have been affected by this bug beyond just saying the issue affected "a subset of our enterprise G Suite customers," with more than 5 million G Suite enterprise customers, the bug could affect a large number of users — presumably any user who used G Suite in last 14 years.

In order to address the issue, Google has since removed the capability from G Suite administrators and emailed them a list of impacted users, asking them to ensure that those users reset their passwords.

Google says the company would be automatically resetting passwords for those users who do not change their passwords.

    "Out of an abundance of caution, we'll reset accounts that have not done so themselves," the tech giant says.

Google is the latest tech company to accidentally store unhashed passwords on its internal servers. Recently, Facebook was in the news for storing plaintext passwords for hundreds of millions of its users, both Instagram and Facebook, on its internal servers.

Almost a year ago, Twitter also reported a similar security bug that unintentionally exposed passwords for its 330 million users in readable text on its internal computer system.

!Privacy Issues

Apple admet écouter certaines conversations privées via Siri

Emanuel

Basel, Schweiz, Fri, 03 Jan 2020 12:10:34 +0100

Linux News wrote the following post Mon, 19 Aug 2019 18:42:00 +0200

Apple admet écouter certaines conversations privées via Siri
Un ancien sous-traitant de l’entreprise a révélé que des contractuels sont chargés d’écouter des enregistrements réalisés par l’outil de commande vocale Siri à l’insu des utilisateurs. Une manœuvre qui serait destinée à « améliorer les performances » du dispositif, mais qui contraste avec la position stricte d’ #Apple en matière de respect des données personnelles : https://www.lesechos.fr/tech-medias/hightech/apple-admet-ecouter-certaines-conversations-privees-via-siri-1041502

Après Google , Microsoft et Amazon, c'est au tour du géant à la pomme croquée d'être sur le banc des accusés en raison de son indiscrétion. Selon un article paru vendredi dans « The Guardian », des sous-traitants d'Apple auraient pour mission d'analyser les bandes sonores enregistrées par Siri par erreur. Un mode opératoire confirmé par l'entreprise, qui avance faire cela afin de comprendre pourquoi l'assistant vocal intelligent, présent sur les #iPhone ainsi que sur les #Mac, s'active parfois sans que cela ne lui ait été demandé.

Mais à en croire le lanceur d'alerte ayant informé le quotidien britannique, cela aurait également amené les salariés chargés d'analyser les dysfonctionnements à entendre des bribes de conversations parfois sensibles et à accéder de manière opaque aux données personnelles des utilisateurs.

Des « innombrables cas » d'enregistrements délicats

D'après la source du « Guardian », qui a elle-même été employée par l'un des sous-traitants de la firme, le nombre de conversations enregistrées pourrait être conséquent, en raison de la fréquence à laquelle Siri se déclenche par erreur. En effet, « le son d'une fermeture éclair » serait suffisant, à lui seul, pour activer l'assistant vocal.

Plus inquiétant encore, le fait que le contenu des discussions relèverait souvent du domaine de la vie privée - voire intime - selon l'ancien salarié. « Il y a eu d'innombrables cas d'enregistrements de discussions privées entre médecins et patients, de transactions commerciales, de transactions apparemment criminelles, de rencontres sexuelles… Ces enregistrements sont accompagnés de données de l'utilisateur indiquant parfois sa localisation ou des données de contact » a-t-il déclaré.

« #Apple sous-traite et il y a beaucoup de rotation des effectifs » a confié le lanceur d'alerte, avant d'affirmer que les personnes amenées à étudier les dysfonctionnements de l'application de commande vocale ne sont « pas encouragées à prendre en compte la dimension privée des conversations qu'ils examinent ». Souvent, ce seraient sur les Apple Watch et les HomePod , ces enceintes connectées, que la dictée vocale se mettrait accidentellement en route.
Une politique relative aux données personnelles pourtant restrictive

Face à la polémique, la réponse d' Apple n'a pas tardé. Dès le début de semaine, l'entreprise s'est justifiée en déclarant que seulement une « petite partie » des activations de Siri étaient analysées afin de perfectionner la reconnaissance vocale. Elle a également avancé qu'uniquement 1 % des enregistrements audio étaient effectivement écoutés par des êtres humains, tout en assurant qu'il était quasiment impossible d'associer les bandes-son en question à des individus en raison de « strictes exigences de confidentialité ».

Apple a toujours mis en avant une position plus stricte que ses concurrents sur le plan des données personnelles. Pas plus tard qu'en janvier dernier, à l'occasion de la CES (Consumer electronics show), l'entreprise avait d'ailleurs placardé des affiches géantes à Las Vegas, sur lesquelles on pouvait lire « Ce qu'il se passe sur votre iPhone reste sur votre iPhone ». De la même manière, quelques années auparavant, en 2016, le successeur de Steve Jobs, Tim Cook, avait accordé une interview télévisée au cours de laquelle il affirmait qu'Apple ne lisait jamais les mails et iMessages des utilisateurs.
Un potentiel embarras juridique

Mais il n'y a pas que sur le plan éthique que la firme basée à Cupertino est incommodée. Si les révélations du « Guardian » sont si embarrassantes, c'est également parce qu'elles posent la question du respect des normes juridiques en matière de protection de données. Pour les enceintes HomePod, par exemple, Apple avait assuré que les commandes vocales ne seraient pas exploitées et que toutes les données seraient anonymisées et chiffrées.

« S'il s'avère, au terme d'une enquête en bonne et due forme, qu'Apple a vraiment réalisé un manquement aux obligations de transparence, on pourrait considérer qu'il y a une violation des lois » analyse Oriana Labruyère, avocate spécialisée en protection des données. « On pourrait alors imaginer une condamnation à l'image de celle adressée à Google par la CNIL en janvier dernier, pour utilisation de données personnelles sans consentement » poursuit-elle, avant de souligner le fait que dans le cas de Siri, les données pourraient être particulièrement sensibles en raison du contexte de conversations privées dans lequel elles ont été récupérées.

Un avis partagé par un membre de l'association oeuvrant pour la défense des libertés numériques La Quadrature du Net et connu sous le pseudonyme « Klorydryk ». révèle aussi que les Gafam sont plus humanisés qu'on ne le croit. « Les Gafam nous avaient fait des promesses sur le plan technique » estime-t-il. « L'une d'entre elles consistait à ce que les données soient surtout traduites par des robots… Pourtant, de nombreux cas, comme le fait que des tiers soient ici employés par Apple, nous prouvent que ce n'est pas vrai, ce dont on se doutait déjà après le scandale autour des écoutes réalisées par Amazon grâce à Alexa. »

!Privacy Issues

D'après les Pays-Bas, Microsoft continuerait de collecter illégalement des données avec Windows 10

Emanuel

Basel, Schweiz, Fri, 03 Jan 2020 11:59:16 +0100

Linux News wrote the following post Wed, 04 Sep 2019 15:34:14 +0200

D'après les Pays-Bas, Microsoft continuerait de collecter illégalement des données avec Windows 10
L'équivalent de la #CNIL aux Pays-Bas a publié un rapport, le 27 août 2019, dans lequel elle soupçonne #Microsoft de continuer à collecter illégalement des données via son système d'exploitation #Windows 10. Pourtant, en avril 2018, le gendarme de la vie privée avait finalement estimé que le géant du numérique était dans les clous après une mise en conformité. Si ces soupçons sont confirmés par son homologue irlandais à qui le dossier a été transmis, la sanction pourrait atteindre 4% du chiffre d'affaire global de la firme : https://www.usine-digitale.fr/article/d-apres-les-pays-bas-microsoft-continuerait-de-collecter-illegalement-des-donnees-avec-windows-10.N879890

L'équivalent de la CNIL aux Pays-Bas a publié un rapport, le 27 août 2019, dans lequel elle soupçonne #Microsoft de continuer à collecter illégalement des données via son système d'exploitation #Windows 10. Pourtant, en avril 2018, le gendarme de la vie privée avait finalement estimé que le géant du numérique était dans les clous après une mise en conformité. Si ces soupçons sont confirmés par son homologue irlandais à qui le dossier a été transmis, la sanction pourrait atteindre 4% du chiffre d'affaire global de la firme.
Publié le 02 septembre 2019 à 16H08 mis à jour le 02 septembre 2019 à 23H02
D'après les Pays-Bas, Microsoft continuerait de collecter illégalement des données avec Windows 10
Etant donné que le siège européen de Microsoft se trouve à Dublin, la CNIL néerlandaise a soumis ces soupçons à son équivalent irlandais, la Data Protection Commission. © Pascal Guittet

Et c'est reparti pour un tour. L'Autoriteit Persoonsgegevens, la CNIL néerlandaise, n'est toujours pas satisfaite du traitement des données fait par Microsoft. "Il apparaît que Microsoft collecte également d'autres données (…) ce qui peut enfreindre les règles de confidentialité", peut-on lire dans le récent rapport du gendarme de la vie privée publié le 27 août 2019. En conséquence de quoi Windows 10 ne respecterait toujours pas le Règlement général sur la protection des données (RGPD). L'agence "conseille aux utilisateurs de prêter une attention particulière aux paramètres de confidentialité lors de l'installation et de l'utilisation de ce logiciel".

L'amende pourrait atteindre 4 % du chiffre d'affaire de Microsoft

Etant donné que le siège européen de Microsoft se trouve actuellement à Dublin, la CNIL néerlandaise a soumis ces soupçons à son équivalent irlandais, la Data Protection Commission. Vu la pile de dossiers à traiter par cette agence, il faudra donc être patient pour connaître le verdict.

Si l'infraction est établie, l'amende pourra atteindre 4% du chiffre d'affaire global de la firme, ce qui a peu de chances d'arriver. En effet, selon le site TechCrunch, Microsoft est disposé à collaborer avec la Data Protection Commission. "Nous travaillerons avec la Commission irlandaise pour connaître toutes les questions et préoccupations éventuelles qu'elle pourrait avoir et pour répondre à toute autre question ou préoccupation le plus rapidement possible" a confié un porte-parole de Microsoft au site spécialisé.

Les données télémétriques au cœur des interrogations

Tout a commencé lorsque Microsoft a sorti son nouveau système d'exploitation Windows 10. Ce dernier utilisait un système de télémétrie intégré, permettant d'améliorer le service en récoltant des données concernant, par exemple l'identification des problèmes de sécurité ou l'analyse des dysfonctionnements liés à certains logiciels… Il s'agit du même type de télémétrie qu'intègre les systèmes d'exploitation mobiles comme iOS ou Android.

Le 13 octobre 2017, le gendarme de la vie privée publiait un rapport déclarant que "Microsoft n'informe pas clairement les utilisateurs des données et à quelles fins". Par ailleurs, il accusait la firme de récupérer une quantité d'informations plus importante que nécessaire. L'inquiétude se situait sur l'usage final des informations récoltées. L'Autoriteit Persoonsgegevens exigeait alors une mise en conformité.

Une mise en conformité insuffisante

Le géant du numérique avait alors procédé à quelques modifications, notamment en demandant l'approbation des utilisateurs dans certaines situations. Bingo ! En avril 2018, l'Autoriteit Persoonsgegevens annonçait alors que "Microsoft informe mieux les utilisateurs sur les données collectées et sur les finalités pour lesquelles elles sont traitées". Mais c'est après des tests plus approfondis que l'agence néerlandaise a trouvé de nouvelles raisons de s'inquiéter.

A noter également que le gouvernement des Pays-Bas s'est attaqué en novembre 2018 à Office 365, accusant aussi la suite bureautique de Microsoft de collecter plus de données qu'elle ne le devrait.

!Privacy Issues

Kauf-Nix-Liste

Emanuel

Basel, Schweiz, Thu, 02 Jan 2020 10:30:52 +0100

hoergen on Friendica wrote the following post Sat, 16 Nov 2019 11:54:57 +0100

Die Kauf-Nix-Liste für den modernen Mensch

Brauchen wir wirklich alles, was wir kaufen und wenn ja warum?

Eine praktische Checkliste für den neuen Lifestyle, verantwortungsvollen Konsum, vollere Geldbörsen und eine bessere Umwelt.

Brauche ich das wirklich?
Wie viel davon liegt bei mir schon zu Hause?
Besitze ich schon etwas, das ganz ähnlich ist?
Werde ich es oft genug benutzen?
Wie lange hält es?
Wenn es kaputt ist, kann ich es reparieren?
Besteht die Möglichkeit, es zu leihen, statt zu kaufen?
Kann ich ohne dieses Ding leben?
Will ich das wirklich haben?
Und wenn ich es nicht mehr brauche, wo wandert es dann hin?
Wer erhält das Geld, das ich dafür bezahle?
Unter welchen Umständen wurde es wo produziert?
Wie lange gelingt es diesem Ding, mich „glücklich“ zu machen?

Be active, sympathetic and averted to consumerism or hatred of the vulnerable

Emanuel

Basel, Schweiz, Thu, 02 Jan 2020 10:19:11 +0100

Sei aktiv, teilnahmsvoll/ungleichgültig und wende dich vom Konsumerismus und vom Hass auf die Verwundbaren ab!

HU Art Sound (2) wrote the following post Wed, 01 Jan 2020 23:00:42 +0100

Hatred of the vulnerable...
Image/photo

#quote #chomsky

Music jam in Basel 25.01.2020 14-18h

Start: Saturday January 25, 2020 @ 12:00 AM

End: Sunday January 26, 2020 @ 12:00 AM

Emanuel

Mon, 16 Dec 2019 18:08:10 +0100 last edited: Sun, 12 Jan 2020 00:47:34 +0100

Dear #music friends,

to this #jam, only music #instrument players and #vocalists are invited. It will happen in #Basel in the studio la bonne heure on saturday 25 january 2020 between 14 and 18 h. I will prepare a #drum kit, a #guitar amp, some #synths, some microphones and a #recording setup.

Of course it will be nice to have some recordings as a souvenir, but to have a product is not the goal of the jam. Instead, the jam will create situations which we will encounter together and which will be the base of our instant compositions (creations in the moment).
I look forward seeing you there!
!la bonne heure | Raum für Selbstbestimmung, Kreativität und Menschenwürde !tr'ensemble | Ein Basler transkulturelles Trommel- und Tanzensemble

Location: la bonne heure
Kanonengasse 37
4051 Basel
Switzerland

Music Jam

WikiTribune will become open source. And then: Federation over zot?

Emanuel

Basel, Schweiz, Tue, 03 Dec 2019 12:08:47 +0100

Is somebody in the possibility to outreach to Jimmy Wales?

Jason Robinson 🐍🍻 wrote the following post Tue, 03 Dec 2019 11:35:28 +0100

Replied to Jimmy Wales on his decision to #opensource wt.social and hinted #ActivityPub should be next. He replied with a like.

Image/photo

Good sign? ;)

!Hubzilla Outreach !Zotlabs|Zot

Emanuel

Tue, 03 Dec 2019 12:21:24 +0100

Jimmy Wales uses Twitter, I don't...

photoswipe on zen template

Emanuel

Basel, Schweiz, Sun, 01 Dec 2019 17:56:25 +0100

!Hubzilla Support Forum

When I create a zen template like this


[template]zen[/template]
[region=content]
$content
[/region]

and then create a bbcode page using this template,

then at the bottom of the page there's this code added to my page:

<script>var homebase = "https://example/channel/foo";</script><!-- Root element of PhotoSwipe. Must have class pswp. -->
<div class="pswp" tabindex="-1" role="dialog" aria-hidden="true">

    <!-- Background of PhotoSwipe. 
         It's a separate element as animating opacity is faster than rgba(). -->
    <div class="pswp__bg"></div>

    <!-- Slides wrapper with overflow:hidden. -->
    <div class="pswp__scroll-wrap">

        <!-- Container that holds slides. 
            PhotoSwipe keeps only 3 of them in the DOM to save memory.
            Don't modify these 3 pswp__item elements, data is added later on. -->
        <div class="pswp__container">
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
        </div>

        <!-- Default (PhotoSwipeUI_Default) interface on top of sliding area. Can be changed. -->
        <div class="pswp__ui pswp__ui--hidden">

            <div class="pswp__top-bar">

                <!--  Controls are self-explanatory. Order can be changed. -->
                
                <div class="pswp__counter"></div>

                <button class="pswp__button pswp__button--close" title="Close (Esc)"></button>

                <button class="pswp__button pswp__button--share" title="Share"></button>

                <button class="pswp__button pswp__button--fs" title="Toggle fullscreen"></button>

                <button class="pswp__button pswp__button--zoom" title="Zoom in/out"></button>

                <!-- Preloader demo http://codepen.io/dimsemenov/pen/yyBWoR -->
                <!-- element will get class pswp__preloader--active when preloader is running -->
                <div class="pswp__preloader">
                    <div class="pswp__preloader__icn">
                      <div class="pswp__preloader__cut">
                        <div class="pswp__preloader__donut"></div>
                      </div>
                    </div>
                </div>
            </div>

            <div class="pswp__share-modal pswp__share-modal--hidden pswp__single-tap">
                <div class="pswp__share-tooltip"></div> 
            </div>

            <button class="pswp__button pswp__button--arrow--left" title="Previous (arrow left)">
            </button>
            
            <button class="pswp__button pswp__button--arrow--right" title="Next (arrow right)">
            </button>

            <div class="pswp__caption">
                <div class="pswp__caption__center"></div>
            </div>

        </div>

    </div>

</div>

What's the use of this code? Does it need to be there?
I have some issues with it: it shows undesired empty elements on my page when setting up more advanced css.

show all 9 comments

Emanuel

Sun, 01 Dec 2019 18:00:39 +0100

tested on Hubzilla versions 4.6RC and 4.4.1.
Same thing happens when the page is a html page.

Emanuel

Sun, 01 Dec 2019 18:06:12 +0100 last edited: Sun, 01 Dec 2019 21:46:51 +0100

Example of a dummy page with css:
https://labonneheure.ch/page/emanuel/test
see undesired six grey blocks in the bottom left corner of the page body.

Emanuel

Sun, 01 Dec 2019 20:21:34 +0100 last edited: Sun, 01 Dec 2019 21:47:37 +0100

well, my workaround is to add this to my custom css:


.pswp{
    display: none;
    position: absolute;
    width: 100%;
    height: 100%;
    left: 0;
    top: 0;
    overflow: hidden;
    -ms-touch-action: none;
    touch-action: none;
    z-index: 1500;
    -webkit-text-size-adjust: 100%;
    -webkit-backface-visibility: hidden;
    outline: none;
}

Then it's not visible anymore. The question why this element it put on the page remains.

hEARt PhoniX

Sun, 01 Dec 2019 22:46:24 +0100

Mario Vavti

Tue, 03 Dec 2019 12:05:09 +0100

As @h.ear.t pointed out, uninstalling the gallery app for the channel you use should remove this html.

The question remains if we should add this html just for the default template or for other templates aswell. Any opinions?

Emanuel

Tue, 03 Dec 2019 12:20:12 +0100

@Mario Vavti

The question remains if we should add this html just for the default template or for other templates aswell. Any opinions?

I will try to build up gallery content within a page using the zen template. If it works out, it would be nice to keep the html somehow, maybe as an option when creating the page...
Uninstalling the gallery app indeed solves the issue. But I would say uninstalling the gallery app just for that reason is disproportionate

Mario Vavti

Tue, 03 Dec 2019 12:56:09 +0100

In fact, someone building a page using the zen template has probably code rights and can add the html and javascript using blocks. From this point of view it would make sense to only add this code when using the default template.

Another approach could be to have a configurable whitelist of pages where the photoswipe code would be added. That would complicate things for the everage joe though...

Emanuel

Tue, 03 Dec 2019 13:16:43 +0100

Another approach could be to have a configurable whitelist of pages where the photoswipe code would be added. That would complicate things for the everage joe though...

I wouldn't do that. It should be kept simple.

From this point of view it would make sense to only add this code when using the default template.

True. I agree.

Mario Vavti

Tue, 03 Dec 2019 13:28:59 +0100

I have just looked at the gallery addon code again and it seems like i had planned a predefined modules white list (see gallery_supported_modules()) but it is not implemented. I can't recall why atm. Maybe i just forgot about

I will have a look and possibly this will also solve your issue...

Small suggestions for the zotlabs.org page

Emanuel

Basel, Schweiz, Sun, 01 Dec 2019 13:46:25 +0100

!Zotlabs|Contribute
The text on https://zotlabs.org/page/zotlabs/home starts with

Zot is a webMTA for privacy aware web communication with emphasis on giving you the choice on your needs for privacy.

I don't know what a webMTA is. Maybe it would be good to precise it in the text or to link the word to an explaining page?
On the same site, there's a link "Impressum/Imprint | Datenschutzerklärung/Privacy Policy" in the bottom left corner.

<a href="https://zotlabs.org/page/hubzilla/leg-impr" target="_blank" title="Fehlerreport erstellen">Impressum/Imprint | Datenschutzerklärung/Privacy Policy</a>

The value of the title tag ("Fehlerreport erstellen") should be changed.

show all 8 comments

Emanuel

Sun, 01 Dec 2019 14:39:25 +0100

@h.ear.t You're the maintainer of the site right?
What do you think of making the titles of articles clickable? I think it's easier for sharing them.
It seems zotlabs.org has a display bug: The "share this" link usually shown - when clicking the cogwheel in the right bottom of an article - is covered by a white bar, see attached image. Can others confirm this?

I found a small typo: On https://zotlabs.org/articles/hubzilla/manage-connection-permissions-with-permission-categories

posting too your channel wall

should be

posting to your channel wall

hEARt PhoniX

Sun, 01 Dec 2019 15:36:57 +0100

hEARt PhoniX

Sun, 01 Dec 2019 15:41:09 +0100

hEARt PhoniX

Sun, 01 Dec 2019 23:08:15 +0100

Emanuel

Tue, 03 Dec 2019 11:24:52 +0100

@h.ear.t On https://zotlabs.org/page/zot/zot+about "Here are the specs" is wrongly linked

Emanuel

Tue, 03 Dec 2019 11:53:17 +0100

@h.ear.t

Also concerning https://zotlabs.org/page/zot/zot+about

I think it's a good idea to structure the menu on the left a bit. Maybe a submenu for "zot specs" and one for "community"

kris

Tue, 03 Dec 2019 12:32:16 +0100

as far as I know osada is dead

Why do not remove the osada column ?

https://zotlabs.org/page/zotlabs/comparison+hubzilla+zap

hEARt PhoniX

Tue, 03 Dec 2019 14:55:48 +0100

Url shortening syntax for /page/webname/home

Emanuel

Basel, Schweiz, Mon, 25 Nov 2019 00:14:15 +0100

!Zotlabs|Hubzilla Development
@Mike Macgirvin pointed out here that there are following syntaxes

https://example.com/~foo
https://example.com/@foo

for shortening https://example.com/channel/foo.
What do you think of using one of them for shortening https://example.com/page/foo/home ?

show all 17 comments

Hans W

Mon, 25 Nov 2019 00:19:05 +0100

The link to the word here translates into https://z.macgirvin.com/item/d4d1b2dc-fa73-43b0-8943-23c0f90a1475

An item on a site. It also holds the same site in base64 (can be decoded by any fool). I wonder why

Hans W

Mon, 25 Nov 2019 00:25:42 +0100

And it is weird to link the user as a parameter into that link. Users are on the federation to not be tracked, It is a bad thing that site does link the users

Haakon Meland Eriksen (Parlementum)

Mon, 25 Nov 2019 07:04:50 +0100 last edited: Mon, 25 Nov 2019 07:05:39 +0100

The Zot protocol in Hubzilla and Zap allows decentralized publication with privacy for a nomadic identity, i.e. the goal is to identify you as you anywhere, so items can be published and shared privately between you and your mutual connections. This is a different goal than being anonymous.

hoergen on Friendica

Mon, 25 Nov 2019 09:10:25 +0100 from Friendica

@Emanuel The example : https://example.com/@foo is exactly the profile address of mastodon users. I wouldn't choose that option, if you don't want to actively collide with this network.

Mike Macgirvin

Wed, 27 Nov 2019 20:59:16 +0100

@emanuel @ la bonne heure @Hans W @Haakon Meland Eriksen (Parlementum) @hoergen on Friendica

Why would you collide with Mastodon? In any event, both of these syntaxes are a shorthand for "home" and both take you to the channel home, no matter what physical path is used by the system. If you want to change this to "my page home" rather than "my channel home" I would probably make this a personal configuration option - or use something else, like maybe '='. The problem with using something else is that we'll end up with a can of worms because there aren't enough symbols we can use legally in a URL when somebody decides they also want a shorthand for their photos page or their chess game.

The best alternative by far is to create a simple URL shortener addon which you can use whenever you want for anything on the site. You can generate the names algorithmically - https://example.com/s/a, https://example.com/s/b .... https://example.com/s/aa, https://example.com/s/ab, etc. and/or let people create their own more meaningful shortnames just as long as they are the first ones using it.

Re: the use of your identity in URLs. The use of identity on this network can be turned off selectively with a plugin and there are existing plugins (such as 'authchoose') to use as examples of how to do this. When it is turned off you won't be able to access anything private because the other site won't know who you are. This is totally different from the OCAP concept where you hand out keys to your private stuff and pray the keys don't get in the wrong hands. When it comes to privacy those are your only realistic choices. We either need to know who you are when you visit our site or you need to have a key. Knowing who you are is the most secure of the two.

Every technology can be used for evil. But never forget that every technology can also be used for good. We're building a world where technology that has traditionally been used for evil is turned around and is used for good instead. You might not agree with that goal and I respect that. However if you reject a technology because it can potentially be used for evil, you should probably just take all your computing devices and communication devices and toss them in a bin right now. There are thousands of corporations and governments who not only know who you are, but also where you are and everything you like or dislike. We use decentralisation to foil tracking. If a rogue or evil fediverse site tracks you, all they can see is you accessing their site. They can't see your access to any other sites, unlike the corporate trackers that follow you all over the web and know you better than your family members. Oh and evil fediverse sites are tracking and analysing you already and (surprise) they don't need an identity token in the URL to do this.

Emanuel

Wed, 27 Nov 2019 23:11:46 +0100

I like the idea of an url shortener addon!

Hans W

Wed, 27 Nov 2019 23:14:43 +0100

In general, security companies will not promote short urls. I can only state it is for obvious reasons. Just like embedding objects using an iframe.

Short urls are not to be trusted is the general idea. It enables people to have a fly by apt

Max Kostikov

Wed, 27 Nov 2019 23:17:18 +0100

@Emanuel BTW we already use external shortner in Twitter addon.

Mike Macgirvin

Wed, 27 Nov 2019 23:23:04 +0100

@emanuel @ la bonne heure @Hans W @Haakon Meland Eriksen (Parlementum) @hoergen on Friendica @Mike Macgirvin ⚡

Short urls are not to be trusted is the general idea.

https://example.com/~foo is a shortened URL.

https://z.macgirvin.com/item/d4d1b2dc-fa73-43b0-8943-23c0f90a1475 is a shortened URL.

#justsayin

Hans W

Wed, 27 Nov 2019 23:24:49 +0100

B.t.w., the base64 encoded url is also not safe. It I know Emanuel knows certain people he posts to without me in the list then it will not be hard to simply adjuse a few bits in the url to find the content.

If this was meant to hide something then it is better to use a salt together with sha256. That way you can also think about having different salts for different lists.

Max Kostikov

Wed, 27 Nov 2019 23:32:59 +0100

@Hans W

base64 encoded url is also not safe

I believe we use base64 not for safety but to easily embed links. URL can contain some symbols which can be a mess in some cases.

Mike Macgirvin

Wed, 27 Nov 2019 23:54:24 +0100

@emanuel @ la bonne heure @Hans W @Haakon Meland Eriksen (Parlementum) @hoergen on Friendica @Mike Macgirvin ⚡

You are welcome to decode the base64 if you desire. There is nothing secret being passed. It is being used to encode a message-id which can be generated by any protocol or network entity and may consist of _any_ byte sequence - into a URL which has a strictly defined character set and a set of rules for where these characters may appear. The message-id is what we use to look up any individual article in the database. It could have been generated by WordPress or Mastodon or the New York Times - we have no control over this. It might even be a URL itself or it might just be a random stream of bytes. We just need to ensure that whatever it is can be used in a URL without breaking anything.

Einer von Vielen

Thu, 28 Nov 2019 13:44:55 +0100

B.t.w., the base64 encoded url is also not safe.

@Hans W Are you aware of the fact that even you have (got sent / stolen / guessed) this "randomised" URL you are not automatically allowed to access it in Hubzilla/ZAP, because there is an ACL for this and you might get refused to see it by the server?

Hans W

Thu, 28 Nov 2019 13:52:35 +0100

Might be, did not test it. Fact is that it is very easy to decode the string. Hence my remarkt about using a salt and maybe a better encoding.

base64
md5

Both have rainbow search sites that will do it for those who want to decode. Md5 is a bit harder but doable.

Einer von Vielen

Thu, 28 Nov 2019 13:55:54 +0100

@Hans W You have this link...

https://z.digitalesparadies.de/item/f54c3d30-f7fb-4370-8570-c4a7e18a1cdc

Can you read it?

Einer von Vielen

Thu, 28 Nov 2019 13:58:37 +0100

@Hans W You have this link...

https://z.digitalesparadies.de/item/e28c5765-a105-4696-a1ed-08cb1916bd38

Can you read it?

If everything works as expected you should

not be able to read https://z.digitalesparadies.de/item/f54c3d30-f7fb-4370-8570-c4a7e18a1cdc
should be able to read
https://z.digitalesparadies.de/item/e28c5765-a105-4696-a1ed-08cb1916bd38

Thats because of the ACLs on everything in Hubzilla/ZOT.

Einer von Vielen

Thu, 28 Nov 2019 14:07:41 +0100

@Hans W There is another interesting thing here: I posted the two links above from my server https://zap.digitalesparadies.de where I am currently logged in.

But the channel on https://zap.digitalesparadies.de is a clone of my channel from https://z.digitalesparadies.de. The "https://z.digitalesparadies.de" is in the URLs above (and not the https://zap.digitalesparadies.de where I am currently logged in.)

Resist prison (or any concrete) construction

Emanuel

Basel, Schweiz, Sun, 24 Nov 2019 01:14:11 +0100

Daily Anarchist Meme For Cool People wrote the following post Sat, 23 Nov 2019 12:25:54 +0100

This also ruins the sugar, just so you know.

I post pictures / meme every day about anarchy and other cool stuff.
Feel free to download and share them ! :)

#shitposting #anarchist_meme_for_cool_people #history
#history #French #France #prison #construction #sabotage
#anarchy #anarchism
Image/photo

People in Slovakia, Austria And Hungary can sit at the same table without crossing the border

Emanuel

Basel, Schweiz, Sat, 23 Nov 2019 10:59:04 +0100

elegance@socialhome.network wrote the following post Fri, 22 Nov 2019 08:03:11 +0100

People in Slovakia, Austria And Hungary can sit at the same table without crossing the border

#meeting #places with a difference

show all 5 comments

tofeo

Sat, 23 Nov 2019 20:12:17 +0100

Basel is also a corner of France Switzerland and Germany

Emanuel

Sun, 24 Nov 2019 01:07:27 +0100

@tofeo yes indeed. I live in Basel

The nice thing to live here is that you can go over to France and Germany by bicycle just like this, for fun, do some stuff, eat something and go home again, and in the meanwile only two, three hours passed since you left

tofeo

Tue, 26 Nov 2019 23:08:39 +0100

Yes I know very well that region too. I use to live there too