My guess is that it’s the easiest and cheapest way to set up “MFA”.
TOTP is cheaper.
SMS is actually expensive at scale. An example would be Signal, the messenger app that doesn't use SMS. They have overhead for sending backup codes/new account creation/Verification/etc... https://www.wired.com/story/signal-operating-costs/ 6 million a year. API integrations for SMS messages/codes are still like 1-5 cents per message.
TOTP's requirements? A reasonably accurate clock on the server, and storing the shared secret in a database.
A Karen and a cop can’t put someone in jail. It takes a prosecutor, a judge and a jury of her peers.
This is not factual. A cop can bring anyone into jail that they have just about any made up reason to.
It takes all those extra individual to put you in prison.
https://www.merriam-webster.com/grammar/jail-vs-prison-difference
and will just pop off fast solutions to things like the deep human need for connection like “use zoom, duh.”
There are other needs as well. Like not being imprisoned. And thinking about why you fled from the country in the first place and searched for additional citizenship might have helped make such a decision to not find yourself in such a situation.
I love that you glossed over the actual argument though! All while assuming that you were right. You don't know why she was there... But assuming that telecommunication wouldn't have been sufficient in order to maintain her freedom... That's just silly.
Visiting family perhaps? Oh well then I guess she deserves it for having the audacious stupidity to visit her parents in a shitty country where shitty things happen?
Honestly... Yes. You left the country. Obtained a second citizenship. And donated to the opposing side of an active war. If you have something in between your ears you stay out of the country. I'm not here to victim blame at all. If you need to see family, I get it... but Zoom exists. You can't argue
There are also family, professional opportunities, and cultural ties to consider.
While in the very next sentence identifying that she did exactly that and moved anyway.
but so far at least I’m happy with the bandwidth.
Oh for sure, it's boatloads and I love it... but I'm in the market for a /28. I want to hand them like $40 extra a month. LET ME PAY YOU QUANTUM/LUMEN/CENTURYLINK/LEVEL3. It's effectively free money as once it's setup there's nothing that changes or goes down. There's so little maintenance/upkeep cost to it that I just don't understand why they don't want to print free money.
This is already a risk whether via the existing thumbnail storage
Not anymore. You can opt out of it for the most part.
# Leave images unchanged, don't generate any local thumbnails for post urls. Instead the the
# Opengraph image is directly returned as thumbnail
"None"
Yeah that was 19.4. It's doesn't proxy everything unless explicitly set to. Just thumbnails I believe. But I could be wrong. And many instance owners would be allergic to that as it leaves them on the hook for storing content. For example... someone posts CSAM... a copy of that is now on your server. You get police raided and you're fucked.
Actually going over it briefly looks like it has a few available options for what it will cache...
I refuse to enable it myself for the above reason. I would venture 99% of instances out there would also refuse for liability and bandwidth costs.
Can you see which communities I follow?
Wouldn't need to see it directly. If someone was to tag enough posts they could deduce it over time. Eg, I could post on every community on every lemmy in the fediverse and over time I can be reasonably sure which communities you follow as you'd see these post in your feed and tracking images would populate your view of them as you scrolled. Would take very little automation to do it.
Which feeds I watch (and when I do that)?
Yes.. because it's possible to use "normal" images to track who's downloading those images, what addresses/user agent/referrers over time is powerful. After enough time, it's entirely possible to deduce which feeds/communities you're watching. Eg, if I post 10 different items, and 3 of them come back to your specific IP address, I would have a really good estimate on which feeds you're likely on. Do this at scale and I bet you could deduce it completely and probably with much less time and hassle than you're thinking. Hell because of my reverse proxy I can see EVERYONE who loads my profile picture. I see ALL the users to run into my posts on complete fucking accident. Lemmy loads /inbox to pull that data.
Hell this is the core reason why everyone pushes back on 3rd party cookies these days. It made this tracking trivial. Tagging every page with some image or asset that forces a connection is effectively the same thing.
Who I interact with through DMs?
I've already stated clearly that this would be the hardest thing. Just because there's one or 2 things that would be hard or impossible to obtain (even over time) passively or as a complete outsider doesn't make the rest of the argument wrong. All it would take is either site operator to leak the data, any type of MITM, etc... to leak the plaintext content of your DMs. Hell federation leaks where it sends data outside of the expected subscribers has happened. Then you have to also realize that many instances use services like Cloudflare or other WAF solutions to stop DDOS's and such.... Those nodes can read the plaintext DMs and all federation data. Any malicious actor that manages to break any single part of the chain has access to it all... and it can be quite trivial in many instances to do so.
The Lemmy system is not "secure". It's not meant to be. Everything on the fediverse is public and all of your actions here are trackable by many parties in many ways even outside of the operators of both ends of the federation action itself. Including how you're connecting and using the system.
DMs alone, and actual hashed passwords are not really needed for a third party threat to act malicious and get all of the aggregated data they'd ever want. You pointed out specifics, I answered those specifics. Then you pivoted to other shit that I ALREADY outlined. This argument is super disingenuous.
I've addressed the points you've brought up. I run my own instance. I can collect just about everything in the DB tables I've seen without being logged into the instance with some external work.
Are you trying to get my point? If you have a specific item that you believe is stored on a lemmy server that you think isn't possible to obtain. I'm all ears. otherwise I think this conversation is done. This kind of response is pointless and I'm not interested in continuing if you're going to act like that.
The hardest thing to collect would be private messages, and login information (which is hashed btw, so even your server operator doesn't really know it). But messages are plaintext and openly federated. All the other information is really really easy to collect through other means.
I'm not sure that Nintendo has any pull in any Middle Eastern country or China.
But all of this is moot as the lawsuit is in the US... And Nintendo would just tell the streaming services to ban them over and over again.
that kind of threat doesn’t work when they can just tell your country to arrest you for breaking the law.
That assumes the country gives a shit. Many countries simply do not care about what Intellectual Property you "own" or created in some other country.
but that instance owners have even more, probably more valuable info, like IP addresses from which not just geolocation but also wake times, device usage patterns and other gnarly stuff could be extracted, that could - together with other personalized surveillance info (like the usual adware stuff) - be aggregated to give a bigger picture.
I have IP behind the geolocation. How do you think that I know the geolocation? It's an IP lookup. My interface that I shown in the image just doesn't publish it because I don't care personally. What I use that service for is simply to track where sensitive emails/documents go. Not to track lemmy. I don't need specific resolutions. Just to know if they leak outside of what I expected.
Device patterns? The app you use is the app you use. That would be given away via your browser header. I also collect that with the tracking image. Just once again. Not shown in the graph cause I don't care to track it personally (I'm only doing this as an example, not to actually aggregate data).
If you use lemmy over the web browser, browsers don't really give up that much information unless you're google themselves. In which case apparently chrome gives up a boatload of information to google's domains.
not-so-public information
You'd have to give me an example of any of what you're referencing. I can collect IP, web headers, access times, and if I tag enough pages or mark the image as non-cacheable could even see multiple views/accesses (you see views higher than actual visitors) I can track your movement across all of the fediverse.
that one can get some info about me through my (public) actions
Simply "viewing" the page (which pulls the image and is not necessarily "public") is a direct rebuttal to obtaining data that isn't "public".
Yeah it’s so simple to just live wherever you want
It is when you hold multiple citizenships. You tend to have more options if you're considered native in multiple countries. You should have read the article.
instance owners have quite a lot more information on their user’s activities
Not really. Only thing additional that could be identified is browsing patterns while on the site itself. I don't think it's that valuable. You likely already gave up what you're likely to see by commenting in communities. That's going to be tracked best through a proxy or something, not lemmy itself. And can even be tracked externally through other means. Ex: This post has a tracking image on it and because you need to connect to me to load it I now see everyone that had loaded this comment. So this can be done externally without even being an instance owner. Click view source to see it at the end of the post.
Votes are federated, kbin instances see them as "likes" publicly. Messages are federated, sent in clear text. And posts that are loaded can be tracked via other means... Think of sites that display ads... They do this exact thing and collect information by the boatload because they can inject on every page that shows an ad. Without needing to be an admin on the site itself.
Edit: In theory someone could canvas/comment on every post with a bot and embed tracking images everywhere. Rotate usernames doing it from different servers and rotate through domains that are all cnamed back to the same tracking node and you could attack the whole fediverse with this type of tracking. Probably already being done... But it would be visible in that we have the ability to check source of each comment. But who the hell is going to take the time to do that?
Edit2: Here's example of what was collected with that embedded image. Keep in mind that this type of tracking can happen with REAL images as well, making it impossible to track. And I'm specifically not tracking much of anything. But things like IP address used to access is on the backend. There's also Browser, OS, referrers... etc...
I've been repeatedly told by everyone I talk to over there that it's not ready yet... still... even though it was supposed to be ready by end of Q2 this year.
Calling them today still yielded the same answer for me.
I'm forced to use DDNS and a service to route my emails for me. But email and PBX servers really don't do well on DDNS type stuff.
I have basically a full rack of equipment. Here's the network side of it all. My desktop is 2 SPF+ fiber connections back to the core switch. Tons of stuff in my rack is all 10gbps or 40gbps.
Dual opnsense firewalls (top 2 slots, dual 40gbps connecting to core switches), though one is inactive until they let me buy static addresses. I run some business stuff on this. Boatloads of homelabbing and self-learning.
If you want to do full IPS/IDS, then yes you need some horsepower. But just connection with basic rules there's plenty out there that's not super expensive. Ubiquiti has their dream machine line which even the "cheap" $400 one can do 10gbps (2gbps with ips, or something like that. I dunno, I don't keep tabs on them).
I didn't stop any active connections/downloads happening on the network. I very likely had a gig of other stuff going elsewhere on the network.
Their "smart-nid" is also a router... so that works too, but I don't trust it and in my setup it's in transparent mode.
Edit: Formatting sucked
My personal best so far is 7TB in a month 😂
This is just my past month... I have no idea what my record is... but would likely be significantly higher as I slowed down on some stuff recently. I need more harddrive bays/harddrives... Stupid ebay doesn't have what I want.
Edit: here's past 90 days as well
Harris did not out perform Biden in ANY category.
The only downside is it’s still IPv6 Rapid Deployment.
And no static IP addresses yet... Even though it was supposed to be rolled out Q2.
And yet here I am in the USA with 8/8 Gbps fiber with no caps. Though I do pay $185 a month. I live in a Red state, and in a metro area, but not near the metro core, in unincorporated county land.
last 30 days stats to prove no caps:
