The updated article is here:

http://techrights.org/2021/03/15/duckduckgo-in-2021/

There is too much censorship & shenannigans like concealing censorship from modlogs to trust lemmy.ml anymore. I just saw a post about how the admins removed a community creator and quietly put someone else in control.

There’s a lot of tor-hostile links in this post and references to untrustworthy sites and services.

It’s bad advice. Sony and Motorola are terrible recommendations. See https://neoreddit.horobets.me/post/51

wow what a blast from the past. I’m quite surprised Soulseek is still around and still actively maintained.

Is there any way around this? As this would seem to defeat the purpose. Using it as 2FA means all your 2FA codes get sent publicly. Using it is a temporary messenger means anybody can read those messages, etc.

It’s a race condition. They send a verification code, you use it to verify your account immediately, and then the one-time-use code is no longer usable. The others who see the codes coming in have no simple way of knowing which account the code is for, so the code is useless to them. Even if someone knows the number you used and how to reach the service, they would also have to know when you’re going to receive the code and they would have to know your userid (and possibly pw).

In short, a highly skilled adversary would have to be in your threat model. And if the adversary is so skilled that they’ve penetrated your system and rooted it, then you’re pawned anyway.

People who use the kinds of services that need your phone number aren’t really committed to privacy as an activist, but they care about their own privacy from a selfish standpoint. E.g. they’re willing to create a Google account and help a privacy abuser profit as long as their getting enough privacy for themselves (like not sharing their phone number).

I used to use pinger numbers to create accounts but evolved past that realizing that I was still feeding the privacy abuser by dancing for them and using their service. So I simply walk when asked for a phone number. It’s really the best solution.

Exceptionally, there are some situations where you already have an account (e.g. for your bank, school, or even Twitter), and out of the pure blue Twitter says “we think you’re a bot – for ‘your protection’ you must verify your phone number.” Then you’re trapped. Access to the profile you’ve built over the years is suddenly threatened, and your data is being held hostage until you surrender a phone number. In that case, the pinger number is quite useful… use it, download your data, and gtfo and don’t come back.

This is why gitlab.com should be listed as a service to avoid, like MS Github.

About Qwant, what is so bad about it?

I go into some of it here:

https://lemmy.ml/post/31487

While I appreciate your dismay for GitHub (which I share), I don’t think your “(shamefully)” concept would be constructive to our platform.

The precise word choice is immaterial to my thesis. The status quo needlessly promotes MS Github. One option is to use “shamefully” in cases where the project using it has core purpose to its mission that’s undermined by its use of MS github. The word would be far-fetched for projects where privacy or the environment are orthogonal to their mission, in which case “unfortunately” would suffice.

One of the main facets of ReverseEagle is to educate people on alternatives, and why they’re so much better.

Of course it educates. Neglecting to link to page of Github harms is a missed opportunity to educate.

About Gitlab.com: we have decided not to list that, as it’s hosted on Google Cloud and Cloudflare. Instead, we thought it was wiser to direct uneducated users to a wide range of alternative hosts.

You list Github precisely because it is detrimental. Yet for the very same reason, you’re choosing *not* to list Gitlab.com. Why the inconsistency? Gitlab.com is even more harmful than Github. They should both be listed and condemned together.

While I was creating the article listing alternatives to Visual Studio, I felt that the best approach to listing alternatives was to list other developer environments. It wouldn’t be appropriate to say “learn a different language”.

The stated purpose of the project is “Privacy-conscious, ethical and safer alternatives to software for developers.” Because “ethical” is mentioned, promoting unethical languages (i.e. languages that hinder free society and feed unethical tech giants) is counter-productive. To be very precise, learning the offending languages is not in itself where the harm is done. If Bob’s C# program only runs on his machine and is never distributed, and he never uses MS products to develop it, no harm is done. The harm is done when a tool in an MS-controlled language is publicly distributed because it empowers Microsoft and adds to the dominance and demand of an exclusive and oppressive language. Of course it’s appropriate to condemn polluting the commons with software that works against Reverse Eagle’s stated mission.

Who learns a language with intent to keep the works they create internal? It’s very unlikely outside the non-free software context, so learning C# will generally propagate the spread of it.

The thing is, there’s a lot of research that’s gone into UX work that makes your suggestion hard. For example, it might have the opposite effect: less people would click the link, as that’s an extra step.

Two cases:

1. They click the link– they discover Lemmy and they make a move to it. That’s also less time that they are on Reddit, feeding Reddit and making Reddit’s ads profitable.
2. They don’t click the link– a moment of their time was spent making their Reddit UX worse. The more frustrations experienced by Reddit users, the more the Reverse Eagle mission cause benefits.

It’s a win either way.

If I were an uninformed user on Reddit, I would much rather have the text on the page.

Are you actually trying to add value to Reddit, and make the Reddit UX positive enough to keep ppl there?

So bear this in mind: we’re a young community, we still might need to rely on platforms like Reddit to ‘spread the word’. We’ll see.

That being said, we do continue to link people to our Lemmy, from Reddit. I think I speak for everyone on the ReverseEagle team when I say: Lemmy is unanimously preferred over Reddit.

Then there’s no reason to link into Reddit from outside of Reddit. All links outside of Reddit of this kind should reference a Lemmy post.

Of course, and we don’t blindly trust them. They even say you should seek advice from other platforms on their page.

In principle it’s good that they do that, but PTIO and PRISM Break are terrible recommendations that far too often undermine their own cause. Neither of those projects have integrity and it’s harmful to mention them.

What platforms would you recommend for this? I heavily doubt immature FOSS projects have enough donations to be able to self-host a discussions platform like Discourse.

There is a huge list of alternatives, but I see no reason not to stick with git.sr.ht and framagit.org. Git is inherently decentralized, but there is a project that takes the idea further which is perhaps worth mention.

I think you’re proving a point I made the other day. As we continue to be more influential, and make waves in the FOSS world, we need to be very careful of which products we actually recommend.

I did not suggest recommending Patreon, Liberapay, and Open Collective. I suggest condemning them. Of course condemning these services is not risky, unless you consider advocating for your own mission risky.

If you want to find an alternative to endorse, there is a raw list here (some good, some bad) to review.

There is also freedomsponsors.org and villages.io. Both are hosted by Amazon but perhaps a lesser of evils.

Especially where money is concerned. Then, it gets hairy. Doesn’t Liberapay use PayPal too?

IIRC, Liberapay accommodates Paypal if a project discloses their PP acct. You should look further in case I’m confusing the three. But I think there is no choice with Patreon – it’s Paypal or nothing.

Are you offering to provide an improved version?

I did. I’ve got more dirt on MS than that, but it’s a start. Since the project is on framagit, I might be willing to contribute more directly.

If you have any more suggestions, and if you are in possesion of a Matrix account, please join our Matrix room.

Matrix seems to have a high-level dependency on CloudFlare, so I’ve not even been motivated to investigate using it yet.

I applaud your effort overall. We need more of these kinds of efforts. I do see ways to improve:

Most FOSS projects are vaguely aware of MS Github’s controversy, but they lack the constitution and integrity needed to abandon Github. Proponents of social responsibility are blocked from contributing bug reports to FOSS projects because they cannot or will not enter the private walled-gardens of Microsoft and Gitlab.com. So it’s important to tell developers that if they insist on using Github or Gitlab.com, they put the bug tracker in a non-controversial publicly accessible place. I find bugs that I often don’t report because of this problem. They should also be advised to at least mirror their project on a free and open alternative.

Regarding Switching Software as a partner and your plug for tycrek/degoogle: you can get good and bad advice from them. Check out my review of Switching S/w. E.g. DuckDuckGo is a terrible alternate to suggest to people. The tools Switching SW endorses need further analysis; you can’t blindly trust them. For tycrek/degoogle, there are a few lousy search engine recommendations. I suggest plugging them this way: “tycrek/degoogle (but disregard the search engine advice)”.

The wording would have to account for the fact that some regions have (will have?) privacy laws that force DNT to be honored. California may be one such place though I’m vague on this. I think the next revision of the CCPA will force DNT respect, IIRC.

Condemning DNT on the basis that some ppl don’t respect it is not sound rationale. DNT was never designed with an expectation that all websites would honor it. Some honor it, some do not. Ecosia.org is an example of a website that honors DNT. To disable DNT is to give up privacy for nothing. Two cases:

1. Website respects DNT-- You obviously have the benefit of privacy by sending a DNT signal. If you don’t send a DNT signal, you give up privacy for nothing.
2. Website does NOT respect DNT-- You gain nothing by using DNT, but you also lose nothing. It’s a wash; makes no difference either way.

Exceptionally, there is one reason not to use DNT: fingerprinting. Poorly designed browsers ship with DNT disabled by default. Users who proactively change their DNT setting are in a minority and thus have a more unique browser print. The asinine brain-dead decision of some browser developers to disable DNT by default ensures that those who don’t care (who don’t alter the setting) fail to serve to unify the browser print for those who do care. The users who care enough to change the DNT setting are the ones who are forced to compromise protection from one privacy intrusion (browser printing) to gain protection from another privacy intrusion (optional tracking).

So when assessing the privacy-fitness of a browser and the competency of the developers, browsers that enable DNT by default are the ones to favor.

As I understand it, the LibreSignal issue was a matter of trademark enforcement (specifically, the trademark “Signal”). Signal did try to get LibreSignal to stop using Signal’s servers, but it’s unclear to me (IANAL) if Signal had the legal or technical ability to block LibreSignal from using Signal’s servers (and I don’t think you’d accomplish this with a trademark suit).

The trademark case was the easy legal tool that OWS lawyers could intimidate LibreSignal with. The lawyers threatened F-Droid and F-Droid folded. F-Droid removed LibreSignal, and LibreSignal did not have the resources to fight OWS lawyers. Trademark infringement of course wasn’t the real reason for OWS threats. The real reason was that LibreSignal made it possible for users to violate OWS’s network protectionist ToS. OWS has no direct case against LibreSignal for that, because it’s users of LibreSignal that violate the ToS, not the LibreSignal project. The LibreSignal project isn’t bound by the ToS – only users who agree to the terms can be subject to them. OWS would have to sue each of their own users who make use of LibreSignal independently, which is highly impractical. This is why they pushed the trademark angle. It was a legal hack to impose their network protectionism.

LibreSignal was abandoned voluntarily, not because Signal forced them to.

It wasn’t ordered by a judge, but force comes in many forms. LibreSignal was abandoned because they couldn’t finance the legal battle. That’s force. To be unable to finance the cost of freedom is to not have the freedom.

It’s also unclear how much of this is relevant to Lemmy. I’m unaware of the Lemmy developers threatening any lawsuits over forks, or expressing a wish to block forks from federating with Lemmy.

It’s relevant to your claim that free software = freedom to use the network how you wish. Whether the Lemmy project would actually make good on enforcement of their Antifa agenda remains a question. But certainly they can if they want. They can trademark “Lemmy” if they want, and they can create a ToS that bans unauthorized Lemmy mods if they want. So it’s wrong to claim GPL’d s/w is the end of the story as you did.

(Edit: It’s also worth noting, Signal’s developer is openly hostile to the idea of federation and wishes to control every aspect of “his product.” I see no indication that the developers of Lemmy share that view. If they did, they would not have designed Lemmy to be federated to begin with.)

It’s also worth noting that the Lemmy project openly hostile to non-supporters of Antifa. It’s also worth noting that the Antifa has no restraint in pushing their ideology – they don’t even renounce violent protest.

It’s not clear to me that other ActivityPub servers need “permission” to federate with Lemmy at all.

Using a network without permission is trespassing. Permission need not be express; it can be implied, but ultimately the owner of a server has a right to control access to their resource.

An instance of Lemmy using a hard-coded slur filter != That instance of Lemmy assuming other peers are using the exact same slur filter

This is a bad assumption. You cannot assume that a hard-coded elements are not relied on in a design. Such an assumption is perversely stupid. If you must assume something, you should assume that a project may rely on hard-coded behaviors. This is why (as I pointed out) it’s a poor design to hard-code the slur filter.

It’s more a synonym for anti-fascist,

Antifa is far more than that.

As mentioned before, while the developers of Lemmy are communists and this particular instance is an explicitly anti-fascist instance, the slur filter targets expressions of hate, not discussion of capitalism or liberalism.

Where was this “mentioned before”? You’ll need to quote that. This instance is not simply anti-fascist – it’s actually Antifa.

I’m not sure what valuable discussion is being suppressed by this filter.

Suppression is not a significant problem with the slur filter. Other problems arise out of the poor design of the filter, like users having to become programmers to change the filter, and the interoperability risks I detailed (both legal and technical).

As I see it, with few exceptions, anyone using such language is not participating in good faith.

Not if they’re using the language to discuss the language. e.g. “I was minding my own business and someone called me a k-i-k-e”. Suppressing that would be to suppress the victim of hate. It’s profoundly short-sighted to think those words are only directly inflicted on others.

sorry, you’re right it’s not Google’s captcha. I wrote about it here but then I had forgotten: https://lemmy.ml/post/31487

/cc @resynth1943@lemmy.ml

As a Tor user, the CAPTCHAs from Qwant are frequent enough to be unusable and they’re implemented in a particularly abusive manner. That is, Qwant presents the query page without CAPTCHA every time, thus giving users an opportunity to waste their time as they compose a search query, then after submitting the search query the CAPTCHA manifests.

It’s a dark pattern. So after the user has invested some effort, the choice is throw away your effort so far or play the CAPTCHA game. If you walk, you’ve helped feed Qwant’s & Microsoft’s analytics and left with no reciprocity in return.

The CAPTCHA is actually worse than CloudFlare’s. CF uses hCAPTCHA while Qwant-Microsoft uses Google reCAPTCHA (which is more privacy abusive). (corrected- see below)

It seems like you’re arguing from a point of unfamiliarity with federated social media like Mastodon. When you’re talking about “syncing the message” being able to “crash” an instance of Lemmy, this is not based on how anything ActivityPub actually works.

I don’t know what Lemmy does, and I’m not sure how much clearer I could have been that the possible outcomes mentioned were speculative, having seen no other Lemmy code than the slur filter. I saw just one line of code and it was lousy.

Mastodon nodes certainly *do* store copies of msgs from other nodes, which is precisely why I would envision Lemmy having msg redundancy.

Below you’ve construct a straw man about how if a slur filter has been implemented one way, then that means that it must programmatically break federation if it’s variant between instances

You don’t know what a straw man is. A straw man is obviously *not* speculating on risks and outcomes. To construct a straw man is to misrepresent someone else’s argument. My reply was to @adrianmalacoda@lemmy.ml . I did not even present his arguments, so there was obviously no opportunity to misrepresent them.

Pretty radical semantic versioning you’ve got going on there if every modification requires a different project name. 🙄

This ^ is an example of a straw man. I neither said nor implied that a modification “requires a different project name”, yet you’re implying that this is my stance.

When you fork a project and modify it, and the mods are not to be integrated upstream, the new software is different and the project is yours regardless of what you name it. If the original project name isn’t trademarked and you don’t care about causing confusion, you can name it the same if you want, and even choose conflicting version numbers. The authorship is likely different as well (it’s the set of all upstream authors plus yourself).

The way these instances will interact has probably not yet been specified, so it’s ridiculous to start getting up in arms about it.

You’re apparently implying here that you think it’s wise to ignore the production of code that will likely cause a conflict in the future and wait until the problem manifests during operation time. As opposed to thinking in advance “hey, hard-coding an English slur filter for the world maybe isn’t the smartest way forward”?

This is *precisely* the time to get the design right on this-- if not sooner.

Please do not start spreading pseudotechnical FUD about the properties of this software without reference to fact.

I’m afraid state of the art software design principles are not “fact”. Sorry you have to hear this from me, but competent design prior to implementation is a subjective opinion. It’s an opinion that’s widely held in high regard across the most prestigious academic institutions in the world and has far more merit than the sloppy and reckless approach you’ve suggested. And how dare you present your “personal opinion” and then demand facts – without so much as stating what factual information you’re in need of.

No, but it creates the potential for someone else to create it if they wish.

No it doesn’t. That software doesn’t execute in a vacuum. It needs to interact with other software. A recent proven disaster is with the Signal’s so-called “free software”. It’s GPL’d but if you modify it, it is something else, and that something else is legally prohibited from connecting to the Signal network. Someone created “Libresignal” and Open Whisper Systems threatened lawsuit. Libresignal shut down and abandoned their work.

It’s a similar situation here. You can modify Lemmy all you want, which makes it something else, but that doesn’t give you permission to connect to Lemmy instances. And even if you get permission, that doesn’t mean it will function. I already detailed why.

Not to mention the software doesn’t exist. The failure to design Lemmy well puts *users* in a position of having to be *developers*, in the best case. If a *user* needs to write code, it’s a bad design. It absurdly restricts users to those with expertise and skills that a software user shouldn’t need to have.

but I hope it doesn’t assume this

Of course it does. It’s hard-coded. It’s a valid assumption, and the assumption simplifies the design. Why would they do extra work to assume the code isn’t what it is? If the design assumption is that the slur filter is changeable, then it’s a bad idea to hard-code the slur filter in the first place. You don’t hard-code something that’s presumed mutable.

that it’s possible or even desirable to be “non-political” or “neutral”

It’s actually trivial to create a communication tool like Lemmy without political bias. You simply don’t hard-code things like slur filters and you give moderation freedom to the instance operators not the developers.

or that catering to an anti-antifa audience is a worthy goal.

Let’s not conflate “anti-antifa” with “non-antifa”.

Perhaps you have the misconception that Antifa is simply a synonym for being anti racist. They are also anti-capitalist and anti-government, and they do not renounce violent protest. This makes them a relatively small fringe group. For example, most Americans (conservative and liberal) endorse capitalism and condemn violent forms of protest. That’s probably roughly ~300 million ppl who aren’t onboard with Antifa ideology. Why shouldn’t they have a voice?

Bingo. Boycotting is the real answer. Otherwise if you dance for them, you serve as an enabler. It’s not worth it.

And when it’s the public sector (i.e. talking to a government office that you can’t boycott), I write an old-fashioned letter, print it out on paper, put a fucking stamp on it, and go to the fucking mailbox like it’s the 1980s. There is satisfaction in knowing that someone has to open that shit up and perhaps manually do some data entry or scanning.

I used to think it was purely Tor users getting most of the mistreatment, but recently normies are reportedly getting hit with CAPTCHAs from Bing-sourced search engines (e.g. Qwant, Ecosia, Swisscows, etc).

Being free s/w does not automatically make s/w appear out of nowhere. Find a fork that:

1. Has removed or soft-coded the slur filter
2. Attests that the changes to their fork do not break compatibility with other federated nodes. (What happens when they hack the filter to allow the word “salt-w-a-ter”, and then one node tries to sync the msg with an instance that uses the stock slur filter? For all we know, it could crash in a nasty way, or it could simply circumvent the filter. Or if the filter gets applied and one copy of the msg differs from that of another node, will the next sync re-copy the msg? Could this start a loop between different instances trying to sync the same msg with different text? Will instances with a different slur filter have to sever connectivity with nodes of different slur filters? Because it was poorly designed with the absurd assumption that everyone wants the same English-based slur filter, we have to assume there would be a chain of problems. Obviously the current design wasn’t thought through.)

If you can find such a fork then you’re on to something – and whatever it is, it’s not “Lemmy”, because once you change it it’s something else. This thread is about Lemmy and you’re effectively using an “argument to the future” fallacy by bringing up software that doesn’t exist.

Had they soft-coded it, then these matters would be moot because the design would have to accommodate slur filter variation. But they didn’t. They decided to micro-dictate moderation. So the design can assume everyone is using the same slur filter. It’s their choice to do so but reflects poorly on credibility. And I happen to concur with most of the bad-word list (not the design or implementation, but simply the words).

Of course this raises the question: what else is inappropriately hard-coded as a result of this biased authoritarian tendency, and how will that break the network when ppl hack it to be politically neutral or reasonable for a wider audience than Antifa?

Peekier, Gomu, and Joshwho are all CloudFlare sites. And if that’s not embarrassing enough, Peekier and Gomu simultaneously claim to be privacy-respecting. So I won’t be looking any further at those two unless something else brings me to them. It’s appalling that they claim to offer privacy while letting the biggest privacy abuser of the web see the queries and all traffic to those sites. Either it’s profound ignorance or it’s intellectual dishonesty.

Runnaroo seems to be garbage.

Swisscows sources from MS Bing and like many engines that do that, they treat Tor users with hostility (just like Qwant and Ecosia).

from the article:

“Reddit’s source code uses bundling and minification”

Would be nice if uMatrix could detect obfuscation on any j/s it retrieves, and have 2 separate switches: one for retrieval & one for execution. Users have to guess on what to trust and this would help ppl make more informed decisions.

BTW, I will not upvote the OP b/c it sends ppl to a CloudFlare site. This is a replacement link.