Indeed. But cups-browsed isn’t necessary in order to be able to print things, it’s for automatically discovering new printers on the network.

cups-browsed <= 2.0.1 binds on UDP INADDR_ANY:631 trusting any packet from any source

Well that would explain why I didn’t have it installed (although I did have other parts of cups until jwz coincidentally reminded us two days ago that it can all be removed if you don’t have a printer.) I clear out anything that opens ports I don’t need to be open. A practice I would recommend to anyone.

Wait, what? You think they’re not planning on getting paid for providing this data to advertisers?

I would say it’s more of a desperate attempt to continue the current paradigm of online advertising which deems indispensable the kind of data about conversion rates to which the industry has become accustomed, despite the recognition that their current means of collecting it must come to an end.

But either way, it’s incompatible with the principles of free software. Users are not meant to put up with features that are there for the sole benefit of someone else; someone they might normally consider an adversary. The only incentive we’re given to participate in this scheme is one that resembles blackmail. Except it isn’t even advertisers saying “do this, or we’ll spy on you like usual” — it’s Mozilla saying “do this, and maybe we can persuade a few of them not to spy on you as much, and to give us a cut.”

They are selling behavioural data about their users to advertisers. People are not going to be happy with that no matter how they try to spin it.

They added a feature to track conversions among Firefox users for online advertisers. Selling it as a “paradigm-shifting boost to online privacy” while accusing others of pushing a misleading narrative is absurd.

There certainly are many people who seem suspiciously eager to find fault with Firefox. But it’s not really a surprise when its authors do things like this. They chose not to make this feature opt-in because they know that nobody in their right mind would opt into it. There is no benefit to the user in it, only risk. Mozilla seems to be leaving us to go off and join the advertising industry instead. People feel betrayed, and it feeds the cynical nihilism that comes so easily to social media users under the conditions of late capitalism.

Maybe some day after we’re done replacing X11 people will collectively find the will to do something about systemd before it gets too much worse. I wonder which will be easier: Throw it all out and start again, or split it up into parts of more manageable size with well-defined interfaces between them.

Self-censorship working a little too well.

https://lists.debian.org/debian-devel/2024/06/msg00041.html

I was wrong, it’s 1024 not 256. It’s a soft limit, so easy to adjust once you’re aware that you need to.

I would certainly advise everyone to choose a phone with that in mind.

The desktop client is not great, but it works. There certainly are things Signal could do better. Its phone-centric nature is ridiculous and I have no idea why they cling to it. But it’s easier than trying to get everyone to use Matrix or whatever — mainly because more people have heard of it.

Be paranoid in your estimation of how much privacy you have, but diligent in your efforts to get more of it for everyone.

Yeah, Signal is good enough. If people use shitty operating systems like Google’s version of Android that’s another problem and not really one that it’s my job to care about that much. What matters is the network effect and every user who moves moves from Whatsapp to Signal is one more person who gains the freedom to easily improve their digital lives further if they someday choose to do so without it costing them the ability to chat with all their friends.

Added a warning that appears in Proton Log for systems that have low file descriptor limit

I’m glad to see that. There are reasons why debian didn’t choose to increase their default limit beyond 256, but some games require it and if you happen to find one it can be tricky to figure out what went wrong.

What they need to do: Ban the practice of showing ads to people based on surveillance data, for a start.

What they will do: Demand that more data be collected to determine which users are children and therefore worthy of protection.

I took notes for the benefit of anyone who doesn’t like their info in video form. My attempt to summarize what Linus says:

He enjoys the arguments, it’s nice that Rust has livened up the discussion. It shows that people care.

It’s more contentious than it should be sometimes with religious overtones reminiscent of vi versus emacs. Some like it, some don’t, and that’s okay.

Too early to see if Rust in the kernel ultimately fails or succeeds, that will take time, but he’s optimistic about it.

The kernel is not normal C. They use tools that enforce rules that are not part of the language, including memory safety infrastructure. This has been incrementally added over a long time, which is what allowed people to do it without the kind of outcry that the Rust efforts produce by trying to change things more quickly.

There aren’t many languages that can deal with system issues, so unless you want to use assembler it’s going to be C, C-like, or Rust. So probably there will be some systems other than Linux that do use Rust.

If you make your own he’s looking forward to seeing it.

If most pirates are the kind who sail around drinking rum and chasing booty, patent trolls are the kind of pirates who blow a big hole in the side of a supertanker to steal a few barrels of oil and let the rest drain into the ocean.

… not that I especially trust Monero much; not even as much as Tor. What I object to is the tendency to be too quick to go ahead with the assumption that it probably has been broken even in the total absence (such as in this thread so far) of any evidence to demonstrate that.

It’s the same misguided instinct that leads people to believe that all encryption is futile, that the NSA already knows all the keys no matter what we do. It’s not really true. It is true they can easily compromise the security and privacy of any one of us normal people they choose to single out, but for those of us who don’t practise unreasonably strict op-sec the point of choosing secure and private modes of communication (including monero if your sense of morality allows for the use of a proof-of-work cryptocurrency) is not to protect one target against all possible threat models. And it’s not only to protect against lesser threats. Much of the time the most important thing is to contribute to the effort to make it impossible for anyone to systematically spy on the whole world all at once. Nobody should have that power.

Well then, what specific research do you have suggesting that monero has been broken? After all it is not in any way a “black box”. The algorithm is well known.

I too don’t know much about monero specifically, however:

Parallel construction is still a thing, yes. But so is spreading the false idea that everything is already compromised so there’s no point trying to defend yourself.

It has been falsely claimed that the measure undertaken by MCMC is a draconian measure

While it may be unclear exactly what kind of Internet traffic laws Draco would’ve written, allowing only the major landowners to run DNS servers does seem to be in keeping with the spirit of “aiding and legitimizing the political power of the aristocracy and allowing them to consolidate their control of the land and poor” as his laws are said to have done.