I believe ungoogled-chromium does have MV2 support. Unfortunately, there are still real security concerns with Firefox. The good news is that Trivalent (a hardened version of Chromium developed by the Secureblue folks) has ad/content blocking built in. I am still mostly using Firefox, but the small amount that I have used Trivalent has been good.
Spent the last week playing with some security shit (thinking about a career change, since it looks like I will be mastering out of my PhD program) and fuck me everything about hardening your personal devices is exhausting. We are nowhere close to accessible privacy and security in our computers. The best solution right now may be “buy a Macbook and learn MacOS”, which is so depressing.
Still deciding on a web browser. Used to be I could recommend Firefox because Righteous-Opposition-to-Google, but that doesn’t really track anymore with Mozilla’s behavior. Now I guess I would recommend Chrome, but it feels so gross (and I am unsure about things like Ungoogled-Chromium, for security reasons).
As far as passwords, the only password I have to memorize is the one to my Bitwarden vault. Everything else is stored in Bitwarden. The passwords (except for my phone PIN) are 16 characters if I ever need to type them in manually (e.g. LUKS password), whereas passwords that will always be copy-pasted are 128 characters. I am looking into integrating a yubikey, but am leaning towards “fuck that shit, why would anyone actually want to use this?” If anyone here has comments on this (am I missing an obvious pitfall? do yubikeys suck as much as it looks like they suck?) I would be happy to hear them.
Anyway tl;dr is I spent the last week hardening all my devices and it sucks. In some cases it was a complete waste of time (my Steam Deck does not appear to have a way to set a password in the BIOS). In other cases (e.g. my Framework), it was probably worth it but a deeply terrible experience.
also which issues
I know this one!
I have the outline of a write-up about about category errors and measuring proxies (e.g. reported sexual orientation). I think I am a poor writer but the only critique I’ve ever gotten was from a “colleague” who writes like he gets paid by the word1. I will consider sharing the post once it is finished. ❤
1: one rejection on a collaboration with this guy was essentially “have you nerds heard of ‘brevity’ or ‘wit’?” — from computer scientists 😭
Well, this Andy dipshit gave an absolute dogshit apology on reddit.
Snippets below:
First, while the X post was not intended to be a political statement, I can understand how it can be interpreted as such, and it therefore should not have been made. While we will not prohibit all employees from expressing personal political opinions publicly, it is something I will personally avoid in the future. I lean left on some issues, and right on other issues, but it doesn’t serve our mission to publicly debate this. It should be obvious, but I will say that it is a false equivalence to say that agreeing with Republicans on one specific issue (antitrust enforcement to protect small companies) is equal to endorsing the entire Republican party platform.
Second, officially Proton must always be politically neutral, and while we may share facts and analysis, our policy going forward will be to share no opinions of a political nature. The line between facts, analysis, and opinions can be blurry at times, but we will seek to better clarify this over time through your feedback and input.
The exception to these rules is on the topics of privacy, security, and freedom. These are necessarily political topics, where influencing public policy to defend these values, often requires engaging politically.
The operations of Proton have always reflected our neutrality. For example, recently we refused pressure to deplatform both Palestinian student groups and Zionist student groups, not because we necessarily agreed with their views, but because we believe more strongly in their right to have their own views.
deleted this because i realized i can’t even explain how email works, why am i proposing anything
deleted by creator
I agree. Currently I can’t recommend any email providers. Hopefully Posteo works out, but at this point I am strongly considering just starting my own competitor in the vein of Signal messenger. Basically “we think of email as a public good.”
Thanks! I actually plan on putting a couple of things on Mataroa:
(Aside: if anyone can recommend a better blogging platform, I would appreciate it. I like Mataroa for its privacy focus, minimalism, and low cost-of-leaving. The only issue I have is lack of KaTeX/MathML/however-the-fuck-omg-why-is-TeX-still-trying-to-hurt-me-in-2025 support.)
Thanks for sharing this. Also
using your own head must weigh far too heavy
absolute chef’s kiss
Here is their response:
@mav Yes, this was bad. I did not take a screenshot back then (the post was deleted after 30 minutes), but I scrolled all my way through Mastodon to find our apology:
https://mastodon.social/@Tutanota/108910936764865962
https://mastodon.social/@Tutanota/108910937813834878
This was a mistake, we apologized & we made sure that we would never post something similar again.
At Tuta, we foster honesty, respect & diversity.
We are here to fight for privacy & against Big Tech surveillance. We want everyone to get the respect they deserve.
and this:
@shalf We set up guidelines that all team members on social media duty need to adhere to. We also created a social media review group where we post & discuss every proposal before actually publishing. And it has worked fine ever since. :)
Dear Privacy Fans,
Last week, on Friday, a post was made on our social media profiles which goes against our core values as team members and as a company. This post was made in poor judgement, without stopping and examining the underlying racist and sexist problems posed by this meme template, and it does not represent the culture and environment of the Tutanota Team. After a period of approximately 30 minutes the offensive post was removed from all platforms and a “brief” apology was posted.
This brief apology does not go far enough to address this mistake and we would like to update everyone on how we are working to address this issue internally and how we will make sure that this does not happen again. As a company we are working with all of our team members to foster a culture that respects diversity in all forms. This is both on a personal level between colleagues, but also at an institutional level by working to create structures which allow diversity to flourish.
Last time this came up, I considered Posteo but decided to hold off (I think it was actually you who suggested it ❤). There was a concern I had about deleting an account due to inactivity, but I think I just misunderstood or misremembered something on PrivacyGuides. This might be a good choice.
As far as Filen for photos, I am reasonably confident that Ente will stick around (they seem to take sustainability seriously). Stuff like this worries me about Filen (emphasis mine):
What else is planned for Black Friday this year?
As every year, we’ve planned a special surprise to give back to our loyal users this Black Friday. Just like in previous years, we won’t be revealing any details just yet. All I can suggest is to check in with us around November 18th—you won’t want to miss it!
Are lifetime plans stackable?
Yes, we’d like to emphasize once again that all types of our plans can be easily combined. Subscription plans only expire based on their individual purchase dates.
I am also in the “scream and cry” phase of this. However, I have already decided on the following replacements for non-email:
edit: Should mention that I am also looking into a calendar replacement.
edit2: maybe mailbox.org? They are recommended on PrivacyGuides.org.
1: This is more like a stopgap for me until I confirm they are worth sticking with or find someone better. The 29.99€ 100GB lifetime storage may be worthwhile for this (though I cannot say whether I am confident they will be around in 5 years, this can at least serve as a short-term solution).
2: lassitude
my pants are an anti-embarrassment protocol
After reading some of the counterpoints here, I began thinking about how I considered Excel a hyperkludge if you qualify it enough. I realized the qualifications apply to every programming language (good ol’ Turing Completeness). I think, in my case, the common scenario of
had me erroneously criticizing the tool instead of its application[2]. In the case of Excel, I worked a few jobs where the spreadsheets used when the company was small led to an absolute nightmare after the company grew.
I appreciate the thoughtful responses from everyone. <3
1: Usually a spreadsheet, in my experience.
2: Noting that, while “it’s not the tool, it’s the application” is a common refrain from people using tools in shitty ways, there is a distinction between “this is the wrong tool for the job” and “this tool will hurt people”.
I need an excuse to learn Rust and have wanted to do a “parse, don’t validate / make invalid states unrepresentable” project for a while. I will definitely share it if I get anything done.
At the end of the day you shouldn’t have to maintain anything in order to use a program, in my opinion (at least ideally). I think a “everything must be present in the file” type of config would require less no extra maintenance (assuming devs don’t do anything too silly). Additionally, while noting that my primary programming language is TeX and also that I am a dipshit, this just strikes me as an API-design problem. Alternative solutions could be:
I have thought about doing #3 for Sway (a sort of Sway-config editor). This does give me an idea, though: define a meta-format for specifying the variables, default values, allowed values, etc., for an arbitrary[0] program’s config file, and create a program that reads a meta-format file and presents a GUI for editing the config.
tbh i just lost my config file, forgot what i changed, and now i have to read documentation (and figure out which file the mpv flatpak uses for config)
[0]: maybe not too arbitrary
I personally disagree. I think in the era of “a megabyte is big,” this made sense, but in my opinion after parsing a config file with missing config data, we should print something indicating they are missing then error out. The existence of a reference config file with all options included would definitely help, but I think it’s no coincidence that there is no such config for mpv — why bother creating and maintaining one if the program will use the default value anyway?
tl;dr explicit is better than implicit
What’s great is even the very best “just use valgrind lol, lmao” folks make these errors all the time. It’s basically impossible to write correct C code generally — the best we can do is verify subsets of code (c.f. Rust’s unsafe keyword). The memory-safety CVEs in EXT3/4 are proof of this, IMO, as if there were anyone able to write correct C code today, it would be Ted Ts’o.
A note to the effect of:
is a good idea if I ever do recommend a Mac.