• 0 Posts
  • 71 Comments
Joined 9 months ago
cake
Cake day: May 14th, 2024

help-circle





  • This assumes a legitimate need to prove who you are outside the context of that specific site, rather than just within it. Sometimes that need is real, sometimes it is not.

    When it’s not, and you only need to prove you are the same person who created the account, then a simple username and password is sufficient. Use 2FA (via authenticator app or key, NOT via SMS or email) on top of that. This allows users to prove to a sufficient degree that they are the owner of that account.

    This is how most Lemmy instances work, for example. I can sign up by creating a username and password, with optional 2FA. They do not need my email. They do not need my phone number. They do not need my name, or my contacts, or anything else that is not related to my identity within their server.

    I realize that this is untenable at large scales for any communications platform. Spam (and worse) is a problem wherever there are easy and anonymous signups. I’m honestly not sure how Lemmy is as clean as it is. I guess it’s just not popular enough to attract spammers.




  • which would indicate that it’s somehow needed to generate AI-generated CSAM

    This is not strictly true in general. Generative AI is able to produce output that is not in the training data, by learning a broad range of concepts and applying them in novel ways. I can generate an image of a rollerskating astronaut even if there are no rollerskating astronauts in the training data.

    It is true that some training sets include CSAM, at least in the past. Back in 2023, researches found a few thousand such images in the LAION-5B dataset (roughly one per million images). 404 Media has an excellent article with details: https://www.404media.co/laion-datasets-removed-stanford-csam-child-abuse/

    On learning of this, LAION took down their database until it could properly cleaned. Source: https://laion.ai/notes/laion-maintenance/

    Those images were collected from the public web. LAION took steps to avoid linking to illicit content (details in the link above), but clearly it’s an imperfect system. God only knows what closed companies (OpenAI, Google, etc.) are doing. With open data sets, at least any interested parties can review, verify, and report this stuff. With closed data sets, who knows?



  • Another issue with Google Play is that there’s nothing stopping the developer from pushing out an update that doesn’t match the published source. It isn’t tied to GitHub or anything.

    Developers with apps on Google Play are frequently targeted with buyout requests from scammers looking to get malware to an existing user base. Or even if it’s not explicitly malware, it could be closed-source.

    For example, the “Simple Mobile Tools” app developer sold their apps a year or two ago. Now they have ads, in-app purchases, and god knows what else. If you had installed them from Google Play, you would have received these updates automatically. Those new versions don’t exist on f-droid, naturally. Anyone who was using them should really uninstall them and install the “Fossify” forks from f-droid.

    Every developer ID publishing on Google Play is potentially for sale. There are no real safeguards against this, and you might never know. At least with F-Droid it’s verified as open source and malicious (or just plain crappy) updates can be identified and dealt with, either by f-droid maintainers or by end users.






  • I’m not worried about getting raided by the KGB or anything like that, but break-ins happen and my computer equipment would be a prime target for theft.

    I occasionally cycle my backup drives off-site, so I want those encrypted as well.

    The cost of encryption is very close to zero, so I don’t even entertain the question of whether I should encrypt or not. I just encrypt by default.


  • Are you able to spend a lot of money on it? Last I checked, there were a few places in the EU that had a citizenship track if you purchased substantial property. So if you’re in position to buy a nice house, that’s an option. I think Portugal is the most approachable cost-wise. But it’s been a while since I looked at this so I’m sure things have changed.

    Several countries will allow extended student visas, even if you only speak English. I think Sweden allows this.

    Then of course there’s the easy way: marry a Canadian.


  • And it wouldn’t affect your ability to download torrents if you don’t have port forwarding on VPN, just your ability to upload

    This isn’t quite true. Two peers who both lack port forwarding will not be able to connect to each other at all. Once a connection is established between two peers, both uploading and downloading should work just fine.

    A significant portion of swarms are users like that, who can initiate connections but cannot receive incoming connections. This is especially problematic with smaller torrents. If you’re working with well-supported torrents with dedicated seeders and thousands of users, then it won’t really matter. But if you need something with just a couple seeders, you might find yourself stuck with zero accessible peers.



  • I think it’s just for enterprise contracts, yeah.

    Fedora seems like a good general-purpose pick to me, because it is modern, it has a large community, and it’s easy enough to install and use. It has similar advantages as Ubuntu — that is, a large community and broad commercial third-party support — without the downsides of having a lot of outdated software and lacking support for new hardware. I think Fedora is less likely to have show-stopping limitations than a lot of other distros, even beginner-friendly ones like Mint.

    But that’s just one opinion. There’s nothing wrong with Ubuntu or derivatives. I’ve heard good things about Pop_OS as well, though I’ve never tried it myself.