sneak

Speaking of fraud:

If you're so professional and trustworthy and transparent as you claim, Mister Sneak, then why haven't you updated your list of government requests for user data on keytern.al since 2015-Q3, 8 years or 32 quarters ago?

https://keytern.al/p/faq/

Either you've had government requests since then during the intervening 8 years and you're dishonestly concealing them, or keytern.al is not a serious company, and you're just yet another cryptocurrency scammer trying to defraud people and get rich quick by shilling on Hacker News.

So stop shilling your crypto key stealing company on Hacker News as recently as 26 days ago, if you don't have the time to update your list of government requests for user data in 8 years, missing 32 quarters in a row, or honestly answer legitimate questions about your company, and provide objective proof of your outlandish claim about your own security and integrity.

For many years, you've run a web site that offers to "back up" gullible sucker's crypto keys, with outlandish unsubstantiated claims like:

>Trusted by over 30,000 wallet holders, keytern.al is the market leading bitcoin backup key provider, trusted by large companies and small startups alike.

And there's a spectacularly suspicious gaping 32 quarter (8 year) gap in your list of government requests for user data.

https://keytern.al/p/faq/

>We will update this table from time to time as permitted by law.

>Last update: 2016JAN01.

Does that sound like a legitimate,…

Allow me to auto-translate my comment which initially was a response to "How can an ordinary developer get involved in the open source community, and is it worth it?" article (in Russian), because it describes how these different social expectations arise from the start.

It's very long and poorly structured, but it's valuable from my standpint. Don't read if you value your time.

---

Your article only covers the most well-known, largest, and established projects that meet both the technical definition of open source (open source code, under a free license) and the social definition (code is publicly available to everyone, free of charge, with both bug fixes and simple bug reports encouraged), and are also economically attractive to businesses (more on that later).
There may be a couple of hundred such successful projects. A drop in the ocean of open source.

From my experience, I believe that the lack of mention of this distinction between technical and social open source is the main cause of disagreements, disputes, and, ultimately, burnout due to misaligned social expectations.

---

FFmpeg vs. AWS (spoiler)

>This can even be seen in your screenshot of AWS vs. FFmpeg in the article: the author of the FFmpeg Twitter account repeatedly believes that corporations owe something since they use open source code, even though the license doesn't obligate them to do so. Moreover, when Google launched its fuzzing program (objectively the most advanced in the industry), which…

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously that's going to be really hard with the changes they have made to the OS).

I know many Apple's fan see this as a positive move.

But let's not ignore the pattern of privacy violations and user data collections due to deliberate design and the "apology" and "changes" that follow once CAUGHT. A few of these that immediately come to mind are:

- Apple selling user data to US government: https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data

- Apple iPhone 11 tracks user location even when location services are explicitly turned off by user (another BACKDOOR): https://www.silicon.co.uk/mobility/smartphones/apple-iphone-collects-location-data-321509?cmpredirect

- Apple macOS tracks every app that you use: https://sneak.berlin/20201112/your-computer-isnt-yours/

- Apple introduces BACKDOOR in its API to allow Apple apps to bypass application firewalls: https://www.patreon.com/posts/hooray-no-more-46179028

(For those who want to diss me for the above, realise that Apple's new found love for privacy doesn't mean shit without such public scrutiny and…

I don't really follow Apple news, but I do remember this:

https://sneak.berlin/20201112/your-computer-isnt-yours/

> On modern versions of macOS, you simply can’t power on your computer, launch a text editor or eBook reader, and write or read, without a log of your activity being transmitted and stored.

> It turns out that in the current version of the macOS, the OS sends to Apple a hash (unique identifier) of each and every program you run, when you run it. Lots of people didn’t realize this, because it’s silent and invisible and it fails instantly and gracefully when you’re offline, but today the server got really slow and it didn’t hit the fail-fast code path, and everyone’s apps failed to open if they were connected to the internet.

> Because it does this using the internet, the server sees your IP, of course, and knows what time the request came in. An IP address allows for coarse, city-level and ISP-level geolocation...

> Apple (or anyone else) can, of course, calculate these hashes for common programs: everything in the App Store, the Creative Cloud, Tor Browser, cracking or reverse engineering tools, whatever.

> This means that Apple knows when you’re at home. When you’re at work. What apps you open there, and how often. They know when you open Premiere over at a friend’s house on their Wi-Fi, and they know when you open Tor Browser in a hotel on a trip to another city.

Did the folks downvoting me forget about Gatekeeper and trustd or what?

https://sneak.berlin/20201112/your-computer-isnt-yours/

> It turns out that in the current version of the macOS, the OS sends to Apple a hash (unique identifier) of each and every program you run, when you run it. Lots of people didn’t realize this, because it’s silent and invisible and it fails instantly and gracefully when you’re offline, but today the server got really slow and it didn’t hit the fail-fast code path, and everyone’s apps failed to open if they were connected to the internet.

> Because it does this using the internet, the server sees your IP, of course, and knows what time the request came in. An IP address allows for coarse, city-level and ISP-level geolocation, and allows for a table that has the following headings:

> Date, Time, Computer, ISP, City, State, Application Hash

Would anyone care to actually make an argument how celebrating an OS that phones home about every application you run, all but forces you to create online accounts, and pushes you to store your data on the cloud as ‘pro-privacy’ because its chief competitor is truly outrageously bad does not speak to a serious degradation in our privacy standards?

Nitpick: What I think you're talking about is not E2E because there is no recipient (ie in this scenario Apple is not able to decrypt your data). It's just bog-standard encryption so your files are private or only shared with people you choose.

We can only recognize the current situation, not a hypothetical future one.

I for one think it is unlikely that Apple will willingly lock themselves out of that mountain of intoxicating user data.

I believe their privacy stance is just marketing. There's countless examples of them not caring about real security issues, eg https://sneak.berlin/20201112/your-computer-isnt-yours/

Even if they do ever implement true encryption - not E2E between customer and Apple - personally I wouldn't trust it because of the unauditable on-device scanning/snitching.