debanqued

joined 2 years ago
[–] debanqued@beehaw.org 1 points 1 day ago

Every method has a barrier:

  • snail mail: requires postage, which is particularly costly if you need proof of delivery. Also generally entails revealing your physical address to the controller.
  • email: requires revealing your email address to them. And if the recipient is MS or Google, or a user on those platforms, their mail server is fussy. I cannot email any MS or Google users because their server blocks my mail server.

A webform could potentially have the fewest barriers, but they blew it.

 

Indeed, MS only makes GDPR rights available to people who are willing and able to solve their graphical CAPTCHA. You must execute their JavaScript and have image rendering enabled in your browser.

For sighted people it’s not the more shitty varieties of CAPTCHA. Looks easy. But still fucked up that there is a barrier to exercising GDPR rights.

 

Suppose you have the following parties to an email conversation:

Douche Bank¹ manages to collect Alice’s email address either legitimately from her or illegitimately without her consent. DB sends her an email like this:

From: "Douche Bank" 
To: "Alice Marie Smith" 
Subject: Your unpaid debt of €20,000 on account № 354-987-156

Pay up.

Alice did not choose to do business with Microsoft Corporation and does not trust MS in the slightest. Yet Douche Bank has exposed sensitive financial information about Alice to MS, potentially without her consent. She may or may not have supplied an email address to D/B but certainly she opposes MS receiving her sensitive data, which it will then exploit to the fullest for surveillance marketing or otherwise.

Alice has no control over her bank’s choice of email provider. But in principle the GDPR is expected to give her control over her data exposure. If she makes an art.17 request to erase the privacy-abusing email, it’s too late b/c MS already saw it. The bank would not erase it because they have a legit need to track the fact that they sent a payment reminder. The bank /can/ mirror Alice’s art.17 request to MS if they are motivated, but most likely they will not, particularly if the bank is not treating the art.17 request themselves. And most likely MS would ignore it anyway.

If Alice sends a GDPR request direct to MS to erase MS’s copy of the email, MS would naturally respond with something like ”who are you? You are not our customer. Therefore we cannot properly identify you in accordance with GDPR rules. Also, we are just a “data processor” not a “data controller”. Sorry.. you can fuck off now.” (in so many words)

If Alice were to complain to the Data Protection Authority of Germany (where MS is headquartered), they would be helpless in this situation. I mean, there is Art.32 which requires processing to be secure, but most data controllers seem to be ignoring Art.32 w.r.t Art.77 requests. EDPB said in their “Contribution of the EDPB to the report on the application of the GDPR under Article 97” report:

“fines were imposed … for failure to comply with the obligations with regard to the rights of the data subjects (Article 12 to 22 GDPR),”

IOW, infringements on Articles outside the Art.12-22 range are not considered by the EDPB as “rights of the data subjects”. I’ve seen a similar sentiment expressed in other places.

¹fictitious name inspired by Deutche Bank/Bank of America

[–] debanqued@beehaw.org 1 points 4 months ago* (last edited 4 months ago)

I wish I kept track of where I read that. Could have been case law, or EDPB guidelines. Maybe I was speed-reading Art.21¶4 (which is really a requirement on the data controller).

It might be a good idea to send a registered letter with reply advice (Einschreiben mit Rückschein).

If I did that it would cost me over €10 for every single request. Even if it leads to lawsuit and the court favors my claim, registered letters are still a loss. They cannot be claimed back in court.

 

I read somewhere that GDPR requests for restricted processing (Art.18) cannot be combined with any other topic or request. E.g. If you request that they not use your e-mail for marketing purposes.

WTF. Yes, I understand the idea is that if the request stands on its own, it cannot be overlooked. But #GDPR requests are ignored so often that I deliberately combine a GDPR request with another request that is more difficult to ignore. That way when they ignore the GDPR request but treat the non-GDPR request from the same letter, it proves that the data controller received my letter. When a GDPR request is made on its own, they can more easily claim the letter never came and shift the proof-of-delivery burden onto me.

[–] debanqued@beehaw.org 1 points 5 months ago (1 children)

You say for suspicious users, but for the 4-month stretch of beehaw being unreachable there was no opportunity to login. So there was apparently a user agnostic systemwide change.

[–] debanqued@beehaw.org 4 points 6 months ago* (last edited 6 months ago) (1 children)

It’s worse than being reversible. The problem is that it’s unprovable. A switch from “zero logging” to “log everything” is wholly undetectible to users. You have to rely on blind faith that a profit-driven entity will act in your interest and resist their opportunity to profit from data collection. All you have is trust. Tor avoids that whole dicey mess and reliance on trust.

[–] debanqued@beehaw.org 3 points 6 months ago (3 children)

Indeed the ISP can only see where you go when using TLS, and that data can be aggregated to who you are along with everywhere else you go. It’s sensitive enough that in the US lawmakers decided on whether ISPs need consent to collect that info. Obama signed into force a requirement of ISPs to get consent. Then Trump reversed that. Biden did not reverse it back AFAIK.

W.r.t VPNs, you merely shift the surveillance point; you do not avoid the surveillance. The VPN provider can grab all that info just as well.

[–] debanqued@beehaw.org 7 points 6 months ago* (last edited 6 months ago) (6 children)

I am anonymous. Only doxxing experts know who is behind my account. Using clearnet makes it trivially simple for doxxers. Activitypub msgs include the IP address of the sending source which anyone with their own instance can see, IIRC.

But note as well Tor offers more than anonymity. It mitigates tracking by your ISP.

 

For the past four months beehaw has been unreachable to those of us on the Tor network. Glad to see access was finally restored. Was there an attack?

I could really use a way to periodically backup my posts to my local disk so if Tor is spontaneously blocked again I at least have my history. I’ve not found a Lemmy equivalent for Mastodon Archive.

(edit) For security, it would be a good idea to setup an onion instance. The Tor network has built-in DDoS protection for onion hosts.

[–] debanqued@beehaw.org 3 points 6 months ago (2 children)

lemm.ee is centralized in Cloudflare’s exclusive walled garden. I can’t speek for the admins but it’s antithetical to the purpose of the fedi to advocate for federation with centralized hosts.

And there are consequences. If an image is posted to Lemmy.world, sh.itjust.works, or discuss.online, those of us who are excluded from Cloudflare cannot see it. A non-CF node federating to a CF node creates a broken network.

[–] debanqued@beehaw.org 2 points 6 months ago* (last edited 6 months ago)

If I recall correctly, the main reason we defederated from those instances at the time was the sheer volume of spam we were getting from users of those instances.

Good point (if that’s true). I can’t help but expose the irony of instances centralized under Cloudflare having a spam problem. It seems to show that those instances sold their sole to the devil only to not get the benefits of the devil’s offer.

[–] debanqued@beehaw.org 1 points 6 months ago* (last edited 6 months ago)

That’s the topic of discussion at hand.

When you say “we are at 2”, you make it sound like the royal “we” as a society. So it’s not the right language for what you were trying to express. The correct pronoun would be “they”. Some libraries are inclusive and some are not. The exclusive ones are at #2.

BTW- this necropost is due to Beehaw being unreachable for 4 months. I finally got back in today to see your msg.

[–] debanqued@beehaw.org 1 points 9 months ago* (last edited 9 months ago) (2 children)

The elitist idea that it’s okay to exclude people from public service for not having property cannot be framed as “harm reduction” when in fact it fails at that. The people who have mobile phones and subscriptions are the same people who can afford Wi-Fi at home, data plans, etc. These are people who are already served by the private marketplace. You merely give them a convenience at the expense of spending money in a way that marginalises the needy. It’s not just discrimination you advocate -- the money is poorly allocated when it should go toward serving precisely those you exclude; the ones underserved by the private sector. By catering for the more privileged you only introduce harm by creating a false baseline that harms the excluded groups even more. Libraries were more inclusive 10 years ago, before they needlessly introduced these SMS-imposing captive portals. And some still are inclusive. Some poorly managed libraries have gone in an exclusive direction and this trend is spreading.

We’re at #2.

Who? Which library is at #2? Some libraries are entirely inclusive and treat everyone equally. Some libraries have regressed and have no pressure to join the inclusive world. You’re opposing the pressure that’s needed to make them better. That’s not helpful.. that just enables the problem to worsen.

[–] debanqued@beehaw.org 0 points 9 months ago* (last edited 9 months ago) (4 children)

Having services for some rather than none is quintessential harm reduction.

No it’s not. It increases the harm. We have already reached a point where many governments assume everyone is online and they have used that assumption to remove offline services. So people who are excluded are further harmed by the exclusivity as it creates more exclusivity. If a public service cannot be inclusive then nixing it ensures the infrastucture is in place to compensate knowing that the service is not in place.

extremely childish and harmful.

Elitism is extremely childish and harmful. Respect for human rights is socially responsible. It’s the adult stance.

Unified Declaration of Human Rights, Article 21:

“2. Everyone has the right of equal access to public service in his country.”

[–] debanqued@beehaw.org 1 points 9 months ago* (last edited 9 months ago) (6 children)

If a library is exclusive the threat of defunding has two outcomes:

  • compliance -- to become inclusive and (if necessary) show the door to elitists therein who think it’s okay to exclude people
  • closure (unrealistic, see below)

Either outcome is better than directing public money toward exclusive services. In the case of closure, the same money can rightfully be redirected toward other libraries that are inclusive.

Compliance splits into two possible outcomes:

  • exclusive services dropped entirely; inclusive services like book/media access continue
  • exclusive services reworked to become inclusive

Both of those are better outcomes than inequality. Dropping an exclusive service invites pressure to fix it. In any case, the elitism of exclusive public service is unacceptible because it undermines human rights.

(edit) One thing I did not consider is the exclusive services getting non-public funding. If Wi-Fi is going to be exclusive/elitist, perhaps it’s fair enough to continue as such as long as Google or Apple finances it. The private sector is littered with exclusivity and that doesn’t pose a human rights issue. In any case it’s an injustice if one dime of public money goes toward a service that is exclusive, which has the perversion of potentially excluding someone whose tax funded it.

2
submitted 10 months ago* (last edited 10 months ago) by debanqued@beehaw.org to c/bugs@sopuli.xyz
 

I installed the Aria2 app from f-droid. I just want to take a list of URLs of files to download and feed it to something that does the work. That’s what Aria2c does on the PC. The phone app is a strange beast and it’s poorly described & documented. When I launch it, it requires creating a profile. This profile wants an address. It’s alienating as fuck. I have a long list of URLs to fetch, not just one. In digging around, I see sparse vague mention of an “Aria server”. I don’t have an aria server and don’t want one. Is the address it demands under the “connection” tab supposed to lead to a server?

The readme.md is useless:

https://github.com/devgianlu/Aria2App

The app points to this link which has no navigation chain:

https://github.com/devgianlu/Aria2App/wiki/Create-a-profile

Following the link at the bottom of the page superfically seems like it could have useful info:

“To understand how DirectDownload work and how to set it up go here.”

but clicking /here/ leads to a dead page. I believe the correct link is this one. But on that page, this so-called “direct download” is not direct in the slightest. It talks about setting up a server and running python scripts. WTF.. why do I need a server? I don’t want a server. I want a direct download in the true sense of the word direct.

 

These are Lemmy instances with a “Sign Up” link which present you with a form to fill out to register. Then after you fill out the form and supply information like email address to the server, they respond with “registration closed”:

  • lemmy.escapebigtech.info (dead node now, but got instant reg. closed msg when they were alive)
  • expats.zone
  • hackertalks.com
  • lemmie.be
  • lemmy.killtime.online
  • lemmy.kmoneyserver.com
  • lemmy.sarcasticdeveloper.com
  • level-up.zone
  • zoo.splitlinux.org

I suppose it’s unlikely to be malice considering how many there are. It’s likely a case of shitty software design. There should be a toggle for open/closed registration and when it’s closed there should be no “Sign Up” button in the first place. And if someone visits the registration URL despite a lack of Sign Up link, it should show a reg. closed announcement.

Guess it’s worth mentioning there are some instances that accept your application for review (often with interview field) but then either let your application rot (“pending application” forever) or they silently reject it (you only discover non-acceptance when you make a login attempt and either get “login failed” or even more rudely it just re-renders the login form with no msg). These nodes fall into the selective non-acceptance category:

  • lemmy.cringecollective.io
  • lemmy.techtriage.guru
  • lemmy.hacktheplanet.be (pretends to send confirmation email then silently neglects to)
  • links.esq.social
  • dubvee.org

To be fair, I use a disposable email address which could be a reason the 5 above to reject my application. And if they did give a reason via email, I would not see it. Not sure if that’s happening but that’s also a case of bad software. That is, when a login attempt is made, the server could present the rationale for refusal. Another software defect would be failing to instantly reject an unacceptible email address.

 

Utility companies, telecoms, and banks all want consumers to register on their website so they do not have to send paper invoices via snail mail. When I started the registration process, the first demand was for an e-mail address.

Is that really necessary? They would probably argue that they need to send notifications that a new invoice has been prepared. I would argue that e-mail should be optional because:

  • They could send SMS notifications instead, if a data subject would prefer that.
  • They need not send any notification at all, in fact. Reminders is why calendars and alarm clocks exist. A consumer can login and fetch their invoice on a schedule. If a consumer neglects to login during a certain window of time, the data controller could send a paper invoice (which is what they must do for offline customers anyway).

They might argue that they need an email for password resets. But we could argue that SMS or paper mail can serve that purpose as well.

Does anyone see any holes in my legal theory? Any justification for obligatory email address disclosure that I am missing?

 

Yikes. As some Tor users may know, the UN drafted the Unified Declaration of Human Rights, which in principle calls for privacy respect and inclusion. That same UN blocks the Tor community from their website. Indeed, being denied access to the text that embodies our human rights is rich in irony.

Well that same UN plans to create a “Global Digital Compact” to protect digital human rights. It’s a good idea, but wow, they just don’t have their shit together. I have so little confidence that they can grasp the problems they are hoping to solve. Cloudflare probably isn’t the least bit worried. Competence prevailing, Cloudflare should be worried, theoretically, but the UN doesn’t have the competence to even know who Cloudflare is.

 

I created a whitelist access profile. That ensures that the whole WAN is blocked except what is exceptionally whitelisted. I started with an empty whitelist. The LAN is rightfully accessible and the WAN is rightfully inaccessible.

The router does not use DSL. Instead, it uses a USB mobile broadband LTE modem. The modem has its own website which gives SMS capability. The modem is technically upstream to the router, so it is blocked when the WAN blocking profile is enabled. I want to whitelist the modem so that when I am blocking WAN access I can still reach the web UI of the modem and monitor SMS msgs.

Fritzbox is designed so that all attempts to directly access an IP is blocked if whitelisting is in play. IP addresses cannot be whitelisted, only URLs using FQDNs. So I did “nslookup 10.10.50.8” to get the hostname of the modem. Then I whitelisted the hostname. That does not work. The modem is still blocked.

 

BBC World Service was covering the US elections and gave a brief blurb to inform non-US listeners on the basic differences between republicans and democrats. They essentially said something like:

Democrats prefer a big government with a tax-and-spend culture while republicans favor minimal governance with running on a lean budget, less spending¹

That’s technically accurate enough but it seemed to reflect a right-wing bias that seems inconsistent with BBC World Service. I wouldn’t be listening to BBC if they were anything like Fox News (read: faux news). The BBC could have just as well phrased it this way:

“Democrats prefer a government that is financed well enough to ensure protection of human rights…”

It’s the same narrative but expressed with dignity. When they are speaking on behalf of a political party it’s an attack on their dignity and character to fixate on a side-effect rather than the goal and intent. A big tax-and-spend gov is not a goal of dems, it’s a means to achieve protection of human rights. It’s a means that has no effective alternative.

① Paraphrasing from what I heard over the air -- it’s not an exact quote

#BBC #BBCWorldService

view more: next ›