mastodon.world is one of the many independent Mastodon servers you can use to participate in the fediverse.
Generic Mastodon server for anyone to use.

Server stats:

9K
active users

#e2eencryption

0 posts0 participants0 posts today

#e2ee #e2eencryption

AMD: Microcode Signature Verification Vulnerability

"... security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside a VM) to load malicious microcode patches."

github.com/google/security-res

This is exactly the attack against which #confidentialcomputing should protect us

And it won't, when the attacker has access to ring0 of the hardware. Everywhere you don't run yourself.

### Summary
Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside...
GitHubAMD: Microcode Signature Verification Vulnerability### Summary Google Security Team has identified a security vulnerability in some AMD Zen-based CPUs. This vulnerability allows an adversary with local administrator privileges (ring 0 from outside...
Replied in thread

@futurebird @ineiti

1/3

When my company's #DEI Director explained the concept & **mentioned** **why** they were sharing their personal pronouns I have had mine out there in my public profile, right now, not here. My pronouns would not put me at risk so it's not brave. I do it more in #allyship than anything else. I also use strong #e2eencryption whenever possible even for nonsensitive information.

It's part allyship, part aircover, part practice of being the person I choose to be.

-more-

Replied in thread
@Tejan Ausland @Kevin Karhan :verified: Generally, Hubzilla does optionally offer encrypted conversation.

I'm not sure, however, if it encrypts the messages themselves, including in the database, or if it only encrypts the transfer.

It only works between Hubzilla channels that have this app enabled anyway because both sides need it. This mostly reduces its availability to communication between private hubs because some major public hubs don't have it enabled at hub level, so you can't enable it on your channel either if you're on one of those hubs. And, obviously, it doesn't work for communication with anything that's ActivityPub-based.

Also, I'm not sure how up-to-date it is. It's clearly a thing from the 2010s when there was that dream of a "grid" of Hubzilla hubs as its own decentralised network with StatusNet/GNU social, diaspora*, Friendica, WordPress, LiveJournal, Tumblr, Twitter etc. as optional satellites.

#Long #LongPost #CWLong #CWLongPost #FediMeta #FediverseMeta #CWFediMeta #CWFediverseMeta #Hubzilla #Encryption #E2EE #E2EEncryption
hub.netzgemeinde.euNetzgemeinde/Hubzilla

#e2eencryption is essential. Arguments that criminals use it & we need to ferret them out are misleading. Source code is out there & criminals will simply roll their own & host it where it suits them. I'm sure #northkorea would love a piece of that pie...if they aren't serving it already.

If you think you have nothing to hide then use it anyway to provide air cover to #journalists, #civilrights #activists, #lgbtq folk & others whose lives are literally on the line.

theintercept.com/2024/12/11/fb

The Intercept · How to Protect Yourself From the Salt Typhoon Hack, No Matter What the FBI SaysBy Matt Sledge

"End-to-end encryption means that the information is scrambled in transit and only the sender and recipient can access it. Regular text messages (SMS messages) and voice calls are usually not encrypted, and can be intercepted in transit or stored on a carrier’s server for extended periods of time.

Email services such as Gmail and Outlook generally offer encryption in transit, which means they can be read on the companies’ servers and by the end users. Messages that are encrypted in transit can’t be nabbed from a telecom network in an accessible format, but they could be accessed through an email service provider or a law enforcement request to that company.

End-to-end encryption—the kind offered by services like WhatsApp and Signal—is considered the best bet for privacy, particularly when paired with the option to auto-delete messages after a set period of time, says Mullin."

inc.com/jennifer-conrad/why-yo

Inc · Why You Should Start Using Encrypted Communications—TodayA massive hack prompts a government official to encourage businesses to do a better job of protecting their communications.

So wie sich das anhört sind die Hacker durch die Vordertüre gekommen, also wahrscheinlich über diese Wiretap Schnittstellen die Provider für Strafverfolgungsbehörden einbauen müssen. Wundert einen jetzt nicht wirklich, oder? https://www.heise.de/news/Wegem-schwerem-Cyberangriff-auf-US-Provider-FBI-wirbt-fuer-Verschluesselung-10187110.html #hacking #wiretap #e2eencryption

heise online · Wegem schwerem Cyberangriff auf US-Provider: FBI wirbt für Verschlüsselung
More from Martin Holland
Continued thread

Privacy: 2+ hrs into the hearing, protecting #encryption, #privacy & stopping #spyware are finally raised, thanks to S&D's Kaljurand. But Brunner's response pits safety against privacy - a common trope of the outgoing Commissioner.

What's more, despite an outright ask for him to commit to protecting #E2EEncryption, Brunner skirts the question. A silver lining? He compliments the Parliament's position on the #CSAReg, which rejected the Commission's mass surveillance and encryption-breaking plans

#CyberSecurity #Privacy #Discord #E2EE #E2EEncryption #SocialMedia: "Last year, we announced that we were experimenting with new encryption protocols and technologies for audio and video calls on Discord. After extensive experimenting, designing, developing, and auditing, we’re excited to announce Discord’s audio and video end-to-end encryption (“E2EE A/V” or “E2EE” for short), which we like to refer to as our DAVE protocol.

Discord is committed to protecting the privacy and data of the roughly 200 million people who use our platform every month. As we continue to be a place that helps our users deepen friendships around games and shared interests, we are thrilled to be launching more secure and private voice and video calls.

Today, we’ll start migrating voice and video in DMs, Group DMs, voice channels, and Go Live streams to use E2EE. You will be able to confirm when calls are end-to-end encrypted and perform verification of other members in those calls.

We’d like to explain why we’re bringing E2EE A/V to Discord, share our design and implementation goals, and provide a high-level technical overview of how the new protocol works."

discord.com/blog/meet-dave-e2e

discord.comMeet DAVE: Discord’s New End-to-End Encryption for Audio & VideoWe’re rolling out end-to-end encryption for voice and video calls! We’d like to share why we’re bringing E2EE A/V to Discord, share our design and implementation goals, and provide a high-level technical overview of how it works.
Continued thread

"#Chatkontrolle" klingt so gefährlich. Drehen wir den Spiess doch einfach um, und zeigen den lieben Nutzern, dass sie doch im Namen des Fortschritts freiwillig auf Ende-zu-Ende-Verschlüsselung verzichten wollen. Und es vielleicht nicht einmal merken:

Damit die #KI noch besser auf eine persönlichen Bedürfnisse eingehen kann, darf sie alle deine E2E-verschlüsselten Nachrichten über eine Hintertür lesen. Und zu den Servern schicken.
#E2E #E2EE #e2eEncryption
forbes.com/sites/zakdoffman/20

Forbes · Google Update Shows How Bard AI May Work With Your Messages AppBy Zak Doffman
Replied in thread
tl;dr: Hubzilla has had at least some of this for over a decade now. And it won't replace any of it with a new standard tailor-made for Mastodon.

@silverpill If you look past projects based on ActivityPub and at projects that have ActivityPub as an additional protocol, some of this already exists.

- Data portability. In my opinion, this is the most important problem. I'm in favor of FEP-ef61, which also solves identity portability and unlocks many new features.

Exists in the shape of nomadic identity. Invented by @Mike Macgirvin 🖥️ in 2011 with his Zot protocol and first deplayed in 2012 with the Red Matrix, nowadays known as Hubzilla. Also available on (streams), Mike's current project at the end of a string of forks from Hubzilla, now based on the Nomad protocol.

Mike would like to see nomadic identity and other special features of the Zot and Nomad protocols included in the ActivityPub protocol. He has actually submitted a number of proposals for this. They were all rejected. Even though he is a protocol developer first and foremost, and he has both created and worked on more Fediverse protocols than anyone else, so he should be considered competent.

Nomadic identity with ActivityPub won't come unless either Evan Prodromou and the W3C commission cave in and allow Mike's suggestions, or someone re-invents the wheel from scratch in a way that's utterly incompatible to Hubzilla and (streams). And it won't come to Mastodon unless Eugen Rochko can imply that Mastodon has had it first.

And there will never be a nomadic identity standard that meets Mike's requirements as well as Eugen's wishes.

- End-to-end encryption. MLS has become a standard, and it would be wise to adopt it. Issue 3 at fediverse-ideas provides a good overview of what we have at the moment (not much). Some variation of FEP-ae97 is likely needed to make end-to-end encryption work.

AFAIK, all three of Mike's still existing projects, Friendica from 2010, Hubzilla from 2012/2015 and (streams) from 2021, have it. Optionally, but still. I think Friendica actually advertises military-grade encryption.

- Plugins. Something like Pleroma MRF, but cross-platform (e.g. Wasm-based). Also, pluggable timeline algorithms.

Friendica, Hubzilla and (streams) have had support for add-ons, including third-party add-ons, plus a number of official add-ons since their respective inceptions. If you want a cross-platform add-on standard, I hope you don't expect these three to throw their own standards over board in favour of the new standard. Otherwise, good luck developing a replacement for Pubcrawl that makes Zot-based Hubzilla compatible with ActivityPub while working on ActivityPub-based Mastodon just the same. Friendica, Hubzilla and (streams) rely on add-ons for all federation beyond their respective base protocols (DFRN, Zot, Nomad).

- Groups. We have several competing standards for groups: FEP-1b12, FEP-400e, Mastodon developers are working on their own standard. It would be nice to converge on a single standard, that also supports private groups.

Friendica, Hubzilla and (streams) have had support for discussion groups/forums since their respective inception. On Friendica, a group is a user account with special settings; on Hubzilla and (streams), it's a channel with special settings. In addition, especially Hubzilla and (streams) have access permission control on a level that most people for whom the Fediverse is only ActivityPub couldn't imagine in their wildest dreams. All three can be used by users from all over the Fediverse already now.

Good luck forcing Friendica to give up its 13-year-old standard that's used by Fediverse News, just to name one, and Hubzilla to give up its 11-year-old standard that blows everything else but what (streams) does out of the water. Good luck forcing them to adopt something inferior.

On the other hand, good luck forcing Lemmy and /kbin to switch to a wholly different standard. Don't forget that these two exist as well. And good luck having the Fediverse outside of Hubzilla and (streams) adopt both server-side and client-side OpenWebAuth.

And I'm not even talking about how different Fediverse projects handle threads differently. Mastodon has a Twitter-like thread structure: many posts, tied together with mentiones. Just about everything that's built on ActivityPub has taken this over. Friendica, Hubzilla and (streams) have a Facebook/blog/Tumblr-like thread structure: one post, the start post, and many comments which aren't posts. It's similar on Lemmy and /kbin which are Reddit clones, only that they don't allow thread starters to moderate their own threads.

- Quoting. FEP-e232 is a proposed standard, but most fediverse applications still use non-standard properties. Mastodon developers are trying to invent something completely different.

This is something that almost the whole Fediverse has implemented, save for Mastodon.

And again, Friendica has had quotes since its inception in 2010, almost six years before Mastodon was launched (which, by the way, federated with Friendica and Hubzilla on the spot). Hubzilla has had quotes since 2012, inherited from Friendica. Their way of quoting is dead-simple: BBcode. [quote][/quote] (streams) supports Markdown and HTML in addition to BBcode, but otherwise it's the same.

Oh, and by the way: Friendica, Hubzilla and (streams) have also supported quote-posts a.k.a. quote-tweets a.k.a. quote-toots a.k.a. quote-boosts from their very beginnings.

- Markets. So far there's only one server implementation capable of processing payments.

At least two. Hubzilla has a payment add-on, too. It isn't installed on all hubs, but it's there.

#Long #LongPost #CWLong #CWLongPost #FediMeta #FediverseMeta #CWFediMeta #CWFediverseMeta #CWFedisplaining #Fediverse #Mastodon #MastodonIsNotTheFediverse #NotOnlyMastodon #ActivityPub #Friendica #DFRN #Hubzilla #Zot #Streams #(streams) #Nomad #Lemmy #kbin #/kbin #NomadicIdentity #OpenWebAuth #Group #Groups #Forum #Forums #Quote #Quotes #Encryption #E2EE #E2EEncryption
Summary card of repository fediverse/fep
Codeberg.orgfep/fep/ef61/fep-ef61.md at mainfep - Fediverse Enhancement Proposals
Replied in thread

@3fachverglast
Das wäre technisch gesehen ziemlich sicher eine Katastrophe.

Es nützt ja nichts, wenn sichere #messenger wie #Signal oder #Threema ihre bisher vertrauenswürdige #Vetschlüsselung auf brechen müssen damit #whatsapp den Klartext bekommt und neu verschlüsselt.

Dann hat WhatsApp wieder jede Nachricht im Klartext (wäre ja noch schlechter als direkt von WA zu WA zu schreiben).

Das ist dann eben keine #e2eencryption mehr, sondern Homöopathie...

Continued thread

This system should be an open standard, so that all existing contact book apps could implement it. Kinda like an updated version of CardDAV (en.wikipedia.org/wiki/CardDAV).

And ideally, all of that would be end-to-end encrypted, so that only your friends get to see your personal data. The host where you store your profile and your friends hosts should not be able to read your contact info!

en.wikipedia.orgCardDAV - Wikipedia