• 0 Posts
  • 28 Comments
Joined 2 years ago
cake
Cake day: July 9th, 2023

help-circle






  • I’ve been checking out the localhost tracking vulnerability and there’s something I can’t work out: it’s not even a terribly obscure or convoluted exploit, especially Yandex’s implementation that’s been chugging for more than 8 years over basic HTTP. It’s just a glaring sandboxing workaround that’s been exclusive to this OS for more than a decade.

    No matter how many ways I look at it, I haven’t come up with a reasonable explanation for how it was ignored, by demonstrably capable engineers, unless Google itself had use for it in the first place. And that fits a pattern of selective competence in information security that they just can’t seem to quit.

    In short it’s the data collection backdoors they leave themselves that defeat the otherwise top-tier security of their consumer offerings, and it’s why I’ll probably never trust anything they’ve touched until I’ve taken it apart and put it back together again.

    So no, you probably shouldn’t use it. Trusting the privacy or security claims of any adtech company will always be a mistake.


  • Important caveats:

    (1) Measure expectations

    To know oneself is a personal journey one must travel themselves. You can accompany them to a nearby milestone and/or encourage them to find the next, but ultimately you can’t fight their intellectual battles on their behalf. Expecting to will lead only to frustration.

    (2) Be forewarned

    Note that even in the best case, proceeding will almost certainly alter the dynamics of your relationship, and perhaps end it altogether.

    (3) Consider the safest approach

    If you’re interested in maintaining the relationship, it would be far better if they were supported in this long journey by a professional (a cognitive behavioral therapist / social worker) rather than a friend/peer. This is especially true for anything so extensive as what you’re describing.

    With these caveats carefully considered…

    I have found that most people are receptive to a method of periodic open-ended questioning, a common technique of active listening.

    I don’t mean confrontational interrogation or leading questions (to which there are “correct” answers). I mean precisely the kinds of unassuming questions someone with more developed introspection might ask themselves internally. Questions of clarification or contemplation, for example, and general curiosity regarding others’ motivations, as well as one’s own.

    This method, used carefully, seems to work by temporarily donating perspective to someone, via simple demonstration, which aids them in cultivating their own.

    Over time, you may find that they begin to anticipate your questions (perhaps with friendly exasperation) which is the first sign that it’s working.

    Best of luck.


  • Focus on maximizing empty horizontal surface space.

    Explanation

    Have you ever noticed that restaurants and bars often decorate their walls with stuff that would easily be considered clutter on the floor?

    Apparently “clutter” is a highly relative descriptor, and the visual-spatial bias behind it privileges horizontal surface space.

    You can leverage that knowledge to quickly de-clutter spaces without investing in lots of new storage furniture and organization systems.

    It’s by far the cheapest trick I know.

    How (basic)

    Move and reorient items from horizontal surfaces to vertical ones.

    Horizontal surfaces include table tops, floors, chair seats, and so forth.

    Vertical surfaces are everything else: shelves, hanging storage, stackable cubes, upright bins, baskets that can sit on top of cabinets, boxes that slide under beds, wall-mounted anything, shelving beneath any horizontal surface, any storage above eye level, etc.

    Even just stacking things can make a space look less cluttered.

    How (advanced)

    Once you start getting creative with this concept, you can build it into the planning of your living space.

    For example, you might figure out what stuff can live in wall-mounted dispensers instead of occupying the space of a counter/vanity/floor.

    Similarly, you might find visually appealing ways to store “clutter” out in the open, such as a ceiling-mounted pot rack or a stainless steel prep table used as kitchen island storage.

    One of my favorite side-effects of this technique is that once you’ve minimized the footprint of items lying on horizontal surfaces, cleaning becomes a snap.

    For example, fewer obstructions on the floor lets you use cheap sweeper bots on a schedule that keep interior dust levels low.

    Likewise, wiping off counter tops and bathroom vanities takes mere seconds when you don’t have to move anything.

    ETA: tldr — “picking up,” interpreted literally, is an endlessly useful principle of housekeeping.









  • Yes, in fact. That’s a good example.

    The API for the ads allowed on-platform (only in their “App Store” and “News” products to my knowledge) is also used internally, which you can verify yourself by simply inspecting network traffic. The component instrumentation is obviously meager compared to the rich analytics and user behavior tracking data offered by virtually every other platform.

    But the foremost restriction is granularity. Neither internal analytics nor advertisers are ever provided a persistent user identifier. The advertising ID is generated on-device and doesn’t persist with device reset. That’s unheard of on platforms like Google, Meta, Amazon, etc.

    In-app tracking is allowed but subject to item by item opt-in user permission and is similarly restrictive, audited with package submission (they will reject the submission if you attempt to circumvent the API to extract more/better data from the user). What I’m describing is draconian compared to most platforms, especially carrier-manufacturer Android distributions in many countries.

    I mostly use custom roms and distros personally, and I’m not even trying to convince you Apple is in some way more ethical than other big tech cos. I just don’t like seeing misinfo and hearsay spread around for any purpose, especially when that purpose is apparently bullying other users for upvotes.




  • They do, so far. I test these machines for privacy claims as a hobby and have been a bit surprised to find Apple stuff mostly delivering on those claims. I’m used to seeing a lot of dark patterns in testing and it’s made me expect the worst, but so far they’ve followed through on (in particular) their end-to-end encryption and on-device processing guarantees. Security audit failures so far have appeared to be engineering oversights, and the ones I reported have been patched already.

    The majority of user data they collect appears to be optional analytics and diagnostics that are properly encrypted and anonymized using the same pooling strategy used for their built-in VPN service. They recently started doing processing off-device for some new features related to the Apple intelligence thing (I haven’t gotten around to testing most of that) but otherwise anything siri-related is indeed processed locally. You can toggle a setting to allow anonymized siri recordings to be sent to Apple for quality control but they ask you permission each time you reset a device and re-confirm when you install updates, which IMO is adequate.

    Edit: Yes this is the opposite of what the other guy said. He is, to put it delicately, talking out his ass. There are good reasons to hate Apple, such as the fact that it’s a massive soulless corporation raping the planet to make luxury electronics for affluent consumers, but for most of the rabid apple conspiracy theorists I find online the reasons seem to be far more selfish and petty than that.