Browsers are complicit in browser fingerprinting.


Everyone talks about how evil browser fingerprinting is, and it is, but I don't get why people are only blaming the companies doing it and not putting equal blame on browsers for letting it happen.

Go to Am I Unique and look at the kind of data browsers let JavaScript access unconditionally with no user prompting. Here's a selection of ridiculous ones that pretty much no website needs:

  • Your operating system (Isn't the whole damn point of the internet that it's platform independent?)
  • Your CPU architecture (JS runs on the most virtual of virtual environments why the hell does it need to know what processor you have?)
  • Your JS interpreter's version and build ID
  • List of plugins you have installed
  • List of extensions you have installed
  • Your accelerometer and gyroscope (so any website can figure out what you're doing by analyzing how you move your phone, i.e. running vs walking vs driving vs standing still)
  • Your magnetic field sensor AKA the phone's compass (so websites can figure out which direction you're facing)
  • Your proximity sensor
  • Your keyboard layout
  • How your mouse moves every moment it's in the webpage window, including how far you scroll, what bit of text you hovered on or selected, both left and right clicks, etc.
  • Everything you type on your keyboard when the window is active. You don't need to be typing into a text box or anything, you can set a general event listener for keystrokes like you can for the mouse.

If you're wondering how sensors are used to fingerprint you, I think it has to do with manufacturing imperfections that skew their readings in unique ways for each device, but websites could just as easily straight up record those sensors without you knowing. It's not a lot of data all things considered so you likely wouldn't notice.

Also, canvas and webGL rendering differences are each more than enough to 100% identify your browser instance. Not a bit of effort put into making their results more consistent I guess.

All of these are accessible to any website by default. Actually, there's not even a way to turn most of these off. WHY?! All of these are niche features that only a tiny fraction of websites need. Browser companies know that fingerprinting is a problem and have done nothing about it. Not even Firefox.

Why is the web, where you're by far the most likely to execute malicious code, not built on zero trust policies? Let me allow the functionality I need on a per site basis.

Fuck everything about modern websites.

This entry was edited (1 hour ago)
in reply to toomanypancakes

As I found out recently, drawing.

I took some classes in high school and only recently got back into it, and I’d consider myself..averageish? I know where I need improvements and I see the quirks and wonks, so to speak.

The people in my adult life who have seen my sketchbook make (positive) comments, which surprised me. Still, it’s nice.

Why should I continue to financially support the development of Lemmy when the developers operate .ml, an instance that is a prime example of arbitrary censorship?


Please convince me that I should continue my support or advice what I can do. I'm prepared to do my part, but I can only do so if I can be sure that my support is not going to people who think arbitrary Censorship is alright (needs to be based on objective community rules and not on the political agenda of mods).
This entry was edited (9 hours ago)

Got any security advice for setting up a locally hosted website/external service?


Setting up a personal site on local hardware has been on my bucket list for along time. I finally bit he bullet and got a basic website running with apache on a Ubuntu based linux distro. I bought a domain name, linked it up to my l ip got SSL via lets encrypt for https and added some header rules until security headers and Mozilla observatory gave it a perfect score.

Am I basically in the clear? What more do I need to do to protect my site and local network? I'm so scared of hackers and shit I do not want to be an easy target.

I would like to make a page about the hardware its running on since I intend to have it be entirely ran off solar power like solar.lowtechmagazine and wanted to share technical specifics. But I heard somewhere that revealing the internal state of your server is a bad idea since it can make exploits easier to find. Am I being stupid for wanting to share details like computer model and software running it?

This entry was edited (10 hours ago)
in reply to SmokeyDope

No need to cargo-cult security practices here, chief. You’re not gonna get pwned by publishing your hardware specs. If you’re planning to build some kinda webapp for yourself, that’s a different story - but you have to fuck up hard to get hacked while hosting raw HTML.

Use an SSH key, disable password auth, make sure you’re firewalled (i.e. test with nmap), and call it a day.

This entry was edited (9 hours ago)

UK announces $19 billion investment in first major nuclear plant since the 1990s


Archived version of AP article (archive.org)


"Britain to invest further 14.2 billion pounds in Sizewell C nuclear project" (Reuters)

::: spoiler Reuters article:

  • Summary
  • Takes total government investment to 17.8 billion pounds
  • Project will supply 6 million homes with electricity
  • Total expected cost of the project not revealed

LONDON, June 10 (Reuters) - Britain will invest a further 14.2 billion pounds ($19.25 billion) to build the Sizewell C nuclear plant in southeast England, the government said on Tuesday, as part of its wider spending review which will define its priorities over the next four years.

Britain is seeking to build new nuclear plants to replace its ageing fleet to boost its energy security, reach its climate targets and also create new jobs.

Make sense of the latest ESG trends affecting companies and governments with the Reuters Sustainable Switch newsletter. Sign up here.

The funding announced on Tuesday takes the total amount the government has committed to the project to 17.8 billion pounds, with 3.6 billion pounds invested prior to the spending review.

"This Labour Government is launching a new era of nuclear power here in Britain," Chancellor Rachel Reeves told a trade union conference on Tuesday, calling the investment the biggest rollout of nuclear power in a generation.

The Sizewell C plant in Suffolk is expected to create around 10,000 jobs during the peak of construction, and produce enough electricity to power around 6 million homes when built.

Britain has been seeking to bring new investors into the project but Tuesday's announcement did not mention any other parties.

The government has not said how much the project is expected to cost in total or given a date for when it is expected to be completed.

"With the continued secrecy about Sizewell C's total cost, how can voters decide whether the 18 billion pounds pledged to Sizewell C is a good use of their money?" said Alison Downes of campaign group Stop Sizewell C.

It would be only the second new nuclear plant built in Britain in more than two decades, after French state-owned EDF's Hinkley Point C which has had several delays and cost overruns and is currently expected to start operations in 2029, with an estimated cost of between 31 and 34 billion pounds at 2015 prices.

EDF initially said Sizewell C would be around 20% cheaper than Hinkley C.

Simone Rossi, CEO of EDF in the UK welcomed the British government's decision to go ahead with Sizewell C and said: "It is also a vote of confidence in Hinkley Point C, which has re-started the UK nuclear industry and built the experience and skills that will benefit Sizewell C."

Sizewell C was originally being developed by EDF and China's General Nuclear Power Group but the government bought out the Chinese firms stake in 2022 amid security concerns.

The UK government's stake was 83.8% and EDF's stake was 16.2% at the end of December, EDF financial results showed in February with EDF's stake expected to decrease following Tuesday's announcement.

The project's developer last December told Reuters there were five investors involved in a bidding process.

($1 = 0.7378 pounds)
:::

„Größte Beweisvernichtung der Steuergeschichte“: Kommen Steuerhinterzieher leichter davon?


[Combat] Failed attempt by a Russian Pantsir-S1 air defense system to shoot down a Ukrainian AN-196 Liutyi UAV over the Tatarstan region this morning.


Mirror

https://t.me/karymat/11143

in reply to k_rol

According to Wikipedia, the Pantsir shoots small missiles with radar or optical guidance. No idea why it missed.

I watch this one history yt channel that goes through the moment to moment details of various battles. One thing I learned from that is that things just go wrong all the time in wars. Missiles fail to launch, radars malfunction or aren't properly calibrated, a manufacturing defect turns a potent weapon into a dud, etc.

White House responds to California city terminating contract with ICE


DHS Assistant Secretary Tricia McLaughlin told Newsweek that the City of Glendale's decision was "deeply disturbing," and accused state officials of siding with criminals over public safety after unrest in Los Angeles.


Just so people are aware, this is the same rhetoric/same regurgitated talking points being used against "progressive" policies in blue cities within red states all over the country.

They are banking on an escalation of physical violence and confrontation that they will use as an excuse to establish a permanent federal and military force in California that will not be subject to any California state laws.

Why do I believe that? Because its how it happened in my own city to establish a permanent state police force that can't be regulated by any city or local ordinance.

They instigate and then argue that progressive policies have resulted in an emergency and chaos, that leaves them no choice but to step in and fix things by taking control.

They have been using takeovers of blue cities within red states as a testing ground for this kind of thing since Trump's first term.

This entry was edited (13 hours ago)
in reply to dinren

it’s just an example of state overreach in a violent manner. one of many. none are appropriate when one truly considers things like “rights” etc.

the civil war was probably the last time the state was able to “legit” use violence because it was to quell an actual secession by a formal militia of more than a million traitors and terrorists.

This entry was edited (11 hours ago)
in reply to flandish

Asserting that the state has no legitimate interest in using limited violence (i.e. tear gas) to execute lawful search and arrest warrants against heavily-armed, recalcitrant pedophiles is truly one of the takes of all time.

The Bundy standoff, the SLA, and the Waco Siege are categorically different from the firebombing of Philly or the Tulsa Massacre to anyone with a brain.

This entry was edited (11 hours ago)
in reply to DominusOfMegadeus

I'm pretty happy with Downie (and Permute to directly convert media to whatever format I like). So far it downloads everything I throw at it. And you can create custom download handlers (using JavaScript) to make it work (without interaction) with sites that are currently not supported and would spawn the user-interactive downloader.

If you just want to download and don't care about a nice GUI, yt-dlp probably has similar features.

Gedanken gegen Bot-Armee


Wie wir alle Wissen, können Bots heutzutage und in Zukunft den Turing-Test bestehen. Das bedeutet, dass man an einem Kommentar nicht sehen kann, ob dieser von einem Mensch oder einem Bot geschrieben wurde.

Das erzeugt ein großes Problem: Internet-plätze wie Feddit und andere Treffpunkte leben davon, dass Menschen sich im Internet begegnen können. Ich denke, dass diese Treffpunkte wertvoll sind und aufrecht erhalten sollten.

Doch wenn diese Treffpunkte von Bots überschwemmt werden, die Content generieren, z.B. um subtile Werbung/Propaganda zu erzeugen, dann zerrüttet das das Netzwerk, weil es die Menschlichkeit des Treffpunkts infrage stellt und Zweifel an der "Echtheit" der Inhalte aufkommen lässt.


Ich schlage daher vor, auf dem 39. Chaos Communication Congress viele kleine Chipkarten auszugeben (eine pro Person), die eine kryptographische Identität (d.h. ein public/private-key-pair) enthalten, damit man im Internet beweisen kann, dass man am CCC war. Dadurch kann man beweisen, dass ein Mensch hinter dem Account steht und nicht nur eine KI.

Gerne kann man statt dem CCC auch andere, dafür geeignete Veranstaltungen vorschlagen.

in reply to Aniki

Was, wenn diese Leute dann mit dieser Identität selbst Bots (bzw. einen Bot, ist ja schlimm genug) laufen lassen? Beim CCC wird ja vermutlich keine große Identitäts- und Gesinnungskontrolle gemacht, bevor die Karten verteilt werden. Das hilft natürlich gegen eine Schwemme an Bots, aber hier sind ja so wenige regelmäßige Beitrags- und Kommentarersteller, dass schon ein Dutzend Bot-Accounts sehr viel kaputtmachen können, besonders wenn die dann alle als "beim CCC als echte Menschen zertifiziert" dargestellt werden.
This entry was edited (11 hours ago)

Israel says it is keeping Rima Hassan because hostage taking is only wrong when Hamas does it


Israel has already proven it’s the good guy by spraying the Madleen with an unknown chemical, ramming the vessel, boarding it and making the crew throw their mobile phones overboard.

Israeli commandos were so nice during the encounter that they agreed not to kill anyone as long as they showed total obedience. In fact, the commandos showed such restraint that they didn’t even strip anyone naked. Well, not that I know of…

Israel was temporarily nice to the crew of the Madleen so it could get a propaganda picture and then it took them ashore where it tried to make them watch footage of October 7. When the crew refused, it demanded they sign deportation papers accepting they had illegally entered Israel, even though they were in international waters and it was Israel who took them to Israel!

I understand some of the Madleen crew signed the deportation papers and were sent on their way, but disgracefully, Rima Hassan refused to be repatriated. Apparently, she wouldn’t confess to something she hadn’t done because she has “principles”. Israel says it therefore has no choice but to keep her as a hostage, I mean an, um, prisoner.

Obviously, prisoner is the only accurate word to describe someone who is being illegally detained, having committed no crime. Hassan can’t be a hostage because she smiled defiantly and ate a sandwich and no hostage would ever eat a sandwich. It disrespects all those who were captured on October 7 to call Hassan a hostage, just because she is being held against her will after being abducted by armed men.

I’m not sure if you’re aware of this, but Hassan is Palestinian and it’s fine to treat Palestinians this way. It’s what Israel has always done x

Russia’s tech company VK unveils WeChat clone built on Putin’s orders: the app has mic and camera access, gathers user data, and shares it with the state


cross-posted from: lemmy.sdf.org/post/36376926

Archived

On June 4, during a meeting with government officials, Vladimir Putin stated that all public services must be moved to the national messenger app called Max. According to Minister of Digital Development Maksut Shadayev, the multiplatform system is already operational.

[...]

The Max app — a Russian equivalent of China’s WeChat — was unveiled by the tech giant VK in late March. At present, it features a messenger, a chatbot builder, a payment system, and mini-apps. On June 5, VTB’s digital bank launched on the platform.

To register, a Belarusian or Russian SIM card is required — which, as The Insider noted, foreigners can no longer obtain without submitting biometric data.

As stated in the Max app’s privacy policy, the platform will collect data on:

  • user devices
  • IP address
  • operating system
  • browser
  • location
  • internet provider
  • contacts from the address book
  • all user activity within the service
  • information obtained through the camera or microphone, if the user grants the app access (most users will, for example, in order to record voice messages)

Other messaging apps collect such data as well, but there's a catch. The Max app's privacy policy explicitly states that it may share this data with the “company's partners” as well as with “any government or local authority.”

[...]

Drama on Fedi. Framasoft vs Firesidefedi.


Source: peer.madiator.cloud/w/wuqKuurL…


Episode 20 - Booteille - Framasoft - Livestream 2025-05-27


Welcome Fedi Friends to the episode 20 of Fireside Fedi! I'm your host ozoned. Fireside Fedi is a show about folks within the Fediverse. If you're seeing this, you are a part of the Fediverse.

With me today is Booteille! Booteille was a volunteer to Framasoft for 3 years, then became a co-president, a volunteer position as well, and then got hired by Framasoft and stepped down from his volunteer position . Booteille seems to wear many different hats around Framasoft. From interviews, conventions, building donation campaigns, to sysadmin tasks, website tweaks, etc.

Booteille describes their goal with Framasoft is "to help as much as I can the organisation in our goals: raising awareness about digital issues and helping to build a society fitting our values."

I'm very excited to finally have this show as we've had to reschedule numerous times. Schedule conflicts, then I was sick for weeks, and booteille is finally getting over being sick as well.

framasoft.org
Donation Link - support.framasoft.org
Framasoft Mastodon - framapiaf.org/@Framasoft
numerethique.fr/
blog.dreads-unlock.fr/
Mastodon - framapiaf.org/@booteille
degooglisons-internet.org/en/
support.joinpeertube.org/en/


This entry was edited (13 hours ago)

Lemmy.zip 2nd Birthday Giveaway! 🍰


Hello all!

To celebrate Lemmy.zip turning 2 years old, we are once again hosting a small giveaway to say thank you for being here ❤️

We're giving away 3 prizes to 3 lucky winners. This will be 1 x £25 Steam gifts, and 2 x £10 Steam gifts.

The giveaway will be open for 48 hours from 12:00 UTC on the 10th June 2025, to 12:00 UTC on the 12th June

You can enter by making a comment in this very thread! Your comment can say or be absolutely anything you want (within reason!)

Once you've made a comment, you should get a message back from ZippyBot confirming you've entered and a ticket number. For transparency, at the end of this we'll publish the entry list and ticket numbers.

You must be a Lemmy.zip user to enter (comments from anyone else will be ignored!) and you will need a Steam account and be happy to send me your username so I can gift you the value via Steam. Your Lemmy.zip account must have been created before the 9th June 2025.

At the end of the giveaway, I'll lock the thread and Zippy will pull three random entries. The first username pulled will win the first prize (£25), and the other two users will win the other prizes (£10).

I've put a few FAQs in this spoiler tag if you want to know more:


FAQs - PLEASE READ!

::: spoiler FAQs
- Q) Can anyone enter?
- A) You must be a lemmy.zip user, have a steam account, and your lemmy.zip account must have been created before 9th June 2025


  • Q) Can I have a giftcard for a different platform, i.e. xbox or playstation?
  • A) Unfortunately not. Those platforms (to my knowledge) don't allow me to purchase a giftcard in the UK and you activate it anywhere in the world. Steam allows currency conversion on gifts.

  • Q) How quickly will I get my prize?
  • A) Steam requires that someone must be on a user's friend list for 3 days before giftcards can be sent, therefore I will share my Steam profile with the winners (or vice versa) and after 3 days of being friends on Steam, I will send the gift over. (Unless you live in the UK, in which case I can send you a code within 24 hours)

  • Q) I think my entry was valid, but I didn't get a reply from Zippybot with my ticket number. What do I do?
  • A) Send me a message asap! You can try commenting again too.

  • Q) Are Lemmy.zip user donations funding this?
  • A) No, just making it clear here that the donations to Lemmy.zip only ever go towards the server and Lemmy.zip infrastructure. The funds for this are coming from my wallet 😀

  • Q) How does Zippy select the winners?
  • A) Zippy randomly shuffles the list of entrants in the DB. It then randomly shuffles the list again in Python. Then it randomly selects 3 winners from that double shuffled list. You can see the code for this here.

  • Q) What if something goes wrong?
  • A) If for any reason something goes wrong during the giveaway, it will be paused until it can be resumed. If too much time lapses, the giveaway will be restarted.

:::

This entry was edited (16 hours ago)
in reply to handnutaschnitte

Zu einer anderen Einschätzung kommt in der Zeitung der Rentenexperte Bernd Raffelhüschen. „Die Alten sind in Deutschland tatsächlich diejenigen mit dem höchsten Vermögen im Vergleich zu allen anderen Altersgruppen“, gab er in der Bild am Sonntag zu bedenken. „Niedrig verdienende, alleinstehende Personen und Kinder haben in Deutschland ein wesentlich höheres Armutsrisiko und auch einen deutlich geringeren Lebensstandard als Alte“, fügte er hinzu.


Finde ich eine wichtige Einordnung, nicht sicher ob ich es OK finde dafür aus der Bild zu zitieren. Und diese Zahlen sind ohnehin kaum aussagekräftig, solange sie nicht inflationsbereinigt sind - 1500€ sind heute weniger wert als 2022.

Jedenfalls, 7,4% der Rentner haben <1100 €/Monat - das ist ein geringerer Anteil als der der Menschen, die ALGII beziehen. Damit will ich jetzt auch keine Betroffenheits-Olympiade veranstalten, sondern ich möchte nur herausstellen, dass Altersarmut kein größeres Problem ist als Armut allgemein.

This entry was edited (16 hours ago)

Real reasons people do not have the number of children they want revealed in new report


This article notes that "right-wing governments, including the US and Hungary, are increasingly blaming falling fertility rates on a rejection of parenthood", as if today's young adults just don't want children.

But the author suggests that actually people do want children, and one of the main reasons they're having fewer children is because they can't afford many children.

Thoughts?

in reply to SleafordMod

Falling birthrates are not a problem for humanity.

They're a problem for capitalism which can't rely on that for nebulous "growth" figures.

But if capitalists really want a solution, then a home for two adults and two children should be affordable on one average wage, not two. Build more and make them cheaper. If you can't do that then you don't care about the problem enough.

in reply to return2ozma

Right...

Take a look at this: en.wikipedia.org/wiki/History_…

Note how almost every one of these horrible things lead to a conviction of the perpetrator. So tell me, if the police and judiciary system in general does not protect you, who investigated these cases and how did the convictions happen?

What do you think would happen to violence like this if there was no police and hence no way to get caught? Do you think it would decrease or increase?

This entry was edited (22 hours ago)
in reply to VirgilMastercard

Depends on how long I'm inside, how dark the store is and how much of a fuck I give on a given day. I do think that most people think it's rude/douchey/etc., but I'm not convinced that I should care about that kind of moralizing of etiquette (though I do care, to various degrees, what people think of me).

It's somewhat harder to see inside with sunglasses, but I, too, wear prescription glasses so it's a bit of a hassle to change to normal glasses.

This entry was edited (1 day ago)