Post by @hipsterelectron@circumstances.run

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

wanted to mention a pretty important pair of very recent simultaneous incidents (a coincidence, in other words):

reddit somehow figures out a way to institute an even greater degree of restrictions against any attempts to access the site's content via API or otherwise without executing the compiled code they publish as the "official app"
- (DRM as the polite form of RCE vector)
the reddit "official app" simultaneously pushes an update which institutes a new policy which supersedes and subverts the ios app permission model
- by dictatorial fiat, reddit now requires the user to grant complete unfettered read access to all current and future image files ever even temporarily saved to the user"s device, if the user attempts to trigger the familiar existing download feature which saves any of the site's content to the device (which of course limits the reddit app's ability to surveil access to its content)

0 Boosts

0 Likes

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

in short, reddit now adds a conditional branch in the code which users are then coerced into executing on their own device. this is by no means an unprecedented way to enact legislation in the modern fascist surveillance state

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

indeed, it is in fact exactly the strategy employed by the google photos app a few months prior. which raises quite a fascinating conundrum

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

see, for various reasons this ipad pro device (whose hardware specs remain top-of-the-line after a decade, since processors all decided to simply stop getting faster) had not updated from ios 18 or otherwise updated any apple-provided system software for years (no clue how many but at least one calendar year)

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

and ios 18 predated liquid ass, but did support a major security feature blatantly stolen from grapheneos and daniel micay without credit, since apple cares very strongly about maintaining the perception that its devices are secure against hostile and adversarial government intrusion.

which feature was that? it's actually one i haven't seen daniel micay write any 300-post thread on yet (I AM SURE THAT HE HAS, I TRUST HIM WITH MY LIFE, I'M JUST MAKING A JOKE TO EMPHASIZE THAT APPLE HAS NOW DONE THIS AT LEAST THREE SEPARATE TIMES AND AT THIS POINT DANIEL MICAY DESERVES A CUT FROM THE SALE OF EVERY NEW IPHONE)

~20 more replies

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

it was their bastardization of the tremendously slick "storage scopes" feature from grapheneos, a novel invention in the backwater we flatter by calling it the field of OS virtualization/isolation, a true eureka moment: what if you could grant access to the files you want apps to access, without granting them retroactive past and future access to every file you ever have access to?

in the world of sexed up cybersecurity contractors living off US government corporate welfare, this is called a zero trust architecture, and you can grift millions of dollars from taxpayers by claiming to one day consider developing one as a product

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

ios 26, to the best of my understanding, has actually extended this concept quite significantly from the version that was ripped off from micay & team without credit

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

the apple corporation's famous engine of innovation has done it yet again, by making it directly and unambiguously visible to any application whether it has been granted scoped (consensual) or unlimited (nonconsensual) access to images owned by the user and stored on their device (which any constitutional lawyer would describe as unambiguously protected against unreasonable search and seizure by the fourth fucking amendment)

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

so, in other words, apps have been granted a syscall that lets them gaslight the user

HEY COME ON BABE DON'T YOU TRUST ME??? WHY DID YOU CHANGE YOUR PASSWORD WHAT'S ON YOUR PHONE WHAT ARE YOU HIDING FROM ME I CAN'T TRUST YOU AT ALL ANYMORE

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

the US state has many court systems and legislative bodies and executive branches outside the strictures of its constitution. indeed, US corporate governance was (along with our multiple genocides) one of the famous inspirations for nazi germany's dictatorship under adolf hitler. DRM executes legislation—the courts are all implicit and/or secret

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

but the legislation documents somehow remain visible and open https://circumstances.run/@hipsterelectron/116640648673302277 operating system developers are being compelled to backdoor their products, and very specifically encouraged to find creative ways to determine the age of the device's user(s) without the consent of the user. both california and federal legislatures have passed and updated laws that are very specific that consent must not be possible.

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

as i argue in my self-link above and here too for example https://circumstances.run/@hipsterelectron/116640885434234176 being "compelled" by the government is actually a complete misnomer. the laws explicitly limit the government's ability to enforce them—the california one requires the AG to file a claim against your corp individually, and then specifies 3-5 categories of response you can provide that safely indemnify you.

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

that's in the text of the law, so you're safe regardless of the opinion of any AG or judge, unless the judge were to claim the law itself were unconstitutional—which of course, makes it unenforceable. they have completely neutralized any potential legal risk in any way shape or form

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

so when the elementaryOS CEO:

(who pushed out her cofounder under suspicious circumstances and continues to claim he willingly gave up his shares for free while downplaying his prior contributions),
immediately complies in advance with california's explicitly nonconsensual user age surveillance law,
then immediately goes DARVO on fedi claiming the legal risk of not telling fascists the identity of her underage users could bankrupt her,

i wanna know why i see people boosting her fucking platitudes of girlboss feminism and accept at face value her lengthy and involved smear campaign against the x window system

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

i literally do not care if wayland is technically interesting or systemd is convenient to you personally. i also do not consider screenshots from X (which require an active account to procure) of your favorite pet fascist crying about drew devault to be a form of admissible evidence. an enemy you have to screenshot on X is an enemy you're making up, and their enemy is not my friend because everyone boosts you being a girlboss.

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

drew devault evaded repeated bans from the openssh mailing list years back while decrying maintainers as sickeningly immoral in an obvious campaign to coerce their behavior. this preceded openssh colluding with systemd through the magic of dlopen() to weaponize the xz-utils vulnerability, which also famously took the form of negging the maintainer mercilessly.

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

the hare language silently falls back to an insecure CSPRNG and devault absolutely refuses to change this behavior or to make it possible to ensure or even to confirm safety.

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

imagine for a moment i didn't know anything about the security properties of the software that governs the global mutable buffer which also happens to be decodable into pixel values displayed by your monitor hardware. but you're telling me the guy whose programming language is indistinguishable from C (except for the crypto backdoor) invented a middleware layer for this inherently and inescapably privileged hardware resource, and that his politics are distinct from linus fucking torvalds

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

the rationale that historically justifies any intrusion protected by the fourth amendment is concern for the protection of children. i have no doubt reddit's recent subtle photo permissions change is linked to an NSA/FBI program claiming to find and stop CSAM production. i also have no doubt the government agents assigned to this surveillance regime will include people later found to have abused children.

US intelligence agencies are never held accountable for these breaches of trust, at least since 1975 when the church committee was used as a red herring while vint cerf incipiated the ARPANET behind closed doors

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

drew devault would never get his hands dirty like that, and i earnestly believe he thinks he's doing the right thing. apple also makes it a point to hire engineers like devault, who are genuinely motivated to devote their creative energies on the user experience, and i genuinely admire multiple people who currently or have previously worked there

d@nny disc@

@hipsterelectron@circumstances.run 2 days ago

if you refuse to understand the effect of a system as a distinct process that remains inextricably linked to the motivations of its constituent components, then you will count yourself among the second wave of apologists for the second wave of free software. this is the nature of progress under the fascist project