soloActivist

I normally grab a #youtube video via #invidious onion instances this way:

yt-dlp --proxy http://127.0.0.1:8118 -f 18 http://ng27owmagn5amdm7l5s3rsqxwscl5ynppnis5dqcasogkyxcfqn7psid.onion/watch?v="$videoID"

Now it leads to:

ERROR: [youtube] $videoID: Sign in to confirm you’re not a bot. This helps protect our community. Learn more

There used to be a huge number of Invidious instances. Now the official list is down to like ½ dozen.

This email provider gives onion email addresses:

pflujznptk5lmuf6xwadfqy6nffykdvahfbljh7liljailjbxrgvhfid.onion

Take care when creating the username to pull down the domain list and choose the onion domain. That address you get can then be used to receive messages. Unlike other onion email providers, this is possibly the only provider who offers addresses with no clearnet variations. So if a recipient figures out the clearnet domain it apparently cannot be used to reach you. This forces Google and MS out of the loop.

It’s narrowly useful for some situations where you are forced to provide an email address against your will (which is increasingly a problem with European governments). Though of course there are situations where it will not work, such as if it’s a part of a procedure that requires confirmation codes.

Warning: be wary of the fact that this ESP’s clearnet site is on Cloudflare. Just don’t use the clearnet site and keep CF out of the loop.

I have lots of whistles to blow. Things where if I expose them then the report itself will be instantly attributable to me by insiders who can correlate details. That’s often worth the risks if the corporate baddy who can ID the whistle blower is in a GDPR region (they have to keep it to themselves.. cannot doxx in the EU, Brazil, or California, IIUC).

But risk heightens when many such reports are attributable under the same handle. Defensive corps can learn more about their adversary (me) through reports against other shitty corps due to the aggregation under one handle.

So each report should really be under a unique one-time-use handle (or no handle at all). Lemmy nodes have made it increasingly painful to create burner accounts (CAPTCHA, interviews, fussy email domain criteria, waiting for approval followed by denial). It’s understandable that unpaid charitable admins need to resist abusers.

Couldn’t this be solved by allowing anonymous posts? The anonymous post would be untrusted and hidden from normal view. Something like Spamassassin could score it. If the score is favorable enough it could go to a moderation queue where a registered account (not just mods) could vote it up or down if the voting account has a certain reputation level, so that an anonymous msg could then possibly reach a stage of general publication.

It could even be someone up voting their own msg. E.g. if soloActivist is has established a history of civil conduct and thus has a reputation fit for voting, soloActivist could rightfully vote on their own anonymous posts that were submitted when logged-out. The (pseudo)anonymous posts would only be attributable to soloActivist by the admin (I think).

A spammer blasting their firehose of sewage could be mitigated by a tar pit -- one msg at a time policy, so you cannot submit an anonymous msg until SA finishes scoring the previous msg. SA could be artificially slowed down as volume increases.

As it stands, I just don’t report a lot of things because it’s not worth the effort that the current design imposes.

EU-based ATMs tend to charge a fee of ~€4—6 on non-EU cards. I’m fine with that because my bank rebates those fees anyway. However something seems off with some French ATMs.

France has a reputation for having the highest banking fees in Europe and their ATMs seem consistent with that reputation. Some French ATMs charge €6 and that gets printed on the ATM receipt. As expected my bank sees the fee on their side in that case and they credit it back to me -- so no problem there. But then other ATMs in France do not print any fee on the receipt. Consequently my bank sees no fee on the transaction so they rebate nothing back to me. Are those ATMs reeaaally giving up the opportunity to charge a fee to non-EU cards? Certainly no Dutch ATMs ever pass up that opportunity. When calculating the xe.com rate of that day and comparing to the money drawn from my bank account, there is a discrepancy of ~$5.50 USD.

So it looks like the ATM is adding their fee into the euro amount. E.g. I pull out €400 & decline DCC, and the ATM prints a receipt showing €400 but then draws something like €405. In principle it should be evident from the bank statement. But my bank lacks transparency and omits from the statement the euro amount and also withholds the exchange rate they applied (which the contract says is the straight interbank rate with 0% markup).

I see two possible theories here:

1. my bank’s so called fee-free FX rate is really ~1%; OR
2. the French ATMs add the fee to the amount charged and hiding the fee. They do not benefit from it but could be sloppy programming. Maybe they think it does not matter because they are still charging whatever the customer agrees to anyway.

While I struggle to believe that 3 different French ATMs would pass up the chance to take a fee, I ran the numbers on a transaction that actually does transparently take a fee and result in a rebate. I still paid almost 1% more than the xe.com rate.

All fees must be disclosed on the ATM screen by law. But my memory is not so reliable.

(cross-posting is broken on links.hackliberty.org, so the following is manually copied from the original post)

When your bank/CU/brokerage demands that you login to their portal to update KYC info soloActivist to [email protected] ·

In the past I have only seen PayPal spontaneously demand at arbitrary/unexpected moments that I jump their their hoops -- to login and give them more info about me. I reluctantly did what they wanted, and they kept my account frozen and kept my money anyway.

So I’ve been boycotting PayPal ever since. Not worth it for to work hard to find out why they kept my account frozen and to work hard to twist their arm to so that I can give them my business.

Now an actual financial institution is trying something similar. They are not as hostile as PayPal was (they did not pre-emptively freeze my account until I dance for them), but they sent an email demanding that I login and update my employment information (even though it has not changed). Presumably they will eventually freeze my account if I do not dance for them to satisfy their spontaneous demand.

I just wonder how many FIs are pulling this shit. And what are people doing about it? Normally I would walk.. pull my money out and go elsewhere. But the FI that is pushing KYC harassment has a lot of power because they offer some features I need that I cannot get elsewhere, and I have some stocks through them, which makes it costly/non-trivial to bounce.

I feel like we should be keeping a public database on FIs who pull this shit, so new customers can be made aware of who to avoid.

Pushover consumers accepted “Know Your Customer” abuses to their 4th Amendment rights in the banking sector, so why wouldn’t the same work when it comes to internet service? I have no doubt that the privacy apathetic masses will accept this in a heartbeat.

The bank requires customers who use their phone app to:

1. buy a new recent smartphone, repeatedly (because the bank’s app detects when it is running on an Android emulator and denies service)
2. subscribe to mobile phone service (which also costs money and also in some regions requires supplying national ID to the mobile carrier to copy for their records which customers then must trust them to secure)
3. share their mobile phone number with a power abusing surveillance capitalist who promotes the oil industry (Google / Totaal)
4. create a Google account and agree to their terms (which includes not sharing software that was fetched from the Playstore jail)
5. share their IMEI# with Google
6. share all their app versions with Google, thus keeping Google informed of known vulns for which they are vulnerable
7. share with Google where they bank and trust Google not to sell that info to debt collectors
8. install proprietary non-free software and trust the security of non-reviewable code
9. share the mobile phone number with the bank

Why are so many people okay with this?

The state of medical privacy has become quite appalling lately. I started using a young doctor in a new office and they are gung ho on modern tech. That’s fine to some extent but they want to send me invoices and all correspondence via e-mail. No PGP of course. I did an MX lookup on their vanity email address & it resolves to an MS Outlook server.

I asked them for my test results. They offered to email them.

My response: I do not want sensitive medical info coming by e-mail via Microsoft’s servers. I did not give you a copy of my email address for that reason. It needs to be snail-mailed to me.

Perhaps of greater concern is that the receptionist acted like I am making a unusual request, and that they do not mail things. Apparently I am the only patient who has a problem with sensitive medical info going to Microsoft. So the receptionist is investigating whether she can get approval to mail me my results by post.

I wonder if someone in that clinic will have to run out and buy stamps because I have a problem with Microsoft.

cross-posted from: https://links.hackliberty.org/post/984895

Microsoft finances #AnyVision to produce facial recognition technology that the Israeli military uses against the Palestinian people.

So if you oppose Israel’s brutality then #Microsoft should be on your boycott list.

If you are undecided, these stories might help with your decision:

• snipers target a red-cross medic for execution (2018) → https://edition.cnn.com/2018/06/03/middleeast/razan-al-najjar-gaza-nurse-killed/index.html
• Hind Rajab (6 year old; 2024) → https://www.guardian2zotagl6tmjucg3lrhxdk4dw3lhbqnkvvkywawy3oqfoprid.onion/world/2024/feb/10/im-so-scared-please-come-hind-rajab-six-found-dead-in-gaza-12-days-after-cry-for-help

For Hind Rajab, my boycott is on until I die.

cross-posted from: https://links.hackliberty.org/post/125466

My credit card issuer apparently never gets to know what I purchased at stores, cafes, & restaurants -- and rightfully so. The statement just shows the shop name, location, and amount.

Exceptionally, if I purchase airfare the bank statement reveals disclosures:

• airline who sold the ticket
• carrier
• passenger name
• ticket number
• city pairs

So that’s a disturbing over-share. In some cases the airline is a European flag carrier, so IIUC the GDPR applies, correct? Doesn’t this violate the data minimization principle?

Airlines no longer accept cash, which is also quite disturbing (and illegal in jurisdictions where legal tender must be accepted when presented for PoS transactions).

Has anyone switched to using a travel agent just to be able to pay cash for airfare?

UPDATE

A relatively convincing theory has been suggested in this other cross-posted community:

https://links.hackliberty.org/comment/414338

Apparently it’s because credit cards offer travel insurance & airlines have incentive to have another insurer involved. Would be useful if this were documented somewhere in a less refutable form.

There is a common theme pushed by fanatics of capitalism that never dies: that a profit-driven commercial project ensures higher quality products than products under non-profit projects. Some hard-right people I know never miss the chance to use the phrase “good enough for government work” to convey this idea.

I’m not looking to preach to the choir here, but rather to establish a thread of scenarios that correspond to quality for the purpose of countering inaccurate narratives. This is the thread to share your stories.

In my day job I’m paid to write code. Then I go home write code I was not paid for. My best work is done without pay.

Commercial software development

When I have to satisfy an employer, they don’t want quality code. They want fast code. They want band-aid fixes. The corporate structure is too myopic to optimize for quality.

Non-commercial software development

Free software developers have zero schedule pressure. They are not forced to haphazardly rush some sloppy work into an integration in order to meet a deadline that was promised to a customer by a manager who was pressured to give an overly optimistic timeline due to a competitive bidding process. #FOSS devs are free to gold-plate all they want. And because it’s a labor of love and not labor for a paycheck, FOSS devs naturally take more pride in their work.

I’m often not proud of the commercial software I was forced to write by a corporation fixated on the bottom line. When I’m consistently pressured to write poor quality code for a profit-driven project, I hit a breaking point and leave the company. I’ve left 3 employers for this reason.

Commercial software from a user PoV

Whenever I encounter a bug in commercial software there is almost never a publicly accessible bug tracker and it’s rare that the vendor has the slightest interest in passing along my bug report to the devs. The devs are unreachable by design (cost!). I’m just one user so my UX is unimportant. Obviously when I cannot even communicate a bug to a commercial vendor, I am wholly at the mercy of their testers eventually rediscovering the same bug I found, which is unlikely in complex circumstances.

Non-commercial software from a user PoV

Almost every FOSS app has a bug tracker, forum, or IRC channel where bugs can be reported and treated. I once wrote a feature request whereby the unpaid FOSS developer implemented my feature request and sent me a patch the same day I reported it. It was the best service I ever encountered and certainly impossible in the COTS software world for anyone who is not a multi-millionaire.

Some Lemmy instances (e.g. Beehaw) do not support down votes. When an instance does support down-votes, authors often get zero feedback with the down votes which ultimately supports obtuse expression, shenanigans and haters. The status quo suffers from these problems:

• down voters do not need to read the comment they are down voting
• down votes empower non-moderators to suppress comments and posts
• some communities struggle to get content because of some malicious down voters who down vote every post to discourage activity and effectively sabotage the community; voting privacy shields malicious down-voters from discovery and supports their attack
• silent down votes are non-constructive
• some people make heavy use of down votes to suppress civil comments purely because of disagreement; other (more civil) users only use down votes to suppress uncivil dialog. This inequality ultimately manifests to reduce civility.
• transparency: kids and adults are accessing the same forums and adults are blind as to whether down votes are coming from kids (the rationale can reveal this)

The fix:

An instance admin should be able to flip a switch that requires every down vote to collect a 1-line rationale from the voter. These one-liners should be visible to everyone on a separate page. Upvotes do not need rationale. So instance owners should have 3 configuration options:

• down votes disabled (beehaw)
• down votes require rationale (proposed)
• down votes out of control (the most common status quo)

Perhaps overkill, but it might be useful if a moderator can cancel or suppress uncivil down votes.

BTW, the reason this enhancement request is not in the official bug trackers:

• Lemmy’s bug tracker is in MS Github (#deleteGithub)
• Kbin’s bug tracker is on codeberg, who silently deleted my account without warning or reason, and #Codeberg reg forces a graphical CAPTCHA (which fails on my non-graphical browser).

#lemmyBug #KbinBug

/cc @[email protected] @[email protected]