Skip to main content



in reply to David Chisnall (*Now with 50% more sarcasm!*)

replied here fosstodon.org/@arcanechat/1157…


@david_chisnall by saying "requires phone numbers" I was implying that you can discover people by phone numbers since that is the case in 99% if not 100% of all apps that offer phone number registration, that you can disable this feature is meaningless if it is opt-out and most people will leave it like that, by saying ArcaneChat is immune to this I meant because you can't discover people like that, people must get in contact directly via QR or invite link



Je sors de mon silence pour invoquer vos lumières antispécistes 🐀

On a deux rats tous mignons dans notre cave qu'on comptait trapper pour les relâcher plus loin, sauf que ce matin j'ai confirmation de ce que je redoutais.. il y a des bébés 🥺

Évidemment il est hors de question d'abandonner qui que ce soit à son sort, mais je sais pas trop comment gérer la chose là...

le ratpouet est conseillé 🩶



Mangeurs de légumes et/ou de poissons, on a bien compris que la pub, c'était mal. Maintenant, prenez 5 minutes pour participer à la consultation publique pour la protection du loup.
fne.asso.fr/actualites/liberal…


>look for active shooter on the run
>president decides to announce that the suspect is detained
>he isn't
:rinbook:


I’m going to offline & to bed.
There’ll be so much speculation going on right now that until we know what’s happening from the police, everything else is just media noise.
G’nite everyone - & hugs to all my lovely fedi friends that’ll be feeling much the same as I am.


Estonia highlights Belarus’ political arrests, calls for release of all prisoners | News byteseu.com/1626576/ #Belarus #MargusTsahkna


Meanwhile, on the App Store, Firefox claims to champion privacy is now advertising AI partnerships as a new feature 😏 it is turned on by default but you can turn it off. Overall the future of Firefox is not so bright.

reshared this

in reply to nixCraft 🐧

Are there any good ways for Mozilla to monetize Firefox and/or its engine, Gecko? Google monetizes Chrome and Blink through advertizing, and Apple doesn’t need to monetize WebKit because it makes so much money from hardware sales. The money to pay Firefox’s developers must come from somewhere.

in reply to Thor Rapid

Ein Drahtzaun mit Stacheldraht ist vor einem unscharfen Hintergrund aus Pflanzen zu sehen. Der Drahtzaun ist mit Frost bedeckt und hat einen violetten Farbton. Die Stacheldrahtspitzen sind scharf und zeigen in verschiedenen Richtungen. Der Hintergrund besteht aus dichtem, grünen Laub, das unscharf ist. Das Bild ist nah aufgenommen, wodurch der Fokus auf dem frostbedeckten Drahtzaun liegt.

Bereitgestellt von @altbot, privat und lokal generiert mit Gemma3:27b

🌱 Energieverbrauch: 0.084 Wh



1 Kings ~ 8:13 to 8:38, In-depth Study


Welcome back to another in-depth Bible study. If you're just now stopping by I highly recommend going back to the beginning, Genesis 1:1. This is an in-depth Bible study that follows chapter by chapter, verse by verse, Genesis to Revelation. https://youtu


Russia’s war casualty toll in Ukraine up by 710 over past day byteseu.com/1626574/ #Ukraine



splendid

Sensitive content



"Tool allows stealthy tracking of #Signal and #WhatsApp users through delivery receipts"

cyberinsider.com/tool-allows-s…

Another privacy vulnerability caused by the dependency on phone numbers.

In #ArcaneChat (and other #chatmail clients like #DeltaChat) you don't need a phone number (or any private data at all!) to register, so such attacks are simply impossible, keep your family safe, join arcanechat.me

in reply to ArcaneChat

in reply to David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall by saying "requires phone numbers" I was implying that you can discover people by phone numbers since that is the case in 99% if not 100% of all apps that offer phone number registration, that you can disable this feature is meaningless if it is opt-out and most people will leave it like that, by saying ArcaneChat is immune to this I meant because you can't discover people like that, people must get in contact directly via QR or invite link
in reply to ArcaneChat

So there is no way for anyone to use a public identifier like an email address or similar to reach you?

What do you put on business cards or similar if you want people to contact you? An invite link?

in reply to David Chisnall (*Now with 50% more sarcasm!*)

#DeltaChat is for private chatting, so you normally don't put your link anywhere publicly, you could create a dedicated profile for public interactions tho, which, unlike in signal, it is super easy to do and you can have as many as you want,

and notice the use case I am talking here is family chat, not business and public interactions, that is why I said "keep your family safe" I am talking about family chat solution here

This entry was edited (2 weeks ago)
in reply to ArcaneChat

#DeltaChat is for private chatting, so you normally don't put your link anywhere publicly, you could create a dedicated profile for public interactions tho, which, unlike in signal, it is super easy to do and you can have as many as you want,


Okay, so your use case for 'private chatting' excludes journalists publishing contact information for whistleblowers? It excludes union organisation? It excludes protest organisation?

I guess that's fine, but maybe don't claim to be operating in the same space as Signal then.

and notice the use case I am talking here is family chat, not business and public interactions, that is why I said "keep your family safe" I am talking about family chat solution here


Then you need to learn about the concept of an anonymity set. If you have one mechanism for talking to your family and another different one for talking to your union rep, it's really easy for a passive adversary to track when you suddenly start using a different mechanism for high-value conversations.

in reply to David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall
what kind of passive adversary are you talking about here? server, provider, global?

Identifying whether you are using this or that chat profile is not necessarily trivial, especially since the 2.33 releases which introduced multi-relay profiles. A single chat profile can jump between using different relays/hosts.

FWIW we share the recommendation of @arcanechat to split between a public profile (invite link published etc.) and private ones (no publishing).

in reply to David Chisnall (*Now with 50% more sarcasm!*)

> Okay, so your use case for 'private chatting' excludes journalists publishing contact information for whistleblowers? It excludes union organisation? It excludes protest organisation?

> I guess that's fine, but maybe don't claim to be operating in the same space as Signal then.

the ArcaneChat slogan is "private chats for the family" I don't get why you jump angry into my thread to attack, I never said anything about "whistleblowers" whatsoever, please, calm down 😅

This entry was edited (2 weeks ago)
in reply to David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall

> rather than just say ‘I don’t understand this attacks but the researchers who published it didn’t bother trying to attack the protocol I use and so I’m sure it is secure!’ That is exactly the attitude to security that makes me distrust DeltaChat.

I don't understand why do you seem so upset, #DeltaChat has received several REAL PROFESSIONAL INDEPENDENT security audits, all listed here: delta.chat/en/help#security-au…
can you provide a similar list of REAL sec. audits for Signal?

in reply to ArcaneChat

I don't understand why do you seem so upset,


Because you're spreading misinformation to score marketing points and spreading misinformation about secure messengers gets people killed.

I don't understand why do you seem so upset, #DeltaChat has received several REAL PROFESSIONAL INDEPENDENT security audits, all listed here: delta.chat/en/help#security-au


So, none after this particular class of attack was discovered and therefore none that include this in the threat model?

in reply to David Chisnall (*Now with 50% more sarcasm!*)

The attack class is not really new though, for Signal "delivery receipts" it is known that they can be used to track when devices get online since at least 2018: anarc.at/blog/2018-07-27-signa…

It is also very similar to "Silent SMS" problem.

in reply to David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall being careful of claiming that something is "secure" is good advise/critique. Users are easily misled other ways. As to delivery receipts, it's unlikely there is a big problem with #chatmail clients (of which delta chat and arcanechat are two) because you can not cause a delivery receipt from a peer. But there are likely online-leakage issues with the invite protocols securejoin.readthedocs.io like github.com/chatmail/core/issue… that require work and independent audits.
in reply to Delta Chat (39c3)

@delta @david_chisnall
Delta(s). Your design -- separation of chatting logic from transport -- is what will allow to overcome this observation and correlation constructions.
You can swap to different transport, like ASMail from 3NWeb set, it is web-style federation, reducing metadata on servers, and correlations between servers.
And then clients and servers may sit on mixnet, like Nym (say hi to them at 39c3).
in reply to David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall In Delta Chat there are no device-to-device delivery receipts ("two empty checkmarks" in Signal: support.signal.org/hc/en-us/ar…) and no automatic error responses. There are read receipts, but they require displaying the message, so cannot be silent and are not sent for reactions. There is a known issue with long-living QR codes/invite links, but this cannot be used to probe online status of someone you just happen to be in the chat with, I posted about it here:
support.delta.chat/t/careless-…
in reply to David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall
Re XMPP:
> And this is impossible to fix without redesigning the protocol because unknown iq stanzas must be forwarded to the client to enable future extension and clients must respond with errors.

I guess the client can still pretend to fail to receive it? Just like responding with TCP RST or ICMP echo-response, technically yes, you MUST respond according to the spec, but in practice you can just firewall it away to slow down network scans.

in reply to l

@link2xt

Maybe, as long as you have a good allow list, because there are a bunch of extensions that do feature discovery by sending an iq stanza and handling an error as a ‘I don’t know what this feature even is’ response. You might be able to get away with ignoring them for people not in your roster, but that would probably break other things in subtle ways.

Pings are a bit different because the sender expects them to be dropped in some cases. XMPP is built around the idea that you have a mostly reliable network once you have connected and stanzas will either be buffered by a server and delivered eventually or delivered immediately, and that they will be delivered in order between two peers. Breaking that will have a bunch of knock-on effects that are hard to predict because it’s such an ingrained assumption in how every higher-level bit of the extended protocol is designed.

@l


Dodik ally wins vote in Bosnia’s autonomous Republika Srpska – DW – 11/23/2025 byteseu.com/1626572/ #Bosnia #BosniaAndHerzegovina #BosniaHerzegovina #Herzegovina


The Japanese central bank is reportedly likely to raise its policy interest rate to around 0.75% from around 0.5% at present at its two-day monetary policy meeting through Friday this week. japantimes.co.jp/business/2025… #business #economy #boj #monetarypolicy #japaneseeconomy #satsukikatayama #kazuoueda


I can't help thinking that people who fall in love with their ai assistant are having very different conversations than the one I just had with mine.



E sono sempre io, quella che gioisce per un piccolo gesto, che sta male se sbaglia e piange e si dispera, quando vede questa pianta a terra, forse il vento, forse un gatto, o semplicemente colpa mia , c'erano ben 4 orchidee, erano forse pesanti, ora nn credo fioriranno più, si sono spezzate, ed io mi sento così, perché ha un valore affettivo la pianta, l' averla curata e poi forse trascurata, mi fa sentire in colpa ...e tanto!
Unknown parent

pixelfed - Link to source
Marty
Lo so ma è un mio difetto !🙏🫂


Video footage from Bondi: contains only the part where members of the public disarm the gunman

Sensitive content



Somalia and Serbia Eye Broader Partnership in Technology, Security, and Education byteseu.com/1626570/ #EDUCATION #Minister #Security #Serbia