sneak

Speaking of fraud: If you're so professional and trustworthy and transparent as you claim, Mister Sneak, then why haven't you updated your list of government requests for user data on keytern.al since 2015-Q3, 8 years or 32 quarters ago? https://keytern.al/p/faq/ Either you've had government requests since then during the intervening 8 years and you're dishonestly concealing them, or keytern.al is not a serious company, and you're just yet another cryptocurrency scammer trying to defraud people and get rich quick by shilling on Hacker News. So stop shilling your crypto key stealing company on Hacker News as recently as 26 days ago, if you don't have the time to update your list of government requests for user data in 8 years, missing 32 quarters in a row, or honestly answer legitimate questions about your company, and provide objective proof of your outlandish claim about your own security and integrity. For many years, you've run a web site that offers to "back up" gullible sucker's crypto keys, with outlandish unsubstantiated claims like: >Trusted by over 30,000 wallet holders, keytern.al is the market leading bitcoin backup key provider, trusted by large companies and small startups alike. And there's a spectacularly suspicious gaping 32 quarter (8 year) gap in your list of government requests for user data. https://keytern.al/p/faq/ >We will update this table from time to time as permitted by law. >Last update: 2016JAN01. Does that sound like a legitimate,…

I'm currently working on a similar project to make a list of all blogs and personal sites on the web. It's not ready yet but I'll post about it when it is. My personal site: https://sneak.berlin

It's impractical for everyone and impossible for some people to interpret every question through the lens of the person asking the question. The use of American euphemisms is constantly changing and it is unreasonable to expect non-native English speakers or neurodivergent people to keep up. Practice empathy. Guess at others' intent in order to do your best to give others the information that they want. But then insist that they use plain English in the future and that doing otherwise is wrong. https://sneak.berlin/20191201/american-communication/

> What email do you use with domain registrar? Using a paid email account that is only for admin purposes is the suggestion I have followed, based on https://sneak.berlin/20201029/stop-emailing-like-a-rube/

The world has changed. May not be completely accurate yet, but fits 2021 like a glove: https://sneak.berlin/20210202/macos-11.2-network-privacy/ https://sneak.berlin/20201112/your-computer-isnt-yours/

It's a great read. Why not link to it? https://sneak.berlin/20201112/your-computer-isnt-yours/

Interesting article, and call my cynical but wasn't anyone else immediately reminded of the excellent HN post earlier this month [1], and the Apple big-picture play proposed there? "Those shiny new Apple Silicon macs that Apple just announced, three times faster and 50% more battery life? They won’t run any OS before Big Sur." [1] https://sneak.berlin/20201112/your-computer-isnt-yours/

Allow me to auto-translate my comment which initially was a response to "How can an ordinary developer get involved in the open source community, and is it worth it?" article (in Russian), because it describes how these different social expectations arise from the start. It's very long and poorly structured, but it's valuable from my standpint. Don't read if you value your time. --- Your article only covers the most well-known, largest, and established projects that meet both the technical definition of open source (open source code, under a free license) and the social definition (code is publicly available to everyone, free of charge, with both bug fixes and simple bug reports encouraged), and are also economically attractive to businesses (more on that later). There may be a couple of hundred such successful projects. A drop in the ocean of open source. From my experience, I believe that the lack of mention of this distinction between technical and social open source is the main cause of disagreements, disputes, and, ultimately, burnout due to misaligned social expectations. --- FFmpeg vs. AWS (spoiler) >This can even be seen in your screenshot of AWS vs. FFmpeg in the article: the author of the FFmpeg Twitter account repeatedly believes that corporations owe something since they use open source code, even though the license doesn't obligate them to do so. Moreover, when Google launched its fuzzing program (objectively the most advanced in the industry), which…

Did the folks downvoting me forget about Gatekeeper and trustd or what? https://sneak.berlin/20201112/your-computer-isnt-yours/ > It turns out that in the current version of the macOS, the OS sends to Apple a hash (unique identifier) of each and every program you run, when you run it. Lots of people didn’t realize this, because it’s silent and invisible and it fails instantly and gracefully when you’re offline, but today the server got really slow and it didn’t hit the fail-fast code path, and everyone’s apps failed to open if they were connected to the internet. > Because it does this using the internet, the server sees your IP, of course, and knows what time the request came in. An IP address allows for coarse, city-level and ISP-level geolocation, and allows for a table that has the following headings: > Date, Time, Computer, ISP, City, State, Application Hash Would anyone care to actually make an argument how celebrating an OS that phones home about every application you run, all but forces you to create online accounts, and pushes you to store your data on the cloud as ‘pro-privacy’ because its chief competitor is truly outrageously bad does not speak to a serious degradation in our privacy standards?

I don't really follow Apple news, but I do remember this: https://sneak.berlin/20201112/your-computer-isnt-yours/ > On modern versions of macOS, you simply can’t power on your computer, launch a text editor or eBook reader, and write or read, without a log of your activity being transmitted and stored. > It turns out that in the current version of the macOS, the OS sends to Apple a hash (unique identifier) of each and every program you run, when you run it. Lots of people didn’t realize this, because it’s silent and invisible and it fails instantly and gracefully when you’re offline, but today the server got really slow and it didn’t hit the fail-fast code path, and everyone’s apps failed to open if they were connected to the internet. > Because it does this using the internet, the server sees your IP, of course, and knows what time the request came in. An IP address allows for coarse, city-level and ISP-level geolocation... > Apple (or anyone else) can, of course, calculate these hashes for common programs: everything in the App Store, the Creative Cloud, Tor Browser, cracking or reverse engineering tools, whatever. > This means that Apple knows when you’re at home. When you’re at work. What apps you open there, and how often. They know when you open Premiere over at a friend’s house on their Wi-Fi, and they know when you open Tor Browser in a hotel on a trip to another city.

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously that's going to be really hard with the changes they have made to the OS). I know many Apple's fan see this as a positive move. But let's not ignore the pattern of privacy violations and user data collections due to deliberate design and the "apology" and "changes" that follow once CAUGHT. A few of these that immediately come to mind are: - Apple selling user data to US government: https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data - Apple iPhone 11 tracks user location even when location services are explicitly turned off by user (another BACKDOOR): https://www.silicon.co.uk/mobility/smartphones/apple-iphone-collects-l… - Apple macOS tracks every app that you use: https://sneak.berlin/20201112/your-computer-isnt-yours/ - Apple introduces BACKDOOR in its API to allow Apple apps to bypass application firewalls: https://www.patreon.com/posts/hooray-no-more-46179028 (For those who want to diss me for the above, realise that Apple's new found love for privacy doesn't mean shit without such public scrutiny and…

Apple sends tens of megabytes of telemetry from first network connection and regularly: https://sneak.berlin/20210202/macos-11.2-network-privacy/ None of this able to be turned off, the boot volume is read-only. Can only be deactivated by jumping through hoops.

> "Apple lies about a fundamental security practice consistently and with malice" Uploading passwords to the cloud should count. Also this: https://sneak.berlin/20231005/apple-operating-system-surveillance/

> All encryption is end-to-end, if you’re not picky about the ends. This reminds of how Apple iMessage is E2E encrypted, but Apple runs on-device content detection that pings their servers, which you can't possibly even think of disabling. [1][2] [1] https://sneak.berlin/20230115/macos-scans-your-local-files-now/ [2] Investigation in Beeper/PyPush discord for iMessage spam blocking

Among others: https://en.wikipedia.org/wiki/PRISM https://sneak.berlin/20201112/your-computer-isnt-yours/ https://www.cbsnews.com/news/apple-siri-lawsuit-settlement-iphone-eave…

Did you not read your own links before posting them lol? > Mind you, this is definitionally a conspiracy theory; please don’t let the connotations of that phrase bias you, but please feel free to read this (and everything else on the internet) as critically as you wish. https://sneak.berlin/20231005/apple-operating-system-surveillance/ I will admit that this sentence was easy to miss, hidden deeply at the start of the second sentence of the piece. These links are just all Apple Does A Thing HN Dislikes and I just don’t think any of those things is particularly bad.

Even if you try to install it using a flash drive, it still asks you to connect to the internet to "verify" the installation. https://sneak.berlin/20201204/on-trusting-macintosh-hardware/ explains how it's ensured on the firmware level that you really connect with Apple servers.

Uh, yes? Of course. They are just another company that cares little for your privacy. Apple OSes Are Insecure by Design to Aid Surveillance https://sneak.berlin/20231005/apple-operating-system-surveillance/

This: https://sneak.berlin/20201112/your-computer-isnt-yours/

It's already happening, and scans even with iCloud turned off: https://sneak.berlin/20230115/macos-scans-your-local-files-now/

https://sneak.berlin/20230115/macos-scans-your-local-files-now/ is a better link. Discussion: https://news.ycombinator.com/item?id=34392391

I'm using Feedly. Checking it once a couple of weeks and happy about my flow. Here are the blogs that I follow: - https://jvns.ca/atom.xml - http://rachelbythebay.com/w/atom.xml - https://blog.kowalczyk.info/atom.xml - https://ashfurrow.com/feed.xml - https://sneak.berlin/feed.xml - https://sookocheff.com/index.xml - https://www.hanselman.com/blog/feed/rss - https://zachholman.com/atom.xml - https://www.wezm.net/v2/rss.xml - https://alexdanco.com/feed/ - https://tyler.io/feed/ - https://tylertringas.com/feed/

It's easy for the os to stack up the updates and the push everything once the network is back up. See: https://sneak.berlin/20210202/macos-11.2-network-privacy/

Nitpick: What I think you're talking about is not E2E because there is no recipient (ie in this scenario Apple is not able to decrypt your data). It's just bog-standard encryption so your files are private or only shared with people you choose. We can only recognize the current situation, not a hypothetical future one. I for one think it is unlikely that Apple will willingly lock themselves out of that mountain of intoxicating user data. I believe their privacy stance is just marketing. There's countless examples of them not caring about real security issues, eg https://sneak.berlin/20201112/your-computer-isnt-yours/ Even if they do ever implement true encryption - not E2E between customer and Apple - personally I wouldn't trust it because of the unauditable on-device scanning/snitching.

People are forgetting here that MacOS is already scanning all your unknown files (not only images) and sending hashes into the cloud. https://sneak.berlin/20201112/your-computer-isnt-yours/

Last year Apple reacted after the outcry about MacOS tracking[1] so there is some hope. That was not a deliberate product and probably more of an unintended behavior though. I'm really hoping this was just a team at Apple that got blinded by all the cool cryptography they came up with to solve a problem and that the higher ups will react if we screech loudly enough. [1]: https://sneak.berlin/20201112/your-computer-isnt-yours/

I saw your blogpost [1] mentioning how the iPhone 12 is likely your last. Have you given any thought since then to what your next smartphone would be? Or if you still use smartphone at all? [1]https://sneak.berlin/20210202/macos-11.2-network-privacy/

Though the links on this site are now dead and incorrect for the repository on GitHub, it is good to see the author moved their repo to self-hosted Gitea (https://git.eeqj.de/sneak/consoledonottrack.com). It would be hypocritical to be against tracking and then host one's code on Microsoft's GitHub. Even better they released a blog post in 2020 about why the repos were moved (https://sneak.berlin/20200307/the-case-against-microsoft-and-github/).

That's not the worst part. MacOS monitors every time you run an executable, which executable, when and where, and it shares this with unencrypted traffic. Not only that, but the data is collected as part of PRISM, so there is no court order to get it. https://sneak.berlin/20201112/your-computer-isnt-yours/

?? Little Snitch works fine for me on macOS BS on my M1 MacBook Pro. Does it fail to work properly on Intel Macs? All of my x86 Macs are far too old to try Big Sur. EDIT: Oh, I see -- first-party Apple apps can stream unlimited data, tracking your activity. Egads... https://sneak.berlin/20210202/macos-11.2-network-privacy/