If you want serious and professional: Pay for it!

If you want it free, you get the anime girl.

This is an exclusive choice.

Your instance admin subtitutes the public key in your profile with one they control.

How do you stop this?

Like, half the point of E2EE for DMs is to prevent instance admins from seeing what your messages say. The other half is to prevent instance admins from being able to surrender anything useful to government subpoenas.

That's a reasonable thing to dislike about it.

I dislike that I can't reply to another message with a sticker.

I also dislike that, despite having admin access, I can't delete abusive messages left in groups for anyone but myself. That makes it unsuitable for building communities.

Oh, fair. I just remember getting a LOT of notifications from both apps. I didn't check the exact ratio,

It's a building block to make E2EE possible at Fediverse scale.

I've written about this topic pretty extensively: https://soatok.blog/...

If you can build in Federated Key Transparency, it's much easier to reason about "how do I know this public key actually belongs to my friend?" which in turn makes it much easier to get people onboarded with E2EE without major risks.

No no no.

The $3 is to incur a cost on would-be spammers. I don't think most Fedi users appreciate how much work goes into combatting spam at scale. Signal has hundreds of millions of users. Requiring a phone number limits the blast radius of successful spam campaigns. Removing that requirement means making it much easier for spammers to register.

https://hard-drive.net/...

I like their take on this

Hell, even Mullvad uses WireGuard. Your argument is the most confidently incorrect I've seen on Lemmy ever since that one furry shouted over me to recommend Matrix instead of Signal.

We'll get our top scientists on this, posthaste.

Our bottom and vers scientists remain on standby for new assignments. UwU

Yeah, I say block based on this experience alone.

That sort of comment might be true if I had responded with a shallow, emotional response. Something like "how dare these outrageous motherfuckers claim to 'roast' my hand-crafted artisanal open source beauty with their AI slop!!".

I didn't do that. I sifted through the public information, assembled a profile of the people behind it, discarded the irrelevant details, and used it to describe their conduct as illegal in the country their business is incorporated in, with enough receipts for anyone else who finds their AI grift to leverage to give them immense amounts of legal and compliance pain. And then I released this all on my furry blog with the keywords that other open source developers would likely to try in a search engine if confronted with their same outrageous behavior.

Rather than let my outrage make me a useful idiot, I've surveyed the landscape and made sure that I'm controlling the conversation. I'm also keeping the evidence preserved, and not giving them any SEO backlink juice. This all dovetails into how bad their AI is at what it even claimed to be doing.

If any of this plays into their hands, then they're playing chess on a dimension that the void cannot comprehend, let alone my mortal ass. But I'm willing to wager that the amount of legal anguish my blog post will create for their grift will significantly outweigh any benefit they get from the possible name recognition my blog creates.

How much do you know about cryptography?

I've written tons about why this approach was taken, but it might be inaccessible to someone with limited knowledge of modern cryptography protocol design. (Authenticated encryption, forward secrecy, context commitment, etc.)

This was my earliest blog post on the topic, if you want a place to start.

You're the one that chose to comment on my post lol

TL;DR from oss-security:

At a glance, what I found is the following:

1. Session only uses 128 bits of entropy for Ed25519 keys. This means their ECDLP is at most 64 bits, which is pretty reasonably in the realm of possibility for nation state attackers to exploit.
2. Session has an Ed25519 verification algorithm that verifies a signature for a message against a public key provided by the message. This is amateur hour.
3. Session uses an X25519 public key as the symmetric key for AES-GCM as part of their encryption for onion routing.

Additional gripes about their source code were also included in the blog post.

Thanks. Happy to help! <3

Wireguard is not a vpn, there is no usable vpns built on wireguard,

Tailscale

How much can you control the conversation if the entity you are discussing only wants their name published?

It's not about what they want published. It's about what they don't want published.

Sure there will be a few GDPR letters and maybe an inquiry by some regulatory body. Satisfyingly annoying to them, but compared to the cost of an advertising campaign; would this not be just a drop in the bucket.

Advertising campaigns generally don't include OSINT on the people behind it and evidence of their crimes. How does what I published help them increase their revenue or reduce their costs? Everything is ruled by incentives.

Yep. That's why the two things I say Automattic MUST do to make things right are about proper consent controls for Automattic's use of data and sale to AI vendors, but the third thing is a proposed proactive defense against scrapers.

That's a personal matter that I don't really feel like commenting on, but I'm not naive about politics and how it affects people.

Until the mods randomly decide to censor you, like they did with my post about tech companies disrespecting user consent.