Privacy

I'm sharing this one because I'm curious what more knowledgeable people think about this one. Please take a peek at the article before joining the discussion, as my limited quote might have dropped useful information

The VPN industry runs on a promise. Pick almost any provider and the pitch is the same: "we don't keep logs." You hand over your entire internet connection and, in return, you get a pinky-promise that nobody is writing anything down.

For a lot of privacy-minded people, that promise stopped being good enough a while ago. A no-logs policy is only as honest as the company making it, and even an honest company can be hacked, subpoenaed, or quietly acquired.

Obscura VPN is trying to answer to that problem. Instead of asking you to trust its word, it splits the job across two independent companies so that neither one can tie your identity to your browsing. The first hop is Obscura's own servers; the exit hop is run by Mullvad. a respected VPM company out of Sweden. Your traffic is end-to-end encrypted to Mullvad's keys, so Obscura literally can't read it, and Mullvad never sees who you are.

Five years of your social media just to visit the US on an ESTA, and 50,922 phone searches at the border in a single year with no suspicion needed. Part 1 of my Five Eyes series: who else gets to see it?

I built a small open-source web app that lets people share Age-encrypted files using ordinary web hosting. The encrypted file can be hosted at any HTTPS URL, including a public or pre-signed URL for an S3-compatible object store. Decryption happens locally in the recipient’s browser.

Source: https://github.com/parsimonit/web-age-stream-decryptor Demo: https://decrypt-app.zebrastream.io/

The encrypted file stays on the existing server. The recipient opens a share link, and the file is decrypted locally in the browser for viewing or downloading. There’s no decryption backend.

The link contains the file URL and Age passphrase in the URL fragment, so the passphrase is not sent in the HTTP request. The complete link is still a bearer secret: anyone who gets it can decrypt the file.

I’m interested in feedback from people familiar with privacy tools and threat modeling:

• Is this useful compared with existing encrypted file-sharing tools?
• Are there important browser or URL-leakage risks I should document?
• Does the “static frontend + arbitrary encrypted object storage” model seem worthwhile?
• Should rendering decrypted HTML be disabled or treated as an unsafe feature?

Current limitations include buffering large files in memory and the possibility of script execution when decrypted HTML is rendered.

Another win for privacy <3

I made up the title b/c the URL is to the court's finding. Doesn't have a title per se.

TLDR (ruling is 38 pages, so this is BRIEF gd!)

Driver was stopped for following too close. Officer gave warning, but no citation. Officer ran ALPR history, then searched car based on ALPR. Driver admitted to having marijuana in the vehicle, which officer said he didn't care about, and was only after hard drugs. ALPR history had driver driving a long distance for a short visit to the state.

Court ruled:

1. Traffic stop was legal and justified by observed violation. Officer had reasonable basis to stop driver.

2. The subsequent search was NOT constitutional, since officer did not have a warrant for ALPR data, and had no reasonable suspicion of criminal activity.

Result from ruling,

(Driver) has a reasonable expectation of privacy in the location data which tracked her movements over several weeks. .... The ALPR search was an unreasonable governmental intrusion of protected privacy rights.

Vehicle search result was quashed.

There's lots more nuance in the linked filing. Also citations. It's really good IMO. It balances the privacy of the driver's vehicle with the legit justification for the stop. It also notes how "persistent, dragnet surveilence" differs from other kinds. Kudos to judge Sara Hill for really good nuanced ruling, esp around pg 28+ of the ruling talking about constitutional issues.

It's long but totally worth a read. The case does not set a binding precedent.

The legal situation is FAR from perfect. But I hope just once we can have a thread where a ton of ppl don't immediately go, "this good privacy news is useless b/c it does not solve every single problem every single time!" It is evidence in favor of a slow but meaningful shift in ALPR jurisprudence. It stands along side recent SCOTUS rulings that also do that, like Chatrie v United States and Carpenter v United States.

https://github.com/OffGridPete/Fieldwatch/

I added Twitter to my extension to bypass age verification!

Hi! If you don't know me, I made an #opensource #browserextension for #firefox to skip age verification screens on many platforms!

Recently, #Twitter (yes, I'm not calling it X!) sent a cease and deceist letter to #Nitter that allowed you to browse privately. I think this sucks, so now if you want to see an age restricted post you can use my extension to show it! (Still needs to be logged in to an account however, otherwise twitter won't return the tweet data)

🧩 Extension : https://addons.mozilla.org/addon/age-verification-bypass/

💻 Source : https://github.com/helloyanis/age-verification-bypass

Basically, it works by taking all the data from age restricted posts and re-arranging it in the way that regular posts do!

If you're still on twitter (why!) feel free to give it a try, and give me some feedback! Thanks!! 🦊🧡

@privacy@programming.dev @privacy@lemmy.ml

#ageverification #privacy #foss #web

dunno if reason will make a📰

I ( @wslyvh@lemmy.ml ) shared Paperweight earlier here as it was being actively developed and still in beta. After almost 7 months, I'm excited to finally release Paperweight V1 as ready 🗿

Paperweight uses your inbox to map your digital footprint, then helps you take back control and delete your data.

Your email history contains traces of most of your online life. Accounts you created, companies you bought from, mailing lists you joined, services you forgot about, breaches, and personal information accumulated over the years.

Paperweight helps to map your footprint, take back control and delete your data. All locally on your computer.

V1 now includes:

• discover accounts, companies and services connected to your email
• find mailing lists and subscriptions
• show known breaches affecting services you use
• find personal information across your email history
• bulk unsubscribe and clean up old email
• create privacy and data deletion requests
• manage multiple email accounts
• connect to AI agents through MCP

It supports Gmail, Microsoft, Apple, custom IMAP and Proton Mail via Bridge.

The important part for me from the beginning was privacy. All your data stays on your computer. There is no Paperweight backend or external services processing your inbox.

It's also fully open source under MIT.

The free version now includes full-history scanning and discovery, so you can map and inspect your entire footprint. A Pro license makes it actionable. It gives you ease of use, compiled binaries and support and helps support (OSS) development.

Website: https://paperweight.email/
Source: https://github.com/wslyvh/paperweight

By developer @wslyvh@lemmy.ml

TikTok has agreed to pay Alabama at least $100m and enact time limits and other restrictions for teenage users, avoiding a trial with a settlement that was modelled on Instagram-owner Meta’s recent agreement with US states.

Alabama described it as a “first-in-the-nation settlement” with a state in the sweeping litigation over social media’s affect on teen wellbeing.

A trial had been set to begin on Monday in the southern US state over claims by Alabama that TikTok misled parents about tools meant to shield children from harmful content.

TikTok’s settlement with Alabama mirrors safety provisions agreed by Meta, including a two-hour daily time limit for teens, restricted access from midnight to 6am, and suspending notifications during school hours.

It will also strengthen age verification, ban beauty filters for teenagers, and offer young users a non-personalised content feed.

Attorney general Steve Marshall hailed Friday’s settlement as “a great day for Alabama parents”. He said: “Tonight, they can rest easier knowing real protections are in place to shield their children from the dangers of social media addiction.”

Under the settlement, TikTok will send $100m to Alabama and could possibly pay up to $300m in total if 40 other attorneys general sign similar agreements with the company within a specified timeframe.

Alabama’s suit was the latest in a wave of litigation targeting social media companies across the United States about alleged harm their apps cause young users.

In August, Meta agreed to pay $18bn to settle a sweeping lawsuit brought by US states accusing it of designing Instagram and Facebook to get children addicted.

In addition, the Alabama deal includes a conditional restriction that Meta also agreed to: expanding the night-time shutdown period to 10pm to 7am if other platforms also commit to do the same.

“TikTok’s priority has always been fostering a safe and positive space where people can be creative, discover what they love, and connect with their community,” a company spokesperson told AFP.

“This builds on our commitment and core objective to continually enhance our robust safety tools to protect teens,” the spokesperson added.

More than a dozen other states, including California and New York, still havesuits against TikTok.

The company has previously settled cases against it that were headed for trial, including a Los Angeles lawsuit brought by a young woman and a suit from a Kentucky school district.

Meta, by contrast, has taken its chances in court – with bruising results.

In March, a jury in New Mexico ordered the Facebook and Instagram owner to pay $375m after finding it had misled the public about the safety of its platforms for children.

That same month, a Los Angeles jury found Meta and Google’s YouTube negligent in the case of a 20-year-old woman who said she became hooked on social media as a child, awarding her $6m.

Going to trial would have exposed TikTok to unprecedented public scrutiny of how it handles safety, with company documents and executive testimony potentially aired in open court.

Alabama originally sued TikTok and its Chinese parent company ByteDance in April 2025, alleging the app was engineered to hook young users “just like a sophisticated gambling machine”.

The state later narrowed its case to claims under Alabama’s Deceptive Trade Practices Act, focusing on whether TikTok misrepresented the effectiveness of features such as “Restricted Mode” and “Kids Mode.”

The lawsuit accused TikTok of falsely claiming it limits access to sexual and violent content for young users to have its app rated safe for teens in app stores run by Google, Apple and Microsoft and of misleading users about the Chinese government’s access ‌to US users’ data.

TikTok said it designed its platform with teen safety as a key priority and argued that section 230 of the federal Communications Decency Act shields online platforms from liability for user-generated content.

With Agence France-Presse and Reuters

I'm not affiliated with this in any way but saw it posted at the other place & thought fellow Lemmyzens might like to take a look.

I always find it quite hard to answer "favorite" apps as some infrastructure critical self hosted apps aren't as sexy as others which sit front & centre so I feel they often don't seem to get as much credit or attention (such as NGinX/DuckDNS compared to Immich/Jellyfin etc)

Hi everyone,

Like in previous years, I'm running a survey about self-hosting. The focus is on your favorite self-hosted apps, but there are plenty of other (optional) questions too. The top five app lists are free response fields, you don't have to select the suggestions.

Link to take the survey:

https://survey.deployn.de/s/self-host-2026

Last year's results

More info:

• The survey is anonymous. Like last year, results will be published in aggregated form. I'm currently planning to publish them in December.

• It takes about 10-25 minutes.

• Some of you asked for more questions in the comments. I added a lot at first, then realized it took 45 minutes to fill out properly. So I threw some out again, but there are still quite a few. The survey now has a core section that mainly covers the MVPs (your 5 favorite apps), and you can switch on other modules if you want. Almost every question is optional and can be skipped. If you answer everything at a reasonable pace, it takes around 20 minutes.

• The proprietary survey tool caused new problems every year, so last year I switched to HeyForm while the survey was already running. That wasn't ideal for my purposes either, so this year the survey runs on a new app. It should also make entering your apps faster.

• It's still easier to fill out on a desktop computer.

Thank you in advance for participating

TLDR: Flock is moving beyond fixed roadside cameras, into drone surveilance.

With a fixed camera, you might be able to alter your travels to avoid it. In practice that is hard due to how many there are. But you can try. A drone can be anywhere. You prob won't even know it is present most of the time. You cannot change your routes to avoid it.

We now know that Flock does not log only plates. It also IDs pedestrians and cyclists, ppl on scooters or skateboards. It seeks to build a complete picture of the movements of a whole population.

TL;DR is probably:

“What if Google Maps…but you hosted it yourself?”

Hullo.

I know folks here are concerned about privacy (me too), so as part of unfucking myself from big evil, I have started to host my own equivalent services.

You know the score. Swap Google Notes for self-hosted memos. Swap Google Photos for Immich. Etc, etc.

As a fun part of that, I decided to put together an equivalent-ish of Google Maps.

I made it for me, but folks over on !selfhosted asked me to release the source, so here it is.

Let me manage your expectations right away:

• It's clicked together from other things. I am not a singular genius and I stand on the shoulders of others.

• No, it does not do live traffic conditions. There is no simple, open, global source for live traffic-flow data (that I know of).

In some places, government departments DO publish some live conditions. Mine provides things such as roadworks, incidents, slow-down zones, and speed limits. However, actual live traffic flow is very much case-by-case.

• Re-routing. I have laid the groundwork, but I have not enabled it yet. Sorry. I need a little rest after going HAM at v1.0.0. If you want to jump the gun and fork/add it yourself, much of the groundwork is already there. I made a suggestion for how to do it here.

• Spoken navigation: ditto. The groundwork exists. It just needs the last mile (ha).

• No, it is not AI coded, though I used AI for documentation. See HERE for AI disclosure. Ipso facto, by the rules of !selfhosted, I have labelled it [AIP]. If that bothers you, don't use it.

• Yes it's free / no subscriptions / I want nothing for it / maintained for self use / blah blah blah. Use it or don't, entirely your call.

With all that out of the way, may I present Pi Maps.

• Yes, it works entirely on your home LAN.

• Yes, you can use it remotely from your phone. Tailscale Serve, or an equivalent private HTTPS setup, gives the browser the secure context that location access normally requires.

Grant location permission and Pi Maps can use your phone's location. Boom - live routing.

• Yes, it has points of interest. In FULL mode, those can link directly into an offline Wikipedia ZIM through Kiwix (for those not in the know, Kiwix

• Yes, it does local driving routes. Other BRouter route profiles are possible, but v1.0.0 currently ships with driving only.

• Yes, maps, search, and routing work locally after you install the regional data. Normal use does not depend on Google, a public geocoder, or a public map API.

• Yes, it runs on a teeny, tiny Raspberry Pi. Takes up about 300-ism MB of RAM, so you don't need a beefy rig of any kind for this.

• Yes, it is privacy-respecting. You host the service and the normal map, search, and route requests stay on your own system.

As I said, I made this for me. I have now, I think, sufficiently de-tangled it so that with some effort, and some documentation reading, you can make it work for you.

Understand that this is still very much a “roll up your sleeves” thing, though.

But if you are interested, please have it. Fork it, make it better and make it yours.

PS:
Boilerplate:

"The repository is maintained for private use, but you are welcome to use it. Pull requests are not accepted. No support or compatibility guarantee is provided".

PPS: The inspiration for this was Project Nomad.. They do good work, but I like my way better :)

OC by @SuspiciousCarrot78@aussie.zone

I bet most ppl here do not use Meta products. But some may have to for w/e reason. Or you may know ppl who do. Also in the bigger world, it sitll has billions of users, 2.1B every day. This is Meta improving your experience unless you know how to opt out.

I just threw up in my mouth a little bit writing that.

Meta is planning to use the data shared by other businesses to personalize your feed and its AI responses. In a blog post on Tuesday, Meta explains that it already uses your off-platform activity, like the games you play or your purchases on other websites, to serve you ads. But now it’s expanding the scope of the content it personalizes across Facebook and Instagram.

For example, Meta says if you bought a tent online recently, you might see camping-related videos in your Reels feed. “We aren’t collecting any new data as part of this update,” the blog post says. “This is about using information that businesses already send to us to further improve your experience.”