https://www.yubico.com/resources/glossary/what-is-a-passkey/

I haven’t found this to be the case in practice (IE passkeys are plenty portable). I’ve successfully used passkeys on multiple browsers, OS’s, and apps, all stored using a FOSS password manager (keepass). Any FOSS password manager that is either self-hosted, or syncs, should work just as well with passkeys as it does for regular passwords or TOTP.

This is rad. Nice job.

Which are those? I haven’t had one that rejected keepass so far.

Despite the attention-grabbing headline, the only negative thing I can find in the article about passkeys are this section:

Attested passkeys7 are the last but most important type of passkeys you need to know about. These types of keys use what’s known as remote attestation to cryptographically verify – using the aforementioned tamper-proof cryptoprocessor that lives in all your modern devices – that you are using one of the several approved passkey managers, and not using a custom one that you vibecoded yourself and which can lie.

This is the feature that means you no longer get to make the calls about your passkeys. Fortunately, attested passkeys are not yet required on most websites.

I don’t see why we should assume this hypothetical is going to happen. There is a lot of different software that supports passkeys (I use keepass for example), and going against the open standard and forcing all their users to use a specific software would basically make them unusable.

Overall every password / login style has its dangers and bad ways to use it, including passkeys. That doesn’t make them “traps”.

Startpage is just google once removed. Its not an independent alternative, just a front end.

Also the smaller OS’s (puppy linux, tailOS) that can run entirely in RAM are going to be fast when it comes to anything but disk reads.

Reviews in OpenStreetMap, so that google maps can have a real competitor.

Its not FOSS, but I use to use foursquare for years because of how good it was at finding good restaurants / things to do in a new city. Now that its shut down, there’s no real alternative that comes close.

Browsers are bigger than operating systems now. One of the points of gemini is to use a very restricted language and abilities, so that developers can create their own gemini browsers easily.

As it stands now, google exerts enormous control on the web because of how complicated it is to make a browser. Currently mozilla is google’s only competitor in browser engines.

While gemini is a great project, I personally think a better route would be to create a local or server service that converts and saves existing webpages to markdown, and local apps acting as markdown browsers utilizing it.

With that people could write simple browsers, as well as reduce spying and have static content viewable on all form factors.

Everything that’s not static content (like the fediverse) already can have dedicated apps.

Use audiobookshelf for audiobooks.

Getting reviews integrated into OpenStreetMaps should be one of the most important projects in open source today. Last time I checked, its fairly stalled.

Shout out to both @nutomic for working on Ibis, a federated wiki alternative, and Prolewiki, the pro-worker-wiki.

Yes, the wmf has so many problems, especially its bloated administration. Also it’s run by US government regime-change agents like Katherine Maher, who steer the site to pro-US viewpoints.

https://en.prolewiki.org/wiki/Wikipedia

I believe there are a few proposals of integrations of different open source review systems into OSM, but they haven’t been finalized yet.

Totally agree this is the number one thing missing from open source maps rn, and it should be top priority years ago.

You can’t simply say “we must assume” as evidence.

Okay yeah you definitely didn’t read it. Large sections in that doc just before that are on phone number identifiers, NSLs, and 5-eyes countries, the US goverment pushing signal in privacy spaces… literally the reasons why signal isn’t trustworthy. Unless you can tell me what an NSL is, then I’ll assume you didn’t read it.

While there may be other US government requests they are not alllwed to disclose, they were legally required to provide the same information to the courts, and we can see what they provided.

Did you ignore the large section on NSLs? These come with a gag order, meaning its illegal for signal to notify their users about them being spied on.

In fact, they implemented “Sealed sender” in 2018 where they are not able to see who the message is being sent to.

This is a “just trust me” from signal, since neither of us have access to their centralized DB, but you also ignored two paragraphs down, where it showed that with message timestamps and recipient information, this would be trivial to find the real sender of a message, regardless of sealed sender. Again, actually open source software can’t say “just trust me” like signal can, we actually have to show code to prove it, and let people run that code in a private manner.

And sure, while the US government funds Signal, you know who else endorses it? Edward fucking Snowden. If anyone knows about secure messaging, it’s the man that physically removes the microphone and camera from his phones before using them.

Elon musk and jack dorsey also endorse signal. An endorsement means nothing, especially for centralized software based in a 5-eyes country.

Read the linked doc, because it’s clear you didn’t.

Signal is a centralized, US-based service which requires your phone number (thus your real identity, IE name and address), has social networking graphs of everyone you talk to, and must forward that information to the US government when asked, as well as (by law) not tell you that they’ve been asked to do so. During the Obama era, 60 NSLs were issued for this private information every single day.

People overlook its privacy concerns for the same reason they do with apple: it has a shiny interface and is easy to use, and makes people very attached to it. Behind all that, is a surveillance network that its creators have explicitly said they do not want it to be able to run in a decentralized, private manner.

It has a long history of privacy offenses below (such as refusing to publish its server’s source code for years, its reliance on other US tech services (amazon, google), US-government funding, and a US-defense-tank friendly administration) which get ignored or shouted down by many of those above. See the article below.

Why not signal.

Pretty much any alternative is better, as long as its not hosted in a five-eyes country, and especially if it doesn’t require phone numbers or real identities like signal does.

I personally have been using SimpleX for friends and real life contacts, and Matrix for larger more anonymous group chats.

5m seems about right. Lemmy’s from scratch builds are ~3.5m on a fast machine, and we have ~60k lines of code, and are using some with large libraries with lots of features enabled.

But you really should only ever have to do a from scratch build either at the beginning, or when you deploy. When developing, your IDE should only ever really run check or clippy, which should take seconds at most.

This is pretty sad. Oneplus phones, tablets, and watches have like double the battery of samsung / apple, at 1/3rd of the cost. Hopefully OPPO will make another branding for europe at least, because the EU still does allow chinese smartphones to be sold there. The US can just isolate itself and force its people to buy $1500 smartphones.

Xiaomi, vivo, and oppo(oneplus’s parent company) are growing pretty rapidly in market share at least.