Lightnews — Scholar-powered news

💘

@celenity.dev

March 15, 2025 at 8:09 PM

💘

@celenity.dev

they can't; otherwise that would remove the (unfortunately already non-existent) incentive for companies to respect this preference - ex. microsoft near single-handedly killed do not track by enabling it by default for all internet explorer users, so it gave advertisers an excuse to ignore it...

From Wikipedia (https://wikipedia.org/wiki/Do_Not_Track#Internet_Explorer_10_default_setting_controversy):

When using the "Express" settings upon installation, a Do Not Track option is enabled by default for Internet Explorer 10 and Windows 8. Microsoft faced criticism for its decision to enable Do Not Track by default from advertising companies, who say that use of the Do Not Track header should be a choice made by the user and must not be automatically enabled. The companies also said that this decision would violate the Digital Advertising Alliance's agreement with the U.S. government to honor a Do Not Track system, because the coalition said it would only honor such a system if it were not enabled by default by web browsers. A Microsoft spokesperson defended its decision however, stating that users would prefer a web browser that automatically respected their privacy.

On September 7, 2012, Roy Fielding, an author of the Do Not Track proposal, committed a patch to the source code of the Apache HTTP Server, which would make the server explicitly ignore any use of the Do Not Track header by users of Internet Explorer 10. Fielding wrote that Microsoft's decision "deliberately violates" the Do Not Track specification because it "does not protect anyone's privacy unless the recipients believe it was set by a real human being, with a real preference for privacy over personalization". The Do Not Track specification did not explicitly mandate that the use of Do Not Track actually be a choice until after the feature was implemented in Internet Explorer 10. According to Fielding, Microsoft knew its Do Not Track signals would be ignored, and that its goal was to effectively give an illusion of privacy while still catering to their own interests. On October 9, 2012, Fielding's patch was commented out, restoring the previous behavior.

March 15, 2025 at 6:30 PM

💘

@celenity.dev

having some serious deja vu…

Without any kind of enforcement or motivation for companies to respect the intents outlined here, this feature will have the same failings as Do Not Track for the web - and it’s unfortunate to see history repeat itself.

Unless the issue of incentives/enforcement can be addressed in some meaningful way, I would argue that this feature may even do more harm than good. It would give users the wrong impression that they’re stopping ex. AI training on their data by setting the appropriate preference - despite that not being a guarantee (or frankly even likely at all).

So, back to the DNT comparison: it’ll be vital for clients to implement some kind of warning with this feature, similar to Chromium’s for DNT, that ensures users are away that these intents are simply a polite request and may or may not be respected.

@bnewbold Does Bluesky intend to push for legislation or legal mechanisms as outlined by @molly above? If not, why do you think this proposal will be successful where specs like DNT have failed at allowing users to control how their data is used? Does Bluesky have anything else in mind to incentivize companies to respect this preference?

March 15, 2025 at 5:42 PM

💘

@celenity.dev

Important Update for users of #Phoenix #Firefox AND #Dove #Thunderbird:

Codeberg Issue: codeberg.org/celenity/Pho...

Updated commands for Phoenix: codeberg.org/celenity/Pho...

Updated commands for Dove: codeberg.org/celenity/Dov...

**FYI**: If you installed #Phoenix #Firefox OR #Dove #Thunderbird manually on macOS or Linux using the `sudo mv` commands from the `README`, due to potential security issues (https://codeberg.org/celenity/Phoenix/issues/48 ), you are highly recommended to reinstall them with the updated commands:

Phoenix: https://codeberg.org/celenity/Phoenix#manual-installation

Dove: https://codeberg.org/celenity/Dove#manual-installation

This only impacts **manual** installations that were done with the `sudo mv` commands.

Apologies for the oversight and for any inconvenience this may cause.

January 23, 2025 at 10:33 AM

💘

@celenity.dev

2004...

Zuck: Yeah so if you ever need info about anyone at Harvard

Zuck: Just ask.

Zuck: I have over 4,000 emails, pictures, addresses, SNS

[Redacted Friend's Name]: What? How'd you manage that one?

Zuck: People just submitted it.

Zuck: I don't know why.

Zuck: They "trust me"

Zuck: Dumb fucks.

January 11, 2025 at 7:39 AM

💘

@celenity.dev

not a fair characterization IMO…

i still don’t think apple should’ve enabled it by default (could’ve just been a prompt when launching photos after updating…) - but there’s far too much FUD, misinfo, & overreactions around it.

Searching Photos

Enhanced Visual Search in Photos allows you to search for photos using landmarks or points of interest. Your device privately matches places in your photos to a global index Apple maintains on our servers. We apply homomorphic encryption and differential privacy, and use an OHTTP relay that hides IP address. This prevents Apple from learning about the information in your photos. You can turn off Enhanced Visual Search at any time on your iOS or iPadOS device by going to Settings > Apps > Photos. On Mac, open Photos and go to Settings > General.

January 6, 2025 at 8:56 AM

💘

@celenity.dev

not a fan of it being on by default, but it doesn’t seem like a big issue tbh:

December 29, 2024 at 10:42 AM

💘

@celenity.dev

hoping they either support lockdown mode on ios or at least add a clearer message that lockdown mode isn’t supported instead of some vague indexeddb error…

An error occurred while loading Obsidian. ReferenceError: Can’t find variable: indexedDB

December 17, 2024 at 2:16 PM

💘

@celenity.dev

nah, this one is 🔥

Screenshot of a desktop running Hannah Montana Linux, AKA the greatest operating system of all time: https://hannahmontana.sourceforge.net/

December 17, 2024 at 7:44 AM

💘

@celenity.dev

thank you for 50 followers 💜

bluesky >> 💙 🦋

November 22, 2024 at 11:06 PM

💘

@celenity.dev

after this is sorted... please add support for stronger 2FA 🙏

totp/fido/yubikey >>> 🥰

💙 @bsky.app @jay.bsky.team @rose.bsky.team 🦋

Screenshot of the "Privacy and Security" section in Bluesky's Settings, showing that Email 2FA is the only option available.

November 20, 2024 at 10:23 PM

💘

@celenity.dev

article 7 of the gdpr:

Art. 7 GDPR

Conditions for consent

1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.

2. If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. 2Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.

3. The data subject shall have the right to withdraw his or her consent at any time. 2The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. 3Prior to giving consent, the data subject shall be informed thereof. 4It shall be as easy to withdraw as to give consent.

4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

November 19, 2024 at 10:27 PM

💘

@celenity.dev

as evident by her recent post, @jay.bsky.team seems to understand and care about user privacy. if she truly means and stands by this, the suggestions i have proposed are a no-brainer.

this is the MINIMUM i would expect from a service or platform like bluesky.

November 19, 2024 at 8:51 PM

💘

@celenity.dev

bluesky claims to be "social media as it should be". behavior like this is the direct OPPOSITE, and what users ditching platforms like twitter and threads want to AVOID.

what follows are my suggestions for @bsky.app moving forward.

A screenshot from Bluesky's website (https://bsky.social/about), with the tagline: "Bluesky is social media as it should be. Find your community among millions of users, unleash your creativity, and have some fun again.".

https://bsky.social/about

November 19, 2024 at 8:51 PM

💘

@celenity.dev

to be clear, does this mean bluesky is as bad for privacy as x/twitter, threads, etc? no, of course not.

but let's compare this to a platform like mastodon.

both mastodon's website (joinmastodon.org) AND their official instance (mastodon.social) have no tracking or data collection of any kind.

Screenshot of uBlock Origin on 'joinmastodon.org' showing 0 blocked content, providing a stark contrast to Bluesky.

Screenshot of uBlock Origin on 'mastodon.social'. Similar to 'joinmastodon.org', it shows no blocked content.

November 19, 2024 at 8:51 PM

💘

@celenity.dev

to add insult to injury, bluesky's main website (bsky.social) includes tracking from GOOGLE, arguably one of the most privacy invasive companies out there. no introduction needed.

A screenshot of uBlock Origin on Bluesky's main website (bsky.social), showing a connection made to 'www.googletagmanager.com'. This is Google's Tag Manager, one of their most widely used trackers on the web.

November 19, 2024 at 8:51 PM

💘

@celenity.dev

more examples of data collected:

there's more as well, you can check it out for yourself here:

raw.githubusercontent.com/bluesky-soci...

as i stated at the beginning, there is no way to opt out of this data collection.

Screenshot of the "events.ts" file located in the "statsig" directory from Bluesky's source code on GitHub, showing various interaction and clicks being logged and reported. (Continued)

https://github.com/bluesky-social/social-app/blob/main/src/lib/statsig/events.ts

November 19, 2024 at 8:51 PM

💘

@celenity.dev

bluesky also appears to operate their own domain for telemetry & data collection, "events.bsky.app". this appears to be related to statsig, as it can be seen directly called in the "statsig.tsx" file from their source code. it appears to be collecting info regarding app interaction, clicks, etc.

Screen from uBlock Origin's logger showing Bluesky (bsky.app) making several connections to 'events.bsky.app'. Some of the URLs include:

'https://events.bsky.app/v2/rgstr'

'https://events.bsky.app/v2/log_event_beacon...'

'https://events.bsky.app/v2/initialize'

Screenshot of the "statsig.tsx" file from Bluesky's source code on GitHub, showing the connection to 'https://events.bsky.app/v2' being made to obtain 'fresh flags'.

To quote:

" // Get fresh flags for other accounts as well, if any.
prefetchUsers,
api: 'https://events.bsky.app/v2',
}"

https://github.com/bluesky-social/social-app/blob/main/src/lib/statsig/statsig.tsx

November 19, 2024 at 8:51 PM

💘

@celenity.dev

the screenshots from above are via ublock origin's logger, but this tracking can also be seen directly in bluesky's source code... a couple examples below

github.com/bluesky-soci...

github.com/bluesky-soci...

Screenshot of "uploadSentrySourcemapsPostHook.js" from Bluesky's source code on GitHub. https://github.com/bluesky-social/social-app/blob/main/postHooks/uploadSentrySourcemapsPostHook.js

Screenshot of a "statsig" folder from Bluesky's source code on GitHub, showing "events.ts", "gates.ts", & "statsig.tsx", which contain more of the tracking related code. https://github.com/bluesky-social/social-app/tree/main/src/lib/statsig

November 19, 2024 at 8:51 PM

💘

@celenity.dev

overall i'm impressed with bluesky, BUT i have some privacy concerns i'd like to see the team address. these are crucial if bluesky is to live up to its goal & stated values. (THREAD INCOMING 🧵)

to start, bluesky contains tracking from companies like sentry & statsig, with no way to opt out.

Screen from uBlock Origin's logger showing Bluesky (bsky.app) connecting to 'https://statsigapi.net/v1/sdk_exception'.

Screen from uBlock Origin's logger showing Bluesky (bsky.app) connecting to 'https://o4505071687041024.ingest.sentry.io/api/4505071690514432/...'.

November 19, 2024 at 8:51 PM

💘

@celenity.dev

based on stats from wikipedia, we can estimate google has control of ~60 to 80% browser marketshare via their chromium browsing engine, which chrome, edge, opera, and samsung internet all use (not to mention most other browsers like brave & vivaldi also use).

how else do you define a monopoly?