I use Pixel with GrapheneOS as my phone, and I just have a separate profile that only has WhatsApp installed and nothing else. Since the profiles are completely separated, it doesn’t have access to anything else I do on the phone and it’s not running in the background (the profiles are basically sandboxed fresh slates, and switching it can be set-up to behave in a same way as basically turning off the phone as far as the profile is concerned).

When the bridge asks me to log in again or refresh a session, I simply switch to the second profile for a minute and re-log in. I’ve heard iIt might be possible to set up an emulator and leave it running on the server, but that felt like too much effort.

Yeah, that’s my experience as well. In addition to being lazy with updating, so if some kind of supply chain attack happens, I usually sorts itself out before I get to updating :D

But I did limit my browser extensions, after I a cause with Nano Defender taught me a lesson - it was a mildly popular anit-anti-adblock killer that worked where other adblocks were detected, but the developer sold the extension to a company that turned it into a info-stealer malware and pushed an update through chrome store, which got accepted and propagated, and some of my social network sessions got compromised. So, I just stick to more popular projects where something like this shouldn’t happen, and don’t use random extensions.

Yeah, that part about WhatsApp is annoying. I just have a spearate profile on Graphene that has only WhatsApp installed, and whenever it wants me to refresh a session I just switch to the profile and log in.

There is, but it requires you to log into the app every two weeks to maintain a session. You can setup a emulator to do it for you. I just have a separate profile on my Graphene with Only WhatsApp that I switch to and login whenever I get a warning.

I’ve been using it for almost a year by now, and so far I didn’t have any problems. I’ve not considered that problem though, so it might be happening and I was just lucky.

WhenI was setting it up, it took me only like two hours tops. The ansible project is well documented, has a clear setup guide, and the process is really just getting server with ssh access, changing DNS, changing around 5 values in the ansible config and running it.

As far as I know the Discord bridge has some limitations, the major one being that IIRC it doesn’t atually support calls. But just for chatting across servers it has worked well for me.

There’s also the fact that you have to either trust the project with your password (as in, the the bridfe adds a matrix bot that runs on your server, but needs your pssword), since I think it uses the web version in the background (but then you can also use it for DMs and any server), or set up a bot on the discord server you want to bridge, which obviously cant be done if you’re not an admin. It’s a foss project, but there’s always a small risk of it gping rogue.

https://github.com/spantaleev/matrix-docker-ansible-deploy

Its pretty well documented and easy to follow, it took me only like an hour to setup.

I’m hodsting my own Matrix server with WhatsApp, Telegram, Discord (you don’t need a bot for that, you can just share your login with the bridge) and Messenger bridge. I have all my IMs in one app, don’t have to install spyware on my phone, and I can make bots that troll annoying people that message me on any platform.

Hosting it was super simple, thanks to the Ansible project that’s extremely robust and well done, I literally just got a hosting, domain amd changed like 5 config values to enable the bridges I wanted, gave it an IP and ssh key, and ran it. And if I need to update, I literally “just update” (it’s all wrapped up into “just” tool), and it eve handles cases where I didn’t update for a while, failing graciously and telling me what I need to do maually, usually just rename some config values.

I wholly recommend it. You probably wont convince your friends to switch from <insert app here>, and this is the best compromise.

I’m using a small instance on Hetzner, for 6$ a month. You could in theory get a free oracle cloud instance for it, but I didn’t manage to get one.

And you can easily share it with anyone interrested, make them an account, so they can also consolidate their DMs. I’m sharing it with a few friends and colleagues.

I’ve seen this warning in a lot of apps, like Teams, Messenger or some authenticators, and some of the time I could simply ignore it and continue using the app. I think some of apps simply use it for push notifications that I can get by without.

Not all, though. Sometimes it simply doesn’t work.

I can do that and more on my Pinephone running Kali Nethunter. While it’s mostly a gimmick with awfull battery life, I’ve already used it a few times mostly in regards to wifi pentesting for my cyber-sec job, i.e when going to lunch onsite and you notice a new wifi AP you didn’t see when inside the office you’re working on.

And since it has an USB-C, I can simply plug in a dock with two USB-As, Ethernet, PD and HDMI, to turn it into a full-fledged Kali desktop.

Tbh I’m not sure, I vaguely remember that hashes did play a role in how chatcontrol works, but I think it wasn’t looking just for 1:1 match of known illegal content, but also for some signs? I remember reading that it had awfully high false-positive rate, which someone has to check. https://www.patrick-breyer.de/en/posts/chat-control/

According to the Swiss Federal Police, 80% of the reports they receive (usually based on the method of hashing) are criminally irrelevant. Similarly in Ireland only 20% of NCMEC reports received in 2020 were confirmed as actual “child abuse material”.

I mean, Apple is one of the companies that volunteered to the current optional version of ChatControl. They are already sending your messages and photos to EU to scan for “illegal” content.

What I mean by that is that it doesn’t shove the AI summaries into your face, and they are only generated if you actually click on a different tab.

I just use Kagi, which seems to be pretty good at filtering bullshit by default, and have mabually downranked reddit and twitter, ot any other site I found and don’t like. But it’s been a long time since I used other search, so I can’t compare it much since I’m used to it. Never really had any problems with not finding what I need.

I’m using Kagi, but as of right now I’m not sure if I can recommend it. The last year with it was amazing, but for the past few days I’ve been getting blocked searches from my VPN out of nowhere. That would be a dealbreaker for me, but I hope it was just a mistake and they will fix it. It’s the first time it has happened in the year or so I’ve been using it.

Apparently, they are also adding a bunch of AI features, but I only noticed it when I was looking up the feature page, and I haven’t noticed any of it in my feed before that - so I guess they don’t push it on users and it’s optional somewhere out of the way, so don’t let that discourage you. (Though, it would’ve discouraged me, if I saw that before I started using it. But as of now it doesn’t affect you unless you look for it, I guess)

Other than that, the search is awesome. But since I’m using it exclusively for like a year, I can’t really compare it with other engines, it’s possible that I’m just used to it.

I’ve never had issues with looking anything up. By downranking Reddit and using a search engine with a good indexer that downranks bullshit and generated websites, which mine is really good at, I haven’t noticed much change from how it was before.

But I agree with the second part. That’s something that never occured to me, and it makes sense. I was usually trying to answer questions I knew, and never had the urge to reply “just google it”, so it doesn’t change much for me, but it’s a really good point I never realized.

I think it’s quite the contrary, and AI will actually increase our job security. Because now, you have a lot of people learning to code using AI, and I’ve heard from my friends who was talking to other CTO’s at a conference that they have even discusses whether it’s even worth it to bother with hiring juniors now, because it turned out that a surprisingly large amount of them are in fact just a front-end for ChatGPT.

Can you eventually get a problem solved by talking to a LLM about it? Sure, but it will take you a lot longer, and you don’t learn much programming skills. It’s basically a lot worse version of copy-pasting code from StackOverflow, because there you can at least be certain that the code you are copying has been reviewed by at least someone, and the explanation isn’t in most cases hallucinated stuff that sounds correct. You also can’t keep asking Stack Overflow to edit your code for your use-case, and have to figure it out yourself.

But I’m really looking forward to major companies trying to replace programmers with AIs. Google implementing LLMs into search results was my favorite recent trainwreck, and reading articles with the CEO squrming that “We actually have to manually filter the results, because solving the LLM models halucinating turned out to be a really difficult issue”. No shit, it’s almost as if you want factually correct and precise outputs from a statistically-biased but still random generator.

Please, I want to se a company fire most of their programmers to replace with AI, and watch them burn. Hopefully, it will happen soon.

A good reminder to always set your password manager to auto-lock (with PIN for convenience) after 3-5 minutes. The PIN makes it easy to re-log, while not being bruteforceable (AFAIK after few failed attempts it reverts to password), and if someone would get to your PC, either physically or remotely, they won’t be able to get all your passwords.

One of the best jackpots I’ve ever found during Red Teaming engagements was when I RDPd to a server through pass-the-hash, only to find an unlocked password manager with passwords for most of the other servers, service and admin accounts.

You are right, calling it a contradiction was not exactly accurate. Or rather - it did contradict some of the narrative that is pushed by Delta, about CS not providing any support in the first few days, which it sounds like isn’t exactly true. But most of the case will indeed still need more receipts, that’s true.