Skip Navigation

User banner

WardPearce

@ Ward @lemmy.nz

Posts
19
Comments
101
Joined
3 yr. ago

Open source developer & privacy advocate.

  • haha cope harder friend, by default Firefox lacks site isolation. Enabling it is highly experimental 🤣 Before linking something and claiming I'm spreading misinformation (quite a serious claim to me because i spend my days coding foss privacy focused software) read the entire article 1st and when someone points out your wrong, learn how to take a loss. Also Android Firefox doesn't take advantage of Android isolated processes, what Android chrome based browser's do

  • From the article you linked yourself

    Firefox calls per-site process isolation Fission and is enabled by default on desktop. Fission is not yet enabled by default on Android, and when manually enabled it results in a severely degraded/broken experience. Furthermore Firefox on Android does not take advantage of Android's isolatedProcess flag for completely sandboxing application services.

    Read before you send :)

    I use Firefox on my PC, but as I stated Firefox on Android is lacking basic security features.

  • Don't like Brave or their products. But only decent & safe browser on Android with site isolation etc.

  • Organic maps 😍

  • Yea but obviously he has a office 365 plan, so a alternative to the office suite for word processing etc is relevant.

  • Not sure if this is entirely true, it is possible Proton mail is encrypting everything at rest (with the users public key) and only following PGP mail limitations during transit.

  • Thought this comment he made was odd about Proton mail.

    The site is filled by beautiful black screen without JavaScript enabled.

    Like yes, its a bit difficult implementing local encryption or decryption without js enabled.

    Has some good messaging, I'd say most of his comments are pretty widely known concerns or limitations.

    Like obviously web apps still rely on trust from the host, but it minimizes the attack surface massively.

  • Isn't opening sadly.

    Is this open-source? What are the requirements for a service to be listed?

  • Sheeesshh, you know when Public lewdness supports your project you know its good! Thanks for the kind words, have a great day.

  • Don't know the complete inner workings of Cryptpad. But it appears Purplix uses more modern encryption, uses more modern frameworks & has more safe guards against MITM attacks. Also additional options like captcha, proxy block, account required etc.

  • Purplix is planning to launch with multiple choice, single choice, short answer and long answer. After launch we'll be adding additional answer types.

  • Not 100% sure what you mean, but the encryption key for questions are only known by users who are shared the link & is never transmitted to the server. Answers are encrypted by the survey's public key what only the creator of said survey knows the private key. The public key is also encrypted by the secret key in the URL so the server can't even submit answers.

    Here is a example URL of a survey.

    example.com/s/64b185662c74e7c40cac5e66/KfcrkxiR-4nomGbEqNos0dyhEBsgiUAqPpZiRQt5syE#oAnQnjWhxq2IFTZBvrylVSHxg92HoWQr2mJQ-qZwvPY

    • s/64b185662c74e7c40cac5e66 - This is the survey ID, transmitted to server.
    • /KfcrkxiR-4nomGbEqNos0dyhEBsgiUAqPpZiRQt5syE - This is a hash of the survey's signing public key, this is to stop MITM attacks from the host & validation of the survey questions.
    • #oAnQnjWhxq2IFTZBvrylVSHxg92HoWQr2mJQ-qZwvPY - This is the secret key for decrypting questions, this is also used to decrypt the public key for encrypting answers. This key is never transmitted to server.

    All encryption & decryption happens locally, so the server never sees any plain text. It is possible for the host to modify the frontend to expose keys, but this is true of any web app & Purplix is hosted from Vercel straight from our Git repo, so it would be quite obvious if this happened.

  • No not currently, not comfort taking funding for any of my projects right now, until I establish some sort of expensive breakdown and transparent fund use. But even with funding a decent audit from a company who knows what they are doing would probably be 7k USD minimum.

    I do have a personal fund for hosting, what is used for Paaster. https://github.com/sponsors/WardPearce

  • Yea I'd love to have Paaster audited, currently I don't think its likely I'd get enough funding to do so as auditing is expensive.