It is actually possible to use Cloudflare Pages and DNS without CF messing with your CAA records. The first step is to disable BOTH Universal SSL and AMP. If either is enabled, Cloudflare will override the CAA records for your apex. Verify that your records are correct:

- This has been known for a long time, you didn't do anything about it. - What about the Signal TLS being outdated for a long time or the fact that it leaks info like no tomorrow? I sent the PR for you guys to merge on on a silver platter and no one merged it. You guys also...

So @Puri_sm's PureBoot seems to have this circular logic: - The Firmware measures itself and sends the measurements to the TPM - If the measurements matches what the TPM expect, the TPM releases the secret. If the measurements do not match, the TPM will think that...

Microsoft Edge Enterprise Policies for macOS + Linux: github.com/TommyTran732/Micr… I currently leave SmartScreen as "recommended to be off", as it is quite privacy invasive (sending FULL URLs to Microsoft). You can adjust it based on your threat model.

👀 This is quite interesting ... Fedora and Red Hat apparently set this to 2 by default, while Ubuntu and Debian set this to 1. Also, chrony >=4 counts from 0 to 2. chrony <=3.5 actually counts from -1 to 1.

One nice thing about Ubuntu and Snap is that you can actually confine some daemons that would not be confined at all otherwise... Wonder why this is not the default

When someone tells me GNU/Linux phones have better security because of the hardware kill switches:

Ah yes, @robbraxmantech thinks it is impossible to implement proper E2EE with web apps. Maybe that’s why he keep saying “E2EE doesn’t mean anything because they have the key”. Maybe he actually thinks E2EE means sending the keys to the server in plain text then praying…

“Metadata free end to end encrypted social media platform” brax.me by the definitely-cybersecurity-expert @robbraxmantech leaks BOTH the metadata AND THE ACTUAL ENCRYPTION KEY to the server because why not 🤣

So as it turns out, most distributions do not enable DNSSEC in /etc/systemd/resolved.conf by default 0.0 It’s best that you use a DNS provider that supports DNSSEC and just force it in /etc/systemd/resolved.conf. If you use a VPN, make sure that your VPN provider’s…

So apparently @Puri_sm's Matrix homeserver has not been updated since like July last year now... It is infact so outdated that it can't join the new v10 rooms. 😅 If you are a Librem One user you might wanna ask them to update their stuff or move to a different host.

@internet_nl I have achieved greatness

So apparently there’s no client side hashing for when you log into your Google account (the server sees your actual password), but then that same password is what’s used to protect the encryption key on a Chromebook 😓

I find it crazy how some people (especially @robbraxmantech ) presents chroot as some sort of app sandbox or container. It is neither of those things. All it does prepending the filepath to change a process's view of the system. Nothing is namespaced, root inside of chroot is...

MirageOS 4.2 on QubesOS 😁

Easy trick to check if your VPN is leaking: `curl ---interface your_primary_interface_name_here ipinfo.io` No Wireshark or MITM required 😁