Dank je wel!
Thanks! Not only is this a great list of actions, but it also has helped me see this whole issue from a new perspective. More specifically, I multiple times I have tried to switch to cash-only because of privacy reasons, and I eventually become discouraged. For example, I recently gave up again. I have a shared card with my girlfriend, and she doesn't really care much about privacy, so I felt like I was punishing myself for not good reason by paying with cash if my girlfriend next was going to pay with our card anyway.
But now that you have framed it from the point of view of those accepting cash, it does give me an additional source of motivation. It's not only about my personal privacy, but also about pressuring vendors to accept it. This makes it worth it even in cases where there might not be a privacy benefit. Starting now, attempt #I-lost-count begins.
You are right... Cash is king, and letting it be phased out is not a good idea.
You have me on board - how do we stop this?
Interesting. I haven't followed development in the space of "official" crypto currencies, but my impression is that these will probably be centralized, have little to no privacy features, and that the governments will be able to control access to the funds.
But I may be wrong - maybe they are actually building decentralized crypto networks? I just find it hard to believe that a government would do this.
Yes, it is increasingly difficult to pay with cash in the Netherlands. Even at the Albert Heijn they have set it up such that it is a lot more convenient NOT to pay with cash. They have a large amount of self-service pin-only checkouts, and one or maybe two workers accepting cash at the manual checkout lane.
One path is to make an effort to resist this digital move and pressure politicians so that they enforce these type of rules and that cash is accepted. But I think this can at best slow this process down.
The other path is to embrace the digital move and start integrating crypto currencies into our societies in a more substantial manner. I know that many people have given up in crypto, but, putting speculation and hype aside, crypto is the best way we know of to integrate cash-like payments into the digital world. Right? Or is this something others disagree with?
No, I'm not concerned about a lawsuit. It's something that I want to do because I think that it is important. If I want to share tools with non-tech savvy people who are unable to build them from source, I want to be able to share these without anyone needing to "trust" me. The reproducible builds standards are a very nice idea, and I will learn how to implement them.
But I still wonder whether my approach is valid or not - is printing the hash of the output executable during Github's build process, such that it is visible in the workflow logs, very strong evidence that the executable in the release with the same hash was built by github through the transparent build process? Or is there a way a regular user would be able to fake these logs?
Ooh, I did not know this one was of the properties of Rust.
Thanks! I am convinced now, I will learn how to create reproducible builds.
My worry is that the build is run through npm, and I think that the dependencies rely on additional dependencies such as openssl libraries. I worry that it will be a lot of work to figure out what every npm dependency is, what libraries they depend on, and how to make sure that the correct versions can be installed and linked by someone trying to reproduce the build 10 years from now. So it looks like a difficult project, but I will read more about it and hopefully it is not as complicated as it looks!
Ah. Cool. I was under the impression that docker images suffered from a similar issue - that one can't verify that the image is built from the source. I'm happy to be mistaken about that.
How does a docker distribution solve this problem? Is it because the build instructions are automated by the Dockerfile?
My new phone runs GrapheneOS and I love it.
One recommendation that I would give people is that it does not need to be an all-or-nothing jump into the abyss. It can be a bit disheartening when you try to get rid of all the privacy-invasive things in your life and you get cut off from your family and friends.
After some failed attempts, the strategy that I have found more successful is that I have new phone that I installed GrapheneOS into, and I keep the older phone with whatsapp. The older phone is in Airplane mode connected to WiFi at my home. It is effectively a landline. I can still use it once or twice a day to check on my family through WhatsApp without having to broadcast my location all day to Meta. This way I don't need to install any sandboxed Google Play services into my new phone. The old phone is the sandboxed Google Play. I also use the old phone for verifications, 2FA, and any other things that I don't want to contaminate my new phone with.
Over time I am finding that my GrapheneOS is perfectly functional. The main difficulty is the chats services that are used by my family, friends, and work-related "group chats". I have convinced some people to join my XMPP server, including my mom (wuhuu), but it is an uphill battle. That's why the other phone is still essential for me.
I have forked a project's source code on GitHub. The program takes a private key as an input and that key must never leave the client. If I want to share a pre-built executable as a release it is essential that I can prove beyond reasonable doubt that it is built from the published source.
I have learned about how to publish the releases by using a Workflow in the GitHub actions such that GitHub itself will build the project and then repare a release draft with the built files as well as the file hashes..
However, I noticed that the release is first drafted, and at that point I have the option to manually swap the executable and the hashes. As far as I can tell, a user will not be able to tell if I swapped a file and its corresponding hashes. Or, is there a way to tell?
One potential solution that I have found is that I can pipe the output of the hashing both to a file that is stored and also to the publicly visible logs by using "tee". This will make it such that someone can look through the logs of the build process and confirm that the hashes match the hashes published in the release.
Like this:
I would like to know whether:
-
There is already some built-in method to confirm that a file is the product of a GitHub workflow
-
The Github Action logs can easily be tampered by the repo owner, and the hashes in the logs can be swapped, such that my approach is still not good enough evidence
-
If there is another, perhaps more standard method, to prove that the executable is built from a specific source code.
Canvas is available for Lemmy!
This is similar to reddit's /r/place. Each user gets to place a pixel on a canvas. The pixels are refreshed every 30 seconds.
The website with the canvas is: https://canvas.toast.ooo/
To log-in, you simply provide your instance's name and your username, and you get a code to log-in.
I have made a template for making an XNO flag. You can reach it by clicking here.
In the settings there is a button that allows you to toggle the tample on/off. You can use that button to make sure that you are placing the pixel in an unoccupied spot.
view more: next ›
This week I've been paying by cash, and I noticed a few things.
One thing is that there is a lot of people paying with cash that are doing so because they do not have another option. Some of them are simply tourists without a working card, but I suspect some of them might really have no card at all.
The other is that the people at the shop do notice when a long line of buyers stand to pay with cash. I have seen cashiers struggling to get someone to stand on the second cash register to offload some customers.
As for the ethical vendors... I struggle with this. It is just so much more convenient to go buy from the Albert Heijn that's right under my apartment. I tried the shops around, but they rarely have what I want, products are often more expensive, and lower quality. I also don't know how to tell whether specific small vendors are ethical vendors or not. So, for now I just go to AH for most of my purchases.