I’m self hosting both too. MollySocket’s docs are pretty clear that it never gets an encryption key for your account, so it can’t read your messages. It only gets/forwards alerts that something happened on your account AFAIK. So I’m not sure what data it has that’s worth encrypting.
For Signal/Molly, it’s less that the notification is encrypted as I understand it. It’s more the notification content is just “Hey! Stuff happened” for Signal. The app then reaches out directly to the Signal servers to see what’s new. So the message content is never sent via the push notification service (UnifiedPush or Google’s service).
That would require a lot of data privacy concerns to be addressed. Even if it’s an explicit opt-in. The current method uses sample text which can’t include PII. Using user supplied text would almost guarantee they’d get names and other PII in their data set.
I also imagine it’s harder to train the model when you don’t know exactly what the user was trying to type. I.e. Was the swipe detection wrong, or did the user delete the word because they changed their mind on what to write?
The issue isn’t a big deal for the average user. The vulnerability required them to first get your username and password, physically steal your Yubikey, spend half a day using $10-15k worth of electronics equipment to repeatedly authenticate over and over, they then could potentially make a clone of the key.
I’d say it’s worth doing this regardless to help determine if it’s an application or system issue causing them not to go off.
It’s a good game. Just don’t take the content warning at the start lightly. I’ve tried to finish it twice but haven’t been able to get more than a couple of hours in.
When I migrated emails last time, I setup my old email to automatically forward to the new email. Then on my new email, I setup an automatic label for any email that was addressed to the old address. Every week or two I’d review what was sent to it and either update the email address used or unsubscribe. Eventually it got to a level where I wasn’t getting much at the old email anymore and finally deleted it.
This is one of my favourite episodes when I do my rewatches.
It’s a bit similar. However this goes a bit further than I understand those projects do. They’re creating a game like the original. With this decompilation project, if you use the N64 compiler you will get a ROM which is 100% identical to the original.
The ROM in this case is only used for game assets, like maps, models, and textures. All the game logic in native code. This allows is to be easily modified to add in new features without trying to hack it into a 20 year old game/console.
Which apps are you referring to? Google and Apple’s services have long been the default choice for notifications on mobile devices. Other options get killed off by battery optimization processes without special setup.
The page says it captures game audio only by default. But you can switch it to all audio if UPI want to capture something like external voice chat.
I know GrapheneOS implenents Contact Scopes so you can choose which contacts an app can see.
Bridge doesn’t support the calendar yet from what I’ve heard.
It’s not that it’s closed, it’s more that none of the exiting email protocols support a server which can’t read your email (as it’s all encrypted). They do offer Proton Bridge which you can run locally which will handle all the decryption and local mail clients can talk to that as the would any other mail server.
I don’t know off hand if it supports calendar syncing though.
I’d say the main benefit Futo has over Heliboard is that it has native swype typing with its own model (and also own voice typing model).
Still a bit light on customisation (certainly compared to Heliboard), but a nice first release certainly.
Proton is not the same as a VM. It has direct access to your filesystem. It could delete your entire home directory if it wanted to.
It’s mostly a power efficiency thing. Before push notifications were the norm, most apps used a polling method. They had the application send a request every X seconds asking “anything new”. There wasn’t coordination between apps, so even every app checked once every 30s, it likely wouldn’t be on the same 30s. This caused the device to wake up a lot and never let it switch into low power mode.
A push notifications system like FCM or UnifiedPush means only a single application needs to run in the background. It maintains a persistent connection to the push notification service and waits for a message. When it receives one it wakes up the relevant app and passes it the details.
The issue lies with Google’s FCM (Firebase Cloud Messaging) system, so it’s not something GrapheneOS can really fix. As far as I know FCM doesn’t offer a way to encrypt notification content. Some apps like Signal work around this by instead of sending the message content, they send a little “wake up” notification. This tells Signal on your phone to wake up and it goes and retrieves the new message.
If you don’t install Google Play Services, you won’t be impacted. But you’ll also not get notifications for most applications. There is an alternative push notification system called UnifiedPush which allows you to choose any server to handle your notifications (and even self host it). But it does require both the service and the app to support it, so it’s not very wide spread yet.
The UnifiedPush server is intended to be a single source your phone can keep a persistent connection open to, rather than needing a connection per service/app (this is how Google’s Firebase notifications work too).
As Signal doesn’t support UnifiedPush, MollySocket keeps a permanent connection open to Signal’s servers to listen for new activity and forward them to your UnifiedPush server. This saves your phone keeping a permanent connection open to Signal’s servers and draining your mobile battery more.