Re: evercookies.
On 08/23/2016 11:41 PM, Tim wrote: You browse half a dozen addresses, using their DNS server, they can see all the queries coming from your IP. Somewhere amongst them is a server where they can set a cookie in a browser. Except, of course, for the fact that most servers aren't running browsers, and if they are, that cookie will identify them, not you. The point I was making, and you didn't address is that there is no way to use the DNS protocol to set or retrieve a cookie in an end-user's browser. -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
Re: evercookies.
On 2016-08-24 00:18, Joe Zeff wrote: On 08/23/2016 11:41 PM, Tim wrote: You browse half a dozen addresses, using their DNS server, they can see all the queries coming from your IP. Somewhere amongst them is a server where they can set a cookie in a browser. Except, of course, for the fact that most servers aren't running browsers, and if they are, that cookie will identify them, not you. The point I was making, and you didn't address is that there is no way to use the DNS protocol to set or retrieve a cookie in an end-user's browser. Perhaps more telling is that with several browsers on a single connection the cookies must be associated with a browser to matter. With FireFox profiles it should be possible to generate some "confusion" in the evercookie world by using separate browsers for various sites you visit regularly with one or more additional profiles for various other activities. They won't have the same cookies. So tracking is more difficult. That said, Verizon has an IP header they put on traffic to track the sites you visit if not the content. I suspect privacy is a concept that will die out over time. {^_^} -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
Re: F24, changing Thunar (Xfce) default archive manager
On 24.08.2016, Robert Moskowitz wrote: > This shows both xarchiver and engrampa with xarchiver first, and the status > is 'user set'. I cannot see a way to reverse their order or make engrampa > the default archive manager. Hmm, maybe you just have to uninstall xarchiver? -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
Re: evercookies.
Allegedly, on or about 24 August 2016, Joe Zeff sent: > Except, of course, for the fact that most servers aren't running > browsers, and if they are, that cookie will identify them, not you. > The point I was making, and you didn't address is that there is no way > to use the DNS protocol to set or retrieve a cookie in an end-user's > browser. To be blunt, the points you missed, were: a. Not that it's the DNS protocol, but a DNS server, that was implicated. DNS servers can keep access logs, too. b. We were talking about web servers. It's kind of implicit that it's webservers and webbrowsers when talking about cookies. And since the exposé of the exploit talked about JavaScript, Flash, Silverlight, webhistory, and a variety of other website related things, the point was quite clear. But just to be sure, this link is practically a one-page list of things: https://en.wikipedia.org/wiki/Evercookie c. Cookies *do* identify *you* (or are able to). If you log into to anywhere that's in the middle of this spiderweb, it identifies you. If you don't log in, just browsing the web anonymously, it may not identify you, but certainly categorises you. And with a service that has a massive database at their disposal, and the longer you're on-line, it may well be possible to follow that through to an identification. e.g. You've posted on a public list, something will be databasing this list, recording messages and headers. It has your IP and your email address. Marry that up with something else logged on internet using the same IP at the same time, and it's a 99% chance that it's you. If they're lucky, some time while your browsing you'll use a server that they can set a cookie with. And use that as an aid to them further keeping track on you. You really do have to be one of the tinfoil hat brigade, never logging in, using things like TOR, stealing other people's WiFi, changing IPs, etc., all of the time to be able to avoid that kind of big brother watching (in the Orwellian sense) -- [tim@localhost ~]$ uname -rsvp Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64 Boilerplate: All mail to my mailbox is automatically deleted, there is no point trying to privately email me, I only get to see the messages posted to the mailing list. Hooray! I finally finished typing this email. -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
Re: Browser Privacy
Allegedly, on or about 23 August 2016, Drew Samson sent: > I too have found browsing doesn't work without scripting yet still > find NoScript essential. Here is my typical usage - like 5 minutes ago > on cnn.com: > > Full protection of noscript = page doesn't load. 23 scripts blocked. > > 1 click on icon - temporariliy allow all this page. At which point, you may as well have not bothered with using NoScript, in the first place. Sure, this half measure has stopped some of the nonsense (the other things that would also have loaded), but you're still exposed to the risk that many people are trying to mitigate (whether that be privacy, hacking, or simply having your computer grind to a halt under the burden of many badly programmed scripts). I tend to go through the annoying route, of temporarily allowing likely looking scripts, one by one, until either the page works, or I'm so annoyed with it that I abandon it. If there are sites that I want to regularly use, I consider permanently allowing the scripts that were needed to make them work. But don't always do so. It's slightly less of a risk if they're self-hosted than coming from a third party. But that could be faked, they could be proxying a third-party script through their own domain. -- [tim@localhost ~]$ uname -rsvp Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64 Boilerplate: All mail to my mailbox is automatically deleted, there is no point trying to privately email me, I only get to see the messages posted to the mailing list. ZNQR LBH YBBX! -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
Re: evercookies.
On 08/24/2016 06:08 PM, Tim wrote: To be blunt, the points you missed, were: a. Not that it's the DNS protocol, but a DNS server, that was implicated. DNS servers can keep access logs, too. And, to be equally blunt, you were asserting that DNS servers could be used to set evercookies on your machine and I was refuting that claim. And even if they do keep logs, they won't do you much good unless you know exactly what IP address to search for, which won't be of any help if your target's on the road using various free WiFi hotspots, or sharing a connection (and IP) with several other people, such as in an office environment. I won't say that you can't build up a profile of a specific person that way, but I doubt that cost effective in terms of targeting advertising. -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
Re: evercookies.
(I'm replying to the entire discussion as of Wednesday evening US Mountain time.) I'm now wondering if evercookies can really be fully blocked. I do want to block what I reasonably can. But as was pointed out, a lot of wanted web functionality needs cookies. So now I'm mainly focused on getting them deleted when I close a tab or the browser. * My Firefox is set to never remember history. It clears all "regular" cookies, cache, and browsing history when I exit Firefox, right? What about evercookies? * Fingerprinting was mentioned. Wikipedia has two relevant fingerprinting articles: device (browser) fingerprinting and graphic fingerprinting. The device fingerprinting article makes this curious statement: "Recently such fingerprints have proven useful in the detection and prevention of online identity theft and credit card fraud. In fact, device fingerprints can be used to predict the likelihood users will commit fraud based on their signal profile, before they have even committed fraud." So now we're stuck in a love-hate relationship with fingerprinting. Having experienced credit card fraud at least 3 times, I want what those two Wikipedia sentences mention. But I hate commercial sites tracking, profiling, and targeting me. I also understand that the advertising is needed to have "free" content on the web. I accept "generic" (non-personalized) advertising that is not intrusive and not deceptive. The rest actually affects me opposite of what the advertiser intents: it pushes me away! So what / how much fingerprinting to allow vs. try to block? * Does NoScript block evercookies or the fingerprinting parts of allowed scripts? * I recently looked at Adblock Plus, and saw the same conflict-of-interest noted by others in this discussion. I will look at the alternatives mentioned in this discussion. I also saw the separate "Browser Privacy" topic started by Drew. I've since turned off html5 storage, and will study the other recommendations there. * It seems CCleaner is for windows but not Linux. I am indeed looking for windows-7 solutions, but I'm also looking for Fedora solutions. How can I clean out evercookies on my Fedora workstation? * Stan - In your last message on this topic, you implied you are abandoning Adblock Plus and said you are using "tracking blockers". Which? Thank-you, everyone. Bill. -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
Re: evercookies.
On 08/24/2016 07:51 PM, William Mattison wrote: * It seems CCleaner is for windows but not Linux. I am indeed looking for windows-7 solutions, but I'm also looking for Fedora solutions. How can I clean out evercookies on my Fedora workstation? Have you checked bleachbit? I don't know if it works for evercookies, but it's worth checking out. -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
calendar program loops
Upgraded to F24 and had a big surprise this morning, a mail queue clogged by over 400,000 messages. Root runs a nightly cronjob of "/usr/bin/calendar -a" to look at each users calendar file and send notices of upcoming events. The new version loops endlessly through all the users. If I run calendar as myself without the -a option it doesn't loop. Run it as "sudo calendar -a" and I have to kill it quickly or the mail system will clog again. My google and bugzilla search did not find any comparable reports. Is anyone using this ancient command with the -a option? Jon -- Jon H. LaBadie jo...@jgcomp.com -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://lists.fedoraproject.org/admin/lists/users@lists.fedoraproject.org Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org