Alyx

I am an antispeciesist, and member of L214, a French NGO fighting for animal rights. I also fight for LGBTQIA+ rights.

#antispeciesism #author #privacy #lgbt #NoAI #ResistanceNet #fedi22 searchable

Pronouns: Any pronouns :nonbinary_flag:
Website: https://broken-by-design.fr/about
Podcast (Devops): https://pod.broken-by-design.fr

Public Key

npub12xlcuz83qfw5cv4n5y5yvp448ju7lnyelvc6x253lngwy8elz7cqe83p40

NIP-05 Address

x_cli_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs9r0uwprcsyh2vx2e6z2zxq66new00ejvlkvdr92gle58zrul30vqprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntdl0tyk

Publishing to

relay.momostr.pink

Author Public Key

npub12xlcuz83qfw5cv4n5y5yvp448ju7lnyelvc6x253lngwy8elz7cqe83p40

Show more details

Last Notes

2026-07-16 17:00:55 UTC

- reply

I wrote about that kind of stuff in French a few weeks ago: https://broken-by-design.fr/posts/mots-de-passe/

2026-06-19 15:38:43 UTC

- reply

C'est le bordel de ce côté là pour moi aussi :D
J'ai des tabs ; j'ai des interpréteurs shell directement dans Neovim... et j'utilise assez peu les autres compositions. Je sais que certain·es utilisent tmux pour ça, mais j'ai déjà eu un tmux qui a craché avec toutes mes sessions dedans....
Un temps, j'avais utilisé terminator, mais pareil : un crash m'a fait perdre toutes mes sessions et ça m'a saoulé... donc j'en suis revenu à quelques tabs et de la discipline personnelle.

2026-06-19 14:36:34 UTC

- reply

Hello,
Je dirais qu'il n'y a besoin de rien de plus. Perso, j'utilise Konsole ou Terminal suivant le PC sur lequel je suis et ça suffit amplement pour tout ce que j'ai à faire. Je suis system engineer/platform engineer et software engineer.
Tu peux éventuellement installer une NerdFont pour pouvoir utiliser NeoVIM avec nvchad ou autre.
Pour le reste, mouis, tmux peut être utile pour du peer programming en SSH, mais c'est pas indispensable.
Peut-être toolbx pour avoir des env de dev dans plusieurs distro ?
Sinon, je sèche ^_^
@npub1gdd…3eqj @npub16ys…sjae

2026-04-06 17:05:00 UTC

- reply

> Multiple instances of Signal can be used on the same device at a time.
Using GrapheneOS profiles sure but I don't know how people using other OSes can. Maybe I am missing something?
> There are non-KYC services for phone numbers available.
Services with no KYC may exist in some countries. Even if there is no KYC, you still need to pay in cash or other kind of untraceable currencies, and get the SIM card without being filmed. That can be done, but to be honest, it is just easier to rely on a service not relying on a phone number 🤷
Olvid and SimpleX do not need a phone number to be protected against spam.
> No, Signal is available outside the Play Store in multiple ways.
I know about APK installation and I mentioned it. I don't know about other installation mechanism.
On signal.org/download, the only advertised installation options for phones are the official app stores.

2026-04-06 16:54:17 UTC

- reply

Olvid offers better privacy than Signal because:
* it supports multiple identities, none tied to a real world identity or PII. Signal supports only one identity tied to a phone number;
* it can be installed from F-droid without Google services ; Signal can only be installed from the Google Play Store on Android. Both supports APK, though.
* servers can be decentralized/federated/self-hosted. Signal is centralized and hosted.
* server (message relay) is actually open source. Signal server source code is incomplete, often outdated.
* Servers do not rely on numerous service providers; only the one for the message relay; you can select your own TURN server for calls. Signal on the other hand depends on AWS, Cloudfront and Cloudflare for messaging/attachments.
This was in the previously linked video. Here are the slides if you don't want to listen to it:
https://cfp.pass-the-salt.org/media/pts2025/submissions/7K9MEV/resources/PTS2025-TALK-25-metadata_prot_in_instant_msg_apps_LsHI6ZN.pdf
Signal lies about their security level in two ways:
* inducing a false sense of security by pretending they collect any metadata except the time of account creating and last message retrieval: their infrastructure depends on many subcontractors, none of which make any privacy claims about not collecting data;
* they can silently and selectively disable sealed senders;
* they have a history of ignoring security reports sent to them, sometimes for months or years;
* they obviously can have so much more data than what they pretend, like all metadata regarding group size and management, prekeys requests/refresh, last connection IP address, connection frequency, etc. We have to trust them for not collecting them. That's not security. That's blind trust.
@npub1gsu…fy6l

2026-04-06 06:55:20 UTC

- reply

To be fair, Signal lies about their actual security, particularly regarding metadata protection.
https://passthesalt.ubicast.tv/videos/metadata-protection-in-instant-messaging-applications-a-review/#share
Olvid, a French IM, arguably offers better privacy than Signal, by design. But they are French, so I don't trust them either for the reasons you listed in this thread.
@npub1gsu…fy6l is way ahead of Signal and Olvid, privacy/security-wise.

2026-03-27 17:23:26 UTC

- reply

git over email is so underrated...
And yet, it is federated by design, and sometimes even more efficient than some forges...
@npub1krk…4qg9 @npub1afm…5gp4

2026-03-13 07:46:15 UTC

- reply

Or a vegan at a meat-eaters table, where everybody tells how good their meat is and that you should try it.
I am vegan, against AI and I don't smoke. I chose to suffer 😂

2026-02-18 16:35:49 UTC

- reply

No link in particular. I have experienced it first hand. Shot them a report with what I was to present at a conference regarding some IM issues. Signal was the only one to not respond. I saw several testimonies on the fediverse with similar stories.
Signal left group v1 running for months after a public disclosure on the lack of renewal of group keys when someone leaves the group, allowing them to come back in uninvited. They never fixed group v1 and published much later group v2 as a replacement.
They ignored or dismissed reports about the server being able to disable silently and on demand sealed senders.
I suppose I could dig up some more stories, but of the top of my head, that's what I've got.

2026-02-18 16:27:14 UTC

- reply

Signal just ignores security reports. Matrix could copy that strategy and get away with it 😅
@npub18ds…6490

2026-01-29 19:39:41 UTC

- reply

Ironically, the Avian Intelligence striked back with the increased cost of RAM!

2026-01-10 13:41:57 UTC

- reply

Excellent analysis. Very thorough 😍

2026-01-10 08:12:26 UTC

- reply

Using random words in Bitwarden which uses a 7776 words dictionary, you need 8 words to get over 100 bits of entropy. The last 8-words passphrase I created was rougly 60 characters long, for reference.

2025-11-11 17:04:38 UTC

- reply

Yes, I have been using it two weeks ago on a Peugeot e208 from 2021.
It stopped working on my previous car (Renault Twingo from 2019), though, due to a certificate expiry, but I think it was an issue on the car side of things.
@npub1kwa…e0nj

2025-10-23 16:28:52 UTC

- reply

Are you positive this is a DNS issue or it is your diagnostic? Because to me, it sounds like a cert cache issue and not necessarily a DNS issue.

2025-09-25 09:27:11 UTC

- reply

More importantly, people need to stop uploading to Youtube. But yeah, kudos to the efforts from yt-dlp, Freetube, Newpipe and all the others for trying to keep Youtube usable until people finally get it.

2025-08-20 17:04:31 UTC

- reply

Thank you 😍 I'll look into these two! They were not mentioned on the websites comparing frameworks.

2025-08-20 15:59:44 UTC

Trying to pick a CSS framework to learn.
Bootstrap comes from Twitter, so no thank you by principle.
Tailwind CSS seems completely dumb since it defeats the whole point of using a class system to design reusable components. The magic detection of class names in the codebase looks scary af.
W3.CSS does not seem to be used by anyone.
PureCSS and Spectre.CSS seems to be abandonware.
I mean, the fuck I am supposed to pick?
#CSS

2025-07-16 13:25:39 UTC

Trop de bruit avec Signal : les métadonnées en cause dans les messageries chiffrées
https://blogs.mediapart.fr/xcli/blog/160725/trop-de-bruit-avec-signal-les-metadonnees-en-cause-dans-les-messageries-chiffrees
#Signal est régulièrement désigné comme LA meilleure application de messagerie sécurisée. Pour autant, cette supériorité universelle et présentée sans nuance relève d'un manque de finesse de l'analyse. Pire, elle met en danger les journalistes et leurs sources, les activistes et certaines minorités. Nous voyons pourquoi dans cet article.
#infosec #cybersecurite #simplex #matrix #olvid

2025-05-06 15:27:11 UTC

- reply

No worries :) No new vulnerabilities will be presented: most things were previously discussed or are publicly documented. The idea of this talk is to compare the different approaches and trade-off of the reviewed protocols to give the audience a feeling about how well their metadata is protected, and to give developers ideas about improvements the other messengers already implemented.
But I do want to reach out to ensure what I am gonna say is correct and does not misrepresent the security levels of each network.

2025-05-06 14:53:06 UTC

I'll be presenting a review of some metadata protections implemented by instant messengers at Pass the Salt 2025!
The studied messengers are @npub1rkw…5q62 [@olvid_io](https://bird.makeup/users/olvid_io ) @npub1m9z…whzq and @npub1gsu…fy6l
https://cfp.pass-the-salt.org/pts2025/talk/7K9MEV/
I'll be in touch with the vendors to share with them what I'm gonna say about them, to give them the chance to respond to my observations.
#pts25 @npub1uk4…z2gq

2025-01-24 07:37:51 UTC

- reply

Le pourquoi est plus facile que le comment. Pour la plupart, j'ai jamais commencé ou alors j'ai arrêté depuis longtemps.
Mais Whastapp, c'est pas évident. Je vais pas réussir à faire migrer mon conseil syndical, par exemple. Ni le groupe d'entraide de l'immeuble.
La seule solution que j'ai trouvée, c'est de le compartimentaliser pour que Whatsapp ne puisse presque rien obtenir de moi (à part mon graph social actif). Avec les permissions d'Android, et je vais migrer sur @npub1kwa…e0nj pour augmenter encore l'isolation.
Un temps, il y avait des bridges pour Whatsapp, notamment via Element, mais on dirait qu'ils ont arrêté les offres pour particulier qui l'offrait.

2024-11-21 19:46:47 UTC

- reply

Fair enough. Let me patch that up:
> There is difference between the fediverse, Mastodon the web server, the mobile clients, and mastodon.social the instance

2024-11-21 14:13:56 UTC

- reply

There is difference between the fediverse, Mastodon the software, and mastodon.social the instance. Some can be good. Some others can be bad. But kicking the whole stack because of an instance seems a bad faith argument.

2024-11-18 17:30:21 UTC

- reply

Once installed, the application is still "self-updating" IIRC. As such, you still have the "RCE" issue.
Hosting it on IPFS allows cryptographic content pinning. It is the best solution I came up hitherto.

2024-11-16 17:32:54 UTC

How do your apps/servers authenticate to your secret manager (e.g. #Vault) if you use one?
Boosts are apprecieted
#devops #secdevops #devsecops #secret #infosec

2024-10-28 16:24:18 UTC

- reply

Once a phishing page mimicked the login form of my employer and copied so much of our HTML that they included a javascript file under our control.
We modified the javascript so that if the referrer was the phishing page, it would send a special version of the javascript file that would send US the identifier of the client that was phished and sent fake yet believable credentials to the attacker.
We kept it running for days 😅 before the attacker noticed anything. Then, we sent an email to the "compromised" clients to warn them about the phishing attack.

2024-10-28 10:39:45 UTC

google/magika: "Detect file content types with deep learning"
Fucking hell. Just because we could not create formats with explicit internal types (like PDF, PNG or WEBVTT which start with the strings PDF, PNG or WEBVTT), we are now wasting vast quatities of energy to "predict the type of a file".
OMG, we are so fucking doomed.
(also, throwing yet another AI bullshit into the mix, when libmagic was doing it with static rules; how difficult can it be to just quarantine all files with "data" (i.e. unknown) data type?)

2024-10-23 06:51:29 UTC

All these web applications handling end-to-end encryption of user content (think @npub19kd…t56d, @npub1ykg…ch8k, or even Whatsapp web) have a common flaw: the user needs to trust the javascript sent by the web servers of the provider. This situation defeats the purpose of E2EE because the point of doing encryption in the user agent is precisely that the provider does not need to be trusted.
For some reason, signed javascript has never been a thing. No transparency program (like cosign), no key commitment, no nothing. Weird. Sad and weird.
The most frequent solutions to this problem is to not use web pages: publish a mobile app, a desktop client or a web browser extension.
I've been thinking about it for a while now, and the "solution" I came up with is to use IPFS.
IPFS uses content addressing, meaning the address of a file is a hash of the content of the file. Every time you request a specific address, you get the same file. If you store that address in your bookmarks, then you are sure that you are using a specific version of the web content. If that web content is a web application (frontend) and all resources referenced in that web application are either linked using IPFS content addresses or linked via the "traditional web" with SRI hashes, then you have an integrity-verified web application.
Put that IPFS content address in a transparency program, and you have a publicly auditable log of the javascript served by the providers.
So, my request to @npub1ykg…ch8k and @npub19kd…t56d is: could you please publish your frontend on IPFS?
#javascript #cosign #e2ee #ipfs

2024-10-21 05:44:56 UTC

- reply

Is it a podcast if you have a feed and no website?

2024-10-20 20:00:03 UTC

- reply

Weird architecture when staging can impact production. Would you care to elaborate?

2024-08-30 17:31:29 UTC

- reply

Recently I got failed SSH connections. It was a MTU issue caused by large NTRU signatures 😵