• 1 Post
  • 329 Comments
Joined 1 year ago
cake
Cake day: July 14th, 2023

help-circle

  • if Apple has that group on their “approved” list and they match donations, they are effectively donating to that group.

    Not really.

    First, like I said in my previous comment, the article doesn’t say if there’s an “Approved” list or if they just approved everything the donation platform supports (all 2.1 million nonprofits). I’ve never used Benevity and so have no way of knowing how corporations select which nonprofits they’ll match donations to. I looked at the Benevity site and they didn’t make it clear, either.

    Secondly, like I said in my previous comment, it doesn’t state whether anyone has actually donated (particularly over the last 9 months or so). Benevity has 2.1 million nonprofits in their database but has only supported less than a quarter of them - 470 thousand.

    If nobody has actually donated, Apple hasn’t, either. Heck, suppose a hundred people have donated an average of $100 each. That’d be $10,000 that Apple has donated and $20,000 more than should have been donated, but that’s still ultimately not a remotely relevant amount. The IDF gets $3.8 BILLION every year from US taxpayers. And unlike with donation matching, those taxpayers don’t get a choice in where their money goes. In this case, the employees are in control.

    It’s completely feasible that Benevity doesn’t provide an easy way for corporations like Apple to prevent donations to particular “charities” like this one without impacting other donation options. I.e., they might have an all or nothing approach, where the company selects groups of charities, and in order to prevent donations to the Friends of IDF, Apple would need to also prevent donations to every other actual charity in the same group.

    It’s also completely feasible that it does provide this option. But the article doesn’t say.

    The article also doesn’t explain why the signatories aren’t also making a big deal about the donation platform facilitating donations to Friends of the IDF in the first place. Heck, it doesn’t even mention how many of the “900+ leading brands who use Benevity” have donations to Friends of the IDF enabled.

    OP is basically saying “Grab your pitchforks! It’s Apple harvesting time!” and using an article written by someone too lazy to even email Benevity and ask for the basic missing info I’ve outlined above.




  • From the article (emphasis mine):

    The controversy stems from Apple’s employee donation-matching programme, which allows workers to make contributions to various non-profit organisations and receive matching funds from the company through a platform called Benevity. Among the charities Apple’s controversial platform allows funds to be sent to are Friends of the IDF

    This doesn’t say Apple is donating to the IDF, just that it allows its employees to, and will match that donation. That’s an employee benefit. It doesn’t say how many employees are taking advantage of this, if any.

    It doesn’t say if Apple has simply allowed every Benevity cause or some subset of them that happens to include Friends of the IDF.

    I get that this was organized by Apple employees, but Benevity is the one facilitating this - and not just for Apple. They should be the ones getting pressured to stop enabling it.



  • Every single App Store out there uses “free” to refer to propriety software today, because it’s free.

    “Free” as an adjective isn’t the issue. The issue is the phrase “free software” being used to refer to things other than free software. And afaict, no app store uses the term ”free software” to refer to non-free software.

    The iOS App Store refers to “Free Apps.”

    Google Play doesn’t call it “Free Software,” either; they just use it as a category / filter, e.g., “Top Free.”

    There’s a reason many are … starting to refer to such software as “libre”, not “free”

    Your conclusion is incorrect - this is because when used outside of the phrase “free software,” the word is ambiguous. “Software that is free” could mean gratis, libre, or both.



  • There is no path to any future where someone will be wrong to use the word “free” to describe software that doesn’t cost anything.

    Setting aside that doing so is already misleading, you clearly lack imagination if you cannot think of any feasible way for that to happen.

    For example, consider a future where use of the phrase when advertising your product could result in legal issues. That isn’t too far-fetched.

    They don’t become invalidated. They’re not capable of becoming invalidated.

    They certainly can. A given meaning of a word is invalidated if it is no longer acceptable to use it in a given context for that meaning. In a medical context, for example, words become obsolete and unacceptable to use.

    Likewise, it isn’t valid to say that your Aunt Edna is “hysterical” because she has epilepsy.

    But more importantly, that’s all beside the point. Words don’t just have meaning in isolation - context matters. Phrases can have meanings that are different than just the sum of their parts, and saying a phrase but meaning something different won’t communicate what you meant. If you say something that doesn’t communicate what you meant, then obviously, what you said is incorrect.

    “Free software” has an established meaning (try Googling it or looking it up on Wikipedia), and if you use it to mean something different, people will likely misunderstand you and/or correct you. They’re not wrong in this situation - you are.

    That, or you’re trying to live life like a character from Airplane!:

    This woman has to be gotten to a hospital.

    A hospital? What is it?

    It’s a big building with patients, but that’s not important right now.




  • I’m not the person you replied to, I don’t use Photoshop, but I used to use GIMP exclusively and I use the Affinity suite now. What I’ve seen pop up in discussions about a major area where GIMP is lacking, going back several years at this point:

    Photoshop supports nondestructive editing, and Affinity supports nondestructive RAW editing (and even outside RAW editing, it still supports things like filter layers). Heck, my understanding is Krita has support for nondestructive editing, too.

    GIMP, on the other hand, has historically only had destructive editing. It looks like they finally added an initial implementation back in February. That’s great, and once GIMP 3.0 releases and that feature is fully supported, then GIMP will be a viable alternative for workflows that require it.


  • Sure, that’s why I was confused about the use of the word “pollution.” Even when it comes to water the issue is that the water that’s returned to the water source is warmer, not that it’s polluted.

    How does mining for Uranium compare to mining of materials needed for solar and for battery cells, targeting the same energy output? My guess is that they’re fairly similar, but I haven’t done the research to confirm. I’d be very surprised if either got anywhere near the impact of mining for coal and oil (plus the resulting pollution from their use), though.

    In terms of waste by volume, nuclear doesn’t generate nearly as much as coal. According to https://www.nei.org/news/2019/what-happens-nuclear-waste-us, a single coal plant generates more waste in an hour than the entirety of nuclear power has generated, total. And in the US, at least, we have a centralized location planned since 1987, but it has been blocked for political reasons.

    Nuclear power can also be more efficient relative to the initial amount mined and can reduce fuel waste by recycling waste fuel, and even more by using breeder reactors, which generate roughly 140 times as much energy given the same amount of Uranium. Breeder reactors also do not have a need for the enrichment cycle and can be built to use Thorium instead of Uranium.

    Just to clarify, I’m coming at this from a US perspective. The US doesn’t recycle waste fuel, but some other countries do. As far as I know, there are only two breeder reactors worldwide (both in Russia).

    I’m not a diehard nuclear supporter or anything along those lines, but so far the reasons I’ve seen for why we aren’t investing in nuclear more are either political or economical (since so much of the cost is upfront and the pay-off takes place over the reactor’s entire lifespan).



  • But being rude and abusive to support staff doesn’t help, encourage, or even compel the support staff do their jobs any better or faster. In fact, I’d wager it’s rather the opposite.

    I work in IT (not IT support, though) and I’m fortunate enough that none of my business partners are outright abusive. Even so, I still have some that I deprioritize compared to others because working with them is a pain (things like asking for project proposals to solve X problem and never having money to fund them). If someone was actively rude to me when I had fucked up, much less when I was doing a great job, I can guarantee I wouldn’t work any better or faster when it was for them.




  • It isn’t, because their business practices violate the four FOSS essential freedoms:

    1. The freedom to run the program for any purpose
    2. The freedom to study and modify the program
    3. The freedom to redistribute copies of the original or modified program
    4. The freedom to distribute modified versions of the program

    Specifically, freedom 4 is violated, because you are not permitted to distribute a modified version of the program that connects to the Signal servers (even if all your modified version does is to remove Google Play Services or something similar).



  • That’s still a single point of failure.

    So is TLS or the compromise of a major root certificate authority, and those have no bearing on whether an approach qualifies as using 2FA.

    The question is “How vulnerable is your authentication approach to attack?” If an approach is especially vulnerable, like using SMS or push notifications (where you tap to confirm vs receiving a code that you enter in the app) for 2FA, then it should be discouraged. So the question becomes “Is storing your TOTP secrets in your password manager an especially vulnerable approach to authentication?” I don’t believe it is, and further, I don’t believe it’s any more vulnerable than using a separate app on your mobile device (which is the generally recommended alternative).

    What happens if someone finds an exploit that bypasses the login process entirely?

    Then they get a copy of your encrypted vault. If your vault password is weak, they’ll be able to crack it and get access to everything. This is a great argument for making sure you have a good vault password, but there are a lot of great arguments for that.

    Or do you mean that they get access to your logged in vault by compromising your device? That’s the most likely worst case scenario, and in such a scenario:

    • all of your logged in accounts can be compromised by stealing your sessions
    • even if you use a different app for your 2FA, those TOTP secrets and passkeys can be stolen - they have to be on a different device
    • you’re also likely to be subject to a ransomware attack

    In other words, your only accounts that are not vulnerable in this situation solely because their TOTP secret is on a different device are the ones you don’t use on that device in the first place. This is mostly relevant if your computer is compromised - if your phone is compromised, then it doesn’t matter that you use a separate password manager and authenticator app.

    If you use an account on your computer, since it can be compromised without having the credentials on device, you might as well have the credentials on device. If you’re concerned about the device being compromised and want to protect an account that you don’t use on that device, then you can store the credentials in a different vault that isn’t stored on your device.

    Even more common, though? MITM phishing attacks. If your password manager verifies the url, fills the password, and fills your TOTP, then that can help against those. Start using a different device and those protections fall away. If your vault has been compromised and your passwords are known to an attacker, but they don’t have your TOTP secrets, you’re at higher risk of erroneously entering them into a phishing site.

    Either approach (same app vs different app) has trade-offs and both approaches are vulnerable to different sorts of attacks. It doesn’t make sense to say that one counts as 2FA but the other doesn’t. They’re differently resilient - that’s it. Consider your individual threat model and one may be a better option than the other.

    That said, if you’re concerned about the resiliency of your 2FA approach, then look into using dedicated security keys. U2F / WebAuthn both give better phishing resistance than a browser extension filling a password or TOTP can, and having the private key inaccessible can help mitigate device compromise concerns.