Yes, it is visible when a new trusted device is added. The QR code you scan to link a device contains a one-time public key for that device (ECC is used partly to fit the public key more easily into a QR code). Signal on the phone then sends a lot of information, including the identity keys, to the new device. The new device uses these identity keys to communicate. Note that the transfer of identity keys is fully encrypted, with encryption and decryption taking place on the clients. This can, of course, be bypassed if someone you're talking to has their security key compromised, but the same risk exists if the recipient takes a screenshot or photographs their device's screen.

Edit: The security key refers to the one-time key pair generated to initiate the transfer of identity keys and chat history. It can be compromised if someone accidentally scans a QR code and transfers their identity keys to an untrusted device.

Even in an "insecure" app without air-gapped systems or manual encryption, creating a backdoor to access plaintext messages is still very difficult if the app is well audited, open source, and encrypts messages with the recipient's public key or a symmetric key before sending ciphertext to a third-party server.

If you trust the client-side implementation and the mathematics behind the symmetric and asymmetric algorithms, messages remains secure even if the centralized server is compromised. The client-side implementation can be verified by inspecting the source code if the app is open source and the device is trusted (for example, there is no ring-zero vulnerability).

The key exchange itself remains somewhat vulnerable if there is no other secure channel to verify that the correct public keys were exchanged. However, once the public keys have been correctly exchanged, the communication is secure.

There is no central location to donate to open source software in general. Most open source projects include donation details on their website or in their code repositories.

%20 is the URL-encoded form of a space; %25 is the URL-encoded form of the percent sign. The URL you are posting gets re-encoded and % becomes %25 (in the same way that a space becomes %20)

Could the app be using cell tower data to bypass mock location settings? The Github repository says it identifies a user's location using cell tower data.

Sabotage can also be carried out without submarines. For example, a ship could drag its anchor along the seabed (whether in the Baltic Sea or the Taiwan Strait) near known locations of internet cables.

The problem is that there is nothing meaningful you can exchange this currency for. The Fediverse is fundamentally designed to allow anyone to start a server. There is no meaningful way to reward someone with anything of value except the satisfaction of having helped grow the instance they are supporting. There is no good way to boost someone without manipulating the vote count or changing the protocol itself. Many apps already offer customizability while simultaneously being free as in free beer and free as in free speech. The main reason many people move to the Fediverse is to escape an internet where everything is "enshittified," and most Fediverse users wouldn't want to shift to a proprietary model.

That data might be easily accessible, but that was a choice Root made. I think that it is a safe assumption that Root knew most vigilantes keep their identity secret and, assuming a German background, had read Section 202 of the StGB and other relevant laws and court rulings. As such, Root most likely did this despite knowing their identity is at risk. It is likely they did this publicly specifically to inspire others, though I haven't looked at all the details and there might be a different reason.

Nothing in this comment constitutes legal advice.

Not all hierarchies are bad. For instance, in a judicial system, there need to be different tiers of courts as otherwise, if courts had universal authority and made conflicting decisions, it would complicate the law more so than it is already.

Similarly, in a large society that needs unity, if people make all decisions, the results would be catastrophic as most people don't have the time or energy to focus on every mundane decision. In such a case, elected representatives becomes mandatory, creating a hierarchy.

Yet another example is cases where fast decision-making is required (e.g., to respond to an emergency). In such a case, there needs to be a central authority who holds others responsible and coordinates response.

Ultimately, if you consider a hierarchy where accountability is possible i.e. one party may have more power over the second than the second over first but the second still has some power over the first, then it makes accountability possible in hierarchies. Hierarchies are only wrong when the power gap increases, a small power gap is alright provided it doesn't widen with time.

You could make the argument that a chain of accountability is better (X->Y->Z->X), but even such chains may include hierarchies (i.e. X itself is a hierarchy). Similarly, authority diffused among different people also suffers from potential shifting of blame. Truly neutral relations between different parties are impossible and ultimately, a power difference exists between any two parties, though it may be minute, and this power gap must be acknowledged.

In conclusion, there are a lot of disadvantages of hierarchies but there are some domains where hierarchies are good. There is no system of distribution of power that is without flaws.

TL;DR: not possible with random cookies, too much work for too little gain with already-verified cookies

There is no such add-on because random cookies will not work. Whenever someone has been authenticated, Google decides the cookie the browser should send out with any subsequent requests. Google can either choose to assign and store a session id on the browser and store data on servers or choose to store the client browser fingerprint and other data in a single cookie and sign this data.

Additionally, even with a verified session, if you change your browser fingerprint, it may trigger a CAPTCHA, despite using a verified cookie. In the case of a session token, this will occur because of the server storing the fingerprint associated with the previous request. On the other hand, if using a stateless method, the fingerprint will not match the signed data stored inside the cookie.

However, this could work with authenticated cookies wherein users contribute their cookies to a database and the database further distributes these cookies based on Proof of Work. This approach, too, has numerous flaws. For instance, this would require trusting the database, this is a very over engineered solution, Google doesn't mind asking verified users to verify again making this pointless, it would be more efficient to simply hire a team of people or use automated systems to solve CAPTCHAS, this approach also leaks a lot of data depending on your threat model, etc.

ASCII was interpreted as UTF because the function that checked whether the given text was Unicode checked the difference between bytes at even and odd positions. Many of the common phrases used to trigger this were in the 4-3-3-5 format (by letters), e.g., Bush hid the facts However, there was never any reason that this format of character placement was necessary for the bug (though even length was necessary)

Orca works great on Debian 13 for me (I installed it as a Flatpak)