After extensive testing, it's finally here: the new SHIFTphone 8.1 with iodéOS is now available at NovaCustom! It's a privacy-friendly phone that's not only user-friendly and secure, but also sustainable and fully modular. This smartphone stands for privacy, security, freedom of choice, and repairability: values that perfectly align with NovaCustom's mission.

• https://novacustom.com/privacy-friendly-phone/

Why NovaCustom and SHIFTphone are the perfect match

At NovaCustom, we believe that users should have control over their own hardware and software. The SHIFTphone is perfect for this in terms of hardware: it has a modular design and is easy to repair. In terms of software, the original product is less than ideal: it comes with Google software as standard. NovaCustom replaces that software with iodéOS by default. This is an operating system without Google services (only microG, but it can also work without it!). This gives you a privacy-friendly phone with maximum control over your data.

Fully modular and customizable

NovaCustom launches the SHIFTphone 8.1

Whether you want to replace a screen, insert a new battery, or simply tinker with your smartphone yourself, the SHIFTphone makes it possible. No glue, no frustration, just pure freedom. NovaCustom has been supporting this principle for years with configurable laptops, and now we are bringing that same idea to smartphones.

After extensive testing, it's finally here: the new SHIFTphone 8.1 with iodéOS is now available at NovaCustom! It's a privacy-friendly phone that's not only user-friendly and secure, but also sustainable and fully modular. This smartphone stands for privacy, security, freedom of choice, and repairability: values that perfectly align with NovaCustom's mission.

• https://novacustom.com/privacy-friendly-phone/

Why NovaCustom and SHIFTphone are the perfect match

At NovaCustom, we believe that users should have control over their own hardware and software. The SHIFTphone is perfect for this in terms of hardware: it has a modular design and is easy to repair. In terms of software, the original product is less than ideal: it comes with Google software as standard. NovaCustom replaces that software with iodéOS by default. This is an operating system without Google services (only microG, but it can also work without it!). This gives you a privacy-friendly phone with maximum control over your data.

Fully modular and customizable

NovaCustom launches the SHIFTphone 8.1

Whether you want to replace a screen, insert a new battery, or simply tinker with your smartphone yourself, the SHIFTphone makes it possible. No glue, no frustration, just pure freedom. NovaCustom has been supporting this principle for years with configurable laptops, and now we are bringing that same idea to smartphones.

Why does Stripe require OAuth tokens to pass through a third party server?

Can someone who understands OAuth better than me explain to me why Stripe REQUIRES that their OAuth Access Keys get shared with a third party?

I've tried RTFM, but my biggest hangup is that the OAuth docs appear describe a very different situation than mine. They usually describe a user agent (web browser) as the client. And they talk about "your users" as if I have a bunch of users that I'm going to be fetching access keys for.

Nah, this is server <--> server. I have a server. Stripe has a server. I am one user. All I need is ONE API key for ONE account. But I'm forced to use OAuth. It doesn't seem appropriate, and it's especially concerning that the "flow" requires the (non-expiring!) Access Token to be shared with a third party server. Why?!?

I recently learned that Stripe has been pushing OAuth (branded as "Stripe Connect") to its integration apps as the "more secure" solution, compared to Restricted API Keys. In fact, we've found that most integrations we've encountered that use Stripe Connect are less secure than using Restricted API Keys because the (private!) tokens are shared with a third party!

I've been using Stripe to handle credit card payments on my e-commerce website for years. Recently, we updated our wordpress e-commerce website and all its plugins. And then we discovered that all credit card payments were broken because our Stripe Payment Gateway plugin stopped allowing use of Restricted API Keys. Instead they only support "Stripe Connect" (which, afaict, is a marketing term for OAuth). This change forced us to do a security audit to make sure that the new authentication method met our org's security requirements. What we found was shocking.

So far we've started auditing two woocommerce plugins for Stripe, and both have admitted that the OAuth tokens are shared with their (the developer's) servers!

One of them is a "Stripe Verified Partner", and they told us that they're contractually obligated by Stripe to use only "Stripe Connect" (OAuth) -- they are not allowed to use good-'ol API Keys.

They also told us that Stripe REQUIRED them to include them in the OAuth flow, such that their servers are given our (very secret!) OAuth Access Keys!

The benefit of normal API Keys, of course, is that they're more secure than this OAuth setup for (at least) two reasons:

1. I generate the API keys myself, and I can restrict the scope of the keys permissions

2. I store the key myself on my own server. It's never transmitted-to nor stored-on any third party servers. Only my server and Stripe's servers ever see it.

Can someone shine a light onto this darkpattern? I understand that standardization is good. OAuth Refresh Keys add security (this service doesn't use them). But why-oh-why would you FORCE OAuth flows that share the (non-expiring) Access Tokens with a third party? And why would you claim that's more secure than good-ol-API-keys?

Does OAuth somehow not support server<-->server flows? Or is it a library issue?

What am I missing?

I wrote a guide to help users with their migration to Lemmy

• https://tech.michaelaltfield.net/2023/06/11/lemmy-migration-find-subreddits-communities/

This guide will help new lemmy users find and subscribe-to (remote) lemmy ~~subreddits~~ communities

We just published our #WarrantCanary for 2023 H2 🕵️

https://buskill.in/canary-006/

Warrant Canaries are a means for us to (not) inform you of (not being) breached if served with a State-issued, secret subpoena (gag order) #infosec

We just published our #WarrantCanary for 2023 H2 🕵️

https://buskill.in/canary-006/

Warrant Canaries are a means for us to (not) inform you of (not being) breached if served with a State-issued, secret subpoena (gag order) #infosec

I created a repo on GitHub that has a table comparing all the known lemmy instances

• https://github.com/maltfield/awesome-lemmy-instances

Why?

When I joined lemmy, I had to join a few different instances before I realized that:

1. Some instances didn't allow you to create new communities
2. Some instances were setup with an allowlist so that you couldn't subscribe/participate with communities on (most) other instances
3. Some instances disabled important features like downvotes
4. Some instances have profanity filters or don't allow NSFW content

I couldn't find an easy way to see how each instance was configured, so I used lemmy-stats-crawler and GitHub actions to discover all the Lemmy Instances, query their API, and dump the information into a data table for quick at-a-glance comparison.

I hope this helps others with a smooth migration to lemmy. Enjoy :)

This article is about a new 3d-printable prototype version of the BusKill cable.

The BusKill cable is a laptop kill cord. If you're still struggling to understand what is a BusKill cable and why you'd need a laptop kill cord, there's a 2-minute explainer video that makes this clear:

• https://www.buskill.in/#demo

Enjoy and happy printing :)