• 4 Posts
  • 179 Comments
Joined 6 months ago
cake
Cake day: February 8th, 2025

help-circle

  • First have a look at the report header Content-Security-Policy-Report-Only add things you know about, as that will allow you to log what you need to have setup. Then once you have a list of things you know you need, add them and what the logs again. adding in things as you see and verify them.

    Thank you for this! I feel as if I got the idea however, failed on the execution. I added this to my routers.yml -

            contentSecurityPolicyReportOnly: "child-src; connect-src; default-src; font-src; frame-src; img-src; manifest-src; media-src; object-src; script-src; script-src-elem; script-src-attr; style-src; style-src-elem; style-src-attr; worker-src; report-to csp-report"
    
    

    To my understanding the report-to directive at the end adds a endpoint called /csp-report yet in my testing it doesn’t appear to exist and just leads to 403, I’m likely doing something totally wrong but I appreciate you pointing me in the right direction!

    Also dont just add things in without checking that its in your code, you dont want to add hack-me.com by mistake.

    That’s fair, I’m certainly no wiz at programming and this is just self-hosted docker applications that I’ve jerry-rigged to work with one another.







  • Not the first time for the very neutral state

    According to a Swiss parliamentary investigation, “Swiss intelligence service were aware of and benefited from the Zug-based firm Crypto AG’s involvement in the US-led spying”.

    If your concern is that the CIA owns Crypto AG you should take into consideration what their focus is on, are they focused on child predators and gangs or people torrenting movies and music?

    Crypto AG and Proton have clashed in the past resulting in this article from Proton;

    https://proton.me/blog/is-protonmail-trustworthy

    Transparency: You know who runs the company, where they run it from, how they run it, what data they have, how they interact with law enforcement, and much more.

    Business model: Their business model (how they make money) is simply having paid users that pay for the service. If they were to breach that trust, then they would no longer be able to sustain themselves.

    Competence: They have a team of highly competent people. Most people in their management level have Ph. Ds and they are trusted by many users with heightened security needs. These users includeHKMaps.live, Bellingcat etc.

    Verified By Third Parties: Proton is still in the process of getting all their apps audited and open sourced. Currently, the ProtonMail iOS app, OpenPGP.js, GoOpenPGP and all the ProtonVPN apps have been audited by Cure53 or SEC Consult and the reports publically available with the source code on github with android and bridge on the way. Furthermore, they have been checked over by the EU and given a 2 million euros of funding that can be used on anything to further their mission with no other obligations.

    Legal guarantees: Proton is based in Switzerland, a country with strong privacy protections, and outside the 14 eyes surveillance network. Under Swiss law, they are only permitted to reveal user data if served with a binding legal order from the Swiss government. Sharing data without a legal order is a criminal offense under Article 271 of the Swiss Criminal Code.

    Track record: ProtonMail’s creation by scientists who met at CERN (the European Organization for Nuclear Research) is well documented, including on the CERN website. The scientific background of their leadership team can be easily verified by looking at their academic careers and scientific publications.


    More info

    On a related note, we have also had people ask us about Proton Mail’s official position regarding the ongoing Palestinian-Israeli conflict and whether working with an Israeli company means we are taking sides in this conflict. The answer is NO. As a Swiss company, we adhere to a policy of strict neutrality

    In the header of this article you seemed to have glossed over:

    UPDATE April 3, 2020: The information in this article is outdated. As of last year, we no longer have any contract with Radware.





  • Back up your important files while you still have them and get new ones ASAP; preferably some form of SSD

    Unfortunately I’m going to have to until pay day for me to replace the drives, and I currently don’t have 6tb to back up to, I was thinking of getting a 10tb western digital NAS drive as it is significantly cheaper than a 10tb SSD.

    Granted an SSD would be ideal if I can find one relatively ”cheap” that still has a NAND chip for caching.