No DRM though, which they use

I would never use their proprietary clients. And when looking for software for Linux, start on flathub.org

There are Nicotine+ multiplatform and Seeker for Android.

Soulseek is entirely proprietary and scary insecure. Check the Nicotine+ documentation for an overview. They do not mention encryption or TLS anywhere, which tells us that there is no encryption. Anyone relaying or passively monitoring your internet traffic will know your username, password and what you share.

This is seriously scary as even with user accounts, known contacts etc, you basically can’t trust anyone to actually be who they pretend to be. In practice it works, but that is likely because nobody cares to attack them.

The server is proprietary running whatever software and can access all your data.

And the best, they use MD5 hashes for the files afaik, which is broken. This is pretty unimportant but still interesting: the files you download are sent over an unencrypted connection and could be modified by a man-in-the-middle without you noticing. One could change the file or hide malware inside it that exploits a vulnerability etc.

Most importantly, this will just be open traffic that will be exposed to anyone who cares. You shouldnt use that IP to do ANYTHING else.

Sadly Soulseek is really good for finding stuff, still very much unbeaten.

There is aMule, recently revived. Many servers and also the decentralized Kademlia network. The UX is way worse than Soulseek, there is no Android version, the revival is heavily driven by AI… but it is pretty good, decentralized and encrypted!

I found this repo with tips for setting up aMule and some scripts.

May I introduce you to the german “Elster” tax portal?

Most fucking insane security mechanisms ever. They support fido2 but with their app, not via a browser. Their linux program is a 10MB shell script that crashed my text editor.

They have a probably encrypted keyfile but that expires in 3 years and you need to

• login
• switch to desktop mode as otherwise they hide it
• send a code per email
• the site generated another code you also need
• you get another email with another link, which also doesnt include any code in the URL
• you need to log out to login again?
• you need to enter the 2 different codes for whatever reason. One is generated on the site before you need to log out, the other from the email
• then wait forever to create the keyfile
• you also need to setup a new password for the keyfile

So afaik you need a username, email, password, keyfile and password for the keyfile.

• why a keyfile again?
• why a username if it is never used?
• why so many emails with all the secret credentials instead of secure e2ee login on the website?

This should be illegal

Shouldnt you also disable the “Comodo” ones?

I dont “understand” the “point” of this “summary”

But being serious, it is fucking scary how shitty emudhra is and what amount of companies apparently put trust in their hardware keystore nonsense

Not sure. Most hardening configs disable this afaik but would need to verify

The person is not very techy and trained on adobe malware

Where?

The attack is vague and unlikely, but blak3 might be faster. Of course less support than sha256

PhotoGimp is not a plugin but a set of config files (including random session files from the dude that made it XD)

One thing missing is algorithmic tools like auto-removal or auto-selecting people and objects. It is not very complex but I dont know a gimp plugin for that

Tox did their own insecure crypto and got roasted by the Wireguard dev, now they are apparently rewriting it.

I agree that Matrix is complex but personally never had issues with key verification. Just try to restart it, maybe on the other device?

Why not blake3?

The software doesnt have interenet access and doesnt display an account, only Adobe got info about the new username with the old email and some info. It was that link opened by the software. But yes, could have been appdata too, unless BCU cleans that

Adobe contacted the user to their completely unprivate email with a weird username that might be shared across all installs of that cracked install.

That means if they wanted they could sue you etc.

Interesting, never heard of this. My Windows experience is very small so I assumed this simply didnt exist

Yes but my knowledge of W$ndows is limited and I dont think that exists there that much

Funny video haha

There ia aome pirated apple software but way less. Apparently creative cloud works in WINE now so who knows

I should try this, especially the cracked version

Interesting, yes absolutely. Somehow it works, but who knows? Windows is so permissive and users are just used to pressing ok in the big admin popup. Apps shouldnt need that access! Adobe also doesnt work if you enable filesystem access restrictions in the security settings

Yes of course. Also these cracked versions can’t have internet access so the collaboration stuff is gone.

A Windows VM or maybe even the new bottles soda runtime would be interesting for isolating it, as the invasiveness is just insane.