Update webpage "About" from version "8.0.0" to "8.1.0"
This commit is contained in:
parent
9dca622b67
commit
1c509da6ff
SSH Key Fingerprint:
SHA256:FtEVfx1CmTKMy40VwZvF4k+3TC+QhCWy+EmPRg50Nnc
569
about.xhtml
569
about.xhtml
@ -1,7 +1,7 @@
|
||||
<!DOCTYPE html>
|
||||
|
||||
<!-- Inferencium - Website - About -->
|
||||
<!-- Version: 8.0.0 -->
|
||||
<!-- Version: 8.1.0 -->
|
||||
|
||||
<!-- Copyright 2022 Jake Winters -->
|
||||
<!-- SPDX-License-Identifier: BSD-3-Clause -->
|
||||
@ -27,24 +27,37 @@
|
||||
<div><a href="directory.xhtml">Directory</a></div>
|
||||
<div><a href="key.xhtml">Key</a></div>
|
||||
</nav>
|
||||
<h1>About</h1>
|
||||
<h1 id="about"><a href="#about">About</a></h1>
|
||||
<nav id="toc">
|
||||
<h2><a href="#toc">Table of Contents</a></h2>
|
||||
<ul>
|
||||
<li><a href="#about_me">About Me</a></li>
|
||||
<li><a href="#date_time">Date and Time</a></li>
|
||||
<li><a href="#languages">Languages</a></li>
|
||||
<ul>
|
||||
<li><a href="#languages-markup">Markup</a></li>
|
||||
<ul>
|
||||
<li><a href="#languages-markup-xhtml">XHTML</a></li>
|
||||
<li><a href="#languages-markup-asciidoc">AsciiDoc</a></li>
|
||||
</ul>
|
||||
<li><a href="#languages-programming">Programming</a></li>
|
||||
<ul>
|
||||
<li><a href="#languages-programming-rust">Rust</a></li>
|
||||
<li><a href="#languages-programming-go">Go</a></li>
|
||||
</ul>
|
||||
</ul>
|
||||
<li><a href="#licensing">Licensing</a></li>
|
||||
<ul>
|
||||
<li><a href="#licensing-code">Code</a></li>
|
||||
<ul>
|
||||
<li><a href="#licensing-bsd-3-clause">BSD 3-Clause License</a></li>
|
||||
<li><a href="#licensing-gpl-2.0">GNU General Public License v2.0</a></li>
|
||||
<li><a href="#licensing-code-bsd3clause">BSD 3-Clause License</a></li>
|
||||
<li><a href="#licensing-code-gpl2.0only">GNU General Public License v2.0</a></li>
|
||||
</ul>
|
||||
<li><a href="#licensing-noncode">Non-code</a></li>
|
||||
<ul>
|
||||
<li><a href="#licensing-cc-by-4.0">Creative Commons Attribution 4.0 International</a></li>
|
||||
<li><a href="#licensing-noncode-ccby4.0">Creative Commons Attribution 4.0 International</a></li>
|
||||
</ul>
|
||||
<li><a href="#licensing-open_source_vs_free_software">Do I Distinguish Between Open-source and Free Software?</a></li>
|
||||
<li><a href="#licensing-open_source_vs_free_software">Do I Distinguish Between Open Source and Free Software?</a></li>
|
||||
</ul>
|
||||
<li><a href="#versioning">Versioning</a></li>
|
||||
<ul>
|
||||
@ -73,24 +86,30 @@
|
||||
</nav>
|
||||
<section id="about_me">
|
||||
<h2><a href="#about_me">About Me</a></h2>
|
||||
<p>I am Jake Winters, also known by my pseudonym "Inference", a security
|
||||
researcher based in United Kingdom.<br/>
|
||||
I am the founder, lead developer, and administrator, of Inferencium.<br/>
|
||||
All opinions are my own, and are not necessarily shared with projects or people
|
||||
I am affiliated with.</p>
|
||||
<p>I write about my research and experience in cybersecurity and also physical
|
||||
security. Most of my postings are security-related, but I occasionally post
|
||||
about other aspects of my life.</p>
|
||||
<p>I am an open source advocate for the preservation and modifiability of source
|
||||
code. I believe source code should be considered human knowledge as much as past
|
||||
knowledge and teachings were; it is how modern humanity survives and runs.<br/>
|
||||
Source code being modifiable allows it to be adapted for use by anyone, whether
|
||||
to add features, harden it for increased security and/or privacy, or provide
|
||||
accessibility for disabled users.<br/>
|
||||
I am also a modular design advocate for the ability to securely and robustly
|
||||
make changes to hardware and software without the entire system being
|
||||
affected.</p>
|
||||
<p>I run multiple XMPP channels; a directory of channels can be found on the
|
||||
<p>I am Jake Winters, also known by my pseudonym
|
||||
"Inference", a security researcher based in United
|
||||
Kingdom.</p>
|
||||
<p>I am the founder, lead developer, and administrator, of
|
||||
Inferencium.</p>
|
||||
<p>All opinions are my own, and are not necessarily shared
|
||||
with projects or people I am affiliated with.</p>
|
||||
<p>I write about my research and experience in cybersecurity
|
||||
and also physical security. Most of my postings are
|
||||
security-related, but I occasionally post about other
|
||||
aspects of my life.</p>
|
||||
<p>I am an open source advocate for the preservation and
|
||||
modifiability of source code. I believe source code should
|
||||
be considered human knowledge as much as past knowledge and
|
||||
teachings were; it is how modern humanity survives and runs.
|
||||
Source code being modifiable allows it to be adapted for use
|
||||
by anyone, whether to add features, harden it for increased
|
||||
security and/or privacy, or provide accessibility for
|
||||
disabled users.</p>
|
||||
<p>I am also a modular design advocate for the ability to
|
||||
securely and robustly make changes to hardware and software
|
||||
without the entire system being affected.</p>
|
||||
<p>I run multiple XMPP channels; a directory of channels can
|
||||
be found on the
|
||||
<a href="https://inferencium.net/directory.xhtml">directory</a>
|
||||
webpage.</p>
|
||||
<p>If you wish to contact me for any reason, you can use my
|
||||
@ -99,90 +118,202 @@
|
||||
<section id="date_time">
|
||||
<h2><a href="#date_time">Date and Time</a></h2>
|
||||
<p>All dates and times across my services are
|
||||
<a href="https://wikipedia.org/wiki/ISO_8601">ISO 8601</a>-compliant. The
|
||||
short-form format <code>YYYY-MM-DD</code> is used for dates, and
|
||||
<code>hh:mm:ss</code> is used for times, with display of seconds being based on
|
||||
required level of accuracy. The full expression may be used when necessary;
|
||||
<a href="https://en.wikipedia.org/wiki/ISO_8601">ISO 8601</a>-compliant.
|
||||
The short-form format <code>YYYY-MM-DD</code> is used for
|
||||
dates, and <code>hh:mm:ss</code> is used for times, with
|
||||
display of seconds being based on required level of
|
||||
accuracy. The full expression may be used when necessary;
|
||||
<code>YYYYMMDDThhmmssZ</code> (UTC without offset),
|
||||
<code>YYYYMMDDThhmmss+hhmm</code> (with positive offset), or
|
||||
<code>YYYYMMDDThhmmss-hhmm</code> (with negative offset).</p>
|
||||
<code>YYYYMMDDThhmmss-hhmm</code> (with negative
|
||||
offset).</p>
|
||||
</section>
|
||||
<section id="languages">
|
||||
<h2><a href="#languages">Languages</a></h2>
|
||||
<section id="languages-markup">
|
||||
<h3><a href="#languages-markup">Markup</a></h3>
|
||||
<p>The following markup languages are used in my code, with
|
||||
rationale provided for the usage of each language.</p>
|
||||
<p>Note that derivations of non-Inferencium codebases, such as
|
||||
forks, may not contain the markup languages listed here due to
|
||||
the work involved in replacing all code, but will be rewritten
|
||||
whenever possible, and new code will be written in my preferred
|
||||
languages whenever possible.</p>
|
||||
<section id="languages-markup-xhtml">
|
||||
<h4><a href="#languages-markup-xhtml">XHTML</a></h4>
|
||||
<p>XHTML is preferred for most content
|
||||
due to its HTML-based design and syntax,
|
||||
with advantages over HTML, including
|
||||
strict parsing checks which assist with
|
||||
achieving code-correctness, and being
|
||||
XML-compliant to allow widespread usage
|
||||
even outside of the intended HTML-based
|
||||
use case.</p>
|
||||
<p>HTML has multiple flaws, including
|
||||
allowing broken code to be loaded in the
|
||||
user's web browser, not informing the
|
||||
developer of broken code or mismatching
|
||||
tags, and using non-standard, highly
|
||||
permissive syntax which is
|
||||
non-portable. XHTML mitigates or
|
||||
completely fixes these issues via
|
||||
its XML namespace.</p>
|
||||
</section>
|
||||
<section id="languages-markup-asciidoc">
|
||||
<h4><a href="#languages-markup-asciidoc">AsciiDoc</a></h4>
|
||||
<p>AsciiDoc is used when portability is
|
||||
a concern, as it allows easy conversion
|
||||
to other file formats, including HTML
|
||||
and PDF. AsciiDoc can also be read
|
||||
as-is, due to it having clean markup and
|
||||
high readability when viewed as
|
||||
plaintext.</p>
|
||||
</section>
|
||||
</section>
|
||||
<section id="languages-programming">
|
||||
<h3><a href="#languages-programming">Programming</a></h3>
|
||||
<p>The following programming languages are used in my code, with
|
||||
rationale provided for the usage of each language.</p>
|
||||
<p>Note that derivations of non-Inferencium codebases, such as
|
||||
forks, may not contain the programming languages listed here due
|
||||
to the work involved in replacing all code, but will be
|
||||
rewritten whenever possible, and new code will be written in my
|
||||
preferred languages whenever possible.</p>
|
||||
<section id="languages-programming-rust">
|
||||
<h4><a href="#languages-programming-rust">Rust</a></h4>
|
||||
<p>Rust is a partially object-oriented
|
||||
programming language with a focus on
|
||||
security and performance. It has strict
|
||||
compile-time checks to verify the
|
||||
memory-safety and thread-safety of code,
|
||||
is memory-efficient, has no garbage
|
||||
collection, is highly portable, has
|
||||
great support for integration with other
|
||||
languages, and is suitable for both
|
||||
high-level and low-level code.</p>
|
||||
<p>Rust is the modern replacement for
|
||||
C++.</p>
|
||||
</section>
|
||||
<section id="languages-programming-go">
|
||||
<h4><a href="#languages-programming-go">Go</a></h4>
|
||||
<p>Go is a functional programming
|
||||
language with a focus on performance. It
|
||||
is easy to use, has garbage collection,
|
||||
allows clean codebases, and is suitable
|
||||
for high-level code.</p>
|
||||
<p>Go is the modern replacement for
|
||||
C.</p>
|
||||
</section>
|
||||
</section>
|
||||
</section>
|
||||
<section id="licensing">
|
||||
<h2><a href="#licensing">Licensing</a></h2>
|
||||
<p>I care about upstreaming and sharing code, strongly preferring licenses which
|
||||
have high license compatibility in order to permit sharing code with as many
|
||||
other projects as possible; for this reason, permissive licenses are my
|
||||
preferred choice, while avoiding copyleft licenses and other licenses which
|
||||
place restrictions on how my code may be used, and prevent me from including
|
||||
important proprietary code, such as firmware, which can patch security
|
||||
<p>I care about upstreaming and sharing code, strongly
|
||||
preferring licenses which have high license compatibility in
|
||||
order to permit sharing code with as many other projects as
|
||||
possible; for this reason, permissive licenses are my
|
||||
preferred choice, while avoiding copyleft licenses and other
|
||||
licenses which place restrictions on how my code may be
|
||||
used, and prevent me from including important proprietary
|
||||
code, such as firmware, which can patch security
|
||||
vulnerabilities, privacy issues, and stability issues.</p>
|
||||
<p>All of my code is and will be permissively licensed unless specific
|
||||
circumstances make it impractical or infeasible to do so. My goal is to share
|
||||
code which has the least amount of restrictions as possible, to allow wider
|
||||
propagation of my code and allow more use cases and possibilities, as well as
|
||||
ensuring proprietary code, whenever required, is permitted to be included and/or
|
||||
linked to.</p>
|
||||
<p>All of my code is and will be permissively licensed
|
||||
unless specific circumstances make it impractical or
|
||||
infeasible to do so. My goal is to share code which has the
|
||||
least amount of restrictions as possible, to allow wider
|
||||
propagation of my code and allow more use cases and
|
||||
possibilities, as well as ensuring proprietary code,
|
||||
whenever required, is permitted to be included and/or linked
|
||||
to.</p>
|
||||
<p><a href="https://iso.org/standard/81870.html">ISO 5962:2021</a>
|
||||
is used for licensing, in the format
|
||||
<code>SPDX-License-Identifier: <license></code>; see the
|
||||
<code>SPDX-License-Identifier: <var><license></var></code>;
|
||||
see the
|
||||
<a href="https://spdx.org/licenses/">SPDX License List</a>
|
||||
for the full list of available licenses under this standard.</p>
|
||||
<p>My preferred licenses and rationale for using them are below; any licenses
|
||||
not listed are chosen on a case-by-case basis.</p>
|
||||
<h3 id="licensing-code"><a href="#licensing-code">Code</a></h3>
|
||||
<h4 id="licensing-bsd-3-clause"><a href="#licensing-bsd-3-clause">BSD 3-Clause License</a></h4>
|
||||
<code>SPDX-License-Identifier: BSD-3-Clause</code>
|
||||
for the full list of available licenses under this
|
||||
standard.</p>
|
||||
<p>My preferred licenses and rationale for using them are
|
||||
below; any licenses not listed are chosen on a case-by-case
|
||||
basis.</p>
|
||||
<section id="licensing-code">
|
||||
<h3><a href="#licensing-code">Code</a></h3>
|
||||
<section id="licensing-code-bsd3clause">
|
||||
<h4><a href="#licensing-code-bsd3clause">BSD 3-Clause License</a></h4>
|
||||
<p><b>SPDX License Identifier:</b> <code>BSD-3-Clause</code></p>
|
||||
<p><b>Type: Permissive</b></p>
|
||||
<p><a href="https://spdx.org/licenses/BSD-3-Clause.html">BSD 3-Clause License</a>
|
||||
is a highly permissive license which allows content
|
||||
licensed under it to be used in any way, whether in
|
||||
source or binary form, and allows sublicensing under a
|
||||
different license, with the only restrictions being the
|
||||
original copyright notice must be kept in order to
|
||||
attribute the original creator of the licensed content,
|
||||
and the name of the project and/or its contributors may
|
||||
not be used to endorse or promote products derived from
|
||||
the original project.</p>
|
||||
<h4 id="licensing-gpl-2.0"><a href="#licensing-gpl-2.0">GNU General Public License v2.0</a></h4>
|
||||
<code>SPDX-License-Identifier: GPL-2.0-only</code>
|
||||
is a highly permissive license which
|
||||
allows content licensed under it to be
|
||||
used in any way, whether in source or
|
||||
binary form, and allows sublicensing
|
||||
under a different license, with the only
|
||||
restrictions being the original
|
||||
copyright notice must be kept in order
|
||||
to attribute the original creator of the
|
||||
licensed content, and the name of the
|
||||
project and/or its contributors may not
|
||||
be used to endorse or promote products
|
||||
derived from the original project.</p>
|
||||
</section>
|
||||
<section id="licensing-code-gpl2.0only">
|
||||
<h4><a href="#licensing-code-gpl2.0only">GNU General Public License v2.0</a></h4>
|
||||
<p><b>SPDX License Identifier:</b> <code>GPL-2.0-only</code></p>
|
||||
<p><b>Type: Copyleft</b></p>
|
||||
<p><a href="https://spdx.org/licenses/GPL-2.0-only.html">GNU General Public License v2.0</a>
|
||||
is a strong copyleft license which restricts use of
|
||||
content licensed under it by requiring all source code
|
||||
of the content to be publicly available, making
|
||||
binary-only form and inclusion of proprietary code
|
||||
impossible, requiring all derivatives to be licensed
|
||||
under the same license (allowing sublicensing under only
|
||||
newer GPL licenses if <code>GPL-2.0-or-later</code> is
|
||||
specified in the SPDX license identifier), and requiring
|
||||
the original copyright notice to be kept in order to
|
||||
attribute the original creator of the licensed
|
||||
content.</p>
|
||||
<p>Due to the restrictive and invasive nature of this
|
||||
license, it is avoided unless such restrictions would be
|
||||
beneficial to my code; whenever this is the case, the
|
||||
GNU General Public License v2.0 will be used, rather
|
||||
than the more restrictive
|
||||
is a strong copyleft license which
|
||||
restricts use of content licensed under
|
||||
it by requiring all source code of the
|
||||
content to be publicly available, making
|
||||
binary-only form and inclusion of
|
||||
proprietary code impossible, requiring
|
||||
all derivatives to be licensed under the
|
||||
same license (allowing sublicensing
|
||||
under only newer GPL licenses if
|
||||
<code>GPL-2.0-or-later</code> is
|
||||
specified in the SPDX License
|
||||
Identifier), and requiring the original
|
||||
copyright notice to be kept in order to
|
||||
attribute the original creator of the
|
||||
licensed content.</p>
|
||||
<p>Due to the restrictive and invasive
|
||||
nature of this license, it is avoided
|
||||
unless such restrictions would be
|
||||
beneficial to my code; whenever this is
|
||||
the case, the GNU General Public License
|
||||
v2.0 will be used, rather than the more
|
||||
restrictive
|
||||
<a href="https://spdx.org/licenses/GPL-3.0-only.html">GNU General Public License v3.0</a>,
|
||||
and relicensing derivatives under the GNU General Public
|
||||
License v3.0 will be disallowed.</p>
|
||||
<h3 id="licensing-noncode"><a href="#licensing-noncode">Non-code</a></h3>
|
||||
<h4 id="licensing-cc-by-4.0"><a href="#licensing-cc-by-4.0">Creative Commons Attribution 4.0 International</a></h4>
|
||||
<code>SPDX-License-Identifier: CC-BY-4.0</code>
|
||||
and relicensing derivatives under the
|
||||
GNU General Public License v3.0 will be
|
||||
disallowed.</p>
|
||||
</section>
|
||||
</section>
|
||||
<section id="licensing-noncode">
|
||||
<h3><a href="#licensing-noncode">Non-code</a></h3>
|
||||
<section id="licensing-noncode-ccby4.0">
|
||||
<h4><a href="#licensing-noncode-ccby4.0">Creative Commons Attribution 4.0 International</a></h4>
|
||||
<p><b>SPDX License Identifier:</b> <code>CC-BY-4.0</code></p>
|
||||
<p><b>Type: Permissive</b></p>
|
||||
<p><a href="https://spdx.org/licenses/CC-BY-4.0.html">Creative Commons Attribution 4.0 International</a>
|
||||
is a highly permissive license which allows content
|
||||
licensed under it to be used in any way, in any medium,
|
||||
with the only restriction being the original copyright
|
||||
notice must be kept in order to attribute the original
|
||||
creator of the licensed content.</p>
|
||||
<h3 id="licensing-open_source_vs_free_software"><a href="#licensing-open_source_vs_free_software">Do I Distinguish Between Open-source and Free Software?</a></h3>
|
||||
<p>No. If code is not released under an open-source license and
|
||||
places restrictions on how the code may be used, it is either
|
||||
source-available (if viewing the code is permitted) or
|
||||
proprietary. "Free software" only causes confusion and exists to
|
||||
push an ideology by a specific group of people. If software
|
||||
isn't "free", it's not open-source, either.</p>
|
||||
is a highly permissive license which
|
||||
allows content licensed under it to be
|
||||
used in any way, in any medium, with the
|
||||
only restriction being the original
|
||||
copyright notice must be kept in order
|
||||
to attribute the original creator of the
|
||||
licensed content.</p>
|
||||
</section>
|
||||
</section>
|
||||
<section id="licensing-open_source_vs_free_software">
|
||||
<h3><a href="#licensing-open_source_vs_free_software">Do I Distinguish Between Open Source and Free Software?</a></h3>
|
||||
<p>No. If code is not released under an open-source
|
||||
license and places restrictions on how the code may be
|
||||
used, it is either source-available (if viewing the code
|
||||
is permitted) or proprietary. "Free software" only
|
||||
causes confusion and exists to push an ideology by a
|
||||
specific group of people. If software isn't "free", it's
|
||||
not open-source, either.</p>
|
||||
</section>
|
||||
</section>
|
||||
<section id="versioning">
|
||||
<h2><a href="#versioning">Versioning</a></h2>
|
||||
@ -287,11 +418,11 @@
|
||||
<li>User IP addresses used only for security and debugging
|
||||
purposes (purged along with logs)</li>
|
||||
<li>All connections made via
|
||||
<a href="https://wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3">TLS 1.3</a>
|
||||
<a href="https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3">TLS 1.3</a>
|
||||
only to ensure the most secure
|
||||
<a href="https://wikipedia.org/wiki/Authenticated_encryption">AEAD</a>
|
||||
<a href="https://en.wikipedia.org/wiki/Authenticated_encryption">AEAD</a>
|
||||
ciphers are used, along with
|
||||
<a href="https://wikipedia.org/wiki/Forward_secrecy">forward secrecy</a></li>
|
||||
<a href="https://en.wikipedia.org/wiki/Forward_secrecy">forward secrecy</a></li>
|
||||
<li>All connections made via high-security AEAD ciphers,
|
||||
preferring AES-256-GCM for devices with AES
|
||||
hardware acceleration, and ChaCha20-Poly1305 for devices without
|
||||
@ -302,22 +433,22 @@
|
||||
protocols, preferring X25519, with secp256r1 as a fallback
|
||||
(secp256r1 is mandated for TLS 1.3 by IETF RFC8446 section
|
||||
9.1)</li>
|
||||
<li><a href="https://wikipedia.org/wiki/Domain_Name_System_Security_Extensions">Domain Name System Security Extensions (DNSSEC)</a>
|
||||
<li><a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions">Domain Name System Security Extensions (DNSSEC)</a>
|
||||
enabled to provide a root-of-trust for encryption and
|
||||
authentication for domain and server configuration</li>
|
||||
<li><a href="https://wikipedia.org/wiki/DNS_Certification_Authority_Authorization">Certification Authority Authorization (CAA)</a>
|
||||
<li><a href="https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization">Certification Authority Authorization (CAA)</a>
|
||||
records enabled to prevent all certificate authorities other
|
||||
than
|
||||
<a href="https://letsencrypt.org/">Let's Encrypt</a> from
|
||||
issuing TLS certificates for my domains</li>
|
||||
<li><a href="https://wikipedia.org/wiki/SSHFP_record">Secure Shell fingerprint (SSHFP)</a>
|
||||
<li><a href="https://en.wikipedia.org/wiki/SSHFP_record">Secure Shell fingerprint (SSHFP)</a>
|
||||
records enabled to provide a DNS-based root-of-trust for SSH
|
||||
connections to my domains</li>
|
||||
<li>Referrer headers disabled to prevent knowing where a user
|
||||
was redirected from</li>
|
||||
<li>All content sourced from my own domains, with third-party
|
||||
content prohibited via
|
||||
<a href="https://wikipedia.org/wiki/Content_Security_Policy">Content Security Policy</a>
|
||||
<a href="https://en.wikipedia.org/wiki/Content_Security_Policy">Content Security Policy</a>
|
||||
configuration</li>
|
||||
<li>All servers physically under my control (no VPS or other
|
||||
hosting providers)</li>
|
||||
@ -327,10 +458,13 @@
|
||||
</section>
|
||||
<section id="recommendations">
|
||||
<h2><a href="#recommendations">Recommendations</a></h2>
|
||||
<h3 id="recommendations-hardware"><a href="#recommendations-hardware">Hardware</a></h3>
|
||||
<h4 id="recommendations-hardware-smartphone"><a href="#recommendations-hardware-smartphone">Smartphone</a></h4>
|
||||
<section id="recommendations-hardware">
|
||||
<h3><a href="#recommendations-hardware">Hardware</a></h3>
|
||||
<section id="recommendations-hardware-smartphone">
|
||||
<h4><a href="#recommendations-hardware-smartphone">Smartphone</a></h4>
|
||||
<div style="overflow-x:auto;">
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th id="hardware-smartphone-type">Type</th>
|
||||
<th id="hardware-smartphone">Hardware</th>
|
||||
@ -338,6 +472,8 @@
|
||||
<th id="hardware-smartphone-source_model">Source model<br/>
|
||||
(License)</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<th id="hardware-smartphone-smartphone">Smartphone</th>
|
||||
<th id ="google-pixel" headers="hardware hardware-smartphone-smartphone">
|
||||
@ -346,14 +482,16 @@
|
||||
</th>
|
||||
<td class="desc" headers="hardware-description google-pixel">
|
||||
<h5>Security/Privacy</h5>
|
||||
<p>Google Pixel devices are the best Android
|
||||
devices available on the market for
|
||||
<p>Google Pixel devices are the best
|
||||
Android devices available on the market
|
||||
for
|
||||
<a href="https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html">security and privacy</a>.</p>
|
||||
<p>They allow locking the bootloader with a
|
||||
<p>They allow locking the bootloader
|
||||
with a
|
||||
<a href="https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later">custom Android Verified Boot (AVB) key</a>
|
||||
in order to preserve security and privacy
|
||||
features when installing a custom operating
|
||||
system, such as
|
||||
in order to preserve security and
|
||||
privacy features when installing a
|
||||
custom operating system, such as
|
||||
<a href="https://source.android.com/docs/security/features/verifiedboot/">verified boot</a>
|
||||
which verifies that the OS has not been
|
||||
corrupted or tampered with, and
|
||||
@ -367,63 +505,69 @@
|
||||
(Titan M2, improving on the previous
|
||||
generation
|
||||
<a href="https://security.googleblog.com/2018/10/building-titan-better-security-through.html">Titan M</a>)
|
||||
which is extremely resistant to both remote
|
||||
and physical attacks due to being completely
|
||||
isolated from the rest of the system,
|
||||
including the operating system. Titan M2
|
||||
ensures that the device cannot be remotely
|
||||
compromised by requiring the side buttons of
|
||||
the device to be physically pressed for some
|
||||
sensitive operations. Titan M2 also takes
|
||||
the role of
|
||||
which is extremely resistant to both
|
||||
remote and physical attacks due to being
|
||||
completely isolated from the rest of the
|
||||
system, including the operating system.
|
||||
Titan M2 ensures that the device cannot
|
||||
be remotely compromised by requiring the
|
||||
side buttons of the device to be
|
||||
physically pressed for some sensitive
|
||||
operations. Titan M2 also takes the role
|
||||
of
|
||||
<a href="https://source.android.com/docs/security/best-practices/hardware#strongbox-keymaster">Android StrongBox Keymaster</a>,
|
||||
a
|
||||
<a href="https://source.android.com/docs/security/features/keystore">hardware-backed Keystore</a>
|
||||
containing sensitive user keys which are
|
||||
unavailable to the OS or apps running on it
|
||||
without authorisation from Titan M2 itself.
|
||||
unavailable to the OS or apps running on
|
||||
it without authorisation from Titan M2
|
||||
itself.
|
||||
<a href="https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html">Insider attack resistance</a>
|
||||
ensures that Titan M2 firmware can be
|
||||
flashed only if the user PIN/password is
|
||||
already known, making it impossible to
|
||||
backdoor the device without already knowing
|
||||
these secrets.</p>
|
||||
<p>Google Pixel device kernels are compiled
|
||||
with
|
||||
backdoor the device without already
|
||||
knowing these secrets.</p>
|
||||
<p>Google Pixel device kernels are
|
||||
compiled with
|
||||
<a href="https://android-developers.googleblog.com/2018/10/control-flow-integrity-in-android-kernel.html">forward-edge control-flow integrity</a>
|
||||
and
|
||||
<a href="https://security.googleblog.com/2019/10/protecting-against-code-reuse-in-linux_30.html">backward-edge control-flow integrity</a>
|
||||
to prevent code reuse attacks against the
|
||||
kernel. MAC address randomisation is
|
||||
to prevent code reuse attacks against
|
||||
the kernel. MAC address randomisation is
|
||||
<a href="https://android-developers.googleblog.com/2017/04/changes-to-device-identifiers-in.html">implemented well, along with minimal probe requests and randomised initial sequence numbers</a>.</p>
|
||||
<p>Google releases
|
||||
<a href="https://source.android.com/docs/security/bulletin/pixel/">guaranteed monthly security updates</a>,
|
||||
ensuring Google Pixel devices are up-to-date
|
||||
and quickly protected against security
|
||||
vulnerabilities.</p>
|
||||
<p>Pixel 6-series and 7-series devices are a
|
||||
large improvement over the already very
|
||||
secure and private previous generation Pixel
|
||||
devices. They replace ARM-based Titan M with
|
||||
RISC-V-based Titan M2, reducing trust by
|
||||
removing ARM from the equation. Titan M2 is
|
||||
more resiliant to attacks than Titan M, and
|
||||
ensuring Google Pixel devices are
|
||||
up-to-date and quickly protected against
|
||||
security vulnerabilities.</p>
|
||||
<p>Pixel 6-series and 7-series devices
|
||||
are a large improvement over the already
|
||||
very secure and private previous
|
||||
generation Pixel devices. They replace
|
||||
ARM-based Titan M with RISC-V-based
|
||||
Titan M2, reducing trust by removing ARM
|
||||
from the equation. Titan M2 is more
|
||||
resiliant to attacks than Titan M, and
|
||||
is
|
||||
<a href="https://www.tuv-nederland.nl/assets/files/cerfiticaten/2022/09/nscib-cc-22-0228971-cert-final.pdf">AVA_VAN.5 certified</a>,
|
||||
the highest level of vulnerability
|
||||
assessment. Google's in-house Tensor
|
||||
System-on-Chip includes Tensor Security
|
||||
Core, further improving device security.</p>
|
||||
Core, further improving device
|
||||
security.</p>
|
||||
<p>Pixel 8-series includes Armv9's
|
||||
<a href="https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/enhanced-security-through-mte">Memory Tagging Extension</a>,
|
||||
which dramatically increases device security
|
||||
by eliminating up to 95% of all security
|
||||
issues caused by memory-unsafety.</p>
|
||||
which dramatically increases device
|
||||
security by eliminating up to 95% of all
|
||||
security issues caused by
|
||||
memory-unsafety.</p>
|
||||
<h5>Support</h5>
|
||||
<p>Pixel 5a is supported for a
|
||||
<a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-a-g-pixel-pixel-a-g-pixel-a-pixel-xl-pixel">minimum of 3 years from launch</a>.</p>
|
||||
<p>Pixel 6-series, Pixel 7-series, Pixel
|
||||
Fold, and Pixel Tablet are supported for a
|
||||
Fold, and Pixel Tablet are supported for
|
||||
a
|
||||
<a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-a-pixel-pixel-pro-pixel-a-pixel-pixel-pro-pixel-fold">minimum of 5 years from launch</a>.</p>
|
||||
<p>Pixel 8-series is supported for a
|
||||
<a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-pro">minimum of 7 years from launch</a>.</p>
|
||||
@ -431,12 +575,18 @@
|
||||
<td headers="hardware-smartphone-source_model google-pixel">
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<h3 id="recommendations-software"><a href="#recommendations-software">Software</a></h3>
|
||||
<h4 id="recommendations-software-desktop"><a href="#recommendations-software-desktop">Desktop</a></h4>
|
||||
</section>
|
||||
</section>
|
||||
<section id="recommendations-software">
|
||||
<h3><a href="#recommendations-software">Software</a></h3>
|
||||
<section id="recommendations-software-desktop">
|
||||
<h4><a href="#recommendations-software-desktop">Desktop</a></h4>
|
||||
<div style="overflow-x:auto;">
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th id="software-desktop-type">Type</th>
|
||||
<th id="software-desktop">Software</th>
|
||||
@ -444,6 +594,8 @@
|
||||
<th id="software-desktop-source_model">Source model<br/>
|
||||
(License)</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<th id="software-desktop-os">Operating system</th>
|
||||
<th id="gentoo_linux" headers="software-desktop software-desktop-os">
|
||||
@ -453,24 +605,27 @@
|
||||
<td class="desc" headers="software-description gentoo_linux">
|
||||
<p><a href="https://www.gentoo.org/">Gentoo Linux</a>
|
||||
is a highly modular, source-based, Linux-based
|
||||
operating system which allows vast customisation to
|
||||
tailor the operating system to suit your specific
|
||||
needs. There are many advantages to such an
|
||||
operating system, with the most notable being the
|
||||
ability to optimise the software for security,
|
||||
privacy, performance, or power usage; however, there
|
||||
are effectively unlimited other use cases, or a
|
||||
combination of multiple use cases.</p>
|
||||
<p>I have focused on security hardening and privacy
|
||||
hardening, placing performance below those aspects,
|
||||
although my system is still very performant. Some of
|
||||
the hardening I apply includes
|
||||
operating system which allows vast customisation
|
||||
to tailor the operating system to suit your
|
||||
specific needs. There are many advantages to
|
||||
such an operating system, with the most notable
|
||||
being the ability to optimise the software for
|
||||
security, privacy, performance, or power usage;
|
||||
however, there are effectively unlimited other
|
||||
use cases, or a combination of multiple use
|
||||
cases.</p>
|
||||
<p>I have focused on security hardening and
|
||||
privacy hardening, placing performance below
|
||||
those aspects, although my system is still very
|
||||
performant. Some of the hardening I apply
|
||||
includes
|
||||
<a href="https://en.wikipedia.org/wiki/Buffer_overflow_protection">stack protection</a>,
|
||||
<a href="https://en.wikipedia.org/wiki/Integer_overflow">signed integer overflow trapping</a>,
|
||||
and GrapheneOS'
|
||||
<a href="https://github.com/GrapheneOS/hardened_malloc/">hardened_malloc</a>
|
||||
memory allocator.</p>
|
||||
<p>You can find my Gentoo Linux configurations in my
|
||||
<p>You can find my Gentoo Linux configurations
|
||||
in my
|
||||
<a href="https://src.inferencium.net/Inferencium/cfg/">configuration respository</a>.</p>
|
||||
</td>
|
||||
<td headers="software-desktop-source_model gentoo_linux">
|
||||
@ -502,11 +657,15 @@
|
||||
(BSD-3-Clause)
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<h4 id="recommendations-software-smartphone"><a href="#recommendations-software-smartphone">Smartphone</a></h4>
|
||||
</section>
|
||||
<section id="recommendations-software-smartphone">
|
||||
<h4><a href="#recommendations-software-smartphone">Smartphone</a></h4>
|
||||
<div style="overflow-x:auto;">
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th id="software-smartphone-type">Type</th>
|
||||
<th id="software-smartphone">Software</th>
|
||||
@ -514,6 +673,8 @@
|
||||
<th id="software-smartphone-source_model">Source model<br/>
|
||||
(License)</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<th id="software-smartphone-os">Operating system</th>
|
||||
<th id="grapheneos" headers="software-smartphone software-smartphone-os">
|
||||
@ -523,15 +684,15 @@
|
||||
<td class="desc" headers="software-smartphone-description grapheneos">
|
||||
<p><a href="https://grapheneos.org/">GrapheneOS</a>
|
||||
is a security-hardened, privacy-hardened,
|
||||
secure-by-default, Android-based operating system
|
||||
which implements extensive, systemic security and
|
||||
privacy hardening to the Android Open Source Project
|
||||
used as its base codebase. Its hardening includes
|
||||
closing gaps for apps to access sensitive system
|
||||
information, a secure app spawning feature which
|
||||
avoids sharing address space layout and other
|
||||
secrets AOSP's default Zygote app spawning model
|
||||
would share,
|
||||
secure-by-default, Android-based operating
|
||||
system which implements extensive, systemic
|
||||
security and privacy hardening to the Android
|
||||
Open Source Project used as its base codebase.
|
||||
Its hardening includes closing gaps for apps to
|
||||
access sensitive system information, a secure
|
||||
app spawning feature which avoids sharing
|
||||
address space layout and other secrets AOSP's
|
||||
default Zygote app spawning model would share,
|
||||
<a href="https://github.com/GrapheneOS/kernel_gs-gs101/">hardened kernel</a>,
|
||||
hardened memory allocator
|
||||
(<a href="https://github.com/GrapheneOS/hardened_malloc/">hardened_malloc</a>)
|
||||
@ -541,14 +702,14 @@
|
||||
<a href="https://github.com/GrapheneOS/platform_system_sepolicy/">stricter SELinux policies</a>,
|
||||
and local and remote hardware-backed attestation
|
||||
(<a href="https://attestation.app/about/">Auditor</a>)
|
||||
to ensure the OS has not been corrupted or tampered
|
||||
with.</p>
|
||||
to ensure the OS has not been corrupted or
|
||||
tampered with.</p>
|
||||
<p>GrapheneOS only supports
|
||||
<a href="https://grapheneos.org/faq#device-support">high security and well-supported devices</a>
|
||||
which receive full support from their manufacturers,
|
||||
including firmware updates, long support lifecycles,
|
||||
secure hardware, and overall high security
|
||||
practices.</p>
|
||||
which receive full support from their
|
||||
manufacturers, including firmware updates, long
|
||||
support lifecycles, secure hardware, and overall
|
||||
high security practices.</p>
|
||||
<p>For an extensive list of features GrapheneOS
|
||||
provides, visit its
|
||||
<a href="https://grapheneos.org/features/">official features list</a>
|
||||
@ -566,19 +727,21 @@
|
||||
Vanadium
|
||||
</th>
|
||||
<td class="desc" headers="software-smartphone-description vanadium">
|
||||
<p>Vanadium is a security-hardened, privacy-hardened
|
||||
Chromium-based web browser which utilises
|
||||
GrapheneOS' operating system hardening to implement
|
||||
stronger defenses to the already very secure
|
||||
Chromium web browser. Its hardening alongside
|
||||
Chromium's base security features includes
|
||||
<p>Vanadium is a security-hardened,
|
||||
privacy-hardened Chromium-based web browser
|
||||
which utilises GrapheneOS' operating system
|
||||
hardening to implement stronger defenses to the
|
||||
already very secure Chromium web browser. Its
|
||||
hardening alongside Chromium's base security
|
||||
features includes
|
||||
<a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0081-Implement-UI-for-JIT-site-settings.patch">disabling JavaScript just-in-time (JIT) compilation by default</a>,
|
||||
<a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0051-stub-out-the-battery-status-API.patch">stubbing out the battery status API to prevent abuse of it</a>,
|
||||
and
|
||||
<a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0084-Toggle-for-navigating-external-URL-in-incognito.patch">always-on Incognito mode as an option</a>.</p>
|
||||
<p>Vanadium's source code, including its Chromium
|
||||
patch-set, can be found in its
|
||||
<a href="https://github.com/GrapheneOS/Vanadium/">official repository</a>.</p></td>
|
||||
<a href="https://github.com/GrapheneOS/Vanadium/">official repository</a>.</p>
|
||||
</td>
|
||||
<td headers="software-smartphone-source_model vanadium">
|
||||
Open-source<br/>
|
||||
(GPL-2.0-only)
|
||||
@ -594,7 +757,8 @@
|
||||
<p><a href="https://molly.im/">Molly</a>
|
||||
is a security-hardened, privacy-hardened
|
||||
<a href="https://signal.org/">Signal</a>
|
||||
client which hardens Signal by using a variety of
|
||||
client which hardens Signal by using a variety
|
||||
of
|
||||
<a href="https://github.com/mollyim/mollyim-android#features">unique features</a>,
|
||||
allowing
|
||||
<a href="https://github.com/mollyim/mollyim-android/wiki/Data-Encryption-At-Rest">locking the database when not in use</a>,
|
||||
@ -605,12 +769,14 @@
|
||||
<p>Molly is available in
|
||||
<a href="https://github.com/mollyim/mollyim-android#free-and-open-source">2 flavours</a>:
|
||||
<ul>
|
||||
<li>Molly, which includes the same
|
||||
proprietary Google code as Signal to
|
||||
support more features.</li>
|
||||
<li>Molly-FOSS, which removes the
|
||||
proprietary Google code to provide
|
||||
an entirely open-source client.</li>
|
||||
<li>Molly, which includes the
|
||||
same proprietary Google code as
|
||||
Signal to support more
|
||||
features.</li>
|
||||
<li>Molly-FOSS, which removes
|
||||
the proprietary Google code to
|
||||
provide an entirely open-source
|
||||
client.</li>
|
||||
</ul>
|
||||
</p>
|
||||
</td>
|
||||
@ -628,34 +794,43 @@
|
||||
<p><a href="https://conversations.im/">Conversations</a>
|
||||
is a well-designed Android
|
||||
<a href="https://xmpp.org/">XMPP</a>
|
||||
client which serves as the de facto XMPP reference
|
||||
client and has great usability.</p>
|
||||
client which serves as the de facto XMPP
|
||||
reference client and has great usability.</p>
|
||||
</td>
|
||||
<td headers="software-smartphone-source_model conversations">
|
||||
Open-source<br/>
|
||||
(GPL-3.0-only)
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
</section>
|
||||
<section id="recommendations-music">
|
||||
<h3><a href="#recommendations-music">Music</a></h3>
|
||||
<p>For a curated list of music I enjoy, visit my
|
||||
<p>For a curated list of music I enjoy,
|
||||
visit my
|
||||
<a href="music.xhtml">music page</a>.</p>
|
||||
</section>
|
||||
</section>
|
||||
<section id="gnulinux_or_linux">
|
||||
<h2><a href="#gnulinux_or_linux">Is it GNU/Linux or Just Linux?</a></h2>
|
||||
<p>It's just Linux. GNU is unrelated to Linux, which is a kernel developed by
|
||||
Linus Torvalds. Linux can be used entirely without GNU software in userspace,
|
||||
and the kernel can be compiled without the use of GNU tools. Just because GNU
|
||||
tools were used to initally develop and compile the kernel, and were initially
|
||||
the only available tools for userspace, does not make this true today, and it
|
||||
never made GNU a part of Linux itself at any point of time.</p>
|
||||
<p>Where are all of the other forward-slashes for every other piece of software
|
||||
on a Linux-based system which makes it just as usable? If a system is running
|
||||
"GNU/Linux", it should be using more than a single forward-slash when there is
|
||||
more to the system than only GNU.</p>
|
||||
<p>It's just Linux. GNU is unrelated to Linux, which is a
|
||||
kernel developed by
|
||||
<a href="https://en.wikipedia.org/wiki/Linus_Torvalds">Linus Torvalds</a>.
|
||||
Linux can be used entirely without GNU software in
|
||||
userspace, and the kernel can be compiled without the use of
|
||||
GNU tools. Just because GNU tools were used to initally
|
||||
develop and compile the kernel, and were initially the only
|
||||
available tools for userspace, does not make this true
|
||||
today, and it never made GNU a part of Linux itself at any
|
||||
point of time.</p>
|
||||
<p>Where are all of the other forward-slashes for every
|
||||
other piece of software on a Linux-based system which makes
|
||||
it just as usable? If a system is running "GNU/Linux", it
|
||||
should be using more than a single forward-slash when there
|
||||
is more to the system than only GNU.</p>
|
||||
</section>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user