Inferencium/website
1
0
Fork 0
Code Issues Activity

Update webpage "About" from version "8.0.0-beta.1" to "8.1.0-beta.1"

Browse Source
This commit is contained in:
inference 2024-02-10 00:00:08 +00:00
parent 39699d498e
commit 1e3492f409
Signed by: inference
SSH Key Fingerprint: SHA256:FtEVfx1CmTKMy40VwZvF4k+3TC+QhCWy+EmPRg50Nnc
1 changed files with 597 additions and 432 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

559
about.xhtml
View File

@ -1,7 +1,7 @@
<!DOCTYPE html> <!DOCTYPE html>
<!-- Inferencium - Website - About --> <!-- Inferencium - Website - About -->
<!-- Version: 8.0.0-beta.1 --> <!-- Version: 8.1.0-beta.1 -->
<!-- Copyright 2022 Jake Winters --> <!-- Copyright 2022 Jake Winters -->
<!-- SPDX-License-Identifier: BSD-3-Clause --> <!-- SPDX-License-Identifier: BSD-3-Clause -->
@ -27,24 +27,37 @@
<div><a href="directory.xhtml">Directory</a></div> <div><a href="directory.xhtml">Directory</a></div>
<div><a href="key.xhtml">Key</a></div> <div><a href="key.xhtml">Key</a></div>
</nav> </nav>
<h1>About</h1> <h1 id="about"><a href="#about">About</a></h1>
<nav id="toc"> <nav id="toc">
<h2><a href="#toc">Table of Contents</a></h2> <h2><a href="#toc">Table of Contents</a></h2>
<ul> <ul>
<li><a href="#about_me">About Me</a></li> <li><a href="#about_me">About Me</a></li>
<li><a href="#date_time">Date and Time</a></li> <li><a href="#date_time">Date and Time</a></li>
<li><a href="#languages">Languages</a></li>
<ul>
<li><a href="#languages-markup">Markup</a></li>
<ul>
<li><a href="#languages-markup-xhtml">XHTML</a></li>
<li><a href="#languages-markup-asciidoc">AsciiDoc</a></li>
</ul>
<li><a href="#languages-programming">Programming</a></li>
<ul>
<li><a href="#languages-programming-rust">Rust</a></li>
<li><a href="#languages-programming-go">Go</a></li>
</ul>
</ul>
<li><a href="#licensing">Licensing</a></li> <li><a href="#licensing">Licensing</a></li>
<ul> <ul>
<li><a href="#licensing-code">Code</a></li> <li><a href="#licensing-code">Code</a></li>
<ul> <ul>
<li><a href="#licensing-bsd-3-clause">BSD 3-Clause License</a></li> <li><a href="#licensing-code-bsd3clause">BSD 3-Clause License</a></li>
<li><a href="#licensing-gpl-2.0">GNU General Public License v2.0</a></li> <li><a href="#licensing-code-gpl2.0only">GNU General Public License v2.0</a></li>
</ul> </ul>
<li><a href="#licensing-noncode">Non-code</a></li> <li><a href="#licensing-noncode">Non-code</a></li>
<ul> <ul>
<li><a href="#licensing-cc-by-4.0">Creative Commons Attribution 4.0 International</a></li> <li><a href="#licensing-noncode-ccby4.0">Creative Commons Attribution 4.0 International</a></li>
</ul> </ul>
<li><a href="#licensing-open_source_vs_free_software">Do I Distinguish Between Open-source and Free Software?</a></li> <li><a href="#licensing-open_source_vs_free_software">Do I Distinguish Between Open Source and Free Software?</a></li>
</ul> </ul>
<li><a href="#versioning">Versioning</a></li> <li><a href="#versioning">Versioning</a></li>
<ul> <ul>
@ -73,24 +86,30 @@
</nav> </nav>
<section id="about_me"> <section id="about_me">
<h2><a href="#about_me">About Me</a></h2> <h2><a href="#about_me">About Me</a></h2>
<p>I am Jake Winters, also known by my pseudonym "Inference", a security <p>I am Jake Winters, also known by my pseudonym
researcher based in United Kingdom.<br/> "Inference", a security researcher based in United
I am the founder, lead developer, and administrator, of Inferencium.<br/> Kingdom.</p>
All opinions are my own, and are not necessarily shared with projects or people <p>I am the founder, lead developer, and administrator, of
I am affiliated with.</p> Inferencium.</p>
<p>I write about my research and experience in cybersecurity and also physical <p>All opinions are my own, and are not necessarily shared
security. Most of my postings are security-related, but I occasionally post with projects or people I am affiliated with.</p>
about other aspects of my life.</p> <p>I write about my research and experience in cybersecurity
<p>I am an open source advocate for the preservation and modifiability of source and also physical security. Most of my postings are
code. I believe source code should be considered human knowledge as much as past security-related, but I occasionally post about other
knowledge and teachings were; it is how modern humanity survives and runs.<br/> aspects of my life.</p>
Source code being modifiable allows it to be adapted for use by anyone, whether <p>I am an open source advocate for the preservation and
to add features, harden it for increased security and/or privacy, or provide modifiability of source code. I believe source code should
accessibility for disabled users.<br/> be considered human knowledge as much as past knowledge and
I am also a modular design advocate for the ability to securely and robustly teachings were; it is how modern humanity survives and runs.
make changes to hardware and software without the entire system being Source code being modifiable allows it to be adapted for use
affected.</p> by anyone, whether to add features, harden it for increased
<p>I run multiple XMPP channels; a directory of channels can be found on the security and/or privacy, or provide accessibility for
disabled users.</p>
<p>I am also a modular design advocate for the ability to
securely and robustly make changes to hardware and software
without the entire system being affected.</p>
<p>I run multiple XMPP channels; a directory of channels can
be found on the
<a href="https://inferencium.net/directory.xhtml">directory</a> <a href="https://inferencium.net/directory.xhtml">directory</a>
webpage.</p> webpage.</p>
<p>If you wish to contact me for any reason, you can use my <p>If you wish to contact me for any reason, you can use my
@ -99,90 +118,192 @@
<section id="date_time"> <section id="date_time">
<h2><a href="#date_time">Date and Time</a></h2> <h2><a href="#date_time">Date and Time</a></h2>
<p>All dates and times across my services are <p>All dates and times across my services are
<a href="https://wikipedia.org/wiki/ISO_8601">ISO 8601</a>-compliant. The <a href="https://en.wikipedia.org/wiki/ISO_8601">ISO 8601</a>-compliant.
short-form format <code>YYYY-MM-DD</code> is used for dates, and The short-form format <code>YYYY-MM-DD</code> is used for
<code>hh:mm:ss</code> is used for times, with display of seconds being based on dates, and <code>hh:mm:ss</code> is used for times, with
required level of accuracy. The full expression may be used when necessary; display of seconds being based on required level of
accuracy. The full expression may be used when necessary;
<code>YYYYMMDDThhmmssZ</code> (UTC without offset), <code>YYYYMMDDThhmmssZ</code> (UTC without offset),
<code>YYYYMMDDThhmmss+hhmm</code> (with positive offset), or <code>YYYYMMDDThhmmss+hhmm</code> (with positive offset), or
<code>YYYYMMDDThhmmss-hhmm</code> (with negative offset).</p> <code>YYYYMMDDThhmmss-hhmm</code> (with negative
offset).</p>
</section>
<section id="languages">
<h2><a href="#languages">Languages</a></h2>
<section id="languages-markup">
<h3><a href="#languages-markup">Markup</a></h3>
<p>The following markup languages are used in my code, with
rationale provided for the usage of each language.</p>
<section id="languages-markup-xhtml">
<h4><a href="#languages-markup-xhtml">XHTML</a></h4>
<p>XHTML is preferred for most content
due to its HTML-based design and syntax,
with advantages over HTML, including
strict parsing checks which assist with
achieving code-correctness, and being
XML-compliant to allow widespread usage
even outside of the intended HTML-based
use case.</p>
<p>HTML has multiple flaws, including
allowing broken code to be loaded in the
user's web browser, not informing the
developer of broken code or mismatching
tags, and using non-standard, highly
permissive syntax which is
non-portable. XHTML mitigates or
completely fixes these issues via
its XML namespace.</p>
</section>
<section id="languages-markup-asciidoc">
<h4><a href="#languages-markup-asciidoc">AsciiDoc</a></h4>
<p>AsciiDoc is used when portability is
a concern, as it allows easy conversion
to other file formats, including HTML
and PDF. AsciiDoc can also be read
as-is, due to it having clean markup and
high readability when viewed as
plaintext.</p>
</section>
</section>
<section id="languages-programming">
<h3><a href="#languages-programming">Programming</a></h3>
<p>The following programming languages are used in my code, with
rationale provided for the usage of each language.</p>
<section id="languages-programming-rust">
<h4><a href="#languages-programming-rust">Rust</a></h4>
<p>Rust is a partially object-oriented
programming language with a focus on
security and performance. It has strict
compile-time checks to verify the
memory-safety and thread-safety of code,
is memory-efficient, has no garbage
collection, is highly portable, has
great support for integration with other
languages, and is well-suited for both
high-level and low-level code.</p>
<p>Rust is the modern replacement for
C++.</p>
</section>
<section id="languages-programming-go">
<h4><a href="#languages-programming-go">Go</a></h4>
<p>Go is a functional programming
language with a focus on performance. It
is easy to use, has garbage collection,
allows clean codebases, and is suitable
for high-level code.</p>
<p>Go is the modern replacement for
C.</p>
</section>
</section>
</section> </section>
<section id="licensing"> <section id="licensing">
<h2><a href="#licensing">Licensing</a></h2> <h2><a href="#licensing">Licensing</a></h2>
<p>I care about upstreaming and sharing code, strongly preferring licenses which <p>I care about upstreaming and sharing code, strongly
have high license compatibility in order to permit sharing code with as many preferring licenses which have high license compatibility in
other projects as possible; for this reason, permissive licenses are my order to permit sharing code with as many other projects as
preferred choice, while avoiding copyleft licenses and other licenses which possible; for this reason, permissive licenses are my
place restrictions on how my code may be used, and prevent me from including preferred choice, while avoiding copyleft licenses and other
important proprietary code, such as firmware, which can patch security licenses which place restrictions on how my code may be
used, and prevent me from including important proprietary
code, such as firmware, which can patch security
vulnerabilities, privacy issues, and stability issues.</p> vulnerabilities, privacy issues, and stability issues.</p>
<p>All of my code is and will be permissively licensed unless specific <p>All of my code is and will be permissively licensed
circumstances make it impractical or infeasible to do so. My goal is to share unless specific circumstances make it impractical or
code which has the least amount of restrictions as possible, to allow wider infeasible to do so. My goal is to share code which has the
propagation of my code and allow more use cases and possibilities, as well as least amount of restrictions as possible, to allow wider
ensuring proprietary code, whenever required, is permitted to be included and/or propagation of my code and allow more use cases and
linked to.</p> possibilities, as well as ensuring proprietary code,
whenever required, is permitted to be included and/or linked
to.</p>
<p><a href="https://iso.org/standard/81870.html">ISO 5962:2021</a> <p><a href="https://iso.org/standard/81870.html">ISO 5962:2021</a>
is used for licensing, in the format is used for licensing, in the format
<code>SPDX-License-Identifier: &lt;license&gt;</code>; see the <code>SPDX-License-Identifier: <var>&lt;license&gt;</var></code>;
see the
<a href="https://spdx.org/licenses/">SPDX License List</a> <a href="https://spdx.org/licenses/">SPDX License List</a>
for the full list of available licenses under this standard.</p> for the full list of available licenses under this
<p>My preferred licenses and rationale for using them are below; any licenses standard.</p>
not listed are chosen on a case-by-case basis.</p> <p>My preferred licenses and rationale for using them are
<h3 id="licensing-code"><a href="#licensing-code">Code</a></h3> below; any licenses not listed are chosen on a case-by-case
<h4 id="licensing-bsd-3-clause"><a href="#licensing-bsd-3-clause">BSD 3-Clause License</a></h4> basis.</p>
<code>SPDX-License-Identifier: BSD-3-Clause</code> <section id="licensing-code">
<h3><a href="#licensing-code">Code</a></h3>
<section id="licensing-code-bsd3clause">
<h4><a href="#licensing-code-bsd3clause">BSD 3-Clause License</a></h4>
<p><b>SPDX License Identifier:</b> <code>BSD-3-Clause</code></p>
<p><b>Type: Permissive</b></p> <p><b>Type: Permissive</b></p>
<p><a href="https://spdx.org/licenses/BSD-3-Clause.html">BSD 3-Clause License</a> <p><a href="https://spdx.org/licenses/BSD-3-Clause.html">BSD 3-Clause License</a>
is a highly permissive license which allows content is a highly permissive license which
licensed under it to be used in any way, whether in allows content licensed under it to be
source or binary form, and allows sublicensing under a used in any way, whether in source or
different license, with the only restrictions being the binary form, and allows sublicensing
original copyright notice must be kept in order to under a different license, with the only
attribute the original creator of the licensed content, restrictions being the original
and the name of the project and/or its contributors may copyright notice must be kept in order
not be used to endorse or promote products derived from to attribute the original creator of the
the original project.</p> licensed content, and the name of the
<h4 id="licensing-gpl-2.0"><a href="#licensing-gpl-2.0">GNU General Public License v2.0</a></h4> project and/or its contributors may not
<code>SPDX-License-Identifier: GPL-2.0-only</code> be used to endorse or promote products
derived from the original project.</p>
</section>
<section id="licensing-code-gpl2.0only">
<h4><a href="#licensing-code-gpl2.0only">GNU General Public License v2.0</a></h4>
<p><b>SPDX License Identifier:</b> <code>GPL-2.0-only</code></p>
<p><b>Type: Copyleft</b></p> <p><b>Type: Copyleft</b></p>
<p><a href="https://spdx.org/licenses/GPL-2.0-only.html">GNU General Public License v2.0</a> <p><a href="https://spdx.org/licenses/GPL-2.0-only.html">GNU General Public License v2.0</a>
is a strong copyleft license which restricts use of is a strong copyleft license which
content licensed under it by requiring all source code restricts use of content licensed under
of the content to be publicly available, making it by requiring all source code of the
binary-only form and inclusion of proprietary code content to be publicly available, making
impossible, requiring all derivatives to be licensed binary-only form and inclusion of
under the same license (allowing sublicensing under only proprietary code impossible, requiring
newer GPL licenses if <code>GPL-2.0-or-later</code> is all derivatives to be licensed under the
specified in the SPDX license identifier), and requiring same license (allowing sublicensing
the original copyright notice to be kept in order to under only newer GPL licenses if
attribute the original creator of the licensed <code>GPL-2.0-or-later</code> is
content.</p> specified in the SPDX License
<p>Due to the restrictive and invasive nature of this Identifier), and requiring the original
license, it is avoided unless such restrictions would be copyright notice to be kept in order to
beneficial to my code; whenever this is the case, the attribute the original creator of the
GNU General Public License v2.0 will be used, rather licensed content.</p>
than the more restrictive <p>Due to the restrictive and invasive
nature of this license, it is avoided
unless such restrictions would be
beneficial to my code; whenever this is
the case, the GNU General Public License
v2.0 will be used, rather than the more
restrictive
<a href="https://spdx.org/licenses/GPL-3.0-only.html">GNU General Public License v3.0</a>, <a href="https://spdx.org/licenses/GPL-3.0-only.html">GNU General Public License v3.0</a>,
and relicensing derivatives under the GNU General Public and relicensing derivatives under the
License v3.0 will be disallowed.</p> GNU General Public License v3.0 will be
<h3 id="licensing-noncode"><a href="#licensing-noncode">Non-code</a></h3> disallowed.</p>
<h4 id="licensing-cc-by-4.0"><a href="#licensing-cc-by-4.0">Creative Commons Attribution 4.0 International</a></h4> </section>
<code>SPDX-License-Identifier: CC-BY-4.0</code> </section>
<section id="licensing-noncode">
<h3><a href="#licensing-noncode">Non-code</a></h3>
<section id="licensing-noncode-ccby4.0">
<h4><a href="#licensing-noncode-ccby4.0">Creative Commons Attribution 4.0 International</a></h4>
<p><b>SPDX License Identifier:</b> <code>CC-BY-4.0</code></p>
<p><b>Type: Permissive</b></p> <p><b>Type: Permissive</b></p>
<p><a href="https://spdx.org/licenses/CC-BY-4.0.html">Creative Commons Attribution 4.0 International</a> <p><a href="https://spdx.org/licenses/CC-BY-4.0.html">Creative Commons Attribution 4.0 International</a>
is a highly permissive license which allows content is a highly permissive license which
licensed under it to be used in any way, in any medium, allows content licensed under it to be
with the only restriction being the original copyright used in any way, in any medium, with the
notice must be kept in order to attribute the original only restriction being the original
creator of the licensed content.</p> copyright notice must be kept in order
<h3 id="licensing-open_source_vs_free_software"><a href="#licensing-open_source_vs_free_software">Do I Distinguish Between Open-source and Free Software?</a></h3> to attribute the original creator of the
<p>No. If code is not released under an open-source license and licensed content.</p>
places restrictions on how the code may be used, it is either </section>
source-available (if viewing the code is permitted) or </section>
proprietary. "Free software" only causes confusion and exists to <section id="licensing-open_source_vs_free_software">
push an ideology by a specific group of people. If software <h3><a href="#licensing-open_source_vs_free_software">Do I Distinguish Between Open Source and Free Software?</a></h3>
isn't "free", it's not open-source, either.</p> <p>No. If code is not released under an open-source
license and places restrictions on how the code may be
used, it is either source-available (if viewing the code
is permitted) or proprietary. "Free software" only
causes confusion and exists to push an ideology by a
specific group of people. If software isn't "free", it's
not open-source, either.</p>
</section>
</section> </section>
<section id="versioning"> <section id="versioning">
<h2><a href="#versioning">Versioning</a></h2> <h2><a href="#versioning">Versioning</a></h2>
@ -287,11 +408,11 @@
<li>User IP addresses used only for security and debugging <li>User IP addresses used only for security and debugging
purposes (purged along with logs)</li> purposes (purged along with logs)</li>
<li>All connections made via <li>All connections made via
<a href="https://wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3">TLS 1.3</a> <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.3">TLS 1.3</a>
only to ensure the most secure only to ensure the most secure
<a href="https://wikipedia.org/wiki/Authenticated_encryption">AEAD</a> <a href="https://en.wikipedia.org/wiki/Authenticated_encryption">AEAD</a>
ciphers are used, along with ciphers are used, along with
<a href="https://wikipedia.org/wiki/Forward_secrecy">forward secrecy</a></li> <a href="https://en.wikipedia.org/wiki/Forward_secrecy">forward secrecy</a></li>
<li>All connections made via high-security AEAD ciphers, <li>All connections made via high-security AEAD ciphers,
preferring AES-256-GCM for devices with AES preferring AES-256-GCM for devices with AES
hardware acceleration, and ChaCha20-Poly1305 for devices without hardware acceleration, and ChaCha20-Poly1305 for devices without
@ -302,22 +423,22 @@
protocols, preferring X25519, with secp256r1 as a fallback protocols, preferring X25519, with secp256r1 as a fallback
(secp256r1 is mandated for TLS 1.3 by IETF RFC8446 section (secp256r1 is mandated for TLS 1.3 by IETF RFC8446 section
9.1)</li> 9.1)</li>
<li><a href="https://wikipedia.org/wiki/Domain_Name_System_Security_Extensions">Domain Name System Security Extensions (DNSSEC)</a> <li><a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions">Domain Name System Security Extensions (DNSSEC)</a>
enabled to provide a root-of-trust for encryption and enabled to provide a root-of-trust for encryption and
authentication for domain and server configuration</li> authentication for domain and server configuration</li>
<li><a href="https://wikipedia.org/wiki/DNS_Certification_Authority_Authorization">Certification Authority Authorization (CAA)</a> <li><a href="https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization">Certification Authority Authorization (CAA)</a>
records enabled to prevent all certificate authorities other records enabled to prevent all certificate authorities other
than than
<a href="https://letsencrypt.org/">Let's Encrypt</a> from <a href="https://letsencrypt.org/">Let's Encrypt</a> from
issuing TLS certificates for my domains</li> issuing TLS certificates for my domains</li>
<li><a href="https://wikipedia.org/wiki/SSHFP_record">Secure Shell fingerprint (SSHFP)</a> <li><a href="https://en.wikipedia.org/wiki/SSHFP_record">Secure Shell fingerprint (SSHFP)</a>
records enabled to provide a DNS-based root-of-trust for SSH records enabled to provide a DNS-based root-of-trust for SSH
connections to my domains</li> connections to my domains</li>
<li>Referrer headers disabled to prevent knowing where a user <li>Referrer headers disabled to prevent knowing where a user
was redirected from</li> was redirected from</li>
<li>All content sourced from my own domains, with third-party <li>All content sourced from my own domains, with third-party
content prohibited via content prohibited via
<a href="https://wikipedia.org/wiki/Content_Security_Policy">Content Security Policy</a> <a href="https://en.wikipedia.org/wiki/Content_Security_Policy">Content Security Policy</a>
configuration</li> configuration</li>
<li>All servers physically under my control (no VPS or other <li>All servers physically under my control (no VPS or other
hosting providers)</li> hosting providers)</li>
@ -327,10 +448,13 @@
</section> </section>
<section id="recommendations"> <section id="recommendations">
<h2><a href="#recommendations">Recommendations</a></h2> <h2><a href="#recommendations">Recommendations</a></h2>
<h3 id="recommendations-hardware"><a href="#recommendations-hardware">Hardware</a></h3> <section id="recommendations-hardware">
<h4 id="recommendations-hardware-smartphone"><a href="#recommendations-hardware-smartphone">Smartphone</a></h4> <h3><a href="#recommendations-hardware">Hardware</a></h3>
<section id="recommendations-hardware-smartphone">
<h4><a href="#recommendations-hardware-smartphone">Smartphone</a></h4>
<div style="overflow-x:auto;"> <div style="overflow-x:auto;">
<table> <table>
<thead>
<tr> <tr>
<th id="hardware-smartphone-type">Type</th> <th id="hardware-smartphone-type">Type</th>
<th id="hardware-smartphone">Hardware</th> <th id="hardware-smartphone">Hardware</th>
@ -338,6 +462,8 @@
<th id="hardware-smartphone-source_model">Source model<br/> <th id="hardware-smartphone-source_model">Source model<br/>
(License)</th> (License)</th>
</tr> </tr>
</thead>
<tbody>
<tr> <tr>
<th id="hardware-smartphone-smartphone">Smartphone</th> <th id="hardware-smartphone-smartphone">Smartphone</th>
<th id ="google-pixel" headers="hardware hardware-smartphone-smartphone"> <th id ="google-pixel" headers="hardware hardware-smartphone-smartphone">
@ -346,14 +472,16 @@
</th> </th>
<td class="desc" headers="hardware-description google-pixel"> <td class="desc" headers="hardware-description google-pixel">
<h5>Security/Privacy</h5> <h5>Security/Privacy</h5>
<p>Google Pixel devices are the best Android <p>Google Pixel devices are the best
devices available on the market for Android devices available on the market
for
<a href="https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html">security and privacy</a>.</p> <a href="https://security.googleblog.com/2021/10/pixel-6-setting-new-standard-for-mobile.html">security and privacy</a>.</p>
<p>They allow locking the bootloader with a <p>They allow locking the bootloader
with a
<a href="https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later">custom Android Verified Boot (AVB) key</a> <a href="https://android.googlesource.com/platform/external/avb/+/master/README.md#pixel-2-and-later">custom Android Verified Boot (AVB) key</a>
in order to preserve security and privacy in order to preserve security and
features when installing a custom operating privacy features when installing a
system, such as custom operating system, such as
<a href="https://source.android.com/docs/security/features/verifiedboot/">verified boot</a> <a href="https://source.android.com/docs/security/features/verifiedboot/">verified boot</a>
which verifies that the OS has not been which verifies that the OS has not been
corrupted or tampered with, and corrupted or tampered with, and
@ -367,63 +495,69 @@
(Titan M2, improving on the previous (Titan M2, improving on the previous
generation generation
<a href="https://security.googleblog.com/2018/10/building-titan-better-security-through.html">Titan M</a>) <a href="https://security.googleblog.com/2018/10/building-titan-better-security-through.html">Titan M</a>)
which is extremely resistant to both remote which is extremely resistant to both
and physical attacks due to being completely remote and physical attacks due to being
isolated from the rest of the system, completely isolated from the rest of the
including the operating system. Titan M2 system, including the operating system.
ensures that the device cannot be remotely Titan M2 ensures that the device cannot
compromised by requiring the side buttons of be remotely compromised by requiring the
the device to be physically pressed for some side buttons of the device to be
sensitive operations. Titan M2 also takes physically pressed for some sensitive
the role of operations. Titan M2 also takes the role
of
<a href="https://source.android.com/docs/security/best-practices/hardware#strongbox-keymaster">Android StrongBox Keymaster</a>, <a href="https://source.android.com/docs/security/best-practices/hardware#strongbox-keymaster">Android StrongBox Keymaster</a>,
a a
<a href="https://source.android.com/docs/security/features/keystore">hardware-backed Keystore</a> <a href="https://source.android.com/docs/security/features/keystore">hardware-backed Keystore</a>
containing sensitive user keys which are containing sensitive user keys which are
unavailable to the OS or apps running on it unavailable to the OS or apps running on
without authorisation from Titan M2 itself. it without authorisation from Titan M2
itself.
<a href="https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html">Insider attack resistance</a> <a href="https://android-developers.googleblog.com/2018/05/insider-attack-resistance.html">Insider attack resistance</a>
ensures that Titan M2 firmware can be ensures that Titan M2 firmware can be
flashed only if the user PIN/password is flashed only if the user PIN/password is
already known, making it impossible to already known, making it impossible to
backdoor the device without already knowing backdoor the device without already
these secrets.</p> knowing these secrets.</p>
<p>Google Pixel device kernels are compiled <p>Google Pixel device kernels are
with compiled with
<a href="https://android-developers.googleblog.com/2018/10/control-flow-integrity-in-android-kernel.html">forward-edge control-flow integrity</a> <a href="https://android-developers.googleblog.com/2018/10/control-flow-integrity-in-android-kernel.html">forward-edge control-flow integrity</a>
and and
<a href="https://security.googleblog.com/2019/10/protecting-against-code-reuse-in-linux_30.html">backward-edge control-flow integrity</a> <a href="https://security.googleblog.com/2019/10/protecting-against-code-reuse-in-linux_30.html">backward-edge control-flow integrity</a>
to prevent code reuse attacks against the to prevent code reuse attacks against
kernel. MAC address randomisation is the kernel. MAC address randomisation is
<a href="https://android-developers.googleblog.com/2017/04/changes-to-device-identifiers-in.html">implemented well, along with minimal probe requests and randomised initial sequence numbers</a>.</p> <a href="https://android-developers.googleblog.com/2017/04/changes-to-device-identifiers-in.html">implemented well, along with minimal probe requests and randomised initial sequence numbers</a>.</p>
<p>Google releases <p>Google releases
<a href="https://source.android.com/docs/security/bulletin/pixel/">guaranteed monthly security updates</a>, <a href="https://source.android.com/docs/security/bulletin/pixel/">guaranteed monthly security updates</a>,
ensuring Google Pixel devices are up-to-date ensuring Google Pixel devices are
and quickly protected against security up-to-date and quickly protected against
vulnerabilities.</p> security vulnerabilities.</p>
<p>Pixel 6-series and 7-series devices are a <p>Pixel 6-series and 7-series devices
large improvement over the already very are a large improvement over the already
secure and private previous generation Pixel very secure and private previous
devices. They replace ARM-based Titan M with generation Pixel devices. They replace
RISC-V-based Titan M2, reducing trust by ARM-based Titan M with RISC-V-based
removing ARM from the equation. Titan M2 is Titan M2, reducing trust by removing ARM
more resiliant to attacks than Titan M, and from the equation. Titan M2 is more
resiliant to attacks than Titan M, and
is is
<a href="https://www.tuv-nederland.nl/assets/files/cerfiticaten/2022/09/nscib-cc-22-0228971-cert-final.pdf">AVA_VAN.5 certified</a>, <a href="https://www.tuv-nederland.nl/assets/files/cerfiticaten/2022/09/nscib-cc-22-0228971-cert-final.pdf">AVA_VAN.5 certified</a>,
the highest level of vulnerability the highest level of vulnerability
assessment. Google's in-house Tensor assessment. Google's in-house Tensor
System-on-Chip includes Tensor Security System-on-Chip includes Tensor Security
Core, further improving device security.</p> Core, further improving device
security.</p>
<p>Pixel 8-series includes Armv9's <p>Pixel 8-series includes Armv9's
<a href="https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/enhanced-security-through-mte">Memory Tagging Extension</a>, <a href="https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/enhanced-security-through-mte">Memory Tagging Extension</a>,
which dramatically increases device security which dramatically increases device
by eliminating up to 95% of all security security by eliminating up to 95% of all
issues caused by memory-unsafety.</p> security issues caused by
memory-unsafety.</p>
<h5>Support</h5> <h5>Support</h5>
<p>Pixel 5a is supported for a <p>Pixel 5a is supported for a
<a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-a-g-pixel-pixel-a-g-pixel-a-pixel-xl-pixel">minimum of 3 years from launch</a>.</p> <a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-a-g-pixel-pixel-a-g-pixel-a-pixel-xl-pixel">minimum of 3 years from launch</a>.</p>
<p>Pixel 6-series, Pixel 7-series, Pixel <p>Pixel 6-series, Pixel 7-series, Pixel
Fold, and Pixel Tablet are supported for a Fold, and Pixel Tablet are supported for
a
<a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-a-pixel-pixel-pro-pixel-a-pixel-pixel-pro-pixel-fold">minimum of 5 years from launch</a>.</p> <a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-a-pixel-pixel-pro-pixel-a-pixel-pixel-pro-pixel-fold">minimum of 5 years from launch</a>.</p>
<p>Pixel 8-series is supported for a <p>Pixel 8-series is supported for a
<a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-pro">minimum of 7 years from launch</a>.</p> <a href="https://support.google.com/nexus/answer/4457705#zippy=%2Cpixel-pro">minimum of 7 years from launch</a>.</p>
@ -431,12 +565,18 @@
<td headers="hardware-smartphone-source_model google-pixel"> <td headers="hardware-smartphone-source_model google-pixel">
</td> </td>
</tr> </tr>
</tbody>
</table> </table>
</div> </div>
<h3 id="recommendations-software"><a href="#recommendations-software">Software</a></h3> </section>
<h4 id="recommendations-software-desktop"><a href="#recommendations-software-desktop">Desktop</a></h4> </section>
<section id="recommendations-software">
<h3><a href="#recommendations-software">Software</a></h3>
<section id="recommendations-software-desktop">
<h4><a href="#recommendations-software-desktop">Desktop</a></h4>
<div style="overflow-x:auto;"> <div style="overflow-x:auto;">
<table> <table>
<thead>
<tr> <tr>
<th id="software-desktop-type">Type</th> <th id="software-desktop-type">Type</th>
<th id="software-desktop">Software</th> <th id="software-desktop">Software</th>
@ -444,6 +584,8 @@
<th id="software-desktop-source_model">Source model<br/> <th id="software-desktop-source_model">Source model<br/>
(License)</th> (License)</th>
</tr> </tr>
</thead>
<tbody>
<tr> <tr>
<th id="software-desktop-os">Operating system</th> <th id="software-desktop-os">Operating system</th>
<th id="gentoo_linux" headers="software-desktop software-desktop-os"> <th id="gentoo_linux" headers="software-desktop software-desktop-os">
@ -453,24 +595,27 @@
<td class="desc" headers="software-description gentoo_linux"> <td class="desc" headers="software-description gentoo_linux">
<p><a href="https://www.gentoo.org/">Gentoo Linux</a> <p><a href="https://www.gentoo.org/">Gentoo Linux</a>
is a highly modular, source-based, Linux-based is a highly modular, source-based, Linux-based
operating system which allows vast customisation to operating system which allows vast customisation
tailor the operating system to suit your specific to tailor the operating system to suit your
needs. There are many advantages to such an specific needs. There are many advantages to
operating system, with the most notable being the such an operating system, with the most notable
ability to optimise the software for security, being the ability to optimise the software for
privacy, performance, or power usage; however, there security, privacy, performance, or power usage;
are effectively unlimited other use cases, or a however, there are effectively unlimited other
combination of multiple use cases.</p> use cases, or a combination of multiple use
<p>I have focused on security hardening and privacy cases.</p>
hardening, placing performance below those aspects, <p>I have focused on security hardening and
although my system is still very performant. Some of privacy hardening, placing performance below
the hardening I apply includes those aspects, although my system is still very
performant. Some of the hardening I apply
includes
<a href="https://en.wikipedia.org/wiki/Buffer_overflow_protection">stack protection</a>, <a href="https://en.wikipedia.org/wiki/Buffer_overflow_protection">stack protection</a>,
<a href="https://en.wikipedia.org/wiki/Integer_overflow">signed integer overflow trapping</a>, <a href="https://en.wikipedia.org/wiki/Integer_overflow">signed integer overflow trapping</a>,
and GrapheneOS' and GrapheneOS'
<a href="https://github.com/GrapheneOS/hardened_malloc/">hardened_malloc</a> <a href="https://github.com/GrapheneOS/hardened_malloc/">hardened_malloc</a>
memory allocator.</p> memory allocator.</p>
<p>You can find my Gentoo Linux configurations in my <p>You can find my Gentoo Linux configurations
in my
<a href="https://src.inferencium.net/Inferencium/cfg/">configuration respository</a>.</p> <a href="https://src.inferencium.net/Inferencium/cfg/">configuration respository</a>.</p>
</td> </td>
<td headers="software-desktop-source_model gentoo_linux"> <td headers="software-desktop-source_model gentoo_linux">
@ -502,11 +647,15 @@
(BSD-3-Clause) (BSD-3-Clause)
</td> </td>
</tr> </tr>
</tbody>
</table> </table>
</div> </div>
<h4 id="recommendations-software-smartphone"><a href="#recommendations-software-smartphone">Smartphone</a></h4> </section>
<section id="recommendations-software-smartphone">
<h4><a href="#recommendations-software-smartphone">Smartphone</a></h4>
<div style="overflow-x:auto;"> <div style="overflow-x:auto;">
<table> <table>
<thead>
<tr> <tr>
<th id="software-smartphone-type">Type</th> <th id="software-smartphone-type">Type</th>
<th id="software-smartphone">Software</th> <th id="software-smartphone">Software</th>
@ -514,6 +663,8 @@
<th id="software-smartphone-source_model">Source model<br/> <th id="software-smartphone-source_model">Source model<br/>
(License)</th> (License)</th>
</tr> </tr>
</thead>
<tbody>
<tr> <tr>
<th id="software-smartphone-os">Operating system</th> <th id="software-smartphone-os">Operating system</th>
<th id="grapheneos" headers="software-smartphone software-smartphone-os"> <th id="grapheneos" headers="software-smartphone software-smartphone-os">
@ -523,15 +674,15 @@
<td class="desc" headers="software-smartphone-description grapheneos"> <td class="desc" headers="software-smartphone-description grapheneos">
<p><a href="https://grapheneos.org/">GrapheneOS</a> <p><a href="https://grapheneos.org/">GrapheneOS</a>
is a security-hardened, privacy-hardened, is a security-hardened, privacy-hardened,
secure-by-default, Android-based operating system secure-by-default, Android-based operating
which implements extensive, systemic security and system which implements extensive, systemic
privacy hardening to the Android Open Source Project security and privacy hardening to the Android
used as its base codebase. Its hardening includes Open Source Project used as its base codebase.
closing gaps for apps to access sensitive system Its hardening includes closing gaps for apps to
information, a secure app spawning feature which access sensitive system information, a secure
avoids sharing address space layout and other app spawning feature which avoids sharing
secrets AOSP's default Zygote app spawning model address space layout and other secrets AOSP's
would share, default Zygote app spawning model would share,
<a href="https://github.com/GrapheneOS/kernel_gs-gs101/">hardened kernel</a>, <a href="https://github.com/GrapheneOS/kernel_gs-gs101/">hardened kernel</a>,
hardened memory allocator hardened memory allocator
(<a href="https://github.com/GrapheneOS/hardened_malloc/">hardened_malloc</a>) (<a href="https://github.com/GrapheneOS/hardened_malloc/">hardened_malloc</a>)
@ -541,14 +692,14 @@
<a href="https://github.com/GrapheneOS/platform_system_sepolicy/">stricter SELinux policies</a>, <a href="https://github.com/GrapheneOS/platform_system_sepolicy/">stricter SELinux policies</a>,
and local and remote hardware-backed attestation and local and remote hardware-backed attestation
(<a href="https://attestation.app/about/">Auditor</a>) (<a href="https://attestation.app/about/">Auditor</a>)
to ensure the OS has not been corrupted or tampered to ensure the OS has not been corrupted or
with.</p> tampered with.</p>
<p>GrapheneOS only supports <p>GrapheneOS only supports
<a href="https://grapheneos.org/faq#device-support">high security and well-supported devices</a> <a href="https://grapheneos.org/faq#device-support">high security and well-supported devices</a>
which receive full support from their manufacturers, which receive full support from their
including firmware updates, long support lifecycles, manufacturers, including firmware updates, long
secure hardware, and overall high security support lifecycles, secure hardware, and overall
practices.</p> high security practices.</p>
<p>For an extensive list of features GrapheneOS <p>For an extensive list of features GrapheneOS
provides, visit its provides, visit its
<a href="https://grapheneos.org/features/">official features list</a> <a href="https://grapheneos.org/features/">official features list</a>
@ -566,19 +717,21 @@
Vanadium Vanadium
</th> </th>
<td class="desc" headers="software-smartphone-description vanadium"> <td class="desc" headers="software-smartphone-description vanadium">
<p>Vanadium is a security-hardened, privacy-hardened <p>Vanadium is a security-hardened,
Chromium-based web browser which utilises privacy-hardened Chromium-based web browser
GrapheneOS' operating system hardening to implement which utilises GrapheneOS' operating system
stronger defenses to the already very secure hardening to implement stronger defenses to the
Chromium web browser. Its hardening alongside already very secure Chromium web browser. Its
Chromium's base security features includes hardening alongside Chromium's base security
features includes
<a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0081-Implement-UI-for-JIT-site-settings.patch">disabling JavaScript just-in-time (JIT) compilation by default</a>, <a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0081-Implement-UI-for-JIT-site-settings.patch">disabling JavaScript just-in-time (JIT) compilation by default</a>,
<a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0051-stub-out-the-battery-status-API.patch">stubbing out the battery status API to prevent abuse of it</a>, <a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0051-stub-out-the-battery-status-API.patch">stubbing out the battery status API to prevent abuse of it</a>,
and and
<a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0084-Toggle-for-navigating-external-URL-in-incognito.patch">always-on Incognito mode as an option</a>.</p> <a href="https://github.com/GrapheneOS/Vanadium/blob/13/patches/0084-Toggle-for-navigating-external-URL-in-incognito.patch">always-on Incognito mode as an option</a>.</p>
<p>Vanadium's source code, including its Chromium <p>Vanadium's source code, including its Chromium
patch-set, can be found in its patch-set, can be found in its
<a href="https://github.com/GrapheneOS/Vanadium/">official repository</a>.</p></td> <a href="https://github.com/GrapheneOS/Vanadium/">official repository</a>.</p>
</td>
<td headers="software-smartphone-source_model vanadium"> <td headers="software-smartphone-source_model vanadium">
Open-source<br/> Open-source<br/>
(GPL-2.0-only) (GPL-2.0-only)
@ -594,7 +747,8 @@
<p><a href="https://molly.im/">Molly</a> <p><a href="https://molly.im/">Molly</a>
is a security-hardened, privacy-hardened is a security-hardened, privacy-hardened
<a href="https://signal.org/">Signal</a> <a href="https://signal.org/">Signal</a>
client which hardens Signal by using a variety of client which hardens Signal by using a variety
of
<a href="https://github.com/mollyim/mollyim-android#features">unique features</a>, <a href="https://github.com/mollyim/mollyim-android#features">unique features</a>,
allowing allowing
<a href="https://github.com/mollyim/mollyim-android/wiki/Data-Encryption-At-Rest">locking the database when not in use</a>, <a href="https://github.com/mollyim/mollyim-android/wiki/Data-Encryption-At-Rest">locking the database when not in use</a>,
@ -605,12 +759,14 @@
<p>Molly is available in <p>Molly is available in
<a href="https://github.com/mollyim/mollyim-android#free-and-open-source">2 flavours</a>: <a href="https://github.com/mollyim/mollyim-android#free-and-open-source">2 flavours</a>:
<ul> <ul>
<li>Molly, which includes the same <li>Molly, which includes the
proprietary Google code as Signal to same proprietary Google code as
support more features.</li> Signal to support more
<li>Molly-FOSS, which removes the features.</li>
proprietary Google code to provide <li>Molly-FOSS, which removes
an entirely open-source client.</li> the proprietary Google code to
provide an entirely open-source
client.</li>
</ul> </ul>
</p> </p>
</td> </td>
@ -628,34 +784,43 @@
<p><a href="https://conversations.im/">Conversations</a> <p><a href="https://conversations.im/">Conversations</a>
is a well-designed Android is a well-designed Android
<a href="https://xmpp.org/">XMPP</a> <a href="https://xmpp.org/">XMPP</a>
client which serves as the de facto XMPP reference client which serves as the de facto XMPP
client and has great usability.</p> reference client and has great usability.</p>
</td> </td>
<td headers="software-smartphone-source_model conversations"> <td headers="software-smartphone-source_model conversations">
Open-source<br/> Open-source<br/>
(GPL-3.0-only) (GPL-3.0-only)
</td> </td>
</tr> </tr>
</tbody>
</table> </table>
</div> </div>
</section> </section>
</section>
<section id="recommendations-music"> <section id="recommendations-music">
<h3><a href="#recommendations-music">Music</a></h3> <h3><a href="#recommendations-music">Music</a></h3>
<p>For a curated list of music I enjoy, visit my <p>For a curated list of music I enjoy,
visit my
<a href="music.xhtml">music page</a>.</p> <a href="music.xhtml">music page</a>.</p>
</section> </section>
</section>
<section id="gnulinux_or_linux"> <section id="gnulinux_or_linux">
<h2><a href="#gnulinux_or_linux">Is it GNU/Linux or Just Linux?</a></h2> <h2><a href="#gnulinux_or_linux">Is it GNU/Linux or Just Linux?</a></h2>
<p>It's just Linux. GNU is unrelated to Linux, which is a kernel developed by <p>It's just Linux. GNU is unrelated to Linux, which is a
Linus Torvalds. Linux can be used entirely without GNU software in userspace, kernel developed by
and the kernel can be compiled without the use of GNU tools. Just because GNU <a href="https://en.wikipedia.org/wiki/Linus_Torvalds">Linus Torvalds</a>.
tools were used to initally develop and compile the kernel, and were initially Linux can be used entirely without GNU software in
the only available tools for userspace, does not make this true today, and it userspace, and the kernel can be compiled without the use of
never made GNU a part of Linux itself at any point of time.</p> GNU tools. Just because GNU tools were used to initally
<p>Where are all of the other forward-slashes for every other piece of software develop and compile the kernel, and were initially the only
on a Linux-based system which makes it just as usable? If a system is running available tools for userspace, does not make this true
"GNU/Linux", it should be using more than a single forward-slash when there is today, and it never made GNU a part of Linux itself at any
more to the system than only GNU.</p> point of time.</p>
<p>Where are all of the other forward-slashes for every
other piece of software on a Linux-based system which makes
it just as usable? If a system is running "GNU/Linux", it
should be using more than a single forward-slash when there
is more to the system than only GNU.</p>
</section> </section>
</body> </body>
</html> </html>