Github has made it impossible to create an account when using a VPN and a privacy browser with fully spoofed hardware identifiers. (Use Firefox or Firefox-based Privacy Browser, VPN, install Canvasblocker to test this.) I create an account with Google or Apple (both requiring hardware identifiers and numbers and birthdates) or I can use an email. When I use an email, it comes back with this horrible test, and even if I do it completely correctly, it tells me after I didn’t do the test right, gaslighting me with a picture of what I chose (which I didn’t choose) and showing me the correct picture (which I did choose and it claims I didn’t select).

It’s fucking bullshit and it’s more corporate control of open source software. For people who have their discussion or issue tracker, I can’t even participate without hardware identifiers likely linked to me some other way and phone numbers. It’s fucking bullshit. If anyone from Microsoft is reading this, FUCK YOU!!!

I am so tired of this bullshit. I just want to post an issue about a piece of software. You don’t need my fingerprint, hardware or personal, or biometric shit. This is a slippery slope. Fuck them.

I really hope more developers just get the fuck off Github. Honestly, if you are developing privacy-oriented software and using github, there’s a mistmatch and it’s bullshit, and I know it’s time consuming and annoying to move, but please do. This is fucking bullshit and it’s not like it’s going to become LESS annoying over time. FUCK THIS.

  • toastal@lemmy.ml
    1·
    2 days ago

    Why stop there? Git’s UX on the command line is awful, so adopt a better tool & your hosting will automatically be somewhere better.

  • gokayburucdev@lemmy.world
    13·
    4 days ago

    If something is controlled by a giant corporation and keeping your data and privacy are offered for free, the price is your personel data.🔏

  • whelk@retrolemmy.com
    9·
    4 days ago

    I’ve wanted to for a while, but this post gave me the final nudge I needed to just buckle down and try selfhosting my own. Forgejo was incredibly easy to set up and my buddies and I are already successfully collaborating on a project that I’ve moved over from Github. So thanks for making your rant post, you made a difference

    • witten@lemmy.world
      4·
      4 days ago

      Sure it does. Like mitigating constant DDoS attacks / AI scrapers. (To be clear, I’m not advocating using GitHub instead. I’m just saying freedom ain’t free.)

    • kahnclusions@lemmy.ca
      11·
      4 days ago

      It would be nice if codeberg supported the FUNDING.yml and had their own way to donate to the open source projects I like.

      • toastal@lemmy.ml
        1·
        2 days ago

        Microsoft made Sponsors so they can siphon a portion of the payment fees. There is no reason to make Codeberg add that sort of bloat when you can add a hyperlink to the README.* or in a section of your application to a third-party service that hopefully can be as focused on doing one thing as Codeberg largely has (non-profit hosted Forgejo).

  • ricecake@sh.itjust.works
    81·
    5 days ago

    Tangential to the main point you’re going for: when you say fingerprint or biometrics I think you’re referring to passkeys.
    Passkeys don’t share any of your fingerprint or other biometric identifiers with anyone.

    https://www.eff.org/deeplinks/2023/10/passkeys-and-privacy

    One of the major design criteria of their creation was to be an increase in security without sacrificing privacy. It’s made them more finicky to get working but there’s a very good reason they’re very popular with security professionals.

    • partofthevoice@lemmy.zip
      4·
      5 days ago

      They are not referring to passkeys. They’re referring to deterministic algorithms for uniquely labeling a particular device or person, despite any privacy enhancing features that device or person employed. It can be as simple as sampling various hardware specs, hashing the result, and using that as an ID for the person. So, if you switch browsers, they know it’s still you. More complex techniques exist, obviously.

      • ricecake@sh.itjust.works
        3·
        5 days ago

        I know how device fingerprinting works, thank you though.

        You don’t need my fingerprint, hardware or personal, or biometric shit.

        To me that sounds like hardware identifiers, but also quite specifically the things passkeys use. Hence I mentioned it as aside from their main point, which was “don’t track me”, because the biometrics GitHub or any website is going to ask you to use can’t be used for that.

        • partofthevoice@lemmy.zip
          3·
          5 days ago

          Yeah, I see what you’re saying. As far as I am aware, passkeys issue a one-time-token derived from a private key stored on the device. You can only access the private key via your devices own security (i.e., typically biometric). GitHub can only access the resulting one-time token, and it can verify that the token was derived from the private key using some cryptography. So, agreed. It’s not much different from a tracking perspective than just tracking password-based logins.

          Though, I got the impression OP was talking about something else. Maybe I misunderstood them.

          • ricecake@sh.itjust.works
            3·
            5 days ago

            That’s close enough for a privacy perspective. There’s also limitations on domains that can request the auth, specifically ”only the one the credential is for", and there’s a different key per domain and user typically.
            It’s also implemented in a way where if the user doesn’t choose to disclose their account to the service, the service can’t know.

            Caring about privacy and caring about the details of a security protocol are distinct. You’d be surprised how many people who care about privacy are deeply wary of passkeys because of the biometric factor, which is unfortunate because the way it authenticates is a lot harder to track across domains by design.

            I understood they had a lot of concerns, one of which was biometrics via passkeys since GitHub was a very early adopter due to the supply chain risk they pose.

            • ell1e@leminal.spaceEnglish
              12·
              4 days ago

              Passkeys seem to be advertised in ways that puts people off (edit: not saying that makes them bad):

              • TPMs, Secure Enclaves, etc. are deeply closed-source and security by obscurity. Until there is an open TPM implementation available, many users may prefer not to rely on them. It seems like KeepassXC allows circumventing TPM for Passkeys, but most people probably don’t know that.

              • Too much “trust me bro, my cloud is safe” advertising from big Passkey advocates like Google to try to get people to use their invasive services.

              • A classic hardware key may be indistinguishable from a normal password being entered. But Google has announced they want to push passkeys against user’s wishes here: “Is opting-into passkey mandatory? No, […]. However, over time, as users become more accustomed to passkeys, we might limit where we allow passwords to be used because they’re less secure than passkeys.” Again, not a great look.

              • Collecting biometric data is always dangerous, too many attack vectors during processing. I’m aware that Passkeys can be used without that, but many people may be put off by that push.

              I think that’s why Passkeys have poor adoption among privacy advocates, even though most problems seem fixable.

              Caring about privacy and caring about the details of a security protocol are distinct. You’d be surprised how many people who care about privacy are deeply wary of passkeys because of the biometric factor, which is unfortunat