Sarah Jamie Lewis

Cryptography and Privacy Researcher. President @ Open Privacy Research Society (@openprivacy).

Founder @ Blodeuwedd Labs (@blodeuweddlabs)

Building free and open source, privacy-enhancing, surveillance-resisting tech like Cwtch (@cwtch)

Public Key

npub14mfj9wu5ujvu6rxj8w62dvkvqj7myqc6kz0upz3kuw3wx4dz9vgstvp58n

NIP-05 Address

sarahjamielewis@mastodon-social.mostr.pub

Profile Code

nprofile1qqs2a5ezhw2wfxwdpnfrhd9xktxqf0djqvdtp87q3gmw8ghr2k3zkygpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds8zlwmt

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub14mfj9wu5ujvu6rxj8w62dvkvqj7myqc6kz0upz3kuw3wx4dz9vgstvp58n

Show more details

Last Notes

2026-10-18 22:12:23 UTC

Wanted to try modelling/texturing/rendering something a little more photo-realistic for a quiet Sunday.
Very happy with how the sea lions came out.
#blender #art
https://files.mastodon.social/media_attachments/files/117/464/192/875/234/041/original/d6d8c61ba134717d.png

2026-10-14 19:45:04 UTC

Thinking back to early in my career, sitting in a meeting room with print outs of code and a highlighter, with the goal of deleting us much of it as possible, because everyone understood that each line was a liability, and a drag on every outstanding requirement.
*sigh*

2026-10-13 17:45:28 UTC

#PortfolioDay
Some of my favourite pieces from teaching myself blender/3d modelling over the last couple of years.
https://files.mastodon.social/media_attachments/files/117/434/784/224/712/961/original/dda815e7fa79b0ee.jpg
https://files.mastodon.social/media_attachments/files/117/434/784/216/226/885/original/99ab423b0bb4038b.jpg
https://files.mastodon.social/media_attachments/files/117/434/784/283/189/000/original/e3b3158f352ab9d2.mp4
https://files.mastodon.social/media_attachments/files/117/434/784/280/397/012/original/e94e86d5b9bfd36b.jpg

2026-09-19 19:45:01 UTC

A first attempt at documenting where my thinking is currently at re: the future of web browsers/firefox/a new base browser/the modern web:
https://sarahjamielewis.com/log/2026/future-of-web-browsers.html

2026-09-11 03:15:00 UTC

Apropos of many ongoing threads discussing the state of modern floss:
Main thing I am thinking about: How to design an operating system that, as a consequence of interface, architecture and structure, minimizes both the overall number of required dependencies and the depth of dependency trees of any and all hosted software.
Once you have that, I think many other challenges become tractable (and many proposed "solutions" to the catastrophe of modern software complexity lose their appeal)

2026-08-25 22:45:58 UTC

Hybrid groups (i.e. @nprofile…tvvk peer to peer groups where one peer acts as a semi-trusted "host" permitting more flexibility/functionality/efficiency than the existing untrusted infrastructure groups ) has been one of those long running projects for us.
We finally had the ability to focus on it this summer, and I am really excited by what are have put together.
Watch this space 💜
#nevent1q…ha7c

2026-07-29 21:02:29 UTC

- reply

Do I love the existence of an barely documented binary blob in an open source browser project attached to "filtering" functionality?
No, I can't say I do.
According to contemporary reports and discussion, this filtering functionality was first added so that such sites were not displayed next to "commercial partners".
So that's fun.

2026-07-29 20:48:36 UTC

TIL Deep within the firefox source tree, there is a binary file called adult_set.bin, it's a set of md5 hashes for "adult sites"
https://searchfox.org/firefox-main/source/third_party/application-services/components/filter_adult/src/adult_set.bin
Most of these were previously stored in the firefox source code as base64'd hashes, and have been reverse engineered (https://gist.github.com/roycewilliams/04ed6eb9509b83ce4d85873861c7f7b4) (thanks for documenting that @nprofile…2pg0)
As far as I can tell, there is a single new entry in the list :
df26afcce27598ce38a4e4852cbb3380 (whose domain is documented here https://phabricator.services.mozilla.com/D15915)

2026-07-28 22:56:12 UTC

Plenty of discussion to be had about what should belong in the core of a browser, and what should be relegated to outside of the main source tree.
And I think reasonable people can disagree about certain features.
But can we all agree that the world would be a better place if the Firefox source tree did not have a module that cares about when the 2026 World Cup began?
https://files.mastodon.social/media_attachments/files/117/000/029/160/666/057/original/b2909fef3717e9d4.png

2026-07-24 00:50:31 UTC

Thank you everyone for all your interesting thoughts and pointers re: the crisis that is web browsers.
A few general followups collected in one place:
1. "Servo is the future, we/you should target effort there" - I'm finding this argument more and more convincing as the line count of the amount of code I'm tallying that I'd like to be removed from FF keeps going up.
I am somewhat amazed/shocked by the rapid introduction (and the code size) of recent "features"

2026-07-21 18:34:23 UTC

- reply

An uninformed plan:
- Take Tor's base Browser, the one they use as a branding-neutral base (very clever name) for the privacy-focused soft forks Tor Browser and Mullvad Browser (i know, i know - but they already paid for the work, so some good might as well come out of it)
- Rebase your soft forks on Base Browser, and benefit from that work
- Form a working group to co-manage base browser
- Hard-fork from firefox as you reject future rebases in favour of privacy and humanity.

2026-07-21 18:21:12 UTC

- reply

Mozilla and, by extension, Firefox have laid out the direction they want to go - and have consistently moved in that direction. There is no redemption arc there, they are not going to turn the ship around - and every week and month that goes by, Firefox gains more slop and drifts further from the visions that founded it.
Projects like Tor Browser and Waterfox are painstakingly disabling / patching out the worst - but every release becomes more expensive, and things do slip through.

2026-07-21 18:10:25 UTC

If the independent, non-slop web has any future at all, then now must be the time for every firefox fork to commit to working together to maintain a hardfork isolated from Mozilla.
It's a project that is too large to be handled by any small project alone (and maybe even all of them combined), but one that is too important to left under the guidance of an organization like Mozilla.
Without such bold co-operation I fear we have already lost.

2026-07-21 14:40:18 UTC

It has always made me uncomfortable when privacy projects align themselves with VPNs.
VPNs are, at best, a tool for rerouting traffic. There are a few good reasons
for choosing to reroute traffic but none of those reasons are about privacy.
And all of those reasons are predicated on an ability to trust the new provider *more* than the default/another.
I'm skeptical of that trust in the best cases, I have no idea how it can be justified when/after a provider actively supports authoritarianism.

2026-07-16 17:39:13 UTC

I have a vision in my mind for what I want my next era of computing to look like, and I have been making steady progress towards it for a little while; building the necessary pieces - I'm close to a point where I can be more public about this, which is very exciting.
The Linux kernel is/was going to form a stable layer in that stack, but with recent developments in mind, I am more motivated than ever in exploring/contributing to alternatives.
Very much time for projects to stand for something.

2026-07-10 23:00:19 UTC

Nothing quite like getting everyone in a room and throwing problems around until solutions appear.
Feels good to do this again.
#nevent1q…7mrj

2026-06-10 20:40:03 UTC

We are still awaiting the details, but be prepared to hear Canadians say "C-34" a lot.
https://www.parl.ca/LegisInfo/en/bill/45-1/c-34

2026-06-08 21:02:59 UTC

- reply

It is not enough to not comply in advance.
We must be building our systems - both technological and social - such that they actively reject these kinds of intrusions.

2026-06-08 20:54:27 UTC

- reply

Boiling it down, every single request stemming from "age assurance" / "age verification" / "identity verification" is part of the slow but persistent fight against general purpose computing (itself but one front in the never ending struggle for human freedom)
The idea that you should be able to do anything without seeking permission from someone else is so abhorrent to some people they demand reality twist itself into absurdities to satisfy their need for authority.

2026-06-08 20:27:57 UTC

I was aware that reason and competence had long left the halls of UK governance but "We need the software to prevent camera operators taking nude images" is remarkable in its ridiculous dystopia.

2026-04-05 20:22:27 UTC

Testing out a new telescope camera, chance encountered a bird catching a ride on a thermal.
https://files.mastodon.social/media_attachments/files/116/353/905/262/728/177/original/d58fa4b871847dfe.jpg

2026-03-25 19:05:11 UTC

Another example of how the slop permeates everything.
Today while checking out some new metadata resistance papers, I came across one which talks about a project I originated (@nprofile…lx86) and manages to not only cite the wrong year and paper title, but also attributes the work to "Lewis, Angel and others" in the text or "S. Angel" in the references.
Just why? What is the point in producing slop that looks like a paper? On what planet is that something worth doing?
#nevent1q…hpk2

2026-03-23 21:14:07 UTC

- reply

Thankfully this comes at a time when we are already in the process of migrating away from many of the third party services we use (driven primarily by a desire to not be reliant on US companies) - so this will be added to the queue of systems for which to find a suitable hostable alternative.

2026-03-23 21:05:30 UTC

"we are cancelling the free open source project tier you've been using for years, to be considered for the replacement tier you will need to post the following statement of partnership on your website about that is focused on how great our new AI features are"
Oh...we're in *that* stage of the hype decline.

2026-03-21 16:15:20 UTC

The extent to which core linux projects are laying the groundwork for age verification is very concerning.
I understand why some believe they are compelled to do so, and why others feel that it may be better to implement the most minimal conforming implementation in the hopes of fending off something worse.
But the line must be drawn such that no threat can obligate an OS to collect/store personal information - without that freedom, we face an uphill fight to protect general purpose computing.

2026-03-12 16:51:39 UTC

- reply

The really frustrating bit is that one of those quotes feels like something I might have said ad-hoc during a talk or a lecture, but I spent a while trying to verify it and only found things that were significantly dissimilar - and it's not quite in my voice or how I speak.

2026-03-12 16:45:36 UTC

I like how the internet has got to the point where random sites feature fake quotes by me, occasionally regarding research I never did, sometimes while working in positions I've never held.
https://files.mastodon.social/media_attachments/files/116/217/151/798/491/697/original/c2197917ab23ebf0.png
https://files.mastodon.social/media_attachments/files/116/217/151/822/909/228/original/e9bae96b57b36506.png
https://files.mastodon.social/media_attachments/files/116/217/151/809/434/927/original/feb55a122733fbf1.png
https://files.mastodon.social/media_attachments/files/116/217/151/839/183/810/original/bcf59e4d49c40948.png

2026-03-05 19:58:26 UTC

Something I want to make clear:
The "age verification" bit of the CA/CO laws are not the bit I care about i.e. a law that requires an operating systems to implement some kind of parental control feature is...whatever.
The bits I care about are the obligations on developers to call APIs and then that invocation being taken as evidence of knowledge.
Specifically, I think a -legal- requirement to:
- make any kind of call is an attack on speech
- know a users age (bracket) is a privacy violation
#nevent1q…yuec

2026-03-02 20:55:20 UTC

In fun legislative news, BC has finally stopped waiting around for the US to modernize, and has gone ahead and adopted permanent DST starting next week!
"Recent actions from the U.S. have shifted how B.C. approaches decisions that merit alignment, including on time zones. Making this change now reflects the current preferences and needs of British Columbians, and helps ensure the province is well-positioned to thrive, even when circumstances across the border evolve."
https://archive.news.gov.bc.ca/releases/news_releases_2024-2028/2026AG0013-000209.htm

2026-03-02 20:33:06 UTC

- reply

I am so glad I got the opportunity to grow up in an age where there were no restrictions on what I could do with computers I could access.
Personally I consider any attempt to remove that access from anyone as abhorrent. It is a core part of who I am.

2026-03-02 20:26:44 UTC

The California age verification law imposes behaviour of application developers that I consider morally absurd.
As an application developer, I will never request any information from the OS or any other place to gather personal information about a user - especially if the act of that request has legal implications on what I am deemed to "know".
I simply won't.
Any system that enforces such a check, is a system I will not support.

2026-02-26 23:31:15 UTC

With all the discussion around detecting when a code repo contains commits authored by an LLM, I think it is important to note commits like the following in Mozilla Firefox from 2 weeks ago:
"Bug 2011195 - When an agent commits, don't add itself as author"
https://github.com/mozilla-firefox/firefox/commit/71cc24b6a400dbd434e4df37087960d94b764791
I don't think it's a good thing that Mozilla seem to be explicitly encouraging unattributed LLM code in Firefox.

2026-02-17 19:14:15 UTC

Programming, writing, math, art are all ways I use to structure my thoughts and to test and cement my understanding.
The idea that these domains are limited by how fast I might type, or sketch are fantastical.
In all cases my ability is fundamentally limited by my understanding of the subject before me.
As soon as I understand something, actually know it, then capturing it's essence in code, in prose, through theorems or in medium cannot be a chore, because it must already be done.

2026-02-11 18:02:45 UTC

Today marks the 8th anniversary of the founding of the Open Privacy Research Society (@nprofile…wlq8) which happened a few weeks after @nprofile…659r and I sat down in a coffee ship in Vancouver and committed to trying to bootstrap a different kind of organization.
Since then no two years have been the same; from disclosing flaws in infrastructure in Vancouver and e-voting in Switzerland; to launching and maintaining @nprofile…lx86, to working and partnering with local orgs to build much needed systems.

2026-02-09 18:35:41 UTC

"we can help you book 4-8 meetings each day!"
I don't know how you found my email, but it would appear that you have been gravely misled about the kinds of services that I would find valuable.

2026-02-04 22:30:14 UTC

Does @nprofile…kyv9 consider violations of group transcript consistency (i.e. different members of a group seeing different messages/different order of messages) to be security issues?

2026-01-07 01:54:10 UTC

We are 6 days into the year, and already my fresh list of "new project ideas I want to do but do not have the time to do" is already in the double digits.

2026-01-03 03:28:20 UTC

Memories and Ink fades, links rot, collections cycle, and censors edit and rewrite.
Building archives, even if only in private, is both a defensive and optimistic act.
Make copies of artifacts and please write about them excruciating detail, document from weird angles, note the obvious, and the absurd.
Presuppose a future where someone else wants to know that artifact as you know it.
No one person, or org, can hold back the fog of time forever, but consider giving history a helping hand.

2026-01-03 02:46:39 UTC

Today, the universe wanted to reaffirm my belief that more people should ensure they have local copies of anything they think they might ever need.
- picked up a project I hadn't touched in a few months to find some of the build scripts failing - because the decades old mirror they were attempting to pull packages from has apparently been offline for months.
- then I went to check a popular git repo and got hit with: "site administrator has misconfigured anubis" (worked around it...but still)

2025-12-18 23:41:49 UTC

- reply

Opt-in means that the person needs to perform an explicit action in order to do something. Ideally it means that they do that action of their own accord, without being harassed. They do that because the software/features/whatever is exciting and/or solves a real problem they have.
Something so good you don't have to trick them into turning it on.
You know, like that time 20+ years ago when people actively sought out and downloaded Firefox because it was simply the better option.

2025-12-18 23:31:10 UTC

- reply

The leaders of an organization keep making announcements like "we are building the torment nexus", "we are a torment nexus company"
How much do you really weight a follow up PR statement on a smaller dev channel along the lines of: "we promise to give you a kill switch for the torment nexus that will probably be opt-in for some definition of opt-in....we can reasonably agree that opt-in is a vague term right?"
But keep following them down that road I guess...

2025-12-18 23:22:33 UTC

A quick reminder of a few things Mozilla/Firefox have done in the last *checks notes* ~year that I hope highlights that this is not a case of bad messaging but a consistent pattern of hostility:
- "Mozilla is going to be more active in digital advertising."
- "privacy preserving" Advertising telemetry enabled by default
- New T&C demanding a worldwide license (rolled back) & weakened privacy policy to support the above expansion (active)
- ""[Firefox] will evolve into a modern AI browser"

2025-12-17 21:09:24 UTC

My issue with firefox soft forks is that even in their most ideal form, they can only be reactive harm-reduction, and any reasonable fork necessitates compromises that introduce some amount of risk (delayed security updates, compromised trust anchors etc.)
Perhaps that is the best anyone can do within reasonable costs.
Perhaps the only affordable proactive actions we can take is to reinforce that front against future inevitable assaults.
Perhaps that must be enough. I wish it were not so.

2025-12-16 15:54:20 UTC

Mozilla has a new CEO. Once again iterating that the future of Firefox is AI first, AI by default:
"Firefox will grow from a browser into a broader ecosystem of trusted software"
"It will evolve into a modern AI browser"
"AI should always be a choice — something people can easily turn off."
Source: https://blog.mozilla.org/en/mozilla/leadership/mozillas-next-chapter-anthony-enzor-demeo-new-ceo/

2025-11-25 18:04:52 UTC

- reply

@nprofile…l8gu @nprofile…9274
fwiw Canada tracks poverty levels using the MBM system which takes into account factors like housing and transportation, and scales for family size and location.
Using that method the poverty threshold is between ~24k CAD and ~100k CAD pre-tax income depending on location and family size (See: https://www150.statcan.gc.ca/t1/tbl1/en/tv.action?pid=1110010401)
About 10% of Canadians fall below this threshold: https://www.statcan.gc.ca/hub-carrefour/quality-life-qualite-vie/prosperity-prosperite/poverty-pauvrete-eng.htm
(also worth noting that healthcare costs weighs heavily the US figure)

2025-11-04 04:23:41 UTC

My new hobby is attempting to reverse engineer how something worked from rare archives of building plans, second/third hand interviews, and the occasional archival photograph.
This has reaffirmed my belief that people are really bad at determining what information is worth documenting.
For the future of the humanity, please consider taking photos from more than one angle.

2025-10-06 19:32:46 UTC

If any developer of any software I use to write/review code announced they were going to put logic in that software to extract/send/train on my code - **even if it was opt-in/disabled by default** - that software would be uninstalled and that developer blacklisted from any system I had any control over for the rest of time.
Without hesitation or delay. Even with the best of intentions and security practice I could simply never trust that piece of software again.

2025-10-06 18:28:39 UTC

Mastodon.social have started a community consultation on their new and updated terms of service.
They sent me a heads up on these last week, so I've had a chance this weekend to review. tl;dr: more specific/restrictive in application, much better.
I still think there are broad open questions about how licensing works on the fediverse at large (especially as we more from world of reserved-IP rights to a world where instances seek more formal licensing terms with users)
https://github.com/mastodon/mastodon/discussions/36368

2025-06-19 16:59:56 UTC

The more conversations I have, the more convinced I am that if larger actors in the fediverse wish to move from an implicit licensing to an explicit one; the only sound strategy is for all accounts to communicate licenses on a per-note/activity basis.
It would sidestep many (but not all) annoying legal questions like "if you author a public post, and send it to a remote server, are you considered a "user" on that server for the purposes of licensing of public posts for wider distribution"

2025-06-19 16:40:44 UTC

- reply

@nprofile…x759
Understandable, for motivation I'm mostly thinking about cases like https://github.com/mastodon/mastodon/issues/18958 and https://github.com/mastodon/mastodon/issues/15554 and <another recent example I can't find now related to trimming>
Where changes in how mastodon transforms/modifies content may significantly change the meaning of that content (and any potential fallout of such an action e.g. liability - and for such cases, given a hostile reading, admins may want the ability to do this beyond what might be considered "necessary")

2025-06-19 16:09:38 UTC

- reply

@nprofile…x759
A few thoughts on (local) content "transformations/modifications" & "processing":
- [processing] to determine who/where to send content; includes e.g. extracting hashtags, mentions, topics etc.
- [transformation/modification] includes:
* trimming length / partial hiding
* santization and formatting (also perhaps worth stating that instances (local and remote) may interpret/display the same content differently / over time)
* into web, json+ap, rss etc.
* translations/localizations

2025-06-19 15:44:26 UTC

- reply

@nprofile…x759
Nice!
- "Making your Content available to" may need a provision to cover allowing the embedding/distributing of content on other parts of the internet (i.e. to non-users / non-instances e.g. search engines / website embeds / rss which are currently not scoped)

2025-06-17 19:20:43 UTC

After the whole fosstodon thing, we were already planning on migrating some of our fediverse presence to self hosted non-mastodon instances.
Today is very much a sign that those migrations are going to need to be larger scoped, and the rough-deadline now has an increased sense of motivation.

2025-06-17 16:41:19 UTC

- reply

Absolutely wild to just drop that on the floor only 3 months after pushing it through (the privacy policy itself is still really bad) - A+ planning there.

2025-06-17 16:34:04 UTC

In other legal news, sometime between May 15th and June 12th (effective June 10th): Mozilla seems to have quietly removed the grant of a worldwide license to content from their Firefox terms of service: https://web.archive.org/web/20250612224408/https://www.mozilla.org/en-US/about/legal/terms/firefox/

2025-06-17 15:45:24 UTC

Legal Question: If I have an activity pub instance, and someone on a mastodon instance operating under the new terms of service follows an account on that instance - to what extent does my instance become a "user" of the mastodon instance.
- Arguably user profile info is out of scope, as such content is explicitly requested by the mastodon instance.
However, a "Create" request is submission of content, it is generally posted *to* a server, for the purposes of mirroring content on that server.

2025-06-15 17:14:26 UTC

This might be a very long shot, but I'm attempting to track down a song/mix the only thing I definitively remember about it is that it contains lyric or maybe quoted audio that approximates:
"as soon as you start making art for someone else, you're fucked"
I cannot remember if it's a good song, it might not even be a song - if it is a song it's possible it's adjacent to synthwave in genre. It might also be a break in a larger mix.
Anyone have any idea where this might have come from?

2025-06-10 18:35:29 UTC

When selecting or building a new tool I find myself increasingly filtering and optimizing for ease of repair and maintenance over all other properties.
- How standardized are the parts?
- Will I be able to find replacements in 1/2/5/10 years?
- How many build/runtime dependencies? How stable are those interfaces?
- Does this tool do one thing well, or does it have a hundred other tightly coupled features?
- Can I maintain this myself, or will I be dependent on a third party?

2025-06-08 21:40:33 UTC

OK. Implementing share and like tracking in my tiny activity pub implementation went well: https://tap.resistant.tech/sarah/posts/1749417193
Sitting at just under 1700 lines of code, I have now implemented all the features I wanted to for an mvp (managing multiple accounts, accepting followers, posting, liking, tracking likes/shares, rss, and a simple web interface)
Next steps:
- a little more functionality testing
- a round of review/refactor
- open source it
- setup an instance for some org accounts to migrate to

2025-06-07 22:03:31 UTC

- reply

@nprofile…3nsk the problem is that mastodon is stripping all tags, even when those tags are left alone in otherwise identical posts.

2025-06-07 21:22:43 UTC

Mastodon/Activity Pub question:
As far as I can tell mastodon posts are expected to have a rich text / html-subset representation i.e. https://docs.joinmastodon.org/spec/activitypub/#sanitization)
I'm writing a tiny activity pub service, mastodon is currently stripping out all html tags when displaying posts from my dev account (see e.g. https://mastodon.social/@sarah@tap.resistant.tech/114643976114333084), plain text posts work fine (see e.g. https://mastodon.social/@sarah@tap.resistant.tech/114643533179472725)
I'm attempting to work out why that is the case, but this is proving to be a hard thing to search for.

2025-06-05 05:46:30 UTC

- reply

@nprofile…x759 @nprofile…70gl
Thanks! The issue was the authorized fetch, which I've now implemented correctly...confirming that these were received (and then promptly discarded because the code currently only processes replies to posts made by the user)
https://files.mastodon.social/media_attachments/files/114/629/165/448/442/644/original/1dbee55306bb8b4c.png

2025-06-05 05:13:17 UTC

- reply

@nprofile…x759 @nprofile…70gl
Thanks for these...I did not see them in my logs.
I think because you have secure mode enabled and so GET requests require a signature too?

2025-06-05 04:22:51 UTC

Inspired by defederation discourse and my increasing unwillingness to deal with software I consider way too large, I spent the evening cleaning up the bare bones activity pub implementation I wrote a while back, and extended it to support posts, likes, and replies.
By which I mean, it will increment a number, and will save the replies object to disk and never think about it again.
Test user at: @nprofile…70gl - exposing to identify issues - feel free to poke.

2025-05-22 19:52:34 UTC

- reply

I also feel the need to point out a few months back, when I and others were criticising Firefox's new terms of service / privacy / AUP policy as being overbroad, inappropriate, and down right unethical (it still is)...one of the main category responses was "oh they are only saying they need to collect these categories of data, and require this ridiculously over the top license, things because of integrations...like Pocket"
mmm hmm.

2025-05-22 19:41:30 UTC

All those years of forcing unwanted Pocket integration into Firefox end with an unceremonious shut down.
Pocket didn't even get to star in its own obituary, as Mozilla unwinds itself from anything that isn't its ai/advertisement business - meaning that Fakespot (which Mozilla bought just over 2 years ago) is also on the chopping block.
"This shift allows us to shape the next era of the internet...vertical tabs, smart search and more AI-powered features on the way"
https://blog.mozilla.org/en/mozilla/building-whats-next/

2025-05-21 17:46:41 UTC

- reply

Your one practical option is to actively reject tools that now exist to serve interests other than your own - and to help others do the same; and in doing so support the people who make the tools that put you back in control.
Are there solutions for everything? No - but if we don't start investing in them, and building them, and making them better today then we simply won't have them at all.
Because no tool, no organization, that sells out its users is ever going to stop.

2025-05-21 17:39:03 UTC

Whether we are discussing recall / client side scanning / "privacy preserving" advertisement/analytics/metrics or any of the other plentiful attacks on end-user control:
There is no sound threat model that applies past the point where the operating system / web browser / messaging app / "user agent" is generally considered to be actively hostile to the the person it ostensibly takes direction from.

2025-04-05 03:17:20 UTC

a few phone facts
an active phone, with or without a sim card, is trivial to identify both actively, passively, and post-hoc
a phone and many modern accessories (e.g. watches, headsets) are basically a nicely packaged collection of sensitive antennas - while most require power to operate efficiently, they are still antennas with a variety of well characterised physical properties.
There are some really cool decades old papers developing radar systems based on those properties.

2025-03-11 19:01:54 UTC

Request: Looking to connect with people who are thinking about the future of software, specifically in the areas of:
- Diversification of large/core software development efforts beyond US/EU funding
- Post non-profit organizational frameworks (e.g co-op networks)
- Alternative funding paths (In wider context of the world at large)
- Responding to increasingly locked down operating systems
Very interested in talking to folks (esp. in Canada) who are taking or want to take action in these areas.

2025-03-01 18:34:30 UTC

I've been playing around with using "base browser" as a stopgap and it's really all I want in a web browser - no branding, no labs, no telemetry, a few sensible safety defaults, but nothing that degrades general experience (and with the ability to go hyper restrictive if desired)
The one downside is that you have to compile this browser from source, and its not a standalone project - its the firefox fork that serves as the pseudo-base of the Tor and Mullvad browser.

2025-02-28 18:19:56 UTC

Mozilla's "don't be evil" moment. "Does Firefox sell your personal data?"
From: "Nope. Never have, never will....That’s a promise."
To: "Mozilla doesn’t sell data about you (in the way that most people think about “selling data“), and we don’t buy data about you. Since we strive for transparency, and the LEGAL definition of “sale of data“ is extremely broad in some places, we’ve had to step back from making the definitive statements you know and love. " 
https://www.mozilla.org/en-US/privacy/faq/

2025-02-27 22:38:44 UTC

- reply

For those asking what my current plan is, I've outlined it here: https://mastodon.social/@sarahjamielewis/114072460080871754
I'll extend it to say:
- I'm only considering applications that are open source and non-electron based.
- I don't really use a phone, so I can't comment on mobile browsers
- I have a browser engine that I've written, oriented for basic browsing/RSS, I have a plan to extend that for some usecases (but will unlikely be of use generally without additional interest/planning)

2025-02-27 22:27:46 UTC

- reply

And that is why I've held on as long as I could have, beyond what I rationally consider the breaking point.
Over the last few years I've been publicly critical of Mozilla while still urging people to use Firefox, but to make their voices heard.
That time is over. I can't agree to these terms, I can no longer condone the destructive path that Mozilla has chosen. This is the point where after more than 2 decades, I had to say enough.

2025-02-27 22:23:40 UTC

- reply

And I need you to understand what that decision means to me. I started using Firefox in the early 2000s - I honestly can't remember when but probably sometime in 2003.
I was one of the few people that had an actual Firefox phone in the early 2010s.
I donated time and money to Firefox and Mozfest and Thunderbird over the last two decades because I really believed in all of those projects.
I think Firefox has been incredibly important to what the web is and could be.

2025-02-27 22:13:09 UTC

- reply

Over my career I've been involved in hundreds of contract negotiations, many of them including stuff like software licensing. I've done this work for governments, and corporations, for myself, and for non-profits.
Which is to say, I know what words mean. I know what the legal norms are in multiple jurisdictions, and I know when someone is trying to bullshit me.
I have no doubt that Mozilla think they need this license and privacy policy. I'm concerened enough by the "why" to ditch firefox.

2025-02-27 22:06:58 UTC

- reply

The language is clear, it is being criticised because it is clear. No one is confused about anything. Except maybe Mozilla regarding how this will play out over the long term.

2025-02-27 22:00:16 UTC

- reply

>> Without it, we couldn’t use information typed into Firefox, for example. It does NOT give us ownership of your data or a right to use it for anything other than what is described in the Privacy Notice
This part is entirely correct. And I really want you to understand that it is only so because of the end of that statement i.e. "other than what is described in the Privacy Notice"
The Privacy Notice, as outlined in my previous thread is incredibly broad.

2025-02-27 21:58:45 UTC

- reply

>> "We've seem a little confusion"
There is no confusion, the usage and privacy policy are both incredibly clear and broad in what they say.
>> We need a license to allow us to make some of the basic functionality of Firefox possible.
They do not. This is incredibly condescending. Nothing about the "basic functionality" of a browser demands a "royalty-free, worldwide license". That is absurd.

2025-02-27 21:51:24 UTC

Mozilla have published an update to this:
> "UPDATE: We’ve seen a little confusion about the language regarding licenses, so we want to clear that up. We need a license to allow us to make some of the basic functionality of Firefox possible. Without it, we couldn’t use information typed into Firefox, for example. It does NOT give us ownership of your data or a right to use it for anything other than what is described in the Privacy Notice."
I want to break this down.
https://mastodon.social/@sarahjamielewis/114072293410465140

2025-02-27 03:20:41 UTC

- reply

There is a tendency in all these conversations for people to make excuses. "Oh well they need to do it because <lawyers>", "Every other company does this" etc.
Be mature enough to take into account the entirity of a situation, to see the patterns of behaviour, to see the recent history, to believe that people will do what they say they will do.
Or to put it another way, to the apologists: "don't piss on my boots and tell me it's raining"

2025-02-27 03:11:07 UTC

One thing I really want people to understand: regardless of the reasons for Mozilla introducing that ridiculously broad / privacy hostile terms of service / privacy policy; and regardless of their actual intent.
You should respect yourself, and your fellow humans, enough to not put up with that level of bullshit.
You deserve technology that works for you, technology that isn't built on shifting sands, whose behaviour doesn't radically change between minor updates; software that respects you.

2025-02-26 21:35:43 UTC

- reply

There is also the incredibly broad "To comply with applicable laws, and identify and prevent harmful, unauthorized or illegal activity." in which Mozilla states they may gather "all data types" - among the defined types include: searches, browsing data (visited URLS), content and any other data.
In support of nebulously defined "identify and prevent harmful," and in response to law enforcement.
That "learn more about" link just goes to a list of definitions.
https://files.mastodon.social/media_attachments/files/114/072/328/484/636/263/original/dde6a963859086f7.png

2025-02-26 21:30:54 UTC

- reply

I'd specifically like to bring attention to the "To market our services." bases for data collection under which Mozilla now claim the right to gather, among other things, Unique identifiers and Browsing data - under which Consent is only considered if they have a legal obligation, and of course it's opt-out.
https://files.mastodon.social/media_attachments/files/114/072/300/875/588/751/original/f253f5df7721b395.png

2025-02-26 21:24:23 UTC

General rule of thumb: Every time an organization updates their terms of service and/or privacy policy, it is never because they have your best interests at heart.
Specific thoughts on this latest Mozilla action (https://blog.mozilla.org/en/products/firefox/firefox-news/firefox-terms-of-use/)
Setting aside the "worldwide license" bullshit, the privacy policy appears to have broadened both the classes of data Mozilla aims to collect, and the situations in which they collect them.
These are not the actions of an org that cares about your privacy.

2025-02-25 03:14:14 UTC

Is there some particular (free, open source) software that you feel is missing from your life?
(I'm specifically considering desktop applications, but feel free to go wider than that)
I have a list, and it continues to grow with every passing year; but I finally feel I've reached a point where I have a base to move forwards on and I'm on the lookout for projects to stress test it a little.

2025-02-21 23:38:30 UTC

I've lived in Canada for well over a decade now, and I don't think I've ever seen as many Canadian flags as I saw today in my local grocery store.
I wake up to local radio, the topic every morning for weeks now is the decline of the US, and the promotion of Canadian everything.
Such a stark radical transformation.

2025-02-20 00:25:38 UTC

- reply

Really, what I would love to see is a project with a vision and principles.
Where is the browser with activity pub integration? Where is the browser with rss feeds? Where is the browser that doesn't have to disable the tracking crap, because it simply doesn't exist in the first place?
If we want a web that works for the people, we need to build a browser that takes responsibility for those values.
While understanding that that is a damn expensive thing to ask.

2025-02-20 00:13:11 UTC

- reply

That or the dozen+ firefox forks agree to combine their efforts and maintain a shared hard-forked base.
That could work, but it might be a bigger ask.

2025-02-20 00:00:19 UTC

- reply

I think Tor Project are probably best placed to do it - they are already as close to maintaining a hard fork of firefox you can be without actually maintaining a hard fork. I understand why they don't - but, if anyone has a shot of making that path working, I think it's them.

2025-02-19 23:51:07 UTC

- reply

There is clearly a lot of effort fractured over a lot of projects, perhaps enough to actually take on the task, but I'm not aware of any project committed to a hard fork of firefox, with everything that entails (and if you had the resources to go that route, I'm not convinced that is the best path to take either)
I can only really think of a handful of groups I think have a chance at success, but I don't think any of them are currently considering it.

2025-02-19 23:43:26 UTC

- reply

Many people are in my mentions talking about and/or promoting various firefox forks.
Look, if Mozilla can't afford to keep developing/maintaining firefox without resorting to the sad path, then the question that needs to be asked is how any other organization can? What about the approach is different?
It's one thing to package firefox with some of the bad things turned off. It's another to take on the responsibility of maintaining that codebase sans-mozilla.

2025-02-19 20:59:59 UTC

- reply

Firefox, or at least the ideal of Firefox - an open browser that serves the interests of people rather than corporations is so important.
It's also an incredibly expensive proposition (in part because of how the web has evolved complexity, thanks in part to how corporations have driven, and ultimately practically captured various standards)
I deeply understand Mozilla's desire to continue existing to serve that mission...but it can't be like this.

2025-02-19 20:54:14 UTC

- reply

There is no such thing as privacy-respecting advertising. At least not for any sane definition of "respect"
The arguments are technically nuanced, but I went into it a little a while back: https://mastodon.social/@sarahjamielewis/113199184170538484
Raising money is pointless if doing so compromises the values you claim to stand for.

2025-02-19 20:48:34 UTC

Really sad to see Mozilla committed to such a dystopian vision of the future of the web.
"While Firefox remains the core of what we do, we also need to take steps to diversify: investing in privacy-respecting advertising to grow new revenue in the near term; developing trustworthy, open source AI to ensure technical and product relevance in the mid term"

2025-02-16 21:18:37 UTC

Thanks everyone for the questions and feedback on senary (my new lightweight, self hosted code forge)
Applied a few new updates this morning, including:
- syntax highlighting and css changes to make things look and feel a little better
- a new index page (https://senary.lopeos.org/) that starts to answer questions like "what is indie auth?" and "why senary?"

2025-02-15 23:46:59 UTC

Announcing senary - an experimental, prototype software forge.
- patch based workflow
- lightweight, mostly-static tree listing
- moderated issue/patch management
- indieauth support
- self hosting
I must stress this is incredibly experimental and a prototype. There will be bugs. None of this code is more than a week old.
Don't use this for anything serious yet, but if you are interested in testing/trying out this kind of thing then get in touch!
Check it out: https://senary.lopeos.org/repos/senary/requests/e8df1181174c9e14f8b4f02ec19a33d751b35276233997359e70225dd9c7204dda667d1f16a0790a342e5066bd82f5d52765a58c17150827808cdcb5331ba76c/

2025-02-13 22:17:08 UTC

I'm implementing something and it needs an authentication layer, and I'd prefer not to have a user database.
Is there any consensus emerging on a fediverse sso standard?
I know indieauth exists, and there is some discussion about general oauth2 support for various fediverse mainstays, but I've not looked into this all that deep.

2025-02-04 20:20:24 UTC

Some nuanced privacy advice:
- Signal is good, and you should use it because it strikes an effective balance in the optimization problem that is getting people to use secure technology.
- You should think really, really hard before using any technology whose entire threat model depends on centrally operated infrastructure remaining trusted and uncompromised. Especially ones based in jurisdictions without effective democratic institutions.

2024-12-20 02:17:08 UTC

- reply

Context: https://www.cbc.ca/news/canada/saskatchewan/court-of-appeal-thumbs-up-emoji-contract-1.7415247