The bill did not pass in the first stage of the law making process as all the political parties rejected it. Also, I'm very certain that even if it passed the first few hurdles, someone would make an initiative against it and that initiative would win 9 out of 10 times as most Bünzlis are serious about their privacy and would feel like their freedoms are being taken away by such a law.
this post was submitted on 18 May 2025
247 points (97.3% liked)
Buy European
5873 readers
559 users here now
Overview:
The community to discuss buying European goods and services.
Rules:
-
Be kind to each other, and argue in good faith. No direct insults nor disrespectful and condescending comments.
-
Do not use this community to promote Nationalism/Euronationalism. This community is for discussing European products/services and news related to that. For other topics the following might be of interest:
-
Include a disclaimer at the bottom of the post if you're affiliated with the recommendation.
-
No russian suggestions.
Feddit.uk's instance rules apply:
- No racism, sexism, homophobia, transphobia or xenophobia
- No incitement of violence or promotion of violent ideologies
- No harassment, dogpiling or doxxing of other users
- Do not share intentionally false or misleading information
- Do not spam or abuse network features.
- Alt accounts are permitted, but all accounts must list each other in their bios.
- No generative AI content
Benefits of Buying Local:
local investment, job creation, innovation, increased competition, more redundancy.
European Instances
Lemmy:
-
Basque Country: https://lemmy.eus/
-
🇧🇪 Belgium: https://0d.gs/
-
🇧🇬 Bulgaria: https://feddit.bg/
-
Catalonia: https://lemmy.cat/
-
🇩🇰 Denmark, including Greenland (for now): https://feddit.dk/
-
🇪🇺 Europe: https://europe.pub/
-
🇫🇷🇧🇪🇨🇭 France, Belgium, Switzerland: https://jlai.lu/
-
🇩🇪🇦🇹🇨🇭🇱🇮 Germany, Austria, Switzerland, Lichtenstein: https://feddit.org/
-
🇫🇮 Finland: https://sopuli.xyz/ & https://suppo.fi/
-
🇮🇸 Iceland: https://feddit.is/
-
🇮🇹 Italy: https://feddit.it/
-
🇱🇹 Lithuania: https://group.lt/
-
🇳🇱 Netherlands: https://feddit.nl/
-
🇵🇱 Poland: https://fedit.pl/ & https://szmer.info/
-
🇵🇹 Portugal: https://lemmy.pt/
-
🇸🇮 Slovenia: https://gregtech.eu/
-
🇸🇪 Sweden: https://feddit.nu/
-
🇹🇷 Turkey: https://lemmy.com.tr/
-
🇬🇧 UK: https://feddit.uk/
Matrix:
-
🇬🇧 UK: matrix.org & glasgow.social
-
🇫🇷 France: tendomium & imagisphe.re & hadoly.fr
-
🇩🇪 Germany: tchncs.de, catgirl.cloud, pub.solar, yatrix.org, digitalprivacy.diy, oblak.be, nope.chat, envs.net, hot-chilli.im, synod.im & rollenspiel.chat
-
🇳🇱 Netherlands: bark.lgbt
-
🇦🇹 Austria: gemeinsam.jetzt & private.coffee
-
🇫🇮 Finland: pikaviestin.fi
Related Communities:
Buy Local:
Continents:
European:
Buying and Selling:
Boycott:
Countries:
Companies:
Stop Publisher Kill Switch in Games Practice:
Banner credits: BYTEAlliance
founded 3 months ago
MODERATORS
It's always nice to see companies claiming to care about privacy walking the walk. In this case, all the way out of Switzerland.
walking the walk
But they haven't?
yeah, so far this is just talking the talk. but with a bit of luck we may not need to see them walking the walk
Can we have technology that's secure enough that it doesn't matter what country we are in?
Not as long as somebody else is hosting the server.
I think you are confusing secure with available
There are several dozen paths to securely hosting on someone else's service but they can still pull the plug on your server
If you do it right, they can image and pen test it all they want and get nothing out of it.
Just almost no one bothers to take the time
That's you hosting the service on somebody else's server. I meant somebody else hosting the service, which means somebody else running the software and having admin rights, and there's no way you're securing that.
Just almost no one bothers to take the time
Obviously. Imagine if we applied the same logic to food safety, or anything else. There's no practical way to be self-sufficient in all aspects, and no reason we should be.
Not really, okay I am going to give you the back of the napkin black box operation.
So you lease the instance and spin it up from the console. The first thing you do is set up a SSH key only access instance so from the moment its spun up, the only logins will be from a key that the hosting service is not privy to.
Once established and you make a shell connection, you can SEE how many logins there are and there will be only you. Ok then you set up a virtual machine within that system that maps to the NIC of the host.
Now you have a virtual machine inside a virtual machine that the host service has no access to.
that second virtual machine's secure shell login is set to a non-rotating one time pad that is delivered while monitoring virtual machine 1 for alternate logins. If at any time it is suspected, the entire instance can be wiped and the one time pads discarded and a new pair generated and the process begun again
Once the nested virtual machine is operating, its memory operations are also encrypted by the one time pad, provided it was uploaded completely within the window where you were the only logged in user to VM 1, this means even with the most sophisticated memory reading technology, without that one time pad the data is unreadable, and the only way to get the pad is to have been watching while the pad was uploaded to the 2nd virtual machine.
In this scenario since we have maintained theoretically perfect end to end encryption thrice over, so the one time pad doesn't need to be large, because when you get to the end of the shared key list the last record can be used to safely transmit another arbitrarily large one time pad.
The ONLY way this scenario is compromised is:
-
A compromised kernel and since we are being careful with our distros, we know it is valid and tested by millions of man hours, this is unlikely
-
Someone using a quantum computer to crack the public key set used to secure the 2nd virtual machine via direct reading of the physical server's memory, jumping in as an invisible Man in the Middle attack in the time between the 2nd instance is spun up and the first one time pad record is received (we are talking fractions of a second)
And EVEN THEN they just have the digits of the one time pad don't contain their method, that's in the 2nd VMs kernel and is unreadable in memory unless you can guess the method perfectly the first time.
Let me give you an example, this is ridiculously simplified:
say the one time pad first entry is:
5TF7M828D3
and the method is 'add the hex value of every 3rd character and xor it with the hex value of every 2nd character', and that is the base encoding for the private key that will be secure
See?
you can be aware of the string: 5TF7M828D3, but not know how to manipulate it to get the desired secure private key
I understand the scenario you are describing to me, and that it's perfectly plausible. (I do see a potential weakness or two which I'd love to discuss separately). Let me try to clear up the confusion in the current discussion thread. What you are describing is somebody running their own software service. This is possible, I'm not arguing that. My original assertion, is that if you allow somebody else to run the SOFTWARE service for you, you are inherently at their mercy. Based on what you've just described, I'm absolutely certain you agree with that assertion. This is also the only reasonable way most of the world would have access to most online services. The idea of everybody hosting their own software stack for every service they would like to use is laughably impractical and implausible.
I think what you are trying to say is that if they have shell access it is insecure and yes I agree with that
But even if they have shell access, as long as I can be assured no one else is logged in, I can make any linux box just as secure in about twelve minutes using the above scenario.
Yes in what I described there are weaknesses such as L1 cache doping to vastly reduce uncertainty making identification of prime stripes in packets trivial, but to practically pull that off you need an electron microscope installed above a naked operating processor meaning the entire room has to be sub zero and sealed from contaminants and prepared days beforehand
Which means that any joe schmo spinning up a digitalocean droplet isn't going to be hosted on a machine with NSA grade top level memory and CPU observation installed
I was more thinking that, in theory, anything you install and run could be compromised from the get go. With enough prep, any distro could be replaced with a compromised version on the fly and you would have no way to tell. Any tools you use could similarly be compromised to give you untrustworthy output. It would require a heck of a lot of investment, but not beyond the scale of nation states, and would be pretty scalable.
How are they 'changing on the fly' the distro I downloaded the week before and ran a CRC check on?
Any tools you use could similarly be compromised to give you untrustworthy output.
Serious question, do you have any background in IT security?
I ask that because to cover this properly will take effort, and I'm not prepared to waste that on someone who won't understand what I'm writing.
How are they 'changing on the fly' the distro I downloaded the week before and ran a CRC check on?
Well, you're uploading it remotely at some point. Essentially it's a supply chain attack, where during the process of upload it's compromised by the remote server. The logic would be - they can fingerprint any reasonable distro you might use, and replace it with a pre-prepared compromised version. Any tools you might use to check its veracity could potentially be poisoned the same way, no? As I said, remote possibility and high cost, but not implausible.
Serious question, do you have any background in IT security?
A little. I'm in IT, and know the basics.
and as for 'tools I might use to check', literally anyone can code their own CRC checker in python with no python experience in like 20 mins using widely attested public algorithms
A little. I’m in IT, and know the basics.
Then you understand how statistically impossible it is to craft a modified distro that passes a CRC check?
And by statistically impossible, I mean this in a thermodynamic sense, as in that it is much more likely that you are a brain floating in a void that cohered completely from nothingness due to vacuum energy than it is that any given iteration of a modified file of considerable length will match the same CRC as an established, published, vetted copy.
It is about 100 times easier to randomly guess the private key of a bitcoin wallet than it is to iterate arbitrary changes to match CRC results.
There is a reason it is still the gold standard of file authenticity despite it being literally based on a largely unchanged 50 year old technology.
If you are running an 'illegal' service, why not host it on a virally distributed botnet and embrace the chaos and mistrust in your host systems? Might be the best way to detach from anyhing physical with a fixed location that causes traceable bills.
Yes
I would hope Switzerland isnt stupid enough to do this. Their reputation as a country is based around trust. Dozens of highly profitable privacy based companies would be forced to relocate.
While these companies make up a very small percentage of the GDP, they'd take people out of work, hurt their reputation, and take a minor blow to their budget.
Though, this isnt considering future prospects; the Proton suite is getter better, fast. It wouldn't surprise me, if in a few years, their suite could rival Google's or Microsoft's.
It could be very profitable in the future, but kneecapping the VPN would really slow things down.
Weakening encryption, or access to it, in any way, shape or form should be seen as a violation of human rights, democracy, and national security — a crime against humanity — resulting in lifelong imprisonment.
I don't know if you noticed but no nation is holding up to their reputation right now, even the progressive nordic ones
So…… We got an alternative to Switzerland as a country? Historically I always thought they took digital privacy seriously. But it seems tides are changing.
We got any other GDPR countries as good as Switzerland? How about the Netherlands?
Or is this gonna turn into a game of finding a country that just doesn’t care about digital surveillance?
Be careful with any EU country… there’s a weekly attempt to introduce backdoored encryption, because “pedophiles” and “terrorists”.
Honestly there needs to be aggressive crackdowns on pedo-smearers
But only in some countries, not all of them accepted it
They would not stop there.
Our elected representatives are way too afraid of their citizens (which many of them would not mind if they could change those 'citizens' into powerless 'subjects'), and they've become obsessed with the idea of surveilling our every move. An idea that has been very actively encouraged by an industry that is more than happy to sell them the required surveillance technology for a lot of money. Money always wins, freedom (which can't stand without privacy) is screwed.
So, I already made up my mind upon the quick disappearance of any online privacy, here in the EU. The cloud I'm using (for its full encryption) won't be able to stand against the law (and it should not). So, the moment they introduce a law to force backdoors into encryption I've already decided to quit using any form of online storage and as much online services as I can (one of the reasons I I went back to reading printed books—yep, I'm that paranoid save that It's not being paranoid at all).
Those wannabe EU dictators, worrying so much about our own well-being (as no one in their right mind would express any doubt about their true motivation) they can go funk themselves.
Well, I totally understand you when it comes to using local storage and reading printed books (having physical books on bookshelf looks cool) but from what I remember only some countries decided vote for this idea
You're right, but once a few have that law the EU is a Union (and most countries are not against controlling us), so I would not hold my breath (posted from France, so you know ;)
Same for me, if most decide that then first thing would be downloading all stuff from my clouds and removing all files online. Kinda sad to see that from one side eu tries to make ai providers unable to collect our data but eu doesn’t like us to have freedom and privacy in the internet
You think in Switzerland “pedophiles” and Co. are not surveilled 🤣😂? Bit naive thinking, you have.
I did not say that.
I said the central EU is trying - almost literally on a weekly basis - to require companies like Signal and Whatsapp to replace their end-to-end encryption with a backdoored one, and the excuses they throw up every time is “pedophiles” and “terrorists”. I am quite aware Switzerland is trying that as well, hence the announcement by Proton to leave the country if the government keeps hanging on to that dumb idea.
Proton is in IMHO blowing a lot of hot air. Where do they want to go? BTW, do you have any articles showing that the EU wants to acquire Signal or WhatsApp (???) to end end-to-end encryption and replace it with a backdoors one - just to prove that you are not spreading FUD?
The alternative is to leave cloud services, use GnuPG to encrypt your mail on your device and use a VPN / TOR for any interaction with the net.
VPNs - and even Tor - can be compromised, especially by government cybersecurity agencies, although attacking Tor may require more resources. Some VPN providers, even those that charge for their services, have experienced significant security breaches (just search for terms like “VPN loopholes” or “VPN hack” on Google). Free VPNs are generally even less reliable, and there are rumors that some may function as honeypots. Tor, while offering stronger anonymity, tends to be slower - routing traffic through multiple nodes adds considerable latency.
At the rate we going corporate won't able to provide privacy if privacy becomes illegal
Self hosting is likely the only option until ice gestapo starts raiding residentces of freedom of enjoyers. Which is the likely final stop before complete re enslavement of the plebs
One of the biggest motivators behind open source privacy is that we categorically cannot trust a profit driven entity with absolute security because every business will screw over its customers for the shareholders
IDGAF how transparent or egalitarian a company claims to be, there is a dollar price on their confidentiality, and now we have billionaires that can literally meet any price
Not everyone lives in a pristine 1st-world country.
Plebs being fucked directly correlates with their their proximity to the imperial core.
With that being said. Foss don't discriminate like that
I heard Trump in the US is doing loads of good stuff about big tech’s power; they should move there.
oh man if only this didn’t hold water for Andy
A mandatory backdoor would ruin the purpose of most security but a VPN that doesn't do VPN is just a security theater like NordVPN to some extent is just a security theater.
I am using them while I wait for Tuta drive. Tuta better hurry up.