• 5 Posts
  • 142 Comments
Joined 2 years ago
cake
Cake day: April 27th, 2024

help-circle
  • It’s just a helper. It’s a way for your calendar to ask “uhhh… Should I already know of any calendars…?” and the service going “oh actually yeah, the user configured their email account, hold on, here’s the corresponding calendar”.

    That’s just basic functionality. Maybe what’s tripping you up is that it’s a separate service? Because I assume you have nothing against inputting your email into a mail client and a calendar separately.

    If so, then for one, it’s not really a difference if the mail app stores this into or the service does; and second, it’s a good thing to have this standardized into a single purpose built service, rather than having each app reimplement this stuff.

    CPU and RAM usage is so negligible it’s laughable.

    IDK.

    It seems like you read something about personal data in the service description and just jumped to the conclusion that this is something nefarious.


  • How exactly is it bloatware though? Not a KDE user myself, just had a look at the wiki. Seems it’s just a convenience utility to allow you to not have to enter the same things into multiple applications?

    This is VERY different from pre-installed apps in your start menu that collect and sell info about you…

    Yeah, thinking more about it, I don’t think the term “bloatware” (as it is commonly used) applies here at all.

    How do I completely disable it forever?

    To answer your question: sudo systemctl mask <servicename>.service

    The much more common disable just disables autostart; masking will point the service file at /dev/null, which makes it impossible to load or start the service, even when other services or apps (like the clock widget someone mentioned in the comments) request it.


















  • Huh - you’re right. I went back to Signal’s X3DH spec because I was sure I was right, but it seems I misremembered how the “prekey bundles” work: Users publish these to the server, allowing (in my original assumption) for the server to just swap them out for a server/attacker-controlled key bundle for each Alice and Bob.

    However, when Alice wants to send Bob an initial message and she gets a forged prekey bundle, Bob will simply not be able to derive the same key and communication will fail, because Bob knows what his SPK private key is, while the server only knows the public key.


  • A compromised server would allow the server to man-in-the-middle all new connections (as in, if Alice and Bob have never talked to each other before, the Server/Eva can MITM the x3dh key exchange and all subsequent communication). That’s why verifying your contact’s signatures out-of-band is so important.

    (And if you did verify signatures in this case, then the issue would immediately be apparent, yes.)

    Edit: I was wrong. See below.