Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
eupolicy.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
This Mastodon server is a friendly and respectful discussion space for people working in areas related to EU policy. When you request to create an account, please tell us something about you.

Administered by:

Server stats:

239
active users

eupolicy.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

#cookie

6 posts6 participants1 post today
Public
Felix Palmen :freebsd: :c64:

Just released: #swad v0.2

SWAD is the "Simple Web Authentication Daemon", meant to add #cookie #authentication with a simple #login form and configurable credential checker modules to a reverse #proxy supporting to delegate authentication to a backend service, like e.g. #nginx' "auth_request". It's a very small piece of software written in pure #C with as little external dependencies as possible. It requires some #POSIX (or "almost POSIX", like #Linux, #FreeBSD, ...) environment, OpenSSL (or LibreSSL) for TLS and zlib for response compression.

Currently, the only credential checker module available offers #PAM authentication, more modules will come in later releases.

swad 0.2 brings a few bugfixes and improvements, especially helping with security by rate-limiting the creation of new sessions as well as failed login attempts. Read details and grab it here:

github.com/Zirias/swad/release

New features: Configurable rate-limits for new session creation Configurable rate-limits for failed login attempts (per session, realm and user name) Configurable types of proxy headers (X-Forward...
GitHubRelease swad 0.2 · Zirias/swadNew features: Configurable rate-limits for new session creation Configurable rate-limits for failed login attempts (per session, realm and user name) Configurable types of proxy headers (X-Forward...
Public
Felix Palmen :freebsd: :c64:

Released: #swad v0.1 🥳

Looking for a simple way to add #authentication to your #nginx reverse proxy? Then swad *could* be for you!

swad is the "Simple Web Authentication Daemon", written in pure #C (+ #POSIX) with almost no external dependencies. #TLS support requires #OpenSSL (or #LibreSSL). It's designed to work with nginx' "auth_request" module and offers authentication using a #cookie and a login form.

Well, this is a first release and you can tell by the version number it isn't "complete" yet. Most notably, only one single credentials checker is implemented: #PAM. But as pam already allows pretty flexible configuration, I already consider this pretty useful 🙈

If you want to know more, read here:
github.com/Zirias/swad

Simple Web Authentication Daemon. Contribute to Zirias/swad development by creating an account on GitHub.
GitHubGitHub - Zirias/swad: Simple Web Authentication DaemonSimple Web Authentication Daemon. Contribute to Zirias/swad development by creating an account on GitHub.
Replied in thread
Public
Felix Palmen :freebsd: :c64:

DId lots of smaller improvements to #swad ... but first, I had to hunt down a crash 🤯. Finally found it was caused by my #poser lib (to be fixed later): A connection there can resolve the hostname of a remote end and does so in a thread job to avoid blocking. If the connection dies meanwhile, the job is canceled. Seems my canceling mechanism relying on a signal to the thread is, well, not reliable (the signal can arrive delayed). Ok, for now just disabled name resolution to sidestep that.

Now, integration with #nginx is much better. I intrdoduced (optional) custom headers to transport the authentication realm and the redirect URI, plus state management in the session, so these can be passed to the "auth" endpoint. This requires to make sure nginx always passes the session #cookie, Unfortunately, I still need a "hacky" redirect configuration for login in nginx. If auth_request could just pass the response body, this would be unnecessary .... 🙄

The nginx configuration shows #swad running on "files" and another nginx running on "wwwint" serving #poudriere output there. This nginx instance helpfully adds cache hints, which I have to override, so a redirect works as expected when for example the swad session times out.

Full nginx configuration integrating swad for authentication
swad log output showing bots trying unauthenticated access
#C#coding
Public
utzer [Pleroma]
Ich wollte nur ein #Rezept für #Pasta. Bekommen hab ich:
• 7 #SEO-optimierte Pseudo-Blogs mit 30.000 Zeichen Lebensgeschichte
• 4 Seiten mit 37 Werbebannern pro Scroll
• 3 #Affiliate-Schleudern mit Amazon-Links zu Knoblauchpressen
• und einen #Cookie-Banner, der mich emotional erpressen will.

Am Ende hab ich ein #LLM gefragt – nicht, weil’s schöner ist, sondern weil die #Suchmaschine kaputt ist. Willkommen im #BullshitWeb: Wenn du nicht klickst, existierst du nicht. Und wenn du klickst, willst du danach eigentlich nur noch offline leben.
Public
Stiftung Datenschutz

📢Österreich: VwGH-Entscheidung zu #Cookie-Bannern

Der VwGH bestätigt: Eine erschwerte Cookie-Ablehnung verstößt gegen die #DSGVO.🔗ris.bka.gv.at/Dokument.wxe?Abf

@privacyDE (Stiftung Datenschutz):

„Noch immer verstoßen viele Cookie-Banner gegen gesetzliche Vorgaben. Oft wird die Ablehn-Funktion hinter sog. Dark Patterns versteckt. Dabei handelt es sich um ein Design, das das Auffinden der Ablehn-Funktion erschwert. Die österreichische Entscheidung stärkt das Recht der Nutzenden.“

ris.bka.gv.atRIS - Ra 2024/04/0424 - Entscheidungstext - Verwaltungsgerichtshof (VwGH)
#TeamDatenschutz
Public *
Frederik Borgesius

New pre-print online:

‘The EU Digital Services Act: what does it mean for online advertising and adtech?’

By Pieter Wolters and me.

We explore the question: what does the Digital Services Act mean for online advertising?

We show that some types of ad tech companies, such as ad networks, should be considered platforms.

Comments are welcome! It's a pre-print, so we can still improve it.

arxiv.org/abs/2503.05764

Screenshot of the paper abstract. It says: 'We describe and analyse the DSA rules that are most relevant for online advertising and adtech (advertising technology). We also highlight to what extent the DSA's advertising rules add something to the rules in the General Data Protection Regulation (GDPR) and the ePrivacy Directive. The DSA introduces several specific requirements for online advertising. First, the DSA imposes transparency requirements in relation to advertisements. Second, very large online platforms (VLOPs) should develop a publicly available repository with information about the ads they presented. Third, the DSA bans profiling-based advertising (behavioural advertising) if it uses sensitive data or if it targets children. Besides these specific provisions, the general rules of the DSA on illegal content also apply to advertising. Advertisements are a form of information, and thus subject to the general DSA rules. Moreover, we conclude that the DSA applies to some types of ad tech companies. For example, ad networks, companies that connect advertisers to publishers of apps and websites, should be considered platforms. Some ad networks may even qualify as VLOPs. Hence, ad networks must comply with the more general obligations in the DSA. The application of these general rules to advertisements and ad networks can have far-reaching effects that have been underexplored and deserve further research.' (We deleted some sentences here because of the word limit)
#eu#law#dsa
Public
informapirata ⁂ :privacypride:

#Cookiewall tra silenzi e scuse: non tutto ciò che infastidisce lede un diritto e non tutto ciò che lede un diritto infastidisce.

Leggere un articolo online inizia a essere seccante a causa dell’impiego diffuso dei #cookie #paywall. Viene però il dubbio se al di là del fastidio, che santo cielo possiamo liberamente provare per qualsivoglia cosa dell’universo mondo, non ci sia anche una violazione di qualche tipo di diritto.

gdpready.it/blog/cookie-paywal

Il post di @m0r14rty su @privacypride

Public
Regina Mühlich ✅, Datenschutz

Im aktuellen Newsletter (28.02.2025) der #Datenschutzstelle #Liechtenstein geht es um drei Themen, welche mehrfach in der DSS aufkamen bzw. von ihr in Verfahren gerügt wurden:
➖ Hinweis zur optischen Gestaltung von #Einwilligungsmanagement-Tools (#Cookie-Bannern) auf Webseiten
➖ Vorsicht bei der selbst-deklarierten #DSGVO-Konformität von Softwarelösungen oder Cloud-Diensten
➖ Hinweis zu Risiken bei der Nutzung von #DeepSeek
datenschutzstelle.li/aktuelles

www.datenschutzstelle.liAktuelles aus der Datenschutzstelle #4
ExploreLive feeds
About