201–210 of 237 posts
This old post from Moxie Marlinspike in 2012 about having the worst material possessions made a huge impact on me for some unclear reason. Fun read. https://moxie.org/2012/11/27/the-worst.html
This old post from Moxie Marlinspike in 2012 about having the worst material possessions made a huge impact on me for some unclear reason. Fun read. https://moxie.org/2012/11/27/the-worst.html
Ahh, I'm from the camp of "the worst". My girlfriend is from that "the best" camp, but doesn't have too much money. So we can't use that little more expensive aluminum foil, because it's for "special occasions". She got upset because I've slightly damaged cheapest workshop vacuum (it's cheapest, but happened to be rather good quality) using it for heavy duty tasks (and saved 50x it's price by doing those tasks myself…
Earlier quoted context omitted.
As noted above, I’m pretty sure that Signal’s current state allows a user to choose whether their contacts are uploaded. But again, the point I made originally, and which you replied to, isn’t about what users may or may not do. It’s whether any messaging platforms have resolved to not store metadata, rather than attempting (as Signal has) to only store it securely. We can debate whether people agree with Signal’s ap…
You're really missing the point here. The core Matrix protocol doesn't handle contact discovery at all. An entirely separate system exists to facilitate contact discovery. You have to explicitly choose to publish an identifier to it. You choose the server you want to publish to. You choose if, which, and when to query such servers. You choose what to query them with. A server implementation can (in theory) support wh…
Per the top recommendation from matrix.org, I downloaded the Elements app for iOS. When I opened it, the very first thing it did was ask me if it could access my contacts for sharing them with my (as yet unchosen?) identity server.
Then, I registered an account and clicked the “People” tab. I was immediately prompted to enable contact discovery, via a modal called “Contact Discovery”. It specifically calls out finding contacts by email and phone number. There was never an option presented to select my own identity server, or change what info is published.
If “contact discovery” isn’t part of the core offering, it certainly makes a great attempt to look like it is. The only choice I had available to me is to decline sharing my metadata, which is the same option Signal makes available for SGX.
I get that due to the magic of open source and federation, Matrix implementations could technically use random numbers or favorite colors or some other identifier, and I’m sure there are other less recommended clients which let me pick my own identity server or only share certain slices of data. But if we can’t agree that the flow recommended on the website is the one that the vast majority of users are going to follow, there’s not much room for a productive discussion.
This old post from Moxie Marlinspike in 2012 about having the worst material possessions made a huge impact on me for some unclear reason. Fun read. https://moxie.org/2012/11/27/the-worst.html
This was an entertaining read. I'm probably more of an adherent of the worst than then best. The ideal is probably somewhere in the middle as it usually is. I bought my kid a cheap bike and it fell apart while he was riding it. So then I bought him a more expensive bike. I've bought a lot of junk and I've spent more time trying to fix the junk or replace it than I'd like to admit and I'd rather spend the upfront time…
But there is also an enjoyment to be had with nice stuff. Just be aware that that enjoyment often comes with a "duty" to care for it. The trade-off might be worth it, might not. That care might even be part of the enjoyment: my dad _really_ enjoys cleaning, waxing and polishing his Mini Cooper S (a special edition John Cooper Works model).
Earlier quoted context omitted.
> It limits the damage that some decisions can cause, but exacerbates others. Signal only allows the first-party client to connect to its network; if the developers were legally compelled to add a backdoor into that client, users would have few options. Huh? I send messages to my friends daily using the API via https://gitlab.com/thefinn93/signald which is definitely third party.
Moxie has explicitly said several times that third-party clients connecting to the main Signal servers are actively not supported and has threatened to start blocking them or enforcing the Signal trademark if they get big enough. (I tried to find a link to the exact comments he's made, but the threads involved have hundreds of comments and I'm on my phone -- he said this in one of the huge Google Play issues.)
I don't know enough about Moxie Marlinspike or Signal to really have an opinion, and was hoping to maybe learn something by reading this but I'm afraid this is more hagiography than profile.
I have lots of respect for the man and love his thinking, writing and outlook on things. His blog[1] has a lot of good reads.
Signal’s recent (not even yet out for many) implementation of mention-only notifications has reinvigorated my investment in them. I am a bit more confident now that usernames will eventually come. But the fact that it’s so slow to change is quite ironic, considering that the whole point is “the ecosystem is moving”. Well apparently it moves like molasses.
Re: mention-only notifications I definitely agree - if they exist now for groups then this makes Signal quite an attractive alternative to other messengers. I'm using Matrix for some things now but notifications are set globally (not per client/device). I'd like to keep all channels on mobile on mention-only (I try to minimize mobile notifications in general) but when I have the desktop (or web) app open I don't mind getting all notifications from particular channels. That makes me able to keep up with conversations in real time. And if I want to not be disturbed I just close the app or disable notifications globally (MacOS). With Matrix (at least the Element.io clients) this is not possible so I end up switching the notification settings back and forth...
Earlier quoted context omitted.
You are welcome to develop your argument and point out where in MTProto 2 you find fault or why using standard crypto primitives isn't enough and what you'd like to see from MTProto 2 to secure it in your mind. The gp comment literally just posted a link to a deprecated comment that painted MTProto 1 as (rightfully) insecure. That was not thorough research and it attaches the FUD associated with an unused protocol to…
The point the parent is making is that ‘not a single researcher has found fault’ is not actually a valid baseline for considering cryptographic protocol to be secure. We have to assume that all protocols are insecure by default. That is standard practice. Only protocols which have withstood serious scrutiny and incentivized adversaries can be considered to have a level of security. So if you want to claim MTProto 2 t…
I don't need to demonstrate anything other than what I have already: when would we know a protocol has received significant attention from motivated hackers? I'll take a gander and say it's when that protocol is broken and is discovered by a security researcher or someone on the crisis response team.
I'm not claiming MTProto 2 is secure. Neither am I claiming Signal Protocol is secure. Undoubtedly both protocols have undiscovered vulnerabilities. I am directly refuting and admonishing a user for linking to a Stack Exchange comment that addresses a previous protocol with almost nothing in common to the present one.
I don't know enough about Moxie Marlinspike or Signal to really have an opinion, and was hoping to maybe learn something by reading this but I'm afraid this is more hagiography than profile.
This old post from Moxie Marlinspike in 2012 about having the worst material possessions made a huge impact on me for some unclear reason. Fun read. https://moxie.org/2012/11/27/the-worst.html
In 2013, I started gradually unsubscribing from things which were not absolutely essential to my existence.