71–80 of 206 posts
Given that you have said... "the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy." I don't feel the need to pull my punches. This is the most deluded, idiotic response I've seen on hacker news in a long time. It seems unlikely that the average person (or even a non-techie person of above average intelligence - e.g. a doctor) will be able to set up matrix…
After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
This is an awful attitude. Not everyone understands computers at a technical level. Not everyone has the knowledge to install and troubleshoot Matrix.
Most users are non-technical, full stop. You can't expect them to use something that requires technical knowledge.
After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
> the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy. Those of us who have worked in security have known this for years. There are countless examples of massive security gains through minor inconvenience, and users rejecting them. Two factor auth is a big one. Yeah, it's a slight hassle. It gives major security improvements. Even security people don't li…
Earlier quoted context omitted.
The first commit that they omitted in April 2020 is related to the payment feature they just announced. So the two events coinciding (server code being published and payment feature being announced) might not have been a coincidence. They apparently didn't want to bother creating a private test server running a private fork of the server code and just pushed their experiments to production, just not releasing the sou…
This leaves a very bad taste in my mouth. Unclear how much practical damage this caused (how many security analysts are using the Signal server source to look for vulns?) but this is damaging to the project's claims of transparency and trustworthiness. It’s quite clear that this crypto integration provides a perverse incentive for the project that points in the opposite direction of security.
It's been damaging to their claims of transparency for almost a year now, if anything this should be the first step in repairing that slight. How is dumping a year's worth of private work into your public repo somehow doing damage to their trustworthiness?
After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
This is an unhelpful attitude, IMHO. Your best chance, as a privacy-conscious, tech-savvy individual is to push for mass-market adoption of strong encryption and good government privacy regulations that will help everyone. Lacking those, you will stand out like a sore thumb as one of a tiny number of "weirdos" using Matrix, or Brave, or Tor or GrapheneOS or whatever other hardcore self-hosted, federated niche tools y…
Nice, if only they could be so kind after all this time to provide instructions on how to run it. I don't get why they have been dancing their reputation around Hacker News this way by not releasing sources until there were a bunch of front page posts about it.
Earlier quoted context omitted.
Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate. Note the endpoint does a DYNAMIC lookup of source code. So you can kinda reassure yourself the endpoint is executing dynamic code just by providing your own source code. It might be more obvious the runtime does nothing much if you see the runtime https://github.com/endpointservices/serverlesscells The clever bits that ac…
> Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate. If I was evil, I wouldn't have a totally separate source tree and binary that I shipped; I'd have my CI process inject a patch file. As a result, everything would work as expected - including getting any changes from the public source code - but the created binaries would be backdoored.
After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
This is an unhelpful attitude, IMHO. Your best chance, as a privacy-conscious, tech-savvy individual is to push for mass-market adoption of strong encryption and good government privacy regulations that will help everyone. Lacking those, you will stand out like a sore thumb as one of a tiny number of "weirdos" using Matrix, or Brave, or Tor or GrapheneOS or whatever other hardcore self-hosted, federated niche tools y…
I agree. I gave up fighting for privacy for other people because they don't care. I'm now fighting for my privacy because it's a war that the normies don't care to fight. They never did. Give them a shiny app and they'll sign away their firstborn.
> Your best chance, as a privacy-conscious, tech-savvy individual is to push for mass-market adoption of strong encryption and good government privacy regulations that will help everyone.
Governments, at least the one here in Germany, are already pushing for mandatory backdoors in all messengers and so far they have been hugely successful in pushing for all anti-privacy anti freedom laws they want with the only hindrance being our highest court. Just this week our NSA equivalent, the BND was granted sweeping new rights to hack messenger services around the world, to install rootkits and trojans on people's devices and listen into large parts of the internet.
WE. FUCKING. LOST.
This was all done in the open, the mass media didn't object, normies didn't object, no one cared. Heck my parent's are still using whatsapp despite my best efforts and my father is an IT Professional himself.
> any interested spooks can focus their considerable resources on the user base for these tools. Merely having these things installed becomes suspicious in a way that WhatsApp or Signal is not.
bullshit, it's massively easier to force signal/whatsapp/whatever to hand over user data then to hack my Graphene OS phone (yes, really it's my main phone), backdoor into my qubes OS notebook (yes really, i'm writing this comment using it) or attack my raspberry pi hosted matrix instance. Sure it's possible. If they want to get me they don't have to do much, just threaten me with a rubberhose. But they can't fuck me over by legally attacking large cloud infrastructure that hosts everyone.
i can't save those that don't care but i can build a fucking cyberbunker and host my own stuff in the vain hopes that it protects me from the worst, and it certainly protects me from facebook, google and co. Sure the NSA can hack me if they want to. We lost that fight before we knew we had to fight it. But at least the cost of doing it is slightly higher then using the government mandated backdoors in whatsapp, android and co.
After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
> the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy This is an awful attitude. Not everyone understands computers at a technical level. Not everyone has the knowledge to install and troubleshoot Matrix. Most users are non-technical, full stop. You can't expect them to use something that requires technical knowledge.