Earlier quoted context omitted.
Oh? My current IP is 2601:646:4300:758:f676:3f1b:8b5:42a. Please show me how to turn that into my name and home address. Thanks!
3270 23rd street, 94110?
You definitely didn't get that from my IP address.
No user accounts, by design
71–80 of 147 posts
Re: No user accounts, by design
#72Earlier quoted context omitted.
Oh? My current IP is 2601:646:4300:758:f676:3f1b:8b5:42a. Please show me how to turn that into my name and home address. Thanks!
Comcast has a portal for law enforcement to request subscriber information at https://lea.comcast.com . That IPv6 address, plus the current date and time, uniquely identifies you by name and service address. Any edits you make to Wikipedia from that address are not anonymous.
This is a use of "anonymous" that is unfamiliar to me. Do you mean something like "untraceable"? For example, when non-profits credit an anonymous donor, they know who the person is. In that more common sense of the word, Wikipedia's anonymous edits are indeed anonymous: they are published without a name attached.
Anyhow, that seems besides the point. All HTTP requests come with IP addresses. That the police might be able to trace them back to a house eventually does not say much about either Wikipedia (who would give up an IP address with a warrant whether the edit was for a named account or an anonymous one) or no-user-account systems in general.
Re: No user accounts, by design
#73The thing that F-droid are getting right here is "if we don't track you, you have privacy from us". But privacy is not secrecy. If f-droid tracked my every waking move, and then just never bother to look at that data, I would still have privacy from them. What they are doing here is a form of guaranteeing their future good behaviour. Which is nice, but there are other methods. For example I am happy to announce my pl…
> I would still have privacy from them. No, they have an unexploited asset and you think you're safe because nobody has exploited it yet. This is false security. If money gets tight they'll exploit it. If they get bought out the new owners will exploit it. If they get hacked, the entire Internet will exploit it. I would highly recommend that you spend a little bit of time thinking about or working with groups of diss…
Yes, I do live a privileged life. I think I get it. And I do not want to spark some kind of fight here. I am interested in your views and would be interested in specific cases / archetypes of concern.
But I do not want to be on the side of "we need a better way to hide". Staying hidden should not be the solution to death threats. Jail is the solution.
I hate that we (western ? US/UK?) society has abandoned hope of properly funding a justice system, let alone a mental health system.
In our society I do not want the response to death threats to be "hide better". It must be "police better". And that is expensive and difficult and long.
In other societies, well, We are not going to bring the worlds dictators down with clever messaging protocols. That is going to be old fashioned politics (and by recent events war too).
I have been very unsure about posting this - it's a very big wide topic that raises a lot of emotions. And that's because it is important - we have much to fix about our world.
Re: No user accounts, by design
#74Earlier quoted context omitted.
Oh? My current IP is 2601:646:4300:758:f676:3f1b:8b5:42a. Please show me how to turn that into my name and home address. Thanks!
GP's "directly" is a pretty large overstatement, but at the same time I've noticed something of an uptick over the past couple of years of people saying that IP addresses aren't PII or that people shouldn't be concerned with them getting leaked, and I just don't think that stands up to much scrutiny. If IP addresses didn't matter for privacy, Tor routing wouldn't exist. If IP addresses weren't useful for blocking spe…
I agree IPs are PII, and that they can lead to unmasking. I also agree the person I replied to was wildly overstating things.
But for the current context, where we are talking about whether or not user account registration is helpful in preventing abuse, I think the kinds of low-probability, long-timeline consequences you describe are not really going to deter most would-be vandals. Especially since Wikipedia is going to know the vandal's IP address whether or not it gets show publicly. So I think Wikipedia is still a good example of how "no user accounts" is workable at scale.
Re: No user accounts, by design
#75Earlier quoted context omitted.
> Note that the world's biggest content site, Wikipedia, allows anonymous edits and always has. Not really. You can't edit Wikipedia from a VPN (even with a user account!), and I think they ban most datacenters. The edits aren't really anonymous if they publicly associate with a piece of PII that, for most people, directly maps to their name and home address.
> The edits aren't really anonymous if they publicly [show your IP] Counter-example: stackoverflow is also reasonably big and allows anonymous questions, answers, and even edits, without publishing an IP address or anything. The edits end up in a review queue, the rest I think is actually published immediately.
But doesn't this content need to be reviewed (read permitted) by other non-anon user accounts?
Re: No user accounts, by design
#76F-droid gets many things right (e.g. verifiable builds), but it's just not usable in practice. Installing applications is a rare event, updating them is frequent, and needs to disrupt the user as little as possible. Android used to not allow alternative app stores to update apps without user interaction, but now supports this through UPDATE_PACKAGES_WITHOUT_USER_ACTION, which doesn't seem to be supported by F-droid.…
Not really a counter point because you mention a lot of other issues with f-droid that sound valid (I haven't used it myself) - but as a tangent regarding auto updates, I disable them basically everywhere because I seem to have buggy experiences too often if I allow stuff to update all the time. I then go through the list of updates in the Play Store once a week or so and install those that I think might improve app…
This still sucks for your usecase on F-Droid. If you look through the available updates and pick 10 to install, you have to click through 10 popups to allow the installation, one for each update, waiting in between each for the previous update to finish before being able to approve the next.
Re: No user accounts, by design
#77I'd like to point to my comment on another thread pointing out some poignant issues with F-Droid's design: https://news.ycombinator.com/item?id=30507185
Re: No user accounts, by design
#78Earlier quoted context omitted.
I'm familiar with the theory. But accounts just aren't a big barrier to determined bad actors. Note that the world's biggest content site, Wikipedia, allows anonymous edits and always has. And note also that some of big tech companies, despite having all the money in the world, still have problems with fake accounts. So at best, requiring user accounts is one possible anti-abuse step, but it's neither necessary nor s…
> Note that the world's biggest content site, Wikipedia, allows anonymous edits and always has. Not really. You can't edit Wikipedia from a VPN (even with a user account!), and I think they ban most datacenters. The edits aren't really anonymous if they publicly associate with a piece of PII that, for most people, directly maps to their name and home address.
Wikipedia also locks most interesting pages so only established accounts can edit them.
Re: No user accounts, by design
#79I tried something like this once and it worked surprisingly well, even for a UGC site. Years back we were doing something that included users documenting TV shows. We had a big meeting where people put every feature they wanted on index cards. We laid the cards out a founder's dining room table. The host got their change jar and each person got a certain number of pennies to mark features they thought were vital for…
What's been professionally frustrating me for years as a developer is how much of the engineering and operational budget for a project is tied up into identifying and tracking users. The first time this happened to me we had some idiot who insisted that we needed to display exactly how many logged on users there were on every page load. There was no point in doing so, and we had proven that it was at least ten percen…
Absolutely. I think your last point is especially good. Facebook consumes a ton of cash for what many people feel are disappointing results. Are they vulnerable to a competitor who is less about what users want than what they need? A competitor who can do that for 1/10th or 1/100th as much money? That could be very hard for the me-me-me companies to keep up with.
Re: No user accounts, by design
#80Earlier quoted context omitted.
> I would still have privacy from them. No, they have an unexploited asset and you think you're safe because nobody has exploited it yet. This is false security. If money gets tight they'll exploit it. If they get bought out the new owners will exploit it. If they get hacked, the entire Internet will exploit it. I would highly recommend that you spend a little bit of time thinking about or working with groups of diss…
Yes, I do live a privileged life. I think I get it. And I do not want to spark some kind of fight here. I am interested in your views and would be interested in specific cases / archetypes of concern. But I do not want to be on the side of "we need a better way to hide". Staying hidden should not be the solution to death threats. Jail is the solution. I hate that we (western ? US/UK?) society has abandoned hope of pr…
My friend dragged me to an Amnesty International meeting in college and for like the first half hour I thought they were joking. Surely... no, they're serious. There are movie villains out there in the world.
But since then I've had friends who volunteered for domestic abuse situations, and I've had a few friends who talked about former stalkers. In one case, the stalker was a LEO. My best friend's parents found asylum in the US, having snuck out of Poland sometime in the mid 80's, with the Communists hot on their trail. The Law would have had them swinging from a yard arm.
Jail isn't the solution in at least half of these cases. It's the stick being used against the victim, not a way out of the problem. In the police procedural dramas the cops have to assure people about how they're not INS, they're just here to ask about a murder. Those fictional scenarios, and the real situations that inform those writers, are essentially a case of Principle of Least Power playing out on the streets. Protests are often about changing the laws to match current or emerging public opinion. Changing a law means you're working against the law.
Consolidating all power into one place is how power trips end, but it can also be how they start. As someone else put it so plainly elsewhere in the thread, "You don't need to know" is an important concept and one we've lost. If I were President, I'd dismantle the TSA, and go back to something halfway between what we had before and where we are now. Because it looks exactly like the setup for a dystopian novel. We're still partly in the 'acclimate people to unreasonable request' but that's how totalitarians start out.