Andre607

In this case the CEO of Rumblefish, Paul Anthony, confirmed that it was in fact one of their employees [1]:

> They still work at RF, feel absolutely terrible about what happened and are taking a whole new approach to claim/dispute reviews. A mistake like this in the hands of the right employee is a game changer and brings about significant improvement. In the hands of a less-competent employee...they fold and get worse and that isn't acceptable for me. I hope and trust that it's the former. I believe that although it was a terrible oversight, that it was an honest mistake by this individual.

[1] https://www.reddit.com/r/IAmA/comments/q7via/im_the_ceo_of_r...

Note that since that particular incident, Rumblefish has had continued incidents of blatantly erroneous coypright claims - like claiming ownership of a US Navy rendition of "America the Beautiful" (which is public domain) and proceeded to monetize it! [2]

[2] https://boingboing.net/2015/07/03/july-4-rumblefish-claims-t...

Rumblefish of course describes these incidents as "honest mistakes", which completely ignores the inconvenience they cause people and the fact that they have to make noise via social media or tech news outlets for them to take action - the real concern is how often this happens that we don't hear about.

And what do you do when you go through all of that time and effort (and potential expense) and get the very likely outcome that the claimant is not in your home jurisdiction?

YouTube's approach to takedowns is, simply put, appalling. I'm not just referring to the automated Content ID system, which has a vast catalog of false identification, but am talking about the manual, human confirmation of takedowns.

My 'favourite' (in the sense of most egregious) example of what I am talking about is the case where YouTube's Content ID flagged the sound of birds in someone's garden as being copyright infringing [1]. So far, par the course for a mistaken automatic identification. But the outrage comes after that: the copyright claimant (the notorious Rumblefish) reviewed the claim and confirmed that it was valid! In other words an actual human being looked at the video of someone in their garden, and confirmed the claim that the sound of the birds in the background was copyrighted. Actions like this are indefensible and highlight the outrageous monstrosity of YouTube's takedown system - -beyond Kafkaesque in its total disenfranchisement of users.

[1] https://www.techdirt.com/articles/20120227/00152917884/guy-g...

Biometrics is third-factor authentication (something you are). Its purpose is to supplement second-factor authentication (something you have), which is in turn meant to supplement first-factor authentication (something you know). You can also add a fourth factor (somewhere you are, or location) as an additional authentication factor as well. But it's this key point --that biometrics is meant to be one layer of multi-factor authentication -- which vendors seem to have ignored by conflating its function as supplement with its function as replacement, which it is decidedly not.

I think there is some muddling of the issues at hand here.

Yes, security is a process and involves situation-specific threat modeling, risk assessment, and behavioral conditioning. It is not just a 'here use %foo' band-aid. I don't think anyone here is disputing this.

But that is not the issue here. The issue is that once you've developed your personalised threat model, the issue of which specific tools to use is a very real one. OP has cast ad hominem FUD on VC, and provided no reasonable alternative, leaving someone to ask 'OK, if VC is not trustworthy, what is?' Security is a holistic process, yes, but that by definition includes tools alongside a valid threat model.

So back to the matter at hand: GPG does not provide the functionality that VC does (no FDE, no deniability), and BitLocker and File Vault are closed-source toolkits, are you really proposing them as viable trustworthy alternatives to VC? Which brings us back full circle to the original issue: if VC is deemed not trustworthy by OP, what is a user to use instead?

The Freedom of the Press guide is geared towards media producers. Users who need to make heavy use of Adobe, Apple, Avid production tools. Telling them to 'just get started with Linux' is not a realistic, workable approach and in a real-world setting simply results in them either not using anything or using even worse solutions.

The guide you link to is ultimately a lengthy exposition of how to use various tools, including a full section on Veracrypt.

The article proposes a concrete solution to a problem for media makers: if you need to protect your files, here is a tool you can use, and here is how to use it.

Your response is 'I don't trust this tool'.

The next question from the target audience would then be: 'OK, so what are we supposed to use?'

What would be your response?

Keep in mind, these are users most likely running Mac or Windows to do various media production tasks. Telling them to fire up your pet distro of choice and set up LUKS is not a pragmatic solution.