Gargyle

Complains about tracking, uses google assets.

What an egregious mislabeling.

Data -> Chats and actual Identity

Metadata -> Who with whom and when from where,...

They construe payment info, PII and similar except chat contents as metadata and say metadata of metadata was that which is normally called metadata. And that it was safe to share despite this obviously being not true.

Everyone remembers https://www.nybooks.com/daily/2014/05/10/we-kill-people-base...

?

How does one understand the authors motivation?

Are there resources on the impact of Keybase being bought by Zoom? Zoom is out of question too because they discourage e2e and darkpattern you into installing their software despite browser compatibility and because they darkpattern you into giving cam/mic access just to listen to a broadcast-only session even if unnecessary. They place their own controlled device toggles as source of truth instead of those by the browser UI and fail in weird ways if you toggle in-browser. (Same for almost all other similar software as well)

I tossed them without a second thought after they annoyed me with Stellar. Nobody uses Stellar if they dont have a hidden incentive. It always had a huge forced marketing vibe.

Is there some sucessor to keybase?

(Motivation disclaimer: I want to dump on Keybase because in the end, even with flawless crypto at first, those organizations always erode the good things down to centralized with platform control again.)

Cryptographic Trust /= Trust in persons motives.

I guess we need better words.

SSH tooling does not make that any better tbh.

Things are being worked on.

Watch Sequoia.

Maybe some things regarding UX on my radar will surface in a range of <2 years.

You might have gotten me having this too narrow to be broadly useful. Because we were already arguing about a detail and I concentrate just on this detail, not a general github privacy overview.

The whole intention was to raise attention to a less often mentioned part of the information github exposes about accounts.

Right. They always use git@ instead of account@ and there is no further meta in the git remote url. (gut remote url is a funny typo)

(Don't expect realtime/neartime messages. I'll write whenever I feel like it.)

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCssSd91viJEmUQNx28L6JifYcGwTNEkLnmvZvdNxWxdTCrKwPEBVdlLooN90QugL/mJVwcWj9qsnOLbcoVaJlqMppY8UYlHP6OnGwKRGkpPdbKHnBA+Rrg7r8GUwdLW/PvI8DWhEPXzzWvrCNiESJWVdSCT2bTfAA3CQuPnL9cr5hcpw0i1jf7PBXRiVw2E2133KhEr91xNMH/jXh4jrly3J+kmBEmJcrkHNrHj0O8Ml+PmVQknq+tYT1DivnE2dxHoMkfdP0xP9yV9s0+7/JhU+tnXJ2+kaIOSpOOmhBPyjNYO6wkNvQh3aYzKrtcoOWPO2y56sfw9Uqlbpyr1ZU1 Gargyle

Maybe this needs more precise wording. Like ingress/signature key but more compressed instead of public key. Or peer key. Any nice ideas?

The parents comment style is inherently advice.

Can be configured in .ssh/config. Shortcut for that is to use subdirs or filenames for keys that arent searched automatically and not have a default-name-key.

I am not sure actually because I do not have any persistent github accounts. I only do them in a throwaway fashion. (Of course Github is making that more annoying by the month, as every other bigcorp site.)

Its actually the same thing. A shared identifier. Of course email is another thing to separate for separate identities. But it is way more widely known that email adresses are used ad an unique identifier.

I am just wary of flattery and "my friend". I am not especially suspicious of your motives but we don't know each other yet. If you want to have an interesting conversation with me I am positive to do that pseudonymously. Maybe leave me a pubkey here

That happens as part of the ssh handshake. And is the basis of this whole scheme. No idea if there is tooling to.do.that for arbitrary messages.

Attaching this to cryptoassets increases your operational (more mental overhead, doesnt work with simple keybearer devices, you assume people to be lazy and bad at key management) and technical (irrevocable ethereum-bugs that can only be mitigated by chain splits) complexity.

Albeit for long-term public signatures I see the benefit in spreading the sig and revocation information from the classical tools in to as many hard to modify places as possible. Popular global databases like Ethereum and similar are good condidates for that.

And of course have the verification scheme expose inconsistencies between different key-sources and tag them with their respective power structure categories. (Lime Government, Cryptocurrency-Devs, HugeCodeHostingPlatform, CompanyBehindHugeCodeHostingPlatform, etc...)

Is that sarcasm?

Then this is bad advice in general because its specific to a low trust expectation. Would be sensible to note that in your comment.

The crowd that needs privacy is also the most high stakes and vulnerable crowd. They are the people that may save civil society with a structure built by thousands of small stones. Dismissing concern in that area is inherently giving tyrants and aspiring ones power.

To shortcut a lot of this developing twister of why people should use different keypairs for different ssh hosts:

Its a big privacy leak, not a big security leak.

Your Pubkey can be used to cross-match multiple identities. Example: You have different coding personae. One that is activist, one that is company-peon. Different accounts, same SSH pubkey in Github or other server with publicly listed pubkeys --> Same person confirmed.

As a result of this the information can be used to target each of the identities in a more precise manner. On the human layer of the security side: New phishing/deception/blackmail vectors.

On the organizational layer: we have to target these keybearer devices now.

Maybe it even helps in a cryptanalytic way in some weird exotic scenario but not substantially.

And of course separation of concerns if you have different keybearer devices.

(Also the famous Keysticks are a nice solution to that organizationally but they are an additional risk for big scale attacks by having biased RNGs. In the end its hardware and audits are just a voluntary thing by corps. They can always choose to hide things from auditors or do a compromised batch at their mercy.)

Nothing new. You can't install your own software without store approval.

No source.

When I got a coin everytime I watch people in newer SUVs being entirely confused why the damn thing doesn't start now completely stunned by the sheer number of stuff on the dashboard and middle screen. Or tell their passengers to go fiddle with the aircon system because the cognitive load is too high while driving. Old cars with knobs you learn it once and you can use it without eyes.

I am used to US credit cards and moved to Germany a few years ago.

In Germany credit card chargebacks are very cumbersome. I had 3 banks' customer service tell me at first that it isn't possible (like they had no process for it or the agent never did that or is too lazy) and then the next agent said it works but has huge-list-of-drawbacks-fill-9001-forms-and-waste-days effort.

Because Chrome is already dominant as bad as it is. They are both equally detrimental to society.

Which is still way more than most other os updaters need to download.

Also its incredibly slow. Updating a bunch of computers with i9, 64gb ram, nvme and gigabit uplink from an older iso install to recent still took half a day and 4 restarts on average.

Do they deal with the hassle of maintaining phone numbers for me? I obviously want different numbers for my messengers and for the phone I walk around.

That would be disingenious. Ever had a thing that wanted to encrypt text in a browser? Those things could finally make sense. Or that one offline wallet generator. It would be sweet if software become actually finished.

Where did they actually do nice things?

VSCode is still not entirely open source and the official builds have spyware included.

Because that is not obvious and your post looked like uncharitable interpretation of uncertain things.

Are there others than Tom Scott claiming this?

Are there underhanded motivations propable on Tom Scott's side against BraveBrowser or the other way around?

My motivation? Wanting a browser that is actually pro-user.

If BraveBrowser (wont ever use brave as adjective there) used their platform to do underhanded tactics against people that didn't attack first than this would be interesting and a reason to toss any thought about using it. I don't see a trend there yet. More sources? I crave.

I'd love if Mozilla got their shit together but I am not seeing it coming.