PureParadigm

> First, all these alleged problems exist for absentee ballots, and yet no one complains about that.

Fair enough.

> Second, voting fraud is exceptionally rare in the United States

This doesn't make sense as a justification for relaxing restrictions. Perhaps it is because of the existing restrictions that fraud is so difficult and low, so then relaxing restrictions en-masse would increase the rate of fraud. I'm not saying this is definitely the case, but citing a low current rate of fraud as justification for making fraud easier doesn't make any sense at all.

> Even if you tried to purchase votes, you can’t purchase enough to shade an election, and stay clandestine

In most cases, this is true. But there are elections that are decided by a few dozen votes (maybe local elections, and more rarely larger elections), so a small amount of fraud could change the result.

> If your vote was coerced you can always request another ballot, which invalidates the first.

And whoever is coercing you could also ask for the info for the My Voter Status website [1] and verify that the ballot that the person coercing used was the one that was counted (maybe based on the date recorded as received by the county). They could definitely make sure you didn't go vote in person.

> If you're getting paid to vote a certain way, then nothing here really changes. California already had vote by mail as an option.

The number of mail in votes increases significantly, so if you believe in potential risk with those, then there is a significant increase in overall risk.

[1] https://voterstatus.sos.ca.gov/

One criticism I see often of many electronic voting systems also applies to vote by mail: it does not protect against external pressure or buying votes. Someone could easily offer to buy blank ballots (especially from poor voters who may need the money), or otherwise coerce/pressure people to reveal their ballots and break anonymity. I realize actions like these are already a crime, but one of the main reasons for the secret ballot is to protect against situations like these by making it impossible to do.

Perhaps this compromise in the integrity of the voting system is one we want to make in these unusual times, but I think it is important to point out that there is indeed a compromise here. Mail voting doesn't come without its own issues.

Sure, you may think all these people are racist. Does calling them racist change anyone's mind? No, it just makes them and their supporters mad at you and just poisons the well.

Instead, debate the policies. Explain why they're wrong in a reasonable conversation. You'll actually have a shot at changing people's minds this way.

> Online misinformation can kill people [...] Such content should be forced off mainstream platforms.

Censorship can kill people. Look at China's initial reaction to COVID19, to name a timely example. Admittedly, YouTube doesn't censor to the extent that China does, but whenever you have censorship you open the possibility of censoring life-saving speech, which may be controversial at the time.

Yes, if taken blindly without critical thinking, online misinformation has the potential to do harm and even lead to deaths, as you mention. For freedom of speech to work best, you need an educated and thoughtful population. If you think people are sheep and believe everything they read online, then certainly at first pass it sounds like censoring what they see is the right move. But this relies on a critical implicit assumption: that you (or the censor you defer to) know better and are never wrong. Have you ever changed your opinion? Perhaps you from five years ago would censor something important you would say today. There is no flawless human being in the world that can be trusted with this power.

Okay then, how about we just censor the obviously bad stuff, like Nazis or the 5G conspiracy theories? As other commenters have suggested, censorship will just feed into their narrative, further radicalize, and drive them underground. Instead, for things that are indeed so obviously wrong, simply explain why. Counter their flawed ideas with your correct ideas. If they're so obviously wrong and you're so obviously right, this should be trivial. Reasonable people will see that you're right, and those that don't would be radicalized anyway.

> It strikes me as odd that more people seem to want YouTube to permit far-right propaganda on their platform, than want YouTube to permit 'adult content', which just about no-one advocates.

Personally I would have no problem with adult content on YouTube as long as it's labelled as such. And it's not just "far-right propaganda" that falls under free speech, but also "far-left propaganda" and anything in between. True free speech would not discriminate.

> 'Disagree with' is trivialising the problem. This stuff is serious.

Censorship is also serious, and has serious consequences. It is important to think carefully about the consequences of censorship.

You're absolutely right with the advertising aspect. YouTube is not simply a video hosting platform. It is also an advertising platform.

YouTube's dominance is not because video is impossible to host but because YouTube takes care of the advertising/revenue aspect for content creators. Any competitor would need to provide a similar service, and that's hard to do at the same level when you're not run by the world's largest advertising company. A serious alternative to YouTube would need to draw creators like YouTube does, and you need some sort of built-in way to (probably economically) incentivize them to create videos and put them on your platform.

I agree with what you say here. Freedom of speech does not obligate YouTube to give anyone a platform, as they are a private entity. It does not obligate anyone to listen to you. What the top level comment is saying though, is that just because there is no legal requirement, doesn't mean we can't "ask nicely" or otherwise strive towards the idea that the predominant video platform refrain from censorship.

There is no legal obligation for YouTube to listen to us, but there is no reason we can't ask for less censorship. If they say no, then they are well within their rights, but we don't have to be happy about it either. Just because we can't legally force change doesn't mean we must abandon the cause. The most optimistic scenario would be if public sentiment changes enough such that YouTube feels they are being seen as unfair and it is damaging to their reputation/bottom line, perhaps we may see a change in their censorship policies. This is an ideal to strive for, and uses social/economic pressure as opposed to legal pressure. It is like your obligation to be a helpful neighbor or to be a caring friend. It's not by force of law, but people are expected to do it because it's "the right thing to do." In the same way, when you're the predominant video platform on the internet, the right thing to do is not to censor opinions you disagree with.

It's incredibly unlikely you'll agree with the powers that be on every issue, so you'll find yourself deplatformed, and unable to speak out against injustice. As you mentioned, you feel that the powers that be are suppressing certain ideas. If you want censorship, guess who will be in charge of deciding what to censor.

Sure, astroturfing and other misinformation campaigns can happen if speech is truly free, but the alternative is far worse. With free speech, if your ideas have merit then at least there is a chance they will be recognized and your audience can grow. With complete censorship, you have no chance at all. Free speech is the least bad of these two options.

Yes, as the parent mentions, YouTube can do the same kind of content curation from a legal point of view. The question is whether YouTube is a platform where we should advocate for less censorship/more freedom. I think that since YouTube is a general platform and that no serious alternatives exist, we should advocate for less censorship.

YouTube is different from Hacker News because YouTube is more of a general platform (not focused on a particular topic). In contrast with Hacker News, less censorship on YouTube would not significantly degrade the experience. You can still go subscribe to the channels you like and be completely unaware of the content you don't want to see. On Hacker News, the whole point is that it is focused on particular subjects (I suppose it would be analogous to a curated list of YouTube channels), and its rules keep it that way.

Another factor to consider is what alternatives exist. As far as I know, YouTube is the only serious option at the moment for general video content. YouTube content includes news and politics, and many people use it as their primary source of information. No matter what your politics are, they will likely differ from Google's in some way, and if YouTube begins to aggressively censor opinions they disagree with, you'll find yourself without a platform since no serious alternatives exist.

I use Syncthing [1] and restic [2]. I use restic to backup the important things to several backends, including a home server (Raspberry Pi equivalent) and cloud storage. If you worry about getting your software/operating system up and running in the same way as before, you can use a declarative operating system such as NixOS [3].

[1] https://syncthing.net/ [2] https://restic.net/ [3] https://nixos.org/

I just keep Wireguard on even when on my home network. With NAT Loopback on the router this works fine. Is there a reason to have it off?

Right, that's why I said robust. But I'd push back against the idea that a normal user shouldn't be expected to have backups that are safe in such an event.

If you want to guard against rogue software (or clumsy fingers in the terminal), you'll probably need to have remote backups. It sounds like copies on the cloud saved this user, and it's not unrealistic to suggest users backup to the cloud (I think many already do with OneDrive/iCloud/Dropbox). If you're a Linux user who likes to tinker, you can set up a Raspberry Pi with a hard drive attached and use restic over SFTP (or any of the other numerous choices).

RAID is not a replacement for backups. In the case with Steam the top level comment mentioned, all files writable by the user were deleted (including mounted drives in /media). RAID might protect you against hardware failure, but you also have to consider software (bugs/hackers/ransomware).

You might be interested in Syncthing [1] with the option to keep previous file versions enabled. I use it as one layer in my backup policy by having it on my computers+phone. If I take a picture on my phone, it is synced within minutes to my desktop at home. If I make a document on my laptop, I have a copy on my phone in case something happens to the laptop.

[1] https://syncthing.net/

You can have his fortitude in the face of all your files being deleted if you have a robust, automated backup policy.

One of my professors used to say that he should be able to destroy your laptop, buy you an equivalent new one, and you should be up and running again within a few hours. Hard drives fail all the time and computers get lost/damaged/stolen. Losing your home directory on a computer should be expected, and definitely not the end of the world.

Yes, they're temporary. The concern is that if the shut down ends soon (seems unlikely but who knows) then it will delay an economic recovery until the temporary benefits expire. For a faster economic recovery we would want as many people getting back to work as possible. If you make more money not working, the rational choice is to wait for the temporary benefits to expire and then go back to work.

As current college student who went to a competitive (but not the most competitive) Silicon Valley high school a few years ahead of you, your story rings true. I thought I'd share my story to show my post-graduation perspective.

In my high school class the students who got into Ivy Leagues were either legacy students or the ones that took as many AP classes as possible and had other activities to boost their resumes. (Without legacy, this was not a recipe for admission, but if you didn't do it then you wouldn't get in except in the most exceptional circumstances.)

Since band (and marching band) were not considered AP or Honors, some students had parents that would forbid them from taking these, as it would lower their weighted GPA.

I was a straight-A student for all four years in high school, but focused on the AP/Honors/community-college classes I was genuinely interested in (physics, math, computer science, etc.). Unlike many of my most competitive peers, I also made time for things I enjoyed that may not be the most appealing thing to colleges, like marching band and the computer programming club. I had a deep interest in computer programming, and had numerous side-projects to show for it. I also got a 36 on the ACT. I did not get accepted into any private school I applied to, but had my pick of top UC schools.

Would I do anything differently (perhaps take those extra APs, drop out of band, or focus more on artificially building up my resume) for that chance I might get into a more prestigious college?

I don't think so. My peers struggled with anxiety and depression, and school morale in general was laughably low. From my contact with friends who graduated after me, it appears the situation is only getting worse. Activities like marching band were the only things that kept me sane and their enrollment numbers are becoming anemic. Despite my attempt at having a balanced life, there were countless long nights filled with anxiety and stress as I worked to keep my GPA spotless.

My first semester in college was a relative breeze compared to high school, and many of my peers from high school agreed. But college can be as hard as you make it, so the next semester I doubled up on technicals and am on track to double major. I also got some great internship opportunities and a chance to do research. My high school math teacher would often tell worried students that college is what you make of it, and where you get in (or not) need not define who you are.

As for my future career, college names do mean a lot on resumes, but not getting into an Ivy League is not the end of the world. Recruiters still come to campus, and my friends at lower-ranked colleges have gotten internships at FAANG companies. I think the college name just dictates how much harder you have to work to be noticed by a recruiter.

But what exactly is the end goal in all this? A life in an insanely expensive area working long hours to stay to competitive? Is there another path? These are still questions I ask myself, and I don't think I have the answers. I suppose this is where each person needs to look deeply within and figure out what is best for them, and thank goodness I didn't lose sight of my real self in high school in order to build up an artificial resume. Some of my peers did, and immediately enrolled in the CS program despite having barely touched a computer program before college. I really hope they find what makes them happy, and don't get stuck in a career they hate. Perhaps someone a few years ahead of me can share some wisdom.

I've been typing Dvorak on my computer since middle school and so I thought it'd naturally be a good idea to switch my phone... turns out not so much. While having all the common letters on the home row is good for regular typing, it is not good for phone typing which is heavily dependent on autocorrect. If I miss a letter by one key it's still likely for it to be a valid word because common letters are clustered and autocorrect misinterprets. For example, I might type "i" and then "t", "n", and "s" are all adjacent meaning if I meant to type "is" and I miss by one key and type "in" then it is not corrected. Other annoying ones are "by" and "my" because the b and m are next to each other.

Sadly, I'm in a bit too deep to go back to Qwerty on my phone (I'd be very slow for awhile). I do still enjoy Dvorak on the computer and while I don't think I'm a faster typist than I would be with Qwerty, I rarely (pretty much never) experience finger strain when typing for long periods.

Thanks! I like that you can delete on mouse movement -- I think it's actually better and more intuitive than my original suggestion.

Awesome! Another option if you don't want to take over right-click behavior could be shift-click (holding shift and clicking), or similar.

I realize the point of this is to be simple, but I can't see myself using it unless there is some way to delete elements after they have been created (maybe dragging a diagonal line with right click should delete anything in the box defined).

I know you can use Ctrl-Z but if I want to change a box I made early on then this doesn't work because I'd have to basically start over from scratch.

It does not name specific sources, but it is not hard to find some. For example, in my programs I check passwords against the API provided by haveibeenpwned.com.

More context from the guidance below from https://pages.nist.gov/800-63-3/sp800-63b.html

> When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to:

- Passwords obtained from previous breach corpuses. - Dictionary words. - Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’). - Context-specific words, such as the name of the service, the username, and derivatives thereof.

If the chosen secret is found in the list, the CSP or verifier SHALL advise the subscriber that they need to select a different secret, SHALL provide the reason for rejection, and SHALL require the subscriber to choose a different value.

For code signing to work you need to trust whoever is signing the code. As you mentioned, with HTTPS, all the contents are already signed by the web server. If Jitsi published a native app and signed it, would that even help you? You still have to trust them because they could have signed anything.

Maybe you mean to compare it to a copy that has already been audited by someone else? Then you might as well use the auditor's web server to get the client (and you can do this because Jitsi can be self-hosted). So I think it just comes down to connecting to web servers run by people you trust, since HTTPS already takes care of integrity checking.

According to NIST's memorized secret (aka password) guidelines [1]:

> When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised.

If Zoom had enforced that passwords can't be from a list of already compromised passwords as this guidance suggests, this attack wouldn't have been nearly as successful. This is just what happens when you don't have a decent security policy, and everyone that doesn't follow basic security best-practices should be called out for it.

[1] https://pages.nist.gov/800-63-3/sp800-63b.html

There's a lot of discussion here about key exchange, and how you need to trust whatever service is managing the keys. From the demo, it looks like the key is basically a password. If you can share the password out-of-band through another secure channel (perhaps post it in a Signal chat or something), then your meeting should be secure. It can even be included as part of the link.

But then doesn't the Jitsi web server have to access password when you enter it on their website/have it in the link? Nope! It looks like they're putting the password in an anchor fragment in the URL, which is not sent to the web server [1]. So all encryption/decryption is being done client side (and is therefore real end-to-end encryption).

Yes, it's possible the web server is sending you evil JavaScript that is extracting your password anyway, but at least that's something you can in principle check. For all end-to-end encryption to work, you have to know your client is not compromised.

[1] https://stackoverflow.com/a/3081862

> It seems clear that there has to be a single key, rather than separate keys for each pair of participants, since in a large meeting we need all video streams running through a server and everyone receiving the same streams, for manageable upload bandwidth.

Why is this the case? Watching streams on Twitch or YouTube with HTTPS are all encrypted individually for each connection. It's not like TV or radio where you have to broadcast the same thing to everyone.

> But therefore... as long as you're trusting the server with key distribution/management in the first place... don't you necessarily have to simply trust that the server isn't peeking?

I think you're right that you'll need to trust key distribution. Some companies might actually have PKI set up properly and can do this. Other individuals who are particularly privacy conscious may also have this. Just because verifiable E2EE might not be applicable to a mass market doesn't mean it's not incredibly useful for those who do need it.

I don't think there's an easy answer. It will very much depend on your hardware and what kind of software you run. I'd say the best way to tell is just to try it, measure performance, and compare results.

On Signal you're encouraged to verify out-of-band (such as in person) with the "safety number" which allows users to verify each other's keys to prevent a man-in-the-middle attack. This way you'll notice if the initial key exchange has been compromised.

I don't think that's true. If the VPN is compromised then the Signal traffic over it should still be encrypted (that's the point of Signal). As long as the VPN doesn't block your access to Signal you should be fine, and there is no risk the VPN would read your messages.

Not true for me. I've used several distros (including Ubuntu) with Gnome on my 4K XPS and the worst I've had to do is go into Gnome settings and click 200% GUI scale. I'm pretty sure Ubuntu set that automatically.