confounded

You shell out money to your bank, and they still sell your information.

> Why is this so hard to understand for people?

Because an extremely large amount of money is spent on UX and PR conducted by some of our brightest minds, to make it as hard to understand as possible.

Conflating security and privacy to use 2FA to get phone numbers out of people is a great example. HN and tech news sites were/are awash with security experts telling people to protect their personal information by enriching their identifiers for surveillance companies.

The box controls the DNS; majorwebsite.com points to any sever the attacker likes.

The only defense is HSTS/certificate-pinning, for sites previously visited with that browser & device (it’s a TOFU security model).

HN has HSTS, but not Reddit, or my credit union, or my local pizza place, or Kaiser Permanente, etc. etc. etc.

EDIT: I believe e.g. Chrome and Firefox bake in some major certificates, which would also likely flag MITM attacks, for those sites.

EDIT II: Someone responded below (since deleted) that you’d also need that cert to be signed by a CA your browser trusts, which is true. My explanation is faulty/poor. Better informed discussion of attacks further down the thread!

Take a look at the rest of the stories on lulz.com

It appears to be a right-wing outrage machine about black celebrities and feminists, targeted at young white North American men.

Google’s, no less! (Widevine.)

At least for me, on Linux, it’s always been opt-in, and plenty of the versions of Firefox packaged by distro maintainers get rid of it all together.

And you can play them on anything! :)

It depends what you use it for, and how you set it up. Aside from the Heads/Librem specific features, this is basically the same as a NitroKey/YubiKey. So:

- For use as a key storage device / GPG smartcard, you should have the usual contingencies in place (e.g. backups of decryption keys, alternative signing/auth keys). Only GPG nerds are likely to use this feature.

- For MFA use, you can list an additional device as another acceptable factor. E.g. a second key, or an authenticatior app on your phone.

The Heads boot validation stuff is non-blocking; you can still boot into a system without verifying the boot partition/BIOS. Alternatively, there’s no reason you couldn’t fall back to TOTP on a phone, though I’m not sure if the interface supports that currently.

Source: I put everything on a YubiKey, then lost it.

You could still use the TOTP Heads validation method with a phone (currently how it works on Librem laptops with a TPM).

Isn’t trusting the notary the whole point?

GnuPGP can be used for a lot more than encrypted emails (the subject of that post).

Is there anything wrong with notaries being able to use GnuPGP?

The British government’s thirst for authoriatarian control of the net is just about the strongest in a democracy; much stronger than that in the EU.

In fact, the EU is currently making the UK’s investigatory powers act less extreme, as they’ve ruled that state-surveillance of the population at that scale, is incompatible with the human right to privacy.

I’m not the biggest fan of the EU, but they are a moderating force on the UK’s repressive tendencies.

That’s all true. I don’t actually think that anyone is out to get me in particular, I just find unaccountable concentrations of power and authority distasteful (and troubling). So, I try not to encourage them.

I’m interested in self-hosting for autonomy more than security.

That said, the data Google controls will likely outlive Google the legal entity/business-model of today. Including that huge security apparatus. The long-term (say 10 years from now) security of your data is moot if you can’t control it.

Google have been quite good with allowing exports, and promising to delete things (probably more like perma-hash, but I’ll take it). However, they’re increasingly behaving in ways I don’t expect or like. It’s been great, but they no longer seem like good stewards to me.

Out of interest, have any self-hosters here tried one big machine with lots of VMs, as opposed to a stack of NUCs/Pis?

The recent Intel scares have got me interested in firmware and Libreboot again, and a HN commenter[0] pointed me at some extremely beefy (e.g. 16 cores!) AMD motherboard/CPU combos, that it’s possible to run fully-free firmware on.

Without doing much actual research, Xen on a big box seems like it could be a good way to have a single physical machine where I ‘deploy’ different services in VMs.

Anyone gone this route, or can think of any problems with this approach? It seems like it could be a little easier to manage, but I’m sure there are extra considerations for networking and security.

[0]: https://news.ycombinator.com/threads?id=153791098c

If that wasn’t always implicatly the plan, they would have a very low valuation.

You got me bang to rights; apologies.

So what are you doing here with us losers?

Are you aware that you sound a bit like a paid ad, or a lobbyist going through a list of talking points in the preferred corporate frames of reference?

Really? Jail time for circumventing DRM?

Have you tried Mastodon?

You still pay someone else to run the server (or not, if you prefer), you can just choose who you pay, and which server. Sending toots does not require that you set up your own infra, re: the email example.

> People don't want to moderate themselves, they want a larger power to do it for them. It's why we have representative democracy instead of direct democracy: people don't want to be involved.

This is commonly asserted, but I’ve never seen much evidence for it. Was a direct democracy given a good run in the US at some-point? Do I need communications with my friends to be moderated? Does this effect only kick-in when finding strangers, attempting to influence millions at once, or selling ads? Moderation decisions on Facebook and Twitter make headlines at the moment, it doesn’t seem to me that people don’t care, or don’t want to be heard.

I agree with you that Mastodon is unlikely to ‘take-over’ Twitter or Facebook anytime soon. But that wouldn’t be my criteria for success.

These are not Purism’s gymnastics; they’re those of the FSF.

And I kind of agree with them. If code doesn’t have DMA or network access, I’m pretty happy to treat it like the code in my microwave.

There’s firmware blobs in almost everything. I’d prefer them to be FOSS, but we all need to get things done :)

I agree with you, but having a user-replaceable battery is the single-best thing for the questionable-labor-per-device-lifetime ratio.

If there was a phone made in the USA by unionized FTEs I’d buy 20, but I’m not sure that the factories even exist in 2018.

‘Assembled’ maybe. Their laptops are assembled in South San Francisco.

See dang’s comment way down. The link was originally to a very self-congratulatory press release from the marketing person, and later changed to a blog post with details and exposition from the CTO.

Purism’s style in press releases is pretty annoying, but I really appreciate the blog posts.

I backed the phone. I’ve backed most GNU+Linux replacements for my iDevices.

If it half-works it will have wildly exceeded my expectations!

I wish them the very best.

What would you propose they do?

Out of interest, how do you tend to structure the org-files? Do you enjoy reading long-form text at a laptop/desk?

I’ve made a few attempts to do this (often with org-mode, pdf-tools, and interleave-mode), but I’ve always gone back to printing and scribbling on paper. It just feels more natural, but my notes end up being more ephemeral.

I’d like to be able to sync and search my notes very much, however! Any tips?

Source?

A good motivation to get self-hosting!

A Canadian pension fund may be a bit less aggressive for an exit than traditional SV VC firm. I'm not too worried so far.

IIRC, there are CLI flags for your first two points. I think the latter is something like —atx-headers.

You can choose whether reference links go at the end of the paragraph or the document.

Wrong thread, perhaps.

Not doubting you, but ignorant and curious. What’s the security benefit of userspace?

Easier to introspect/update/verify?

Bit of a tangent, but out of interest, why KickStarter as opposed to CrowdSupply?