confounded

Answering my own question, suppliers of boards are available on the FSF's site (these are the boards which the FSF use themselves):

https://fsf.org/ryf

Thank you for this information!

I’m interested in something like this (though maybe not as beefy) for self-hosting.

Are there any companies that sell the gear you describe, or guides/wikis on getting set up?

AMD has an ME equivalent, which is approximately as prevalent. It’s still a DRM/DMCA-protected remote access CPU on your CPU. What could go wrong?

Buying Librebooted machines isn’t directly supporting Intel.

Just a note that if you want to avoid Intel's disastrous Management Engine, there are companies you can support that disable it.

Purism[0] sell nice MBP-style, Debian-based laptops with modern Intel processors with the NSA's 'High Assurance Platform' bit set, and as much of the ME code removed as possible. It still runs briefly at boot, but this is the most-disabled you can currently get on any i3/i5/i7 processor[1].

[0]: https://puri.sm/

[1]: https://puri.sm/posts/deep-dive-into-intel-me-disablement/

System76 are planning to do something similar[2].

[2]: http://blog.system76.com/post/168050597573/system76-me-firmw...

The last Intel processors where the ME could be removed entirely without bricking, were the non-AMT Core Duos (2008ish), which were used on the Thinkpad T400 (good for your biceps) and the X200/X200T (thick, but compact, even by today's standards).

Various companies (most prominently the Ministry of Freedom in the UK) sell these models with the ME completely removed, and a completely Free Software boot process via LibreBoot (a subset of coreboot). You can find a full list of suppliers on the FSF's 'Respects Your Freedom' hardware page[3]. Most of them will also remove the ME from a compatible laptop you send them, as a service.

[3]: https://www.fsf.org/resources/hw/endorsement/respects-your-f...

These machines are also 'naturally' resistant to both Spectre and Meltdown, and obviously have no ME to exploit. None of the Intel horror-shows of the last few years seem to have touched them.

I previously thought that running an old-machine for largely hypothetical freedoms was bizarre. After these CVEs, I'm beginning to re-examine how bizarre it really is. And I do miss those old ThinkPad keyboards :)

Please do! I would love to do this, but am far too much of a sissy to mess with SPI flash. I've subscribed to your RSS feed. Do drop any guides/artifacts in the Noisebridge IRC when you have them :)

LinkedIn may not be the site for you

How does the business model relate to the source-code being published under a Free Software license?

I don't see how the license of the software relates to it it giving you a shitty experience or not.

The shitty experiences I had on Android were largely due to carrier and OEM spyware and bloatware preinstalled on devices -- deals Google struck.

I had always attributed the security problems to Google having inadequate terms with handset manufacturers, to keep handsets up to date. Specifically, that handsets could automatically fall back to stock Android if the OEM/carrier didn't want to continue to develop their proprietary fork for that line of handsets. Maybe this is wrong. Maybe it was planned obsolescence with unintended consequences.

There are still limits in the US. You have to promise that you’ve never been a member of a communist party on entry. It wouldn’t be wise to talk about bombs near an airport, or tweet about killing the president when he’s visiting your city. People who say controversial things, write controversial articles, or make controversial films tend to get detained and questioned at the border a lot, get harassed, and get their devices confiscated.

Absolute freedom of speech doesn’t really exist anywhere. The US is probably one of the most liberal countries on earth when it comes to policing it, but it’s not like anyone can say anything.

... grep?

> It's proprietary, what I mean by that...

That’s not what that means.

I take your point in it being bound to Emacs however. Pandoc is an excellent tool for conversion though, and other editors are catching up quickly.

Unless you work for one, or have founded a company purpose-built for acquisition, I don’t see how the answer can be ‘No’.

For entrepreneurs, the monopolistic stranglehold these companies have, make them impossible to beat with a better product. The best possible outcome is acquisition. You may join, but never beat them.

For Free Software hackers, the giants turning away from open standards, and towards DRM and abuse of the CFAA, is chilling.

For a free society, surveillance capitalism needs to die.

If you have ambitions in life beyond RSUs and a regular massage, yes they are too powerful.

My understanding of this paper/space is patchy-at-best, but I am I right in thinking that this could only ever work for models where both the outcome-variable and the predictors are entirely categorical, and the input data is always encrypted with the same key?

(E.g. so that the value 'male' in the 'sex' column has the same ciphertext across subjects/observations).

If this is the case, then couldn't a standard logit model be used? (It needn't know what it's categories 'mean', either x or y).

These properties would be fulfilled by, e.g. the MNIST example in the paper (and it wouldn't take 17 hours to train!). Does anyone know where the technique in the paper would work but the one described above would fail?

> inference latency... that's roughly 5 hours,

The 17 hours in the article is to derive the 'encrypted' model. Training takes significantly longer than prediction.

> SMS/SIP features of the phone were actually on separate hardware... basically a phone that only uses SDR for connectivity?

Not exactly what you’re after, but the Librem 5 (crowd-funded, at the head-scratching stage) aims to put the baseband processor in an optional M2 slot with killable power. On a device that runs Debian. From following progress on that project I’ve got the impression that everything to do with chips for mobile connectivity are so patent/IP-law encumbered that there’s little hope for Free Software replacements.

https://puri.sm/shop/librem-5/

However, hacking on that handset is the best chance I’m aware of for you getting the device you want (perhaps with something else in the M2 slot).

At the bottom of all this seems to be the question: can any company practicing surveillance as a business model be trusted?

And if not, what do we do about this business model? Can it be reformed, or should we just kill it off?

It’s doesn’t look like it’s going anywhere on it’s own.

Your feelings are clear!

Thanks for sticking with me. I’d missed the first two of those stories in my RSS feed — they are reassuring on the commercial surveillance front.

On the CCPA, thanks for the link (a very good post, which I hadn’t seen, and you’re right, the name change thew me off). I’m still a bit surprised that I didn’t hear about the CCPA passing from the EFF, but the national business press, local radio etc. If they have objections, I want to hear them! I’m sure this will shake-out in time.

On commercial surveillance: This is still comforting murmurs/asking-nicely (which they’ve always done) as opposed formally endorsing/mobilizing-for specific, enforceable legislation, as they commonly do on government surveillance, copyright, NN, etc.

But, the posts you link do seem to indicate that this is now a stated legal priority for them, I’m glad to see CC and DB’s names on peice, as well as a focus on opt-in consent.

Consider me somewhat-reassured and optimistic, and thanks for digging these up.

On the regulation vs. animal-spirits question, I get the impression we’d agree in-person (all of the EFF’s recommendations in your links sound like good ones to me), but I’ll decline another round :)

From their repos, it’s clear that this particular software community has a strong agenda; rape, incest, and anti-black racism.

The site contains the source for other sites that provide paid email/file-sharing services explicitly to “the date rape appreciation society”.

I’m very glad that they pointed this out. FOSS code and FOSS communities are successful when their work is used, shared, promoted, and contributed to.

I’m all for freedom to be edgy, but this is a dangerous and expressly hateful community, openly devoted to radicalzing young men into hating their own species.

They’re only joking, until they’re not.

Perhaps not to you, but clearly to others, it does.

I should say that I'm a paying EFF member, have been for years, will continue to be, and I don't think that the EFF are a shill for Facebook.

However, the article gave me pause to reflect on the EFF's legislative agenda for what it calls privacy, and made me realize that the EFF's definition is quite different to mine.

Government surveillance is a problem for privacy and freedom. But increasingly, corporate surveillance is too. I had naively considered the EFF my one-stop-shop privacy lobbying organization, but I'm realizing that they're going to fight only half of my battle.

I'm struggling to recall a time when they've backed legislation which ran meaningfully counter to surveillance capitalism as a business model. I'm aware of (and extremely thankful for) Privacy Badger, Panopticlick etc., but these are really toys for nerds, not a credible threat to widespread corporate surveillance.

I'm bothered to find no mention of the California Consumer Privacy Act anywhere on their site (an extremely significant piece of legislation I'd at least expect them to comment on, which was strongly opposed by Google). To be clear, I'm not saying that underneath a rubber mask Cindy Cohn is actually Eric Schmidt, but that the EFF's eagerness not to oppose surveillance capitalism is something I naively hadn't considered before.

You make a familiar argument about the perils of regulation -- I understand this view, but don't personally share it. I'm not trying to convince you (or get you to convince me) on this issue, but my view is that regulating government activities has unintended consequences too, and waiting for the market to implement ethical choices is an call-to-inaction that could have been made (and I'm sure was) against ending slavery, banning child labor, introducing seat-belts, etc. etc. ad nauseam.

> Privacy regulations -- most regulations -- cement incumbents.

I’m not sure about this. This seems likely in industries where the user-facing product/service is necessarily tied to the business model (e.g. manufacturing cars, nuclear power plants, dentistry, etc.).

But that’s not the case with the Internet giants. Surveillance capitalism is the business model that Facebook and Google have chosen, but that doesn’t mean that we can’t have a social network or a search engine sustained though a different one.

It’s the business model, not the service (or the technology), which violates peoples’ privacy.

And it’s one that, upon reflection after reading the article, the EFF seem to be a supporter of.

I find Yasha Levine’s writing style often sensationalist (the Tor ‘exposés’ especially), and cringed a little when I saw his name on the article, but this peice contained some great history which I was unaware of.

I’d always thought of Gmail as a defining moment for surveillance capitalism, and not being in the US at the time, wasn’t aware of extremely prescient legislation about email privacy which EFF helped crush, and were extremely rude about (before the EFF staffer on the subject went off to do PR at Google).

I find it pretty amazing that EFF have said nothing about the California Consumer Privacy bill passing in the last week, an extremely significant bill for Californians, but strongly opposed by Google.

I’ll still support the EFF, but it’s clear that I should find some more genuinely pro-privacy organizations to support too.

That invasive advertising surveillance must happen — or we wont be able to afford to stay in touch with each other — is a very common argument, but not a convincing one to me. This was zucc’s argument to Congress for extracting as much personal data as possible from people.

Surely there must be a middle ground between an app that people enjoy using being worth $570B and employing 25,000 experts to tweak it slightly, and being worth less than nothing after server costs.

I agree with you that should a decentralized social media app take off, it’s likely to be less profitable, but I dont think that necessarily means that no-one wants to work on it, that no-one wants to use it, or that it won’t exist.

> a huge incentive to take advantage of people... The centralized control of our data is a separate issue, no?

Not really. The more data is centralized the stronger the advantage the centralizer has over the centralized. In other words, the greater incentive/payoff to taking advantage.

On the subject of misinformation, there are a two common, non-exclusive explanations:

- Ordinary people are ill equipped to judge the provenance of news information on the web

- Ordinary people’s news intake is being manipulated to maximize their base emotional reactions for profit. Current affairs are interwoven with cat videos and soft pornography in an endless feed to tickle the “good”/“bad” classification impulses of our slug brains.

Both are true in my experience. Little short of improved and updated education programs will address the first. However, I’m hopeful that redecentralization can help with the second.

I’m willing to give it a whirl!

I have been on exactly the same journey!

Can you recommend any of the others?

I’m aghast at how little I remember about the books I read! I’m very interested to see other approaches.

I may have got this wrong, but IIRC, Duo use a Chrome-specific implementation; it’s on Duo to use the standard. I remember reading that it’s in their roadmap, but it didn’t sound like it was coming soon.

I personally enjoy the grand tradition of nerds writing blogs only about how they set up a blog.

Why do you think this?

London Trust Media have pretty public and open positions on Net Neutrality, user privacy, and open source software.

They are a major donor to various open source projects, and are the primary sponsor of the FSF's LibrePlanet conference (to name one that I happen to be aware of).

No need to assume I’m out to get you.

Are there benefits of facial recognition cameras for law enforcement which can’t be said of other mass surveillance techniques?

Are there specific pros you want to be acknowledged?