jon128

Yes, there is actually a way to solve the end to end tacit permission problem, which involves cryptography (obviously). And yes, there is a way to make it ergonomic in a way that users could actually use and understand it well enough that the below-average user would do fine with it.

With this problem solved, all of the anti-spam stuff and all the trouble that comes with it becomes obsolete. Until this has happened, email is going to continue suck a lot.

In some places these mesh networks have nodes that offer paid gateways to the conventional internet.

Writing user-facing social/messaging applications that can work seamlessly between emergent mesh networks and the conventional internet, using cryptography based zero-knowledge tricks to preserve privacy, is necessary for these mesh networks to gain traction outside of just tech enthusiasts.

Some rural areas centered around some small towns have already done this but have kept it to themselves (understandably so).

  https://en.wikipedia.org/wiki/Cjdns

  https://reticulum.network/

  Why do you need an AR-15

The solution is an application framework that removes the 3rd party between any two users or groups of users. The client/server model can't do that. Other models can.

If Facebook/Instagram didn't meddle with users' conversations at scale, the social climate would be very different today. Not because the users can't think for themselves, but because they can.

These systems are not the internet, they run on top of the internet.

If you have ever used Facebook/Instagram or Twitter or know enough people who have, you really need to see this https://rumble.com/v4dxvjo-ep.75-tucker-carlson-interviews-m...

A distributed application model that provides for all of the cool applications we enjoy today without creating "moderation" hotspots for the "reddit mod" archetype, or the "whole of society" horse shit, is the solution that will give non-technical normal people, a systematically oppressed and marginalized demographic specifically, what they have been wanting for since 2018.

A major part of the freedom multi inter-network that freedom loving people want picture, are networks and inter-networks that can survive government-imposed internet kill switches, the topic of the "darknet plan" mentioned here https://news.ycombinator.com/item?id=50235196

I remember r/darknetplan

There are a handful of projects and protocols that are about a fraction of the way to total freedom but they haven't been synthesized into something cohesive yet. What a functioning freedom oriented multi inter-network looks like is a whole different suite of protocols built with a mindful intent to shirk some anti-patterns and ossification of today's conventional web. One key objective is no more Cloudflare shit. inb4 "but how do we deal with bots", different protocol suite model, different "architecture".

About a healthy internet, if you care about that IPv6 with PCP is what you want. CGNAT kills peer to peer traffic, CGNAT is de facto censorship, upstream and at scale. If you care about the internet, then start proactively turning off IPv4 and shunning people who say that IPv4 is "okay". CGNAT can be kludged around with proxies because the internet is so fast but it requires a lot of overhead and leaves a huge vulnerability.

  https://en.wikipedia.org/wiki/Port_Control_Protocol

And they have their favorite phrase:

  Nothing Can Stop What Is Coming.

If you look into the history of Victoria's family it's clear why she did what she did.

In the United States, users of Chase are already using FIDO2 to access their Chase accounts with hardware keys often priced at $15 or $20 made by a diverse set of 3rd party vendors such as Yubico, which has the same cryptography-grounded effects I suggested above. One hardware key can store private keys for several remote sites, this is a basic part of FIDO2.

Before Chase did this, I directly kvetched at Chase on LinkedIn pointing out that many smaller banks had already been securing access to accounts with FIDO2.

Trezor and Yubikey 5C devices happen to also do FIDO2, but the ultimate answer that provides end-to-end cryptography, meaning the cryptographic pieces reach all the way to the record matching the actual contents of the transaction stored at the bank, uses a different format. The legacy tokens never provided end-to-end cryptography, and from a security perspective are as crummy and vulnerable to MITM as OTP/TOTP.

As far as holding onto hardware keys, users don't lose hardware keys/wallets when those are attached to a keychain and the users are instructed to attach to add it to their general car/house keys. Attached to general car/house keys/fobs, hardware keys survive user-chaos at a much better rate than smartphones do. Other security-focused IT pros/execs have reported the same.

The key difference between those hardware tokens and hardware keys/wallets that do OpenPGP, or PIV, or the underlying cryptograpy functionality of "Bitcoin wallet", is they

  1.] generate a cryptographic signature for the actual content ie "this much $xx.xx to meloney@example2.com" that the bank can keep and present later as reliable proof if appropriate

  2.] display on the screen the contents for #1, so a compromised user endpoint (smartphone or laptop) displaying false info is less likely to successfully bamboozle a user.

The diesel shortage has been staved off, in part by temporarily forgiving use of forms of diesel that are normally illegal.

It's not a good time for America to have Zelensky's guys drone-bombing Russia's petroleum and diesel ports/terminals.

I overheard a colleague say the other day that if Zelensky's guys attack another petroleum/diesel port, that Trump should bomb Zelensky. From what I'm reading and hearing, the middle tier of the "line go up plz" crowd don't find that unreasonable.

At this point, this shit show architected by Victoria Noodleman, and implemented in part by players like Lindsey Graham and John McCain, is just a huge waste of resources.

The only thing that has come out of this is removing the bulk of the Ukrainian population from Ukraine. Twenty years from now, a completely different people will occupy that land.

Not sure what to think of it.

I remember when quality desktop ricing was a personal and novel thing, then there was commoditization of that beautiful thing and the posers outnumbered the organic ricers.

Looks like the same is happening for IDEs.

It'll fool other posers and macOS/Windows users, sure.

But when you watch someone work you can tell who carefully configured their plugins for Neovim they added incrementally over time.

It's like a suit. You can have a fancy suit, but people who have their own tailored suits can tell when the one you're wearing isn't really "your's".

But ultimately because if they did, everyone would flip the f*** out. It's the same reason that Google doesn't openly do it. They have former VPs of Google found new companies, or invest in new companies, that all use Google Cloud and have all juicy corporate secrets flow through Google Mail without end to end encryption but are like totally not front companies for Google.

In the mid 2010s Google was way too aggressive with trying to get data from healthcare organizations and they got told to piss off. So they made front companies where the data will flow through.

At the very top there's a bunch of dudes running around in the woods naked and something is lit on fire at the end of the festival. Like Burning Man but without the stupid hippies.

Boomers don't generally have Trezor wallets. Many millennials who aren't in the "failed to launch" category have a Trezor wallet or something similar, as do gen Z.

A Pixel running GrapheneOS is hardly a "non secure" device. As a user, I'm not naive enough to consider iOS or lamestream Android to be "trusted", which is why I run GrapheneOS.

If a bank's app runs on iOS or lamestream Android, but not GrapheneOS, it's not because those operating systems that aren't GrapheneOS are more "trusted", it's because the CTO of the bank is a fucking moron.

Trezor runs open source firmware. Solving the problem with a Trezor is what I want and what most loosely in the category of "hacker" want. Every legitimate IT pro will prefer, for securing their own bank account, this approach over another.

Whatever bank can set whatever threshold they want.

If they want to require a signature from a hardware wallet where their app runs on an unrecognized OS or for a Zelle transaction over $3,000 then they can specify whatever details they want in software at the speed of software. Banks already tune thresholds unique to customer's individual risk profiles.

As has already been widely demonstrated with some of the hardware keys in the Yubikey 5C family, users don't lose their hardware keys/wallets when they are attached to their physical key ring for house key/fob and car key/fob etc. Users cycle through or lose smartphones all the time but "muh keys" not so much.

The use can be optional, I don't think anyone would suggest (or even presume?) otherwise.

Accounts with balance under $30,000 need not apply.

Many of the "good customers" (from a bank's perspective) already have a Trezor.

Big banks already require customers pay the $50 for an RSA fob anyway. No bank is providing these devices as a courtesy.

Many GrapheneOS users would rather pay out of their own pocket for a Trezor Safe 5 than have "you need to carry an additional phone too, a shit-phone" forced on them when GrapheneOS is perfectly adequate to run any app and with more meaningful security assurances than any other Android distro.

If the banks were really so concerned about malware on the user's endpoint, and they had competent CTO, then they would write an app for Trezor or offer a Trezor with their own logo and app on it and users could sign transactions with it.

Trezors show on a screen to the user "this is the amount and where to be sent that you are signing for".

Malware with high privileges on a compromised user endpoint can bamboozle the user but a hardware wallet would catch that.

That crowd thinks 12 Factor applications are some monumental thing, "oh no, we can't do that, we would have to hire only the most expert experts, nobody does 12 Factor applications". They're all Windows tards.

Then as highlighted the other day, the big banks, including LLoyds, all run on Google's Cloud because ding ding ding big surprise they couldn't figure it out themselves, and they didn't deploy multi-AZ. They didn't do a rudimentary thing that virtually every startup knows to do and does.

The banks and the clowns that surround them are, by today's standards, barely computer literate.

The somewhat widely known Mozilla SOPS is a tool in the same broad category.

I hadn't seen securestore-rs before. Thank you for sharing this.

If you have one of Apple's Intel Macintoshes with a T2 security chip, you may want to do a search with ChatGPT through one of the free portals out there to boot something "foreign" to what Apple's secure boot with the T2 security chip already recognizes.

When putting together rootfs on top of what others would consider to be "complicated", reaching for rEFInd when I should probably have run a small PXE server off a Pi did speed things up. rEFInd has been a good general purpose bootloader, simple tool.

In my aged existing familiarity with rEFInd, its docs may not spoon feed you the answer but if you know what you're looking for and what you want to do can be done, you'll find it.

Rhaadt and Stallman have something in common in that they have been vindicated in near biblical proportions, often far long after presenting their stance and having been casually derided for it.

There is today still no real mitigation for the side channel flaws collectively named Spectre flaws. A look at Jonathan Perry's work, adjacent to the side channel stuff, tells us that most modern CPUs still not end of life today are truly single-tenant.

When reading AWS' writing on side channel flaws, someone who skims that writing will leave with a different conclusion than someone who reads what AWS has shared in its entirety and reads it slowly.

The only truly effective way to isolate applications effectively, in a way accessible to people in average financial stature, is to put them on different CPUs (hello dual and quad socket server boards). Thanks to the prevalence of inexpensive ARM and Risc-V based single board computers, although this requires advanced skills with operating systems and relevant tooling this is practicable (as ugly as it is).

There are some new general purpose processors made from ISA that don't use any form of speculative execution. These may be undoing decades of bad-assumptions cruft. Those who deserve these processors won't wait for retail channels to deliver them.

  http://www.rodsbooks.com/refind/using.html

?

We're also collectively contending with more than one generation of contributors who don't know how what they started with got to where it was and carry a mindset of "this is how things should be done", and then we reach moments where a lot of the smarter people collectively talked enough about to realize: oh, the rest of us built three decades on stupidity of what was called OOP (and not real OOP according to some) because categorization meme caught on and was taught in school as the way.

There does need to be heterogeneity where some corners refrain from taking what could be irreversible steps.

Renovation of the core parts of the BSDs, illumos, and Linux with CompCert C or something like it using LLMs, done by the right hands, will be interesting.

I would love to see ZFS on OpenBSD ; if only the necessary talent wasn't preoccupied.

One thing that really sticks out to me and gives me a feeling I won't consider to use Mitos, is the presentation further down on Mitos' front page of rendering of image files inside the terminal emulator. I rather that an image viewing program be opened, maybe called with options to not display interface widgets, and to be displayed in a new window tab. I use i3 or Sway, so I already have macros that do just this, and I don't fail to appreciate that others have this luxury (or not).

Alternative branches, or even forks like this are a good thing. Sometimes these help reach new consensus and merge back into the original project making the new project stronger, provided the original reason for a fork wasn't really issues of conflicting personalities.

I think a fork of Helix can be a step in the right direction. But "view images inside the terminal" doesn't pass the smell test. The mindset of displaying images inside of a terminal window and the macOS window decorations in the example screenshots, those two things together are part and parcel.

  agentcall( claude, data_thing, "please save this file to the user's home directory" )

I already see this behavior out of the tech support class that likes to participate in bureaucratic processes among gen z. The standards and expectations for what is colloquially "engineer", outside of bonafide engineering circles, has really fallen over the last two decades.

The attitude that replacing functions with calls to AI agents is like totally okay in software engineering will eventually seep in too.