md_

I'm far from a punitive-justice kind of person, but arguing that a single dissenting juror should be sufficient to acquit strikes me as not at all obvious.

As long as I can convince one in twelve that I'm innocent, I should be considered innocent?

That said, since you asked, no, it's never occurred to me that jazz is appropriation.

[1] Amusingly, the folks who admit to not actually, you know, reading the thing they are debating, are the ones who claim to be defending the free exchange of ideas. I think. Or maybe they're just angry online.

This is peak HN.

Edit: I take it back. What's peak HN is that this is the top voted comment on the entire post.

I'm far from an expert, but it seems like a reasonable argument to advance that the linkage of Buddhist practices with corporate and material advancement--and the removal of spiritual or ethical content--is "appropriation", and not merely respectful mixing.

You can try using different terms, but the standard terminology in the mail space is "envelope From" vs "header From", as I used above. These are different things, and there's enough information in this email for you to know which is which.

Some MUAs--like Outlook--would render this email as

"Sent by postalerts@robtoledoyour.com on behalf of no-reply@youtube.com"

As I said, it may be that you want your MUA to do that, in which case...use Outlook? But this has nothing to do with limitations of SMTP.

All the YouTube.com DKIM signature says is that YouTube.com did in fact author this content. Which is true!

ARC and SPF (both present on this message!) indicate that the last hop was not YouTube.com, and who the last hop was! So all the information you were asking for is in fact present here.

What you are suggesting is just a different phrasing of your prior suggestion: that people should not be allowed to forward email. And given this message has an ARC header that indicates it was forwarded, and from whom, it seems really strange to me to say that instead of messages that indicate they were forwarded, you think we should just ban forwarding entirely.

Maybe the problem is on Gmail's MUA: maybe this should be more prominently shown to the user as a forwarded email?

ARC allows what you describe for mailing lists, only, even better, it's machine-readable--the message metadata indicate that "Jane User" sent the mail, according to "Some Mailing List", and that Jane User's email was verified per DKIM!

And MTAs can (as you note) require bidirectional confirmation for forwarding and (as you note) can easily identify which authenticated senders actually sent the mail and, if they determine it's an open relay, bitbucket it!

So what you describe is pretty much the status quo, I think. The fundamental issue with the YouTube mail the author has encountered, of course, is that the forwarding domain is authenticated as having passed on an (unmodified) YouTube.com email, and Gmail--quite reasonably, I think--just doesn't know enough to know if the Gmail recipient of that forward wanted it. Since the message has no obvious signs of spam (like linking to a suspicious domain), it seems reasonable to me to treat this like any other authenticated, non-spammy email from a domain Gmail has not seen much volume from before (which I assume is the case here).

Ultimately, even with DKIM, DMARC, and ARC, email allows people to send mail to people they've never communicated with before, and this is an important function to preserve!

(As an aside, I totally acknowledge that a) the protocol complexity in email is a lot worse than it could be if all this functionality was built in up front, and b) there are alternative tradeoffs we could make that would remove some of this complexity. And the complexity is obviously a problem for user comprehension or else we wouldn't be having this conversation! But, fundamentally, if we want to make significant changes, we would have to revisit seemingly desirable features like non-matching envelope and header To, allowing unsolicited email from other people, authenticated forwarding, etc.)

Sorry, by "bidirectional approval" I meant that the author's (i.e. recipient's) mailbox would somehow confirm its desire to receive mail forwarded by robtoledoyour.com.

What you describe is, I think, impossible without eliminating certain extremely common use cases; it would break:

* Mailing lists (which are the whole reason ARC exists); I don't want to have to approve lists.kernel.org to send arbitrary mail on behalf of me (and certainly not on behalf of gmail.com, which I don't control!); I want it to be able to forward mail that it promises came from me and for recipients to trust it only if they trust lists.kernel.org (which is how ARC works).

* Mail forwarding between a user's different mailboxes; there's no way I can get Amazon.com to agree that myspambox@gmail.com should be allowed to forward mail on behalf of Amazon just so I can use a throwaway to forward mail to my main account.

I can imagine configurations where everything works dramatically differently, but it's hard for me to see what's wrong with the status quo (a signed message, with ARC, etc) except that To headers are allowed to not match RCPT TO, which as others have noted is both a point of confusion for users and how BCC works, and thus a hard to eliminate feature.

Probably whoever owns "alltimecaptaincool2019@gmail.com" has it forwarding to "robtoledoyour.com", who is then forwarding (with ARC!) to the author's Gmail mailbox.

I don't see why this shouldn't work--there's nothing in DKIM, DMARC, or ARC which is intended to prevent forwarding of legitimate emails (and such a feature would annoy many users of email!).

A well-functioning spam classifier knows that this email a) has a body that was signed by YouTube.com, b) was forwarded via robtoledoyour.com, and can make a spam classification decision based on that. Allowing the mail through seems reasonable given the contents are not spammy.

I'm unclear on what a protocol--SMTP or anything else!--could do better here other than just not support forwarding mail at all (or require bidirectional approval before allowing forwarding), which would be hugely disruptive to existing email users.

The entire topic of this thread is the disclosure of official documents which, like the Wansee Protokoll, expose the regime's real goals and practices.

Of course, there are people who still disbelieve that the Holocaust happened. I try not to argue with them online, once they have shown their true motives.

And if that is your claim, is your point that a population-wide rate of torture and forced sterilization equivalent to that inside American prisons is...acceptable?

It's really unclear to me what you are trying to say with your repeated analogies to other human rights abuses. That there are multiple bad things in the world, so we should give up on trying to criticise them?

I don't think anyone takes the American Cancer Society to be saying that death by heart attack is good--merely that their focus is on cancer. So too, critics of systemic, widespread, and officially sanctioned torture and genocide in China are not saying that other torture--be it systemic or not, widespread or not, sanctioned or not--is somehow better. They're merely focusing on one particular hotspot, where the offenses are particularly stark.

Those who, like you in this thread, say, "But what about X", are hard to take on good faith. They never seem to be saying, "Let's also talk about X", or "how can we eliminate all torture." Rather, they seem to suggest that critics of widespread Chinese torture are somehow anti-Chinese, that the motives should be questioned, and, by implication, perhaps that well-documented Chinese torture does not exist.

It's deliberate obfuscation for the purposes of disinformation, as you are clearly engaged in here.

"China also employs diplomatic pressure and financial incentives to secure foreign assistance in its efforts to persecute Uighurs abroad. Imran Khan, the prime minister of Pakistan—one of China’s principal allies and the recipient of billions of dollars in loans as part of the Belt and Road Initiative—has said he accepts China’s explanation of the events in Xinjiang, despite frequently speaking out against Islamophobia elsewhere. Crown Prince Mohammed bin Salman of Saudi Arabia, which is China’s largest oil supplier, defended the CCP’s “right” to carry out “anti-terrorism and de-extremization work” during a 2019 trip to Beijing, where he signed a multibillion-dollar trade deal. The kingdom was one of the thirty-seven nations that signed on to a letter to the UN Human Rights Council praising China’s “remarkable achievements in the field of human rights.” Saudi Arabia, along with other countries such as Egypt and the United Arab Emirates, have extradited Uighurs at China’s request, and the Associated Press reported last year on the alleged existence of a secret Chinese-run black site in Dubai, where abducted Uighurs had been detained. After an injection of Chinese funds into Turkey’s crisis-hit economy and shipments of vaccines during the height of the pandemic, even Erdoğan appears to have muted his once-strident criticism. Over the past two years, Turkish police have detained over one hundred Uighurs, including a number of activists, and deported several others."

1. I'm confused. Your original request was, "Can you point me to the documents describing systemic torture in those 'camps'?" Clearly the BBC article outlines fairly substantial evidence of systemic torture in Chinese-run prison camps in Xinjiang. Would you not agree?

2. It's possible for one to criticize the human rights abuses in American prisons--which absolutely exist, I agree--while simultaneously criticizing the human rights abuses in Chinese prisons. If we must make a comparison of scale, the Chinese ones seem far, far worse, of course. But I don't think we need make a comparison; this thread was about Chinese prison camps, and you asked for evidence of systemic torture (which I provided); that you then choose to bring up "similar" behavior in western countries is...strange.

It's almost like you are trying to change the subject, repeatedly and unsuccessfully.

https://www.newyorker.com/news/a-reporter-at-large/china-xin... https://www.newyorker.com/magazine/2021/04/12/surviving-the-...

Same with The Atlantic:

https://www.theatlantic.com/the-uyghur-chronicles/ https://www.theatlantic.com/international/archive/2021/04/uy... https://www.theatlantic.com/international/archive/2019/08/ch...

Interesting is the detail that Chinese state agents routinely attempt to silent Uyghur voices outside of China as well: https://www.npr.org/2020/03/13/800118582/i-thought-it-would-....

The Luna "automatic peg" stuff is genuinely clever, but with genuinely surprising implications (at least for me, a casual observer/layperson) for dynamic instability.

It may be a compliance issue, of course. If you want to stay on the good side of the US Treasury, compliance could be expensive, especially in certain countries.

But the basic premise here is that USDT's risk premium is worth it as the cost of avoiding compliance, which, sure, I guess.

Terra certainly has an element of complicated financial dynamics behind it such that people who know a little--but not a not--may think it's the greatest idea since sliced bread, and get eaten by the professionals. I agree with you there.

But a lot of the crypto ecosystem seems to be much more mundane than that. As far as I can tell, there isn't any financial wizardry behind NFTs; they're just a sort of weird social phenomena (is it a game? is it a market? is it sports betting?) where you can buy a thing at a price that has no basis in reality except insofar as someone else might buy the thing at an even higher price. I think that many--most?--people "investing" in NFTs realize and embrace the greater fool theory.

But, importantly, it seems to me that a random yahoo might actually be better able to predict when the gravy train will stop than an elite trader. So in some sense, it's quite egalitarian (if also stupid)!

Those four companies - 88 Cloud Computing LLC, 88 Enterprise Services LLC, 88 Investment Empire LLC and 88 Venture Capital LLC - each received between $350,000 and $1 million in loans within the span of a week in June 2020. The four companies purportedly provide cloud computing and investment services and two of them listed 24 employees each; however the address of all four businesses is a home in an affluent South Bay suburb.

- is transparent

- is mediated by the FIDO Alliance; the platform makers cannot do it unilaterally, as they can with CAs in browsers

- is mediated by the RPs; even if the FIDO Alliance did do this for some reason, RPs could just ignore it with no ill effects, unlike with CA trust in browsers

- wouldn't have any effect today for the vast majority of RPs, since the vast majority do not even use attestation today

- honestly, isn't something they have any incentive to do; hardware security keys are not a meaningful source of revenue for someone like Apple, Microsoft, or Google

I'm guessing you've never worked in a big tech company before if you think they have an incentive to do that. :)

I agree the potential exists, in a hypothetical sense. But the dynamics are very different than you describe (with your analogy to the CA ecosystem, which, ironically, gives big platform owners far more power—yet has no evidence of such abuse!).

Right now, there is just not that much use of WebAuthn and FIDO. You’re the guy saying, “if we find a way to lower global temperatures, we should fear an ice age.” It’s premature to say the least.

That’s quite different. In your example, if a website does so unilaterally, client user agents break. In the FIDO case, nobody else knows or cares which authenticators an RP trusts.

More broadly, I don’t get this conspiracy theory. You’re worried…the FIDO alliance will abuse their very limited power to…what end?

> If the private ECDAA attestation key sk of an authenticator has been leaked, it can be revoked by adding its value to a RogueList."[1]

The attestation key, which is shared among all devices? That’s rather different from what you said.

> That specific example may never come to pass, but I don't think we should assume that allowing RPs to put arbitrary conditions on the hardware we use is a power that won't be abused.

RPs already have such power. Today they use it to do things like require password complexity policies. Again, RPs aren’t the FIDO alliance; they’re the actual website you’re logging into.

Your repeated argument here is that websites should not be allowed to impose restrictions on how their users authenticate, which is hard to fathom.

In a previous version of this argument, I remember you essentially arguing that banks and enterprises should not be able to restrict what types of authenticators their employees and customers use.

I get it. You hate attestation. But “my employees must use a fips-certified key” (or “my customers must use a hardware key”) is reasonable and ultimately non-negotiable if you want people to use your protocol.

1. By what mechanism can they blacklist a device? A given relying party can choose to use or not use attestation and, if they choose to use it, which certificates to trust. But that's between you and the RP. Authentication doesn't "talk to" the FIDO Alliance--which is just a standards body and does not (AFAIK) even publish anything like a CRL for "bad" attestation keys, so I don't understand what you are talking about here.

2. The intention of the attestation, as I understand it, is to enable RPs to use attestation to limit authenticators to e.g. those that pass FIPS certification (or similar enterprisey requirements), not to ban a whole batch because one key is known to be compromised. That's crazy; can you point out where anyone other than you has ever proposed this?

3. DNA scan? What are you talking about?

4. This assertion you are making, while bizarre and wrong, is very different than the assertion the grandparent made ("Yubikeys intentionally have a very small number of devices signed with one CA key...so those devices do have a basically unique identifier"), which, while also wrong, is I think a genuine mistake and not a bad-faith argument.