Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)L

loudwhisper

@ loudwhisper @infosec.pub

Posts
5
Comments
79
Joined
3 yr. ago

  • Proton has stopped using their Mastodon account

    Jump

  • The problem is that those arguments are not falsifiable. If not one, but two completely reasonable explanation cannot convince you of someone motivations, nothing can. However, I don't care if Musk did or did not a Nazi salute. His actions speak much louder (in a bad sense) than the aesthetic that he decides to adopt. Proton donation pattern for example would be a strong indicator to measure intentions.

    but it was a wildly tone deaf one if so

    Maybe. But also maybe people are allowed to have different cultural references, and in a global context (i.e., the internet) we should expect diversity. I - for example - had never heard of this 88 thing, and I would definitely not think about it at all the next time I create a username, and I didn't think it when I went to a barber shop that has that number in the name. Likewise, I wouldn't call anybody writing "Merry Xmas" tone deaf for missing the reference to the X MAS of infamous history (and just recently in the news). For some people it's apparently impossible to see their culture as non-universal (at the cost of sounding stereotypical, folks from US have particularly this problem after decades of cultural hegemony).

    for a party that’s steeped in all of the same memetic game playing, you cant ignore the dog whistles

    This all happened before Musk/Bannon salute. Just to specify it.

  • Deleted

    Permanently Deleted

    Jump

  • Thanks for the response, despite the fact we disagree quite substantially.

    I think it's OK that different people have different points of view. Everyone's opinion also should fit within a broader (political) praxis and strategy that they support.

    There are a lot of CEOs out there that don’t decide to get all political. They don’t do this because they have an image or brand to protect. Maybe I just like a good illusion though.

    This is something I particularly disagree, as you probably have already read. Ignorance on once's position doesn't mean that position doesn't exist. I appreciate Jeff Bezos for example writing that memo (just yesterday's published), compared to acting the same way without my full knowledge.

    He is no political scientist

    If this was the criteria to comment on politics, honestly we should shut down everything (including Lemmy) :)

  • Proton has stopped using their Mastodon account

    Jump

  • It's not a problem of complexity, it's a deliberate choice of not wanting to do that, because it is synthetic content disconnected from the community.

  • Proton has stopped using their Mastodon account

    Jump

  • This comment is a perfect example of why I have written https://loudwhisper.me/blog/proton-fediverse-burnout/

    The 88 thing is the complete tip of the iceberg for me. I can't honestly imagine the thought process needed to reach a conclusion that a Taiwanese guy (8 is a lucky number) born in '88 would put that number as a dog-whistle (which is not really part of his own cultural landscape) for Nazis, while dealing with a PR issue.

    It's like looking at a crashed car, tire marks on the ground and suggesting it must have been a sharknado and not a car accident.

  • Proton has stopped using their Mastodon account

    Jump

  • (Re)Posting and not engaging with the community is not free publicity, is bad publicity. They don't have the resources (according to them) do to the latter, and therefore they choose not to do the former.

  • Proton has stopped using their Mastodon account

    Jump

  • In case of proton free means "subsidized by paying users". No big mystery on how they make money.

  • Proton has stopped using their Mastodon account

    Jump

  • They specifically said they don't want to do automated posting, to avoid writing and not interacting with the community. I see no value in them doing this, considering we can get the same content via RSS, blog page or email newsletter. Presence makes sense if it means presence. If it means a bot reposting content, anybody can do it, but the value is very low.

  • Deleted

    Permanently Deleted

    Jump

  • Yes, that's absolutely true. Assuming a full PGP flow, (e.g., proton to proton) even in that case the recipient and other metadata (in tuta, excluding subject line) is still visible to the provider.

    Hopefully the more people move to secure providers, the more the general case will be transparent PGP, but we are a long way from there...

  • Deleted

    Permanently Deleted

    Jump

  • I can see a threat model already from 2014.

    Anyway, I think it's a tradeoff that it's hard to assess quantitatively, as risk is always subjective. From where I stand, the average person using native clients and managing their own keys has a much higher chance to be compromised (by far simpler vectors), for example. On the other hand, someone using a clean OS, storing the key on a yubikey and manually vetting the client tool can resist to sophisticated attacks better compared to using web clients.

    I just don't see this as hill to die on either way. In fact, I also argue in my blog post that for the most part, this technical difference doesn't impact the security sufficiently to make a difference for the average user.

    I guess you disagree and that's fine.

  • Deleted

    Permanently Deleted

    Jump

  • Well, yes-ish.

    An organization with resources to coerce or compromise Proton or similar wouldn't have trouble identifying individual users "well enough" (trivially, IP address). At that point there is absolutely nothing stopping a package distributor to serve different content by IP. Not even signatures help in this context, as the signature still comes from the same party coerced or compromised.

    Also most people won't (or are unable to) analyze every code change after every update, which means in practice detection is even more unlikely for OS packages than it is for web pages (much easier to debug code and see network flows). The OS attack surface is also much broader.

    In general anyway, this is such a sophisticated attack (especially the targeted nature of it) that it's not relevant for the vast, vast majority of people. If you deal with super sensitive data you can build your proton client directly, or simply use the bridge (which ultimately is exactly like other client-side tooling), so for those very rare corner cases where this threat is relevant, a solution exists. Actually, in those cases you probably don't want to use mail in general. So my question is, who is the threat actor you are concerned about?

    All in all I think that labeling "insecure" the setup for this I think is not accurate and can paint a wrong picture to people less technically competent.

  • Deleted

    Permanently Deleted

    Jump

  • They wrote that they don't want to "write and forget" but engage with people (as they do on Reddit, for better or worse). I think it's opinable, but it sounds reasonable to me. What is the value of having an official account which just reposts one-way communication already published on the blog and on the newsletter? Anybody can build such a bot, but it's not "presence" the way I interpret it.

  • Deleted

    Permanently Deleted

    Jump

  • Security is hardly a binary property.

    Given you mention the specific technical setup, I would say yes - that is secure against most risks relevant for most people.

    At least, it's totally fine according to my own threat model, where I looked specifically at broswer-based encryption vs "manual" encryption (I.e. using PGP tools locally).

  • Deleted

    Permanently Deleted

    Jump

  • Sender and recipient can't be encrypted e2e. How would the server know to whom deliver the email if those are encrypted and not visible to it?

    AFAIK tuta encryption extends to the subject line only.

    Still a nice addition, don't get me wrong, but I believe you misunderstood something.

    From their own doc:

    The only unencrypted data are mail addresses of users as well as senders and recipients of emails.

    Contacts and everything else is encrypted similarly in all "secure email" providers, including Proton.

  • Deleted

    Permanently Deleted

    Jump

  • TBF, they push the same content via their email newsletter.

  • Deleted

    Permanently Deleted

    Jump

  • Tuta is great, I will start from that. But they encrypt the subject line, in addition to the body afaik. It is technically impossible to encrypt "every part of the email" because that would break delivery (e.g., metadata such as recipient or timestamps).

    This also has the cost of a nonstandard protocol (not plain PGP), with all that implies in terms of compatibility, maintenance needs etc.

  • Deleted

    Permanently Deleted

    Jump

  • Since I have found it historically hard to engage on this (broader) subject around here, just yesterday I put together my own thoughts at https://loudwhisper.me/blog/proton-fediverse-burnout/

    Personally, I did not see the value of their Mastodon presence, it was write only marketing communication, no engagement with the community anyway. That happened only ever on Reddit, which I think is going to continue being the case.

    They push the same info via email newsletter, if someone really wants that stuff.

    Either way, the post above covers my take on the whole drama, not just this last small chapter.

  • PSA: GoDaddy gated their own API. DDNS users warned

    Jump

  • I also use porkbun, their API is not a masterpiece but it works and allows you to get, set and update records. In fact their API is now supported by some of the common ddns scripts out there.

  • PSA: GoDaddy gated their own API. DDNS users warned

    Jump

  • Desec.io is a good option. To be honest using cloudflare just for DNS is completely OK. It's not a service that allows spying on you or consolidates their monopoly.