sudneo

@sudneo@lemm.ee

• ⁨Comment⁩ on ⁨Selfhosted alternative to google keep/onenote/evernote/goodnotes?⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  For browser, there is a webapp that can be selfhosted. See here github.com/logseq/…/docker-web-app-guide.md

  I think you need chromium browsers due to the API they use, but it should work.

• ⁨Comment⁩ on ⁨New largest prime number discovered by former Nvidia software engineer⁩ ⁨⁨4⁩ ⁨weeks⁩ ago⁩:

  Many encryption algorithms rely on the assumption that the factorizations of numbers in prime numbers has an exponential cost and not a polynomial cost (I.e. is a NP problem and not P, and we don’t know if P != NP although many would bet on it). Whether there are infinite prime numbers or not is really irrelevant in the context you are mentioning, because encryption relies on factorizing finite numbers of relatively fixed sizes.

  The problem is that for big numbers like n=p*q (where p and q are both prime) it’s expensive to recover p and q given n.

  Note that actually more modern ciphers don’t rely on this (like elliptic curve crypto).

• ⁨Comment⁩ on ⁨American tourists visiting the EU, what do you think of it?⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  As someone from Rome, I feel you. Pickpocketing is somewhat an issue. In more than 20 years living in the city (before I moved) I never suffered from it, but it’s very common among tourists (especially in the underground and certain bus lines). It sucks and often police does nothing because by the time they catch the people (if they do), everything is gone anyway.

  That said, beside pickpocketing Rome is very safe (or at least most of the places where a tourist would go, except maybe the surroundings of Termini station).

• ⁨Comment⁩ on ⁨How to treat a man⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  For too long it told men they can treat women however they want

  This is demonstrably false, as we have certain narratives that are literally millennia old (latin literature) about courtship, romantic gestures, protection and all the other stuff usually associated with how men should treat women. Usually this is some form of protection/care for a lower/weaker being, but it is absolutely a way society has been telling men how to tell women for centuries.

• ⁨Comment⁩ on ⁨How to treat a man⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  I would say that what you said applies not to feminism in general (who historically had strong links to class struggle and anticapitalism), but to a part of the modern status quo feminism which is focused purely on individuals and has been absorbed by the ruling class (e.g., once the CEO is a woman, the goal is reached). This is not a representation of feminism in general though, and I would say the same can apply to many other movements as well (e.g., ambientalism, antiracism, etc.) that (in part) lost their revolutionary nature and are left fighting for small changes within the status quo.

• ⁨Comment⁩ on ⁨How to treat a man⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  I think that in fact in at least some cases the lack of respect (or general ability to live a relationship with a man in a mutually loving way) is exactly due to that education. At the end of the day the flipside of the “subservient” attitude is that the man in the relationship is represented as a provider, with all the gender stereotypes that come with it: lack of emotions, self-reliance and of course the expectation for him to be a provider. I would say that most of the examples of bad relationships in this thread boil down to exactly these dynamics.

  Also we are not anymore in the 1950, so that education today mostly happens implicitly, but it also gets mixed up with a lot of other messages from the wider society.

  I personally also disagree about the fact that men are not taught how to fit in their gender role. I think they are, since very little, symmetrically to how women are too and possibly even more explicitly: you need to protect women (incl. sacrificing because that’s what heroes do), the whole courtship thing, the fact that as a man you are responsible to provide for others, that there are certain activities that are manly, etc… Essentially is the exact same problem: gender stereotypes and sexism go both ways and impact both genders, although in different ways.

• ⁨Comment⁩ on ⁨If "Master/Slave" terminology in computing sounds bad now, why not change it to "Dom/Sub"?⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  I agree, personally.

  In general I feel the words are so abstract (blacklist and whitelist) that I can’t really see how someone will see some other meaning…

• ⁨Comment⁩ on ⁨If "Master/Slave" terminology in computing sounds bad now, why not change it to "Dom/Sub"?⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  Totally discussing useless stuff here, but green and red to me give the feeling of temporary actions (and possibly alternating). Intuitively sounds more like slowing and speeding than it does permanently blocking or allowing something.

  Black and white have the polar opposite meaning. At this point allowlist and blocklist might be a simpler solution to the “problem”.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  You should definitely be! I take backups every 6h for my self hosted vaultwarden (easier to manage and to backup, but not official, YMMV). You can also restore each backup automatically and have a “second service” you can run elsewhere (a standby basically), which will also ensure the backup works fine.

  I have been running bit/vaultwarden now for I think 6 years, for my whole family and I have never needed to do anything, despite having had a few hiccups with the server.

  Don’t take my word for it, but the clients (browser plugin, desktop app, mobile app) are designed to keep data locally I think. So the term cache might be misleading here because it suggests some temporary storage used just to save web requests, with a relatively quick expiration. In this case I think the plugin etc. can work potentially indefinitely without server - something to double-check, but I believe it’s the design.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  Interesting! That’s very close to this blog post I read long time ago (unfortunately medium.com link)! Are you actually sending emails from those addresses? Like if you need to drop an email to your bank, do you use the banking one or your personal (or something else)?

  Fwiw, I do something similar. I use a mix of domain aliases without address (e.g. made-up-on-the-fly@domain.com) and actual aliases. Since I have proton family (and the same when I used ultimate) I have unlimited hide-my-email aliases, so I have it integrated with my password manager, and I generate a random password and email for everything I sign up now. These though are receive-only addresses. In fact, with this technique I probably use 3-4 addresses in total, but I have probably 30 domain addresses that go to the catch-all one.

  Spam on these addresses are basically non-existing and you can still create folders based on recipient without having a full address (e.g. bank1@domain.com, bank2@domain.com). You can make folder categorization based on recipient regex and this way you also have the “stop bothering me” option: if some email gets into the wrong hands, you can create a spam rule for that dedicated address. However, my approach is that all of these are used just to receive emails, to send I have just a handful of actual addresses or -if really needed- I can create on-the-fly an address from a catch-all one, send the email and then disable it again (so it doesn’t count towards the limit, but I still get inbound email to the catch-all).

  Nice setup anyway!

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  Your requirements are totally fair tbh.

  That said, I think you can use aliases for the use-case you have, you don’t need full addresses. Proton supports “+ aliases” as well, so name+service@domain works, and most importantly they support catch-all addresses if you have your own domain. I now use actual aliases (the ones from simplelogin), which I generate on the fly, but if you can use whatever@domain and it will be redirected to your configured address. You don’t even need to create this beforehand, so many times I was around and had to give an email address for some reason and I just made up an address on the fly. As long as you use your domain, the catch-all will get the email.

  So the 10 addresses only include actual addresses, the ones you can write from. You can have as many as you want to receive emails (which is generally the use case for signing up to services, right?). Just a FYI in case tuta supports the same and you are making more effort than needed!

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  If XMPP were to replace emails, that would’ve been great

  Who knows :) But XMPP also needed all kind of extensions to support even relatively old security measures.

  Anyway, I still don’t trust Proton. Have a great day.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  Encrypted or not, the fact that someone else has it stored somewhere in their computers is dangerous.

  Of course. You are simply over-representing this risk, though. Besides, regular people realistically don’t need to worry about Proton being backdoored, because their device is 10-100x more likely to be breached instead. Security is not a binary, it’s a shade. Performing a software update is also “dangerous”. Do you check every time you update the software its code, to verify no malicious backdoor is there? No, exactly, you trust the maintainers and the package infrastructure.

  The only recommended way to store private keys are offline and encrypted.

  So you don’t store them on your device(s) (encrypted)? I store my GPG keys that I use to sign software on my yubikeys. That said, email is something I check from my phone and multiple computers (as most people). Do you really use a hardware key to do on-the-fly decryption, every time someone sends you a message, from each device?

  As a security engineer, I also generally discourage such absolute “recommendations”. My threat model is different from a regular Joe threat model, and both are different from Snowden’s. There is no such thing as “only recommended way”, because this is not a religion, it’s a risk decision. Most people use Gmail, where the content of their email is literally available server side. Those same people can gain privacy and security using GPG via Proton, and in their threat model “provider gets compromised and software backdoored” is completely irrelevant. Is it relevant in your threat model? Good, then yes, you should only store keys offline and encrypted. Actually, you shouldn’t use email at all, and you should use dedicated tools and protocols that are meant for security, where metadata is not transmitted in clear text, for example. You should also have virtually no session duration and perform a full login with 2FA every time, you should probably access the software that you use to communicate only from a secure machine dedicated for the purpose etc…

  I think you trust Proton a bit too much.

  I simply have clear in my mind what my threat model is and what risks are acceptable. I perfectly fit in the “Anyone with privacy concerns” category in the threat model they built. What about you?

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  Oh that makes sense. Yeah, definitely simple encryption and exported (unencrypted) emails are not going to work together.

  I am all in support for European tech companies, so I think that mailbox.org, tuta, proton etc. Are all good options.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  From what I read though, the GPG security model for mailbox.org is the same as it is for Proton webmail (except for the browser plugin, where the difference is not really there). I like mailbox.org, to be clear, but I don’t get how it is an alternative to the bridge.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  I can’t comment on this, since I don’t use the bridge for a while. But it’s just an IMAP/SMTP server, so not sure why certain features wouldn’t work. What service did you end up using which has gpg integration?

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  One of the biggest risks is when someone knows your password.

  Just a curiosity. How do you think every password for every online service works? The service “has” your password. It is hashed, but if this doesn’t matter (similarly for encryption) to you, then you should be panicking about basically everything.

  In the case of Proton an attacker has basically these options:

  • Option 1: Attack you, try to compromise your device. If this is the case, your local keys are going to be taken, one way or another, even if you have them locally and encrypted. The only way you might save yourself in this scenario is if you store them on an hardware device (like a yubikey).
  • Option 2: Attack proton. Once the infrastructure is compromised, the JS code that does the crypto operation needs to be backdoored, you need to use the service while the JS is compromised, and the attacker will obtain the keys and the messages.
  • Option 3: Compromise the sender/recipient for the emails (this is in cleartext in any case).

  In the case of a manual solution:

  • Option 1 is identical.
  • Option 2: Attack the software you use (let’s say, mutt). Once you gain access to the repository, push a backdoored update and wait for you to install the new version. Incidentally, compromising this tool also allows the attacker to compromise your whole machine (unlike what happens with JS code, which runs at least in the browser sandbox).
  • Option 3 is identical.

  So the tradeoff is really that:

  • With Proton an update is going to be pushed quicker and without your explicit interaction, but
  • compromising Proton is going to be much, much harder than compromising the laptop/repository for the handful of maintainers that generally have the keys to push updates for the software you are most likely going to use. We are talking company with security department + SOC vs maintainers with whatever security practice and no funding.

  It’s not even hard to manually encrypt emails.

  Yeah, and this is why 99.9% of the people have never and will never touch GPG with a 10-foot pole. The tradeoff is a complete no-brainer for the vast majority of people, because the reality is that for most, either someone else does the key discovery, management, signing, encryption, decryption, or nobody does. We can sit here and pretend that it’s easy, but it’s not. Managing keys is hard, it is painful, especially on multiple devices, etc…

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  Introduces some risks in terms of security. Privacy concerns are extremely minimal, because in any case you don’t control the setup of your other interlocutor(s).

  Considering that the realistic alternative is not using anything at all and the fact that you have both options with Proton, it’s a win-win scenario.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  There is a reason: simplicity. Either you do all the key management yourself, which in practice means 98% of the people won’t do it at all, or you implement a solution like they did and increase the risk of a small % (see my other comment) but you cover every customer.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  It’s not “insecure”, it’s simply a supply chain risk. You have the same exact problem with any client software that you might use. There are still jurisdictions, there are still supply chain attacks. The posture is different simply by a small tradeoff: business incentive and size for proton as pluses vs quicker updates (via JS code) and slower updates vs worse security and dependency on a handful of individuals in case of other tools.

  Any software that makes the crypto operations can do stuff with the keys if compromised or coerced by law enforcement to do so.

  In any case, if this tradeoff doesn’t suit you, the bridge allows you to use your preferred tool, so this is kinda of a moot point.

  The main argument for me is that if you rely on mail and gpg not to get caught by those who can coerce proton, you are already failing.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  The Bitwarden client has all the data cached, so the server can be down and you still get access to the passwords (same for internet connection).

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  You upload your private key to the cloud. Encrypted or not, this is a bad idea.

  An encrypted key is a useless blob. What matters is the decryption key for that key, which is your password (or a key derived from it, I assume), which is client side.

  They can do the signing and encryption with my public key

  They can’t sign with your public key. Signing is done using your private one, otherwise nobody can verify the signature.

  Either way:

  and then I’ll do the decryption with my own private key locally without them storing it.

  You can do it using the bridge, exactly like you would with any client-side tooling.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  Shouldn’t we worry of enshittification when we are on the verge of, or on the descending side of trajectory?

  So far they added features in a way that keeps respecting users rights, without changing their business model (which is 90% of the reason why companies enshittify BTW). Just because these products have something in common with products of companies who enshittified doesn’t mean the same applies here.

• ⁨Comment⁩ on ⁨Proton is transitioning towards a non-profit structure | Proton⁩ ⁨⁨2⁩ ⁨months⁩ ago⁩:

  You can use your own GPG key (proton.me/support/importing-openpgp-private-key or using the bridge), whatever tool does the signing needs the key (duh) so I am not sure what you mean by “they store your private key” (they stored it encrypted as per documentation proton.me/support/how-is-the-private-key-stored), their AI was specifically designed as local, exactly to be privacy friendly, plus is a feature that can be disabled (when it will reach general subscriptions).

  I don’t care about cyptocurrencies, but I suppose they started with the most popular, nothing to do with privacy as they just let you store your currencies.

  Anyway, use what you like the most, of course, but yours don’t look very solid motivations, quite a lot of incorrect information, I hope you didn’t take your decision based on it.

• ⁨Comment⁩ on ⁨"PSA: Update Vaultwarden as soon as possible"⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  Yes, you could run it in LAN only. You could access it via VPN only.

  Obviously this adds friction in addition to security, but if that’s fine with you, you can.

• ⁨Comment⁩ on ⁨"PSA: Update Vaultwarden as soon as possible"⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  Thanks for the head’s up!

• ⁨Comment⁩ on ⁨“Mastodon for Harris” is a Success Story for Fediverse Activism⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  I think this is a very real observation, with not much that can be done.

  The best non-USA people can do is to participate and share/produce content which is not US-centric (ideally in their native language too). Unfortunately many communities, even non political ones, often still default to a US-centric perspective and culture, which makes it hard for people to participate.

  It’s hard to dance around it, more people are needed.

• ⁨Comment⁩ on ⁨Sign of the times?⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  Fair enough, the bar is indeed even lower.

• ⁨Comment⁩ on ⁨Sign of the times?⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  I wouldn’t call it cultured. I have been in meetings with people sticking fingers in the mouth to put/remove snys, or put the used ones back in the box, it was quite disgusting…

• ⁨Comment⁩ on ⁨Mamma mia⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  I think it simply comes from the bad english of italian people who immigrated to the US. Plenty of them were from South, but the stereotypical speech is simply a consequence of Italians pronouncing words as they are written (given Italian works like that). Neapolitan dialect is actually very contracted, so the opposite of elongated vocals as the stereotype goes.