@alice @chuck I like the way you're thinking!

Minor counterpoint: computers are free! These days even the poorest have smartphones, which are extremely capable machines.

When we don't want to compromise on privacy, we do have the choice to compromise on other things, such as uptime or speed.

Check out apps like Briar, they're doing some amazing things.

My #PageKite was built to let people run websites on devices without public IPs.

So yes, but... don't rule out the tech side completely.

We've actually seen this dynamic before - in e-mail.

Because of spam, the weird technical hoops you had to jump through to run a mail server kept getting more and more insane.

And at the same time, people demand more and more functionality, fancy web interfaces, high availability.

Fast forwared to today: even big universities and governments with dedicated IT departments have given up and pointed their MX records at GMail.

Is the web headed the same way?

One of the paradoxes I struggle with in my work, is the conflict between crypto and reliability.

Crypto is important. But it is very binary in nature - either the stars align and you can decrypt, or it fails and there's no recovery. With that kind of binary, reliability suffers. This is inevitable.

As an example, most of the Mastodon downtime I've experienced has been related to minor SSL certificate blunders.

I feel like most of the #InfoSec community wilfully ignores this dynamic.

Apparently some silly USians want to extend copyright again: https://boingboing.net/2018/05/18/orrin-fucking-hatch.html

Repeating my Twitter reaction:

When will musicians realize that their biggest competitor is ALL THE PAST RECORDINGS EVER and revolt against this madness?

The Internet is not what makes music hard work. Never was! It's competing with Elvis & Mozart.

Demand the right to build on the past, not compete with it.

@seanl @cwebber @bob @pettter @nolan @CobaltVelvet I'm with Chris here. Yay p2p over Tor!

However, I want to throw shade on the absolutely ridiculous idea that the USG functions as a monolithic all-seeing entity.

The USG funds Tor because parts of the USG use Tor and parts of the USG love Tor and want it to succeed.

The fact that OTHER PARTS of the USG hate Tor and want to compromise it is normal, expected. The USG is big.

Contradictions are the rule in human systems, not the exception.

The casual, cheerful glee with which InfoSec people punish non-technical users, in order to put pressure on the vendors which sold them flawed products, is a bit sickening once you realize what is going on.

If you feel the urge to argue with me about this, tread lightly or prepare to be muted.

I'm not interested in hearing people justify these particular abusive behaviours. I've heard it all before.

Note to self: Remember to mention #Signal and #Wire and all the other #WhatsApp alternatives any time I toot about WhatsApp's relationship with #Facebook.

Otherwise the entire Fediverse will try to "help me" by promoting their favourite alternative... 😛

I wish #Briar were out of beta. It's the only one that is actually radically decentralized!

Next on my test plan is actually Delta Chat (https://delta.chat/). It's based on e-mail and #Autocrypt, so it should play nice with #Mailpile.

@pettter @bjoern I am just full of surprises!

Also, that's what #Mailpile is.

@bjoern Isn't it? Is it also unrealistic to expect everyone to run their own word processor?

Now... which is more complicated, more lines of code, Mastodon or LibreOffice? The web browser we've both got installed is probably more complex than both of those.

The difference is mainly cultural, and how it's presented to the user.

The biggest difference between a client and a server, is that the server author hasn't yet made it easy to run.

@pettter Yes, of course if you are lucky enough to have benevolent governance then problems are mitigated.

The design of the tool is not neutral though. A tool designed to give admins more power plays into the hands of bad actors, a tool designed to give end-users autonomy does the opposite.

Mastodon and the Fediverse fail this test badly, the tools are geeky and technical and the design doesn't allow for easy account migration.

This exaggerates the power imbalance.

I may have to avoid Mastodon until this #DeleteFacebook thing blows over.

It's pushing all my "people being wrong on the Internet" buttons. All of them.

Friends! Stop being idiots! Please!

The fact is, the Fediverse does not protect your data or the social graph AT ALL. Anyone who wants to harvest your data, can. It's virtually all 100% public!

At least Facebook has some speedbumps.

If we replaced Facebook with the Fediverse tomorrow, privacy would suffer immeasurably.

In other news, I'm starting to tinker with "remote access" settings for Mailpile: integrating Tor hidden services and PageKite, integrating Lets Encrypt. Making it easy to access a personal Mailpile from afar.

It's a funny feeling to try and boil years of work (PageKite) down to a single check-box. But it's also oddly satisfying.

That kind of simplicity was the point, after all.

User-friendly, remote access to a running Mailpile is a very exciting feature. Very, very exciting.

Man, the deadline for the Mailpile job applications seems soooo faaar awaaaayyyy.

But it's not even a week now... https://www.mailpile.is/jobs/

I just can't wait to find out who I will get to work with.

Good morning Mastodon!

I want to draw attention to the fact that Mailpile wants to hire folks to help make our software available to Windows and Mac OS users.

Our mission is user privacy, Free Software and online independence for all. And we'd like Mailpile to be a diverse, inclusive, human-friendly and family-friendly place to work.

If you also care about those things, please help spread the word - and if you have the skills we need, check out https://www.mailpile.is/jobs/ and consider applying!

Prediction:

Software will be used to mitigate #meltdown and #spectre, slowing everything down.

In 2020, a new line of Intel CPUs hit the market where you pay a premium for "virtual security extensions" (VSE) that let you turn off the mitigations.

Google, AWS buy truckloads.

Intel profites.

Yay!

I suspect people trying to find alternate CPU architectures that don't suffer from #Spectre - like bugs have misunderstood how fundamental the problem is.

Your CPU will not go fast without caches. Your CPU will not go fast without speculative execution. Solving the problem will require more silicon, not less.

I don't think the market will accept the performance hit implied by simpler architectures. OS, compiler and VM (including the browser) workarounds are the way this will get mitigated.

@cypnk Yeah, that sort of thing is standard here.

You buy a SIM card with a "video" package that gives you all-you-can-eat video on their provider of choice, but everything else costs extra, and rates are high. Or "social" or whatever.

Unbundled data SIMs end up being almost unusable because the caps are so low and you have to keep buying more BW all the time. Or at least I did.

It's so bad I actually just roam on a SIM from the U.K. all the time. It's cheaper and better service.

@cypnk This has been going on since dial-up, having a public, fixed, reachable IP is considered a thing for "businesses" and is priced accordingly.

IPv6 won't solve this, because the firewalls and security are now entrenched and considered mandatory. Mostly for good reason.

Tooting my own horn, this is why I created PageKite. 🙂

Tor hidden services are also awesome, but only if your users all have the TBB or equivalent and never need to type or remember URLs.

Confession: I'm actually the one that plays my daughter's xylophone. We have a fun game, I "play" and the 18mo desperately tries to stop me. #dadtoot

Internally, big sites like birdsite are massively distributed databases.

Look at the federation bugs you see on #fediverse. Delays. Glitches. Missing posts.

Twitter has the same issues, because these are fundamentally hard computer science problems. The tinfoil hat brigade sees censorship and conspiracies, where people who know how these things work just see the expected bugs.