@polychrome
Fediverse (mostly Mastodon) promised us we could just be ourselves, instead of managing personal brand. But that's a false promise. Our public posts are visible to everyone, forever. Our past followers-only post will be visible to any future followers. And they will be used against us, if we're not careful what we say.

So IMO socnets, as they are now, are no good for talking about sensitive personal suff.

Maybe we could fix them, but I'm not sure.

@polychrome IMO, socnets were a mistake.
IRL, as well as on previous decade's IMs and chats, you see what people are around, consider how much you trust them, and decide what things you're OK telling them.
But on socnets, there can always be someone who joins later, and can see everything you said before, even without anyone making an archive.

1/

Back when the GNU project was starting, among the first things they rewrote as Free Software were:
- text editor / IDE (Emacs)
- assembler, linker, and compiler
- make

IOW, they made tools that they needed to further develop Free Software without relying on proprietary tools.

They wanted their project to be self-hosting.

Nowadays, we have more free software than ever, but we develop it using github and Discord...

One thing that's IMO wrong with the way firefox checks addon signatures is that it checks signatures on already-installed addons periodically.

Why?
What's the point?

If a malicious addon was running 5 minutes ago, what do you gain by disabling it now?

And if it wasn't malicious 5 minutes ago, it's probably isn't malicious now. The code is still the same.

Install time checing - sure.
Checking on startup - fine.
But checking after you've already executed it?

@HerraBRE
@rysiek
One of the most important things I've learned about security during last few years is that it consists of not just Confidentiality and Integrity, but also Availability. So a situation where you can't connect to a server, or decrypt a message, is still treated as a security failure. There's often (always?) a tradeoff between Availability and the other two components, but it's not true that security people don't care about Availability.

@jerry @rysiek @Aaron
I have a feeling that right now, SMTP has the biggest adoption of all federated messagning protocols, and the second place is far far behind. Of all the new communication protocols I've seen recently, they're either popular, or federated, not both. And trying to get your new protocol adopted not just by people for their private communications, but also by companies, govts, and orgs for their internal and external communication is going to be extremely hard.

@lattera
IMO it'd be cool if major websites supported registering with .onion email - this way you could really own your email address by having complete control over the hidden service keys.

@rysiek @pettter @HerraBRE @bjoern
There's an example of a peer-to-peer world where you trust nobody: Ethereum.
And as we've seen, people are not well suited to live in such a world, because they:
- make mistakes
- get scammed
- are generally bad at expressing laws with code, let alone expressing social norms with code

@sir btw. I wrote a blog post about how all these language-specific package managers (npm, pip, etc.) are doing things wrong, mind taking a look? [shameless advertising] https://wolf480pl.github.io/thoughts/design/2017/12/02/thoughts-on-package-managers/

@aeonofdiscord @awilfox @Irick IMO what web encourages, is developement off apps, as opposed to protocols.

Back in the day, when we wanted to do sth over network, we'd first come up with a protocol, which would be then implemented in many apps on different platforms (see: SMTP, HTTP, IRC, XMPP). With web, when someone wants to make another app, they just make it a webapp with implementation-specific constantly-changing protocol, and The Only Right Client being the JS on their website. This sucks.