Natanael_L

Yes.

And they have much better mechanisms than DKIM available which they should use instead.

In fact, with reliance on DKIM you create the distorted incentive that one company might want to fake getting hacked to claim an email they sent is not authentic.

As a matter of fact, they might even be so sneaky as to send individual emails without DKIM signatures, with a policy set for the recipients to not reject those emails. Since most email clients do not display this discrepancy in a lack of a DKIM signature, the recipient might not notice and then the sender can later claim forgery.

So then let's not rely on something so unreliable if you need reliable authentication.

It's already common to use unsigned documents in court, as long as you can show provenance is legit or if the counterparty is willing to acknowledge authencity.

In fact, it's quite common that the issue over unsigned documents in court is the interpretation, not authencity.

I think the issue of having to teach users how to opt in to signing emails in potentially controversial cases is preferable to having to teach them how to handle email communications that are permanently provable (for starters, never ever again leave out a quote and never ever write ambiguously).

No, destruction of evidence involves things like making something impossible to analyze and evaluate. Publication of a key doesn't erase the original messages and does not make it impossible to look into their contents to try to establish authencity by external means. Causing ambiguity is not destruction of evidence.

Many DKIM keys uses outdated key generation defaults with 512 bit RSA keys. Google used to have such weak DKIM keys too in ~2012.

This isn't likely very viable, though. In particular because most emails won't contain full context. You can't even really tell from digitalized text if a person in an oppressive society believes in what they're writing or are just trying to avoid suspicion, and so on.

Imagine stuff like abusive relationships where one party cherry picks emails to release to hurt the other. It's not really that complicated.

Stuff like revenge porn already exists. Let's not make the problem worse.

What do you think of reflective screens like Qualcomm's Mirasol?

I seriously doubt that. Network effect "just" makes a particular means of communication more favorable - it doesn't prevent the use of any of the options.

Not being able to use the phone cuts you of from a lot of services where no option exists.

Again, is that because you literally don't have the physical option of communicating by other ways, or because the people you want to communicate with are too lazy to use another option?

If I ask you to meet me at the bar and you're banned from the bar I've selected, it's not the bar's problem.

Is that because you can not replace Facebook, or because it's merely inconvenient to do so?

Because the law doesn't protect convenience in these contexts.

Then they would only have ToS violation claim against those particular users. It's not legally straightforward that FB could demand that the tool can't be distributed. Any 3rd party that didn't agree to the ToS would not be bound by it, and can still redistribute it.

Utility regulation doesn't depend only on importance. It depends on importance plus access.

That's why your local grocery store can ban you even if food is necessary for your survival, because you didn't lose access to other sources (stores).

All of this assumes an equivalence in function and access that just isn't there.

If my phone company decides who I can call, then I got issues. I can't trivially change carrier however I want.

If a website arbitrarily bans all kind of people it will soon be their own problem as people leave with a single click.

More specifically, I do not need linkedin, Facebook and co at all to communicate with people over the internet, stuff like P2P software never went away.

The one I recall was about streaming OTA transmissions captured from individual antennas, one per user, essentially renting remote access to the antennas. The court essentially said relaying the stream is a new broadcast and needs its own broadcast license.

In this case though, the license on Steam follows your account on the platform and not a single time downloaded digital or physical copy.

So the lack of license argument doesn't make sense. At best they can put an explicit term in the license that the game can't run from servers you rent access to, or equivalent. But then that has to already be in the license.

The ToS can't guarantee what other users will or will not do with the data displayed to them, though.

Something can both be a shitty thing to do, and still be allowed because we'd be worse off if we tried to ban it.

(Usually because detection and enforcement is absolutely unreasonable)

Intentionally making time be permanently stupid is a bit stupid, IMHO. Lots of existing scientific standards that are stuck with old cruft that makes things annoying (like the definition of electrical minus/plus poles), why add more cruft?

Even they doesn't actually strive to allow everything that's legal.

Depending on Amazon's mood that day, the answer might be "yes"

Literally everybody has their own personal definition, and if you decide to rely on the choices of other people then their definitions will apply.

That gets people banned

https://www.businessinsider.com/twitter-donald-trump-suspend...

As a moderator in a smaller technical subreddit myself, I mostly agree with that assessment.

The best subs I've seen usually have small communities and/or strict enforcement of the community rules (doesn't always need to be through moderator action!).

Unmoderated or otherwise weakly managed communities just don't scale. They never retain any quality if you try anyway. The noise will always dominate.

With no way to set expectations that the vast majority of the audience understands (see least common denominator), expectations which they agree with and which you can meet, you'll get endless conflicts.

Strict moderation like in /r/netsec and /r/askhistory works when done well and consistently by competent mods. It preserves good discussions and gives people and incentive to maintain high quality in their submissions since that's a requirement to even be seen in the first place.

Smaller forums with tight healthy communities often don't need much moderation (usually niche communities with no significant controversies), and can often self regulate by typical social means (just telling people to behave).

All the best contributors are usually driven by some kind of intrinsic motivation, often an interest in the topic at hand and a wish to share their knowledge. If the forum is by far too flooded with low quality content for that to be seen, they will lose motivation to contribute, and as a consequence the signal to noise ratio falls. You're more likely to incentivize new competent contributors to join if the contributions from your existing competent contributors are among the most prominent submissions in your forum.

-----

As for centralized vs decentralized, I see decentralization of forums as a form of an escape hatch when the quality of a forum degrades. The ability to cleanly fork a forum and walk away to a new location with new rules, like in software projects, provides a motivation to work hard to maintain unity in the forum, or else the mods will have nothing left to be modded, and likewise for other prominent members whose bad behavior contributes to division.

Sometimes drastic actions like this is the only way to maintain high quality

On reddit you can do that natively for a whole thread by locking, but for individual comment chains you can only do it with mod bots.

How's this different from email? Management of server reputation, spam filters, etc.

One and gone spam servers are frequent and are dealt with through putting low trust in new servers and using heuristics to flag behavior that look abusive.

Mostly for in-app payments of a bunch of variants, primarily for digital content, yes.

We don't need the ability to switch to new algorithms as much as we need the ability to ditch old ones. Agility in cryptography only needs to mean the ability to deprecate what's broken. We're still going to see newer and more robust algorithms implemented in new software and protocol versions anyway.

What we need is 1 or 2 strong cipher suites and exactly zero weak ones, not 10 strong ones and 5 weak ones.

From what I read, x.509 allows the signer to specify the curve parameters along with the signature.

And yes, the bug here would be that Windows accepted parameters B without confirming they match A, it only checked that the public key was the same.

So you have official and trusted root / intermediate cert C1 which contains pubkey 1 and parameters A, which uses privkey 1 (secret obviously). When signing it doesn't usually specify parameters (just gets it from the trusted cert), the leaf certificate just contain the reference to the trusted cert and its public key and of course also contains the actual signature.

In the attack you reuse pubkey 1 but create parameters B and associated privkey 2, and using that you create a leaf cert that contain both the same references that an official signature would contain - except you also specify parameters B, and then supply the signature that validates only under parameters B, and then Windows accepts both the parameters and the signature.

Twitter on mobile.....