Natanael_L

What you're linking has now literally been edited with an update to suggest the tool age.

The idea that "AES is enough" is like saying you don't need better winter clothes to go skiing because you have a good helmet. There's still more things left you need to protect than that! A secure block cipher mode and key management and IV generation, etc, is mandatory!

Getting my comment flagged doesn't make you right, just so you know.

Just see my list of links below. It's undeniable that the very reason why people use the term MAGA is to voice support for hypernationalism, as a way to justify racism and hatred. This is what the term was created to be.

There's nothing tenuous in the association when the president himself is retweeting white nationalists using the term, when he's using it in blatantly racist ads, when it's used to justify walls, when it's used to justify abandoning international responsibilities, etc.

The flag wasn't created by a group campaigning on hate. MAGA however is.

Also, funny how my comments got flagged and downvoted. Is the truth so painful?

I'm bringing it up because it's relevant because other people do that. What you personally believe isn't relevant to this argument, because this argument of mine is about the worst content which your proposed rules would protect. Because it WOULD protect bullying and racism and other abuse online under the label "protected opinion".

You would make it literally illegal to counteract such behavior online.

Your rule would necessarily punish Facebook for banning stalkers, punish reddit for banning racist subreddits if they're not strictly illegal, and so on.

The rule you suggest would protect their ability to harass others regardless of if that's what you intend or not. You can't just handwave away those consequences.

Can you prove that it's in fact not super trivial to circumvent bans on non hateful ideas (in non-totalitarian states)? Are here not millions of more websites besides Facebook et al? Is it not easy to go to another website?

The fact is that your proposed rule is far worse than the alternatives.

You're suggesting it's a better tradeoff to forcibly kill quality standards online so that everybody can express literally anything that's not illegal, when it's equally possible to just... Not make a law like that, and instead encourage people to go to other websites.

Each and every person should have their individual freedom to set their standards for what opinions and beliefs they approve of (the edge cases where certain collective decisions are socially harmful are covered by antidiscrimination law).

This extends also to website owners. This means that I as a forum moderator (in a different place, on reddit) has the freedom to ban others from my forum for engaging in what I consider abusive behavior. I get to decide if and when I want to take action.

The admins on Hacker News can likewise ban me from here.

Proactive intervention usually involves government censorship or police action, but can also be considered to cover blocklists and spam filters online.

Each and every one of us decides over our own "domains".

In spaces where I'm not a mod/admin (most of them, that is), "letting you" only means not reporting the account, etc.

Today's trade-off is that every person either accepts the rules for approved content that somebody else has set on their own website... Or your start your own website. Or both at once for that matter, it's trivial to visit multiple websites at once since most browsers have tabs.

If your opinion is banned in one place online, it's easy to go to another to post it. That's how the web worked since the very beginning!

We also purposefully do not extend that protection to literally everything distinct about a person. Even stuff like California's laws only protect employees from their employers when engaging in political action.

There's no universal legal protection against an entity responding to another person's general beliefs, if that entity consider those to be harmful.

We do not want to obstruct society from holding people accountable for harmful behavior.

No it's not. It's literally any faction with hardline dogmatic views. An extremist faction that manage to kill all their opponents doesn't suddenly become non-extremist when they're the new majority.

I have seen the arguments for "why it's positive for them" and they're bullshit. They're using it to justify racism and corruption and to defend politicians on their own side that even break the law (like a certain raid of a certain meeting concerning classified information).

I'm open to actual evidence, not just mere statements of disbelief. Can you provide counterevidence?

The evidence is literally all over his Twitter account. Like considering people murdering others by hitting with cars to be fine people. Promoting "false flag" conspiracy theories when his supporters attack people, claiming democrats are responsible. Language indicating support for civil war.

If you had read the news you'd know about it.

https://www.newsweek.com/trump-uses-language-war-twitter-it-...

https://journals.plos.org/plosone/article?id=10.1371/journal...

https://www.businessinsider.com/trumps-condemnation-of-white...

https://americasvoice.org/trumphatemap/

https://nymag.com/intelligencer/2019/08/report-trump-invoked...

You're either lying or ignorant. In either case you're blatantly wrong.

There's a very wide range of sleazy but not illegal behavior as well as hard to prove illegal acts which also might affect the equation.

For a conference organizer, the primary question is how to make it a positive experience for as many visitors as possible, and that's the criteria they will use when determining who gets to visit.

If allowing a particular person to visit means several others will refrain from visiting, is it then a good idea to permit that? That's a value judgement for the organizers to make.

And if you think they made the wrong decision, feel free to tell them so or even to boycott it yourself, giving them a reason to consider other potential solutions.

And what makes you believe that? Literally the people who introduced and promotes it are the people who promote its use by extremists. I've told you so already. What makes you believe the term still don't carry such meanings?

India haven't stopped using the swastika, actually. But the context of its use typically makes it obvious they do not use it to support nazi ideology.

You haven't read the president's Twitter stream? Because it's pretty blatant.

There's literally academic studies on it. You believe otherwise requires ignorance.

Not really. It would be quite illegal in most places, sure, but I simply wouldn't want to go there in the first place if you banned people like me.

Of course that becomes a problem is a large part of society does the same. Which is why such laws against the exists. But I wouldn't be the one pursuing this.

Especially for online spaces. There's just too many options for it to be reasonable to be pissed about getting banned from just one or a few places. It's always possible to create your own online space, if necessary. And right to speech isn't a right to an audience. You get to speak your mind, but people will only listen if they want to.

But keep in mind that there's a bet good reason for why most antidiscrimination laws deliberately limit the contexts in which they're applicable and what groups they protect. Very few jurisdictions protect opinions on their own.

I don't care if an antivaxxers works at a bakery. I'd be pissed if I hear one worked as a nurse at a hospital I go to, and that they refuse to carry out vaccinations. Some opinions are dangerous when held in certain contexts, and requires a reaction. This is simply about safety and protecting society. You can hold an opinion that terrible opinion elsewhere, where you don't hurt people.

At some point, you have to understand that the person putting their livelihood at risk is the person themselves, and that firing them is just as justified as firing a drunkard from a machine shop.

* whatever. Didn't say I consider myself as some benevolent dictator. It just means it doesn't seem bad enough on its own to require proactive intervention.

* see above

* your misinterpretation of my comment almost seems deliberate, so "no u"

* while they surely are your own, you don't get to demand that other people must ignore their own concerns if they belive your opinions make you untrustworthy or dangerous to them.

I am allowed to base my own opinions about you on what opinions you say that you have. And I am allowed to refuse to associate with you.

If you openly tell people that you want people like me dead, I will never let you do any job for me where my life might be at risk (like medical jobs or similar). You don't get to demand undeserved trust.

So you would let yourself be treated by a doctor that is open with wanting people like you to die? You want police that have stated they hate people like you? You'd trust a cleaner that despise you?

I will let you state your opinion, but you don't get to demand immunity from consequences.

Some opinions are genuinely indefensible.

Why is this question even being asked?

The answer is everybody, in their own respective spaces.

It's not me but not others. It's me AND all others.

If I run a bar, I get to kick out customers who voice despicable opinions. Exact same thing applies if I run a shop, a web forum, or a conference for that matter.

All of us gets to kick out people who behave badly from our own private spaces, nothing obligates me to tolerate abuse.

Free speech does not mean freedom from consequences. It does not mean the right to an audience. It means you get to say your opinion without the government interfering - and then other people get to decide how to react to it.

Freedom of speech without the right to react and respond to what others say would a horrible idea. Partially because it entirely invalidates the reason for why speech is supposed to be free. If you can't change things based on what you learned from what you heard, why even bother letting people speak?

If this means somebody else bans me from their space for being offensive, then so be it.

SHOULD does not equal MAY

For sensitive files with known names, you should be able to set that the cache is only valid for requests from the same host website (as the server might decide to send another response when the host is different). That would fix the sidechannel.

All browsers on iOS are Safari wrappers

Password authenticated key exchange algorithms (PAKE) solves the dictionary of secrets problem, by hiding the password from the server.

We could call it a Supreme Court

Declaring them absolute also don't solve these problems, because sometimes you can end up with conflicts between absolute rights, where you are not able to protect both rights at once.

They can host their own if it's legal, can't they? So sure, kick them off if they're disruptive and hateful. They don't deserve a megaphone.

Signal won't validate the session key via that mechanism, each pair of communicating users have to do that themselves

By that logic we shouldn't recommend cars with high safety ratings, because we can always train users to drive motorized unicycles at 200 MPH. Clearly there's no fault with the unicycle regardless of how many people crash, it behaved as specified.

Except the specification is trash.

But you can't trivially define your own scopes wherein each has their own independent set of trusted CA:s. That's part of what's missing. But default it's universal or per program.

Just look at every kind of umbrella organization out there like industry specific auditors with a scope limited to a field (medical, finance, food safety), or even hobby organizations with a parent organization auditing local chapters.

You don't go to the social security office to look up your neighbors phone number when you need to talk to them. The attributes people care about are often more local, more narrow.

People first go to local trust anchors to get information about things (and their software clients could then traverse various directories up to a root and back down, if necessary). I need my client to be able to understand an assertion from an entity far more personal to me than a distant CA. The CA:s are most useful in ephemeral connection, not long term ones.

This is what I mean when I say the CA system isn't expressive enough.

With "Johnny you're fired", it's clear that many clients don't correctly validate PGP signatures

Still under active development, nothing is really ready to use yet

The problem with this is that a tool that is too generic is itself dangerous, because it creates cross protocol attacks and confusion attacks like in https://efail.de for PGP email.

I think that a better approach is to bind identities from multiple purpose built cryptographic protocols.

As I've mentioned in another thread, I think we're more likely to get there via the route of E2EE documents collaboration tools. Something that cleanly breaks away from the email model, and adds enough value to make the switch worth the effort.

The problem is nobody uses this right

I think we're more likely to "accidentally" end up there via E2EE document collaboration tools that are in development now.

One day, a while after they become usable and common, people will just realize they've been sharing documents E2EE in place of sending email, and they'll be using it for basically everything that matters.

It would be a proper restart and allow for significant improvements in usability and security and everything else.

You're thinking of PGP web of trust, Signal doesn't have that