Taranli_Maren

This is an interesting project. I've been following FreedomBox for ages hoping it would end up as a good way to do this, but development has been slow. I do have some questions about the technical details:

1) Is email access provided through the Helm App, SMTP/IMAP, or is there a webmail interface as well? Can you use this device without a smartphone?

2) Which Linux distro is this based on?

3) What file system is used? Is it something like ZFS or BTRFS, which could protect against corruption? Since there seems to be only one drive, I assume there is no RAID-like redundancy included to protect against drive failure?

4) Where are the encrypted backups stored? What is the procedure for recovering them? I expect that the backup recovery keys are also stored offline on the flash drive?

5) How are software updates performed? Are they pushed from a managed system that you control, or does the device itself pull updates automatically on a schedule? How long will you guarantee software updates for? If you stop providing them, or are slow to patch a vulnerability, is there any way for the user to patch the device themselves? Local SSH access perhaps?

Lastly, a comment, please consider not overriding the scroll behaviour on your website. It may look slick when it works, but when it doesn't (as it doesn't on my Firefox), it totally breaks the website. In the case of your technology page, it is super-annoying, since the details I want are at the bottom, and I'm forced to watch the slideshow before I can see them.

SPF won't help if the spam filter blocks residential addresses outright, which is commonly done using DNSBLs.

That is not entirely true. Perhaps in the stated configuration it is, but since the domain points to the EC2 instance, you could always register a new LetsEncrypt certificate for it, and do a silent MITM.

Perhaps the architecture you describe is the best, however I would hope for two things to be supported: 1) The ability to run your own gateway server instead of having to trust one managed by your company. 2) The ability to disable the gateway entirely if you happen to have a business connection already.

I don't think they are arguing that the government should not be able to collect metadata for suspected terrorists or criminals. This sort of collection could go through the normal channels.

My understanding of the argument is that the mass collection of metadata, from every phone number in America, has not provided any security benefit. For those who feel that sacrificing liberty for security is acceptable, sacrificing liberty to gain no security is probably not.

> A secret collection of mass meta-data collection being examined by people without security clearance is unlikely to find any benefit because no-one is going to tell them what happens with the data. "We see no evidence of benefit" could mean "there is no benefit, and thus we haven't seen any evidence" or it could mean "there is plenty of benefit, but that's all secret, and no-one will tell us about it, and thus we've seen no evidence of benefit".

I'm sure you are aware but Sen. Wyden is on the Select Committee on Intelligence. He is hardly a random guy with no security clearance. If he hasn't seen any evidence that the bulk surveillance has any benefit, then the NSA is withholding critical information from the people that are supposed to be performing oversight over them.