anjbe

> Does mailbox.org even include the "From:" address in the DKIM signature?

According to the spec, the “From:” field must be included in every DKIM signature.

https://datatracker.ietf.org/doc/html/rfc6376#section-5.4

That’s not true. Signal does provide an Android version without Google Play Services.

https://signal.org/android/apk/

I’ve used it for a long time on a GrapheneOS phone with zero Google software installed at all.

Since hardware vendors by and large ignore RYF certification and the FSF’s opinions in general, it’s hardly “yielding” for the FSF to change its policies if the existing policies are harmful to the free software community.

The people who are most vocal about FSF’s incorrect views on firmware are those who themselves are bringing free operating systems to new hardware, writing drivers, and reverse engineering hardware and firmware. They are not hostile parties—their contributions are among the most important to free software today, and their opinions should hold more weight.

I’ve had two Kindles (a Voyage and a first‐gen Oasis) and never tied either one to an Amazon account. I’ve always kept them in airplane mode and sideloaded books over USB.

It’s unfortunate that Kindle doesn’t support EPUB but it’s easy enough to convert with Calibre, and some free book providers (like Standard Ebooks) provide compatible .azw3 for download.

Even though I’m not keen on how locked down Kindles are and their software and rendering quality could be improved, the physical form factor and ability to sideload is enough benefit that my next ebook reader will be a Kindle too, unless something clearly better comes along.

No, irrespective of GCC’s license, Stallman intentionally hampered GCC’s output to be difficult to use with other free software, in hopes that it would also be difficult to use with proprietary software. See this thread:

https://news.ycombinator.com/item?id=26397634

OpenBSD does have dt(4) which is similar:

https://man.openbsd.org/dt.4

https://man.openbsd.org/bt.5

The classic counterexample is GCC, which so contorted its design to prevent being embedded in proprietary software, that it allowed LLVM to take off as a powerful competitor not only due to its friendly license but also by virtue of being architected in a way easier to integrate with IDE software. Stallman’s own self‐own.

Signal’s primary defense against that is disappearing messages. Beyond that, what can you really do against what is essentially an untrusted endpoint? Education and awareness, and hope that it sticks.

I concur, Worsley’s account of the voyage is excellent and highly worth reading.

The journey of Shackleton and his crew is one of the most exciting stories of survival and leadership I’ve ever encountered. Shackleton himself wrote an autobiographical account, and its copyright has expired, so it’s now in the public domain:

https://standardebooks.org/ebooks/ernest-shackleton/south

https://standardebooks.org/ebooks/ernest-shackleton/south/te...

Nintendo used, or attempted to use, various hardware/software, legal, and economic techniques to force publishers to use their cartridges, for which they took a significant cut of sales. The hardware‐enforced logo mentioned in another comment was one technique, that was an attempt at abusing trademark (not copyright) law to limit third‐party cartridge manufacturers. However, the courts decisively struck that strategy down in Sega v. Accolade.

As for economic techniques, there’s a fun story about a third‐party developer named Color Dreams. They released several games, including Crystal Mines, without Nintendo approval, and made their own cartridges. As the story goes, Nintendo threatened to pull their stock from any toy store that sold unlicensed games, and all the stores naturally caved since Nintendo had the most popular titles. Color Dreams saw the writing on the wall, and came up with a strategy to target one market that Nintendo had no hold over: Christian bookstores. Color Dreams rebranded as “Wisdom Tree,” gave all their games a thin Biblical veneer, and started marketing their games heavily to the religious demographic. By all accounts it was a huge success (relatively speaking, for a completely independent publisher).

For an example of the results, check out their conversion of Wolfenstein, Super 3D Noah’s Ark (originally for SNES, now on Steam!): https://store.steampowered.com/app/371180/Super_3D_Noahs_Ark...

> it does spread the idea that the CIA is incredibly capable

That’s hardly in dispute, is it?

> and individuals can sway overall policy

Certainly not the impression I got from at least the first three films. The Bourne Identity ends in an unceremonious coverup of a failed operation, and the sole “idealist” character in the next two films torches her career as well to go to the press. Which depending on your view could be considered exactly what Snowden did, for better or for worse.

Certainly typical tropey US spy movie fare (American characters playing CIA assassination games in Europe, etc.), but more revisionist Western than John Wayne.

That’s about as facile as the Pollyanna view that America nuked Japan reluctantly and purely out of necessity.

The reality is that it was a complicated decision and there were many factors that went into it and many subsequent interpretations of the history on all sides.

This Twitter thread provides an interesting overview of some of the historiography: https://twitter.com/wc_quinn/status/1458891500344029189

> I don't recycle passwords

That’s good. I think you’re probably in the minority though.

There are other ways unique passwords can be compromised. I see passwords accidentally entered into IRC windows about once a month. And even if you have perfect discipline at using unique passwords, that’s not something you can enforce on anyone else logging into your machine.

Maybe someone will chime in with strategies to run ssh from a wrapper that loads a unique password from a password manager with no risk of reuse or entry into the wrong window, or something. But at that point, your complaint about being locked out without the necessary files would apply—might as well use a key, which is simpler and provides strong security with no rigamarole.

I’ve seen a compromised machine whose sshd had been replaced with a trojan that saved all passwords entered into it. Some investigation revealed that sshd modification to be part of a standard script kiddie toolkit.

Are you 100% sure that every machine you log into remotely with your very strong password isn’t logging that password?

That’s one advantage of keys.

I switched to SSH certificates on all my personal machines nearly four years ago. Compared to plain keys, there are three main differences I’ve noticed in practice.

First, I started giving certificates expiration dates, so a compromised key would only be valid for a short time even if I were unable to revoke it manually right away. It provides some confidence that my keys weren’t exfiltrated once and subsequently used behind my back for years and years.

Second, when generating a new client keypair, I only have to copy the public key to my certificate signing machine (one copy) rather than every host I plan to log into (many copies). This more than makes up for the minor certificate configuration necessary on new clients.

Third, host authenticity warnings are now a thing of the past. Since I switched to certificates, they only appear when something’s actually misconfigured, never simply because I connected to a new host. As a result, I’ve lost the habit of blindly accepting the fingerprint (and in fact I’ve now turned on strict host key checking in the config file so accepting it isn’t possible). Of course, you don’t need certificates for that… if you’re diligent at checking fingerprints. I tried to be, but sometimes I fell short. Not anymore.

Why? Putting SSH behind a WireGuard VPN provides stronger security guarantees than port knocking and is built into the OS on both my server and my clients.

> a password-protected SSH key is also two factors

Not really. By default SSH keys are kept in a private subdirectory of $HOME. An attacker who has access to it is very likely able to modify the user’s $PATH, trojan the passphrase prompt, and so on. Thus in many real‐world situations it collapses to one factor.

Contrast that to an SSH key tied to a WebAuthn token with "ssh-keygen -t ed25519_sk"—even a fully trojaned machine would not be able to freely initiate sessions with the compromised key.

> it reduces heat and power and disk wear.

Measurably?

One real‐world example of this is Ulysses S. Grant’s autobiography[1], which he wrote while dying of throat cancer, specifically to provide for his wife. He died five days after finishing the final manuscript.

It’s a great read and I’m glad it was written. I’m also glad that the copyright has expired and as a result there exist free, high‐quality community‐maintained ebook editions.

[1] https://standardebooks.org/ebooks/ulysses-s-grant/personal-m...

With respect to 1, it cuts both ways. Sometimes an author can change a work for the worse, and then use his monopoly to (largely) erase the original. Remember the Star Wars Special Editions? All the fan restorations and rescans floating around are effectively bootlegs. There was one official release on DVD in 2006, but no indication it will ever happen again.

I agree that tying copyrights to lifetimes doesn’t make sense, because it’s logical for copyrights to be inherited and the law shouldn’t benefit long‐lived authors over short‐lived authors. I’m not fond of the reasoning in your comment though—by my reading there’s nothing stopping it from being used to extend copyright to “forever less one day.”

US copyright law at its inception was intended to provide a balance, incentivizing authors to create new works without infringing too far on people’s inherent right to copy and share ideas they haven’t necessarily created. See Madison (who wrote the original Copyright Clause):

“But grants of this sort can be justified in very peculiar cases only, if at all; the danger being very great that the good resulting from the operation of the monopoly, will be overbalanced by the evil effect of the precedent; and it being not impossible that the monopoly itself, in its original operation, may produce more evil than good.”

> I am of the camp, ultimately, that wants to see the U.S. Constitution's original copyright terms restored

The Constitution doesn’t specify copyright terms; it only grants Congress the ability to set them.

You probably mean that you want to restore the terms of the US’s first copyright law, the Copyright Act of 1790 (fourteen plus fourteen years, etc.).

> Nothing changed in these versions though.

There’s no guarantee of that, and definitely no guarantee it won’t happen in the future.

One example: https://www.nytimes.com/2019/07/16/arts/television/netflix-d...

To say nothing of the far more common case of whole works simply disappearing as publishing/streaming rights shift around.

The point is that sales don’t factor into it in the first place. An infringing work could increase sales, and the copyright holder would still have just the same rights. Think of anime fansubs—which effectively brought Japanese anime to mainstream popularity in the west, yet are still heavily cracked down upon by license holders, and always have been.

Disney has options even if copyright legislation doesn’t change. For over a decade now, Disney has used clips of Steamboat Willie in their logo. Even after Willie’s copyright indisputably expires in 2024, they may attempt to litigate under trademark law.

That kind of thing doesn’t always work though. For example, Lego has repeatedly attempted to trademark their brick shape in various venues after the patents expired. Their many resulting lawsuits against Mega Bloks have (to my knowledge) been generally unsuccessful, because the functional elements of an interlocking brick design turn out not to be trademarkable.

You would be able to use only those elements whose copyright had expired, meaning only what’s in the original book. (See, for example, Pride and Prejudice and Zombies.)

You wouldn’t be able to use Tigger, because that character was introduced in The House on Pooh Corner, whose copyright doesn’t expire until 2024.

> aaaand your sales go down.

Whatever valid arguments might exist to restrict speech through copyright, sales going down is not one of them. Otherwise you could lawfully prohibit negative reviews.

Yes, last year—erm, I mean in 2020—the Doyle estate sued Netflix for creating a movie in which Holmes shows emotion… they claimed:

“Among other copied elements, the Springer novels [on which Netflix’s film is based] make extensive infringing use of Conan Doyle’s transformation of Holmes from cold and critical to warm, respectful, and kind in his relationships.” [1]

This is essentially the entire substance of the lawsuit: that creating a new sister character that Holmes felt affection for infringed on their copyright of a single passage in one of the later Doyle stories where Holmes expressed concern for Watson who had gotten shot.

Netflix settled.

[1] https://www.documentcloud.org/documents/6956021-Sherlock.htm...

One potentially interesting point of discussion here is to compare GitHub to PGP keyservers. Both provide a means of sharing someone’s keys with a wide audience. GitHub probably has gotten more people actively using SSH keys than are actively using PGP to encrypt or sign material.

Then there’s the more controversial possibility that with such a large userbase, SSH could encroach on what was traditionally PGP’s territory. Giving someone a new account with password “changeme” is already long obsolete. How about when SSH signatures become mainstream? https://mobile.twitter.com/damienmiller/status/1452796122250...