u801e

> if the client can sign the crypto challenge and initiate a connection

How can the server verify it's the same client signing the crypto challenge with the same private key?

> what does it mean for the client cert to be potentially invalid?

The certificate's signature cannot be verified. Assume a client decides to create a certificate and send it as part of the TLS connection negotiation. The server would reject it because the signature on that certificate isn't valid since the server CA did not sign it.

> What could lead to that case in the system you're imagining?

Someone who's trying to access my account (assuming news.ycombinator.com requires a client side TLS certificate as part of the authentication process) tries to forge the client side certificate. If the certificate is self signed, how will the server know it's from me versus someone else? How do we maintain the association between a particular client and a key pair?

> Under what cases would you either a) not grant a CSR in the first place

For someone creating an account, there would be no reason to reject the CSR. For someone trying to add another device with a different key pair under the same account, not being able to show they have access to the first device would be a reason to reject it.

If we're talking about an account at a bank, a CSR could be rejected if the person is unable to establish that they're the actual account holder (through some form of out of band authentication like a bank official checking my drivers license and passport).

> or revoke a cert your CA signed?

If someone decides to delete their account, then revoking the certificate used as part of the authentication process would be the appropriate course of action.

The same benefit we get by using the external certificate authority to verify that I'm connecting to a certain website and not some fraudulent version of it.

To put it another way, the benefit I get by having my computer verify that I'm connecting to news.ycombinator.com and not some fraudulent website is so that I don't inadvertently transmit my account credentials to a scammer.

The benefit news.ycombinator.com gets by verifying a client certificate I send them is that they can verify that the user u801e is establishing a connection to them and not some scammer who happens to have my account credentials.

Those benefits are lost if either the server or client sends a self signed certificate, because there's no one who we can use to verify the authenticity of the certificate. The reason using an external CA is not needed on the server side is, in my opinion, because the server is the one who's handling the account creation, so it doesn't need an external authority other than itself to verify whether the certificate is valid. If the server just accepted a self-signed certificate, then how does it verify that the certificate is valid?

> Before the first time you connect to a website, your browser asks if you want to generate a new cert or reuse an existing one, you make a choice

The server has to have some way of verifying your certificate. The workflow I would like to see is that the server runs its own CA that it uses to sign client certificate signing requests and then uses that CA to verify any client side certificate presented. If combined with a username and password, it would effectively be 2FA without a shared secret (outside of TLS connection negotiation).

> webauthn, as designed, can't be used to lock anybody into any authentication method

It only supports HTTP as I understand it, and won't work for other protocols like SMTP or IMAP.

What does work, regardless of application level protocol is using TLS certifications on both the client and server side in combination with a username and password for authentication.

What's interesting is that until very recently, the interest rate on treasury bills were higher for shorter term ones versus longer term. That is, the 4 week ones had a higher interest rate compared to the 26 week ones. In fact, the daily treasury bill interest rate for May 26, 2023 was

    5.78% for 4 weeks
    5.30% for 8 weeks
    5.16% for 13 weeks
    5.28% for 17 weeks
    5.18% for 26 weeks
    4.98% for 52 weeks

[1] https://home.treasury.gov/resource-center/data-chart-center/...

> Sometimes they can take up to 3 business days

I've found this to be the case when transferring funds using the external account transfer feature for a number of banks where I have an account. For example, it does take 3 business days to transfer from an account I have at Bank A to another account I have at Bank B.

The banks in question also offer Zelle transfers, but since I used the same email address for both bank's accounts, I'm unable to use it for money transfer from one account I have to another.

> I want terminal editor that does not need me remembering keyboard shortcuts to edit things.

Keyboard shortcuts are essential to increase efficiency and speed. For example, ctrl-c, ctrl-v, ctrl-z, ctrl-s, ctrl-p, ctrl-a etc. People learn these early on if they regularly have to input/edit text to speed up their workflow. Otherwise, they would have to resort to pointing and clicking through menus to accomplish the same thing.

The longer you use an editor, the more of these shortcuts you commit to (muscle) memory, so, even if the commonly used editing operation is easily accessable via the GUI interface, people are going to choose the keyboard shortcut to do the same thing since it's faster.

> When opening that editor, you should not be greeted with tutorial. It should be simple to do things so that tutorial is not even necessary.

You could navigate with the mouse or arrow keys in either vim or emacs. The only thing you would have to learn is how to save the file. You may not even have to learn that because both vim and emacs display a dialog box asking you whether or not you want to save the file if you try to exit the editor without saving first.

I never had the N900, but I used the N9 as my primary phone until the SIM holder broke and I had to hold the SIM in to make a call.

Looking at the comparison[1], it looks like the N9 was a bit more advanced, but it lacked the keyboard the N900 had. At least I also had a N97 :)

[1] https://www.gsmarena.com/compare.php3?idPhone1=3398&idPhone2...

> Lemmy, kbin and mastodon instances can interact with each other via activitypub. People can migrate to literally any instance they want, then subscribe to any community they want regardless their origin instance.

> My mind was blown the first time I watch this this interoperability happen.

Usenet worked in a similar fashion decades ago. It's too bad we can't get the masses to go back to that.

> You need to assume nobody sees you, and you have to see for everyone else.

This really is only applicable when going through intersections where paths can cross. A motorcyclist on the road right in front of a motorist will be seen because they're right in the center of their field of vision.

> If you're on a motorcycle you have to treat everyone and everything as out to get you, because they are.

That's not the best way to put it because it implies that motorists will purposefully try to crash into motorcyclists. In reality, it's due to inattention and the risk of a collision can be reduced by the motorcyclist through defensive driving techniques. For example, when approaching an intersection, is there a motorist approaching or waiting there who could cross my path? What's my plan to avoid that? It comes down to planning rather than reacting.

> This is a strange example because for a remote worker every other worker is "remote" so why would they ever exclude other workers from a group email?

It's possible if all team members in the office went out for lunch and didn't see the messages and emails in time. The remote members wouldn't exclude them, but the in person team members wouldn't be able to provide their input in a timely manner.

> The #1 complaint of full time remote workers is they feel we all agree on designs and decisions and they just get to see a doc that 4/6 have already signed off on verbally and they feel not involved. I have no idea how to "make them feel involved" nor do I care tbh.

Suppose instead of just two people who are 100% remote, you have 8 people who are remote out of a team of 12 (the rest come into the office regularly). The 8 people who are remote find a problem, hash out the design in chat/video, write up a document and the 4 people in the office get to see a document that 8 out of 12 have signed off on. The remote people have no idea how to get the in office people feel involved, nor do they honestly care.

> For example, to reverse sort only the first 5 lines of in buffer, one can execute this ex[0] command:

> :1,5 !sort -r

Interestingly enough, you don't even need an external program for that. You can do the same thing with

    :1,5 g/^/ m 0

The g command allows for effectively looping over matching lines as opposed to operating on them all at once. The /^/ matches every line and since I'm using 1,5 for the address, it still only matches the first five lines. The m command moves a line (in this case, 0 which is the beginning of the buffer).

Since it executes it one line at a time, it moves the first line to the beginning of the buffer, then the second line (which places it above the first line), then the third line (placing it above the second line) and so on.

It's also missing H, M, and L for moving the cursor to the top, middle, and bottom of the window respectively. You can also navigate using the % command. For example, you can use 50% to scroll to the middle of the file, 75% to go down 3/4ths of the way, etc.

At least old.reddit.com still works and it's usable, more or less, on mobile.

> Except some ISPs did eventually cutoff access to the alt.* hierarchy. Some terminated their NNTP service entirely.

That happened after the attorney general of New York threatened to sue them, not because the ISP didn't like certain opinions or viewpoints.

> That case is not related to the 1934 Communications Act and neither are the other two cases you cited. You’re thinking of the Communications Decency Act which is a separate law with the famous Section 230 clause

That was a misunderstanding on my part. Regarding net neutrality, I'm not sure whether its repeal made a practical difference in terms of how people are able to connect to services over the internet. Given the widespread use of encryption, ISPs wouldn't be able to tell whether someone is using a service over HTTPS on port 443 or some other application level protocol using the same port.

Though if ISPs did place substantial limits in their bundled usenet service, then people would choose other ISPs or 3rd party services and/or complain. Just as they would if their ISPcs SMTP server wouldn't send messages to certain domains or if their web browser was blocked from accessing certain websites.

> DNS is probably a core service.

The ability to establish a connection to a remote server using an IP address is a core service. DNS isn't required. Discounting TLS certificate validation, I could connect to a remote server using their IP address instead of their hostname.

ISPs used to provide documentation instructing the end user how to connect to email, usenet, and how to set up their router or computer to access the internet. This could involve access credentials, DNS settings, etc.

> ISPs trying to do anything but give me Internet for money = bad; so a USENET or USENET-like service but at a much larger scale as a service provided by ISPs = unappealing.

Personally, I don't see the issue. If I can get a service bundled in with my existing service, then why not? If the service is significantly inferior compared to third party offering, then I still have the choice to sign up and use it.

> When AT&T cut off USENET access in 2008, it wasn’t just because they were being threatened with legal action over hosting child pornography on their NNTP servers, USENET had in their estimation declined past the point of return and it was no longer worth providing to their customers, particularly with a changing legal landscape that put them further at risk for continuing to provide it.

That doesn't really explain why a lot of major ISPs made the same decision within a short timeframe. The threat of a lawsuit does.

> There will never be a sequel to or rebirth of USENET at social media scale without moderation

Unfortunately, people prefer to use third party services and complain about their free speech rights when those services make arbitrary decisions about what's allowed and what's not. Usenet didn't have that problem.

> 1. [ISPs] could choose which newsgroups to provide access to as part of their USENET access service.

Just as they could decide which websites you can visit, but, outside of government intervention, they normally don't. Similarly, they could limit which MX servers could connect to the ISP's MTA server, but they don't (not counting SPF, DKIM, and DMARC). Why would that be different for usenet?

> 2. USENET or a modern-day like-service as a separate billable item would not necessarily be subject to the same common carrier provisions that broadband service providers were subject to when they were regulated under Title II of the 1934 Communications Act.

Reddit was a defendant in a lawsuit[1] case that the SCOTUS decided not to consider. The 9th US Circuit court ruled in favor of Reddit. Both Google and Twitter went through similar cases[2] and both prevailed.

Would usenet fare any differently?

> 3. This rule was also repealed under the Trump administration and broadband service providers are once again regulated under Title I, which is to say they are not classified as common carriers. Even if it hadn’t been or if they were to be reclassified under Title II, see point 2. I did try to see if this did change under the Biden administration but I have not heard of such a change nor could I find one.

I don't believe ISPs were ever considered common carriers[3] and this includes the period where usenet and email were commonly included with ISP internet access.

> 4. ISPs previously did not have the same incentive structure, and were dealing with a different market and legal environment prior to 2002. The truth is, USENET at the scale of Reddit could not exist without good moderation.

After Eternal September, usenet continued to function relatively well up till the time the attorney general of New York threatened to sue[4] a number of major ISPs over child pornography on usenet (which would be like a user's ISP being sued over the fact that they have child pornographic images stored in their ISP email account's inbox folder). This lead to many ISPs discontinuing their bundled usenet service which led to a significant reduction in the number of people connecting to usenet.

> I have an issue with the idea of getting billed for non-internet access services (read: content) through my ISP as a means of paying for them.

Your ISP provides DNS services you can use to allow your computer to determine what server to connect to when you initiate a HTTP request with your web browser. You could choose not to use them and have your computer connect to an external DNS provider. Similarly, you could choose to use your ISPs MTA and have your mail client connect to it and issue SMTP requests to send your email to whomever you wish. So, if your ISP provided a NNTP server for your NNTP client to connect to, you can still choose to use another provider to connect to usenet.

> I want a direct billing relationship with my service providers, not a stack of line items on my internet bill.

ISPs so far have never had separate line items for bundled services in their bill. Not for usenet, not for email, not for DNS. I don't see that changing in the foreseeable future.

> Put another way, I’m saying it is simply an unappealing arrangement when there are superior alternatives.

I don't really see having to use third party service providers for every single service as a superior alternative.

[1] https://www.reuters.com/legal/us-supreme-court-declines-hear...

[2] https://www.cnn.com/2023/05/18/politics/supreme-court-twitte...

[3] https://www.ncta.com/whats-new/why-its-a-good-thing-that-bro...

[4] https://www.techdirt.com/2008/07/22/andrew-cuomo-threatens-t...

> Unfortunately, that UX is difficult to translate to mobile devices, because it basically requires to be keyboard-driven.

There are GUI NNTP clients that could be adapted to work on a mobile platform. Thinking of webmail clients, you could do something very similar in terms of article selection, replying, new message, etc. The only think that would need to be accounted for is posting replies incline and with proper text wrapping.

> This is definitely not true anymore

If it's political, you can still post it to alt.politics on usenet and not have any issues with any central authority.

I would really like to see collaborative software development done via a usenet newsgroup. The git send-email program could be updated to send cover letters and in line patches to a newsgroup, and people could reply to those messages and review each patch.

> As an analogy a lot happened to HTTP and other protocols to increase user experience, better content deliverability, and control.

On a protocol level, do you have any examples of what you're referring to when you say "increase user experience, better content deliverability and control?" Based on what I understand of the NNTP protocol, it allows for pipe lining commands to retrieve data, allows multiple, and persistent connections, and some commands will instruct the server to send compressed responses.

> [Thunderbird] badly needs spam filtering for its NNTP client

It already has the capability to filter newsgroup posts based on header and/or message body content.

> No I much prefer email groups to online forums or Reddit. Easy to register, just send a subscribe message. Trolls can be ignored or banned by the list administrators.

Do you also prefer email lists over a moderated newsgroup? If so, why?

> Usenet servers act as common carriers but they are not legally common carriers (in my opinion) which means if I am right, the experiment will end as soon as someone decides to litigate against a server operator for passing on material that someone felt offended by. Not even copyright violations, just something they were offended by. For example, it is illegal to insult Ergodan (really) and while that law isn't enforceable here, it was elsewhere until recently in places like Germany which still had laws on the books saying it wasn't legal to insult foreign heads of state, etc. So it's just a big litigious mess now.

Reddit was a defendant in a lawsuit[1] of a similar vein that the USSC declined to hear.

[1] https://www.reuters.com/legal/us-supreme-court-declines-hear...

> Then we would be subject to the moderation policy’s of our ISPs.

ISPs are a common carrier and never really moderated the content of newsgroups on usenet.

> I don’t need any bill on my internet bill

I'm billed monthly for internet access and have had this arrangement with multiple companies over the last 30 years. That bill used to include a ISP email account and usenet access. Now it doesn't.

They did up till around 2010 IIRC. The smaller ISPs had their own feeds, but eventually outsourced them. I remember the Path header containing the server name of the ISPs own NNTP server, but later it changed to supernews.

ISPs also provided email accounts and I believe some provided a server directory for you to host your own website.

> that includes things like Github for code reviews

I've never worked at Google, but if you want a clean set of commits to implement a feature (think Linux kernel/subsystem, git, etc), Github makes it unnecessarily hard to do that. The best they have is squash and merge which basically makes one mega commit and a merge commit that references a branch with a single commit.

> then they essentially bootstrapped a foolproof, checksummed machine-code editor

I remember that I copied a short program in BASIC that you had to run in order to type in the machine code part of the main program you were typing. It would sound a bell if the checksum had no error, otherwise you would hear a buzz sound.

> and, somewhat regrettably, cut out the source-code middleman.

The programs I typed in had parts in BASIC and other in machine code. I just wish the machine code parts used the instruction mnemonics instead of the actual instruction byte code. It definitely would have been more educational to see instructions like LDA, SDA, CMP, JSR, etc instead of the actual number values.

>> Outlook never supported NNTP

> If you know a bit more, you should know that Outlook Express does

I know that Outlook Express does and it's a distinct product from Outlook.

> The reason why I'm using Thunderbird as email client is probably because it got a (even through buggy but) functional NNTP support. I also know Thunderbird has a bug which prevents it from using the correct charset defined by the user, because I guess I've spent too much time on these news groups.

I haven't used Thunderbird to post to newsgroups recently, but I'm pretty sure that it set the charset part of the MIME header to utf8. When I used to post regularly, it was set to us-ascii based on what I set in Thunderbird's, Seamonkey's, Mozilla Mail & News, and Netscape Communicator.

> Also, reading your reply, I realized that you are putting a lots if not all of your own experience on "plain text messages", and you're thinking "this is fine"?

It works for this forum.

> Then wake up. On today's Internet, if your forum service cannot host memes and other types of rich multimedia, it's already out of public view.

Practically every comment on this website is essentially in plain text. Even most comments on reddit stick to plain text and neither website is out of public view.

> Dude, really? Just 750 Kb? :)

None of the comments you or I have written here come anywhere close to 750 Kb in size. Most emails I type aren't anywhere near that either. In fact, if you look at mailing lists like the ones used for the Linux Kernel and various subsystems and the one used by git project, you'll see that their inline patch messages come nowhere near that size limit. So you can easily read through any of those mailing lists using a NNTP gateway.

> It require some setup that most people don't know they can do

Like what exactly? The default configuration[1] shows message subject, author and date in bold text in the message list pane if you haven't read it and in regular text if you have.

> every time when new mails are downloaded, even if none of those mails are meant for you.

Usenet messages formed a multi-threaded discussion per topic. Messages that are posted as direct replies to message you posted are meant for you and can be easily spotted by scrolling through the list of messages in the message list pane and seeing direct replies to messages you posted in bold text. Even in threads that had thousands of messages, I could find replies to messages I posted in less than a minute. In contrast, I have to click through several screens of my comments on this website to see if any of them have replies and then remember if I had already read them or not.

> Your overall reply gives me a feeling that you're deep inside your own good-old-time memories

I still occasionally use usenet today and frequently use NNTP gateway services to browse mailing lists. It's not recollection of "good-old-time memories". Given your remark about being 13 years of age and donating lunch money makes me think that your recollection isn't very precise given your young age. I started using usenet in the mid '90s when I was an adult in my 20s. I used it daily posting and reading groups up till around 2015 or so when the groups I posted in basically were abandoned by all the regulars I used to interact with.

[1] https://i.imgur.com/i226q2c.png