zahllos

Agree. Proof of ID in the UK often means copies of utility bills. You can fill out your own with an online template pretty easily. Inside the UK you don't even need to bother with the notarization requirement. It is indeed backwards.

You can say "well you have a driving license" except if you're a teenager or an elderly person who surrendered theirs, you don't. You can also say "use a passport" but they're not convenient to carry and some people have never left the country so never owned one.

An ID card isn't a bad idea per se. It's the same as a driving license except everyone can have it.

What is bad in this round is the government making everyone have it on their phone "because digital is cheaper" (guarantee it will cost billions either way). Similar problems - what about people who don't have phones, how do you mandate I install this on my dumb phone?

The previous iteration might've worked had they not gone overboard on sequencing everyone's genome and giving every government agency and their dog access (only slight exaggeration) to the data.

I laughed. Indeed there is quite some competition in the category "worst piece of professional software".

This is the answer. Google play services and related privileged components are the non-open source blob hoarding data, along with whatever backend services you use from Google. These components are part of the stock android image that comes on the device that's replaced entirely by GrapheneOS.

Naturally if you continue to use Google services then the data hoarding continues.

I would disagree. One of the problems of operating a VPN is that it is somewhat like operating a tor exit node: bad traffic is absolutely going to exit your infra. This means if you're renting VPSes or whatever you need a tolerant hoster.

For this reason a large part of Mullvad's infrastructure is hosted by M247 Ltd. If you simply block that ASN you will block quite a large part of Mullvad. You can block the ASN by using one of the myriad services that allow you to query all the IP blocks assigned to an ASN.

It's also possible to simply enumerate all their servers. They have an API.

You might not get it all, but you can block a significant percent.

I am not the original poster, but there are a few reasons to pick Wireguard.

Performance is better due to the in-kernel drivers, UDP design and crypto choices. If you're simply looking for the fastest option wireguard is it.

Openvpn's protocol is somewhat more janky than wireguard. It looks tls-like but then does its own transport thing. It has a lot of flexible options and ciphersuite choices meaning you could very well pick something less than ideal. The complexity of the code makes an undiscovered bug slightly more likely.

The downside of wireguard, mitigated by some VPN providers, is that it is UDP-only. You may find environments where you cannot tunnel out this way, even if you try to impersonate QUIC by running the remote port on 443. Mullvad has a udp-to-tcp proxy as part of their client and server to work around this.

I'd say more like none at all.

The last Labour government (1997-2010) passed the counter terrorism act and had multiple public arguments about how long suspects could be detained without being charged or released in their future legislative attempts - see "prolonged detention" in this: https://www.jrrt.org.uk/wp-content/uploads/2019/06/Rules_of_.... They similarly passed the Regulation of Investigatory Powers Act, which amongst other things includes compelled key disclosure (or compelled decrypt). They also had the national identity register planned as part of ID cards.

For fairness/balance, the tory government passed multiple acts. Online Safety Act was one, but the Investigatory Powers Act another - this did some relatively mundane things like call security service hacking "equipment interference" and say they were legally allowed to do it, but it was the act used on Apple to mandate technical capability to access iCloud e2e (act written by Tories, but TCN probably by Labour home office I would guess based on timing).

And Intel do make GPUs.

I agree and apparently so does the CA/B forum: SC085: Require DNSSEC for CAA and DCV Lookups is currently in intellectual property review.

DCV is CA/B speak for domain-control validation; CAA = these are my approved CAs.

This seems to be optional in the sense that: if a DNS zone has DNSSEC, then validation must succeed. But if DNSSEC is not configured it is not required.

The argument counter dnssec is that if you are trying to find some random A record for a server, to know if it is the right one, TLS does that fine provided you reasonably trust domain control validation works i.e. CAs see authentic DNS.

An argument for DNSSEC is any service configured by SRV records. It might be totally legitimate for the srv record of some thing or other to point to an A record in a totally different zone. From a TLS perspective you can't tell, because the delegation happened by SRV records and you only know if that is authentic if you either have a signed record, or a direct encrypted connection to the authoritative server (the TLS connection to evil.service.example would be valid).

So it depends what you expect out of DNS.

I agree with this to some extent. I am from the UK, which is pretty monolingual and with the same advantage as the US: we're native English speakers. So I think we do have a slight advantage, or put another way the incentive to learn another language isn't always there.

I think, based on my own experience, it is harder to to from English to another language for a variety of factors. Many native speakers will jump on the opportunity to practice with you, understandably. Everyone has different motivations and some will ask why are you even bothering if you speak English. Since there's almost always an English source for what you want, you have to avoid laziness as much as you can. Lastly a great majority of entertainment is in English - things like french rap are basically a crime against humanity.

That doesn't mean that every European you meet is automatically multilingual or automatically has English in one of their languages. Go to rural France and you will find plenty of monolingual french people. Italy is also somewhere English is not as widely spoken as you might think given the tourism (in fact outside major tourist areas, good luck). Go to the mountains in Switzerland and you might find people who speak a couple of national languages but no English.

You can however go "the other way" and for major languages there is an abundance of materials. I agree 100% with the sibling comment that there is something about the act of writing things out that helps with memorisation. I've done this with a few languages and I don't think flashcard apps are enough. Can they help? I guess a little. Are they going to make you fluent? Not a chance. Absolutely nothing beats taking a course and being dedicated to it, in my experience.

More generally I think what I am saying is that there is no magic shortcut, except being born to parents speaking multiple languages at you.

I don't think it is an odd take. I live in Switzerland, which has 4 national languages (Swiss German is spoken in dialect form that varies between towns, while Romansh has well-defined idioms with distinct spelling, although the 5 or so idioms are mutually intelligible). I speak French, passable German and one of the Romanshes, and I'm a native of none of them. Between French and Romansh I can more or less read Italian, although I can't understand it when spoken.

The same thing that has worked for me as a method for learning languages has always been the same. Get books, particularly short stories or children's stories aimed at A2/B1 level, and read them. Practice grammar. Get a pen and paper and learn vocab by repeatedly writing it down. Boring but effective. And of course practice listening and talking, which means either having native friends, doing a course, using audio materials from somewhere, etc. Courses with actual humans make learning go faster (in the case of Romansh, it would have been impossible without the course).

I don't find duolingo to be effective at all, as others mention beyond the A1/A2 level. I'd be a bit more skeptical and say even A2 you need to expand your horizons.

Yes, except that the "votations" happen 4x per year. Here are all the next ones: https://www.bk.admin.ch/ch/f/pore/va/vab_1_3_3_1.html

Each will have 1-4 issues (approx) scheduled. Elections for politicians happen every 5 years, but no need to wait for those. What takes time (for votations) is the process: you have to verify the signatures once they're handed in at the federal chancellery and then decide when to schedule it.

Further additions to your comment. Expanding on your downside: Big reforms like giving women the right to vote only took effect in 1971 on the federal level. On a cantonal level, Appenzell-Innerhoden had to be forced into it in the 90s by the Tribunal Federal, but well.

I'd add some advantages to the upside as well: some changes require a referendum, such as changes to the constitution. But there's more: a popular initiative can be launched and if you collect 100,000 signatures in 18 months, you can force a vote on your own law. This is most commonly done by political parties and adjacent organisations, so it is at least feasible that a privacy-conscious organisation could launch an initiative to make it illegal to store any kind of user-identifying data. It is even possible private citizens could do it. There would likely be a "contre-projet" arguing why this isn't a good idea, but there is often a for/against for any initiative or referendum and they get to present their views in detail (in paper booklets, the vote swiss app, and on the federal chancellery website).

Further upsides: unlike US/British/some other countries, nobody has a 50% voting block in the Swiss parliament and it has remained a coalition since the modern iteration of the country (since 1848).

Basically Swiss politics is extremely deliberative. I honestly think "we will quit Switzerland if they do this!" is a bit of a hyperbolic reaction.

Only if the entire address space for that process is built using memory safe code (different from necessarily marked "safe" in the rust sense) and only if there are no soundness bugs in the rust compiler.

Otherwise C code can muck with things the rust code considers invariant and "verified". Or if something with a soundness issue is used, maybe safe doesn't quite mean safe.

As a counterpoint unsafe can be safe if the behaviour is well modelled and understood. It just means no checks are applied to the superset features of rust if they are used (outside of unsafe they can't be). The standard library of rust uses unsafe quite a bit.

Probably the best way I can try to put it is that "safe" is a subset of correct where you mean no memory safety issues (spatial or temporal) and rust tries to prove this for you. Except it you type unsafe then it is on you to promise to the compiler that the extra footguns it enables are used correctly. If you include this code in a larger program some of these guarantees are statically assured at compile time for performance including the correctness of the runtime checks rust does. There is no compartmentalisation unless you use OS features (separate processes) for that (or whatever webasm allows for).

I worked at a software vendor where we would check the type of product and yes you needed our server product to run on their server product, whether or not you used the server as a server.

Not all software does this but I also don't recall it being unusual.

This is what is done for code and document signing, because you want the signed object to continue to be valid even after the certificate expires.

However it has a tradeoff: you cannot remove any certificate from a CRL if revoked, ever. Under normal circumstances certificates naturally expire so only need to remain in CRLs if revoked before then, but with timestamps they are valid indefinitely so must be explicitly marked invalid.

Also given automatic iPhone backup it might contain information they want as part of an investigation that they'd otherwise have to demand key disclosure for (if cloud backup didn't exist)... Absolutely.

The jail time for failure to comply with key disclosure is 2 years unless it is national security, then it is 5. But if you're organised crime and facing who knows what for being a snitch it might be better simply to do the time.

I can see why they want it. I just don't understand why the person I'm replying to said the feature (I think) was problematic. Not really a criticism, I'm just struggling to identify the tone and why 'too right' and 'more problematic than they let on'.

I don't really understand your comment to be honest. Section 3 of the Regulation of Regulatory Powers Act 2000 allows for compelled key disclosure (disclosure of the information sought instead of the key is also possible). Schedule 7 of the Counter-Terrorism Act allows 9 hour detention, questioning and device search at the border. With these powers it isn't necessary to get access to iCloud backups, as you can get the device and/or the data.

I don't think the e2e icloud backup is problematic under existing legislation / before the TCN. While you can't disclose the key because it lives in the secure enclave, you can disclose the information that is requested because you can log into your apple account and retrieve it. IANAL, but I believe this to be sufficient (and refusing would mean jail).

The Investigatory Powers Act allows for technical capability notices, and the TCN in this case says (as far as we know) "allow us a method to be able to get the contents of any iCloud backup that is protected by E2EE for any user worldwide". This means that there is no need to ask the target to disclose information and if implemented as asked, also means that any user worldwide could be a target of the order, even if they'd never been to the UK.

Relevant info:

- https://wiki.openrightsgroup.org/wiki/Regulation_of_Investig...

As Encrochat/ANOM/Sky ECC show, not only is this possible, it actually happens.

As I posted under another comment, https://en.m.wikipedia.org/wiki/Communications_Data_Bill_200... - communications data bill 2008 / interception modernisation programme. A precursor to what became the IPA.

RIPA and key disclosure law came in under Tony Blair's labour government as well, along with https://en.m.wikipedia.org/wiki/Communications_Data_Bill_200..., arguably the precursor idea to the IPA that this notice was issued under.

This is true but, non crime hate incidents can appear on enhanced DBS checks (criminal records): https://www.slaterheelis.co.uk/articles/crime-category/non-c... and https://www.london.gov.uk/who-we-are/what-london-assembly-do... - but bizarrely not on security clearances at least according to the London link.

I would hope that this along with any other disclosure where the police decided on no action would be treated appropriately and only disclosed/acted upon if the incident was really worrying. On the other hand, I can't help but feel if the incident is worrying enough would it not also meet the bar for a criminal incident?

I'm not really comfortable with the naming and the lack of due process to be honest.

On the other hand, being careful what you say on social media is a requisite in many careers as companies can and do perform private background checks.

It looks like they are trying to tcp with wireguard: https://mullvad.net/en/blog/introducing-wireguard-over-tcp-a...

I'm not sure if this can be done without the app or not.

A lot of their endpoints are rented or hosted from ASes that are well known, e.g. M247 Ltd. If I wanted to vastly reduce annoying VPN traffic, I'd simply block these ASes as well. That's likely the cause of these.

There isn't a lot Mullvad can do about it. Not all providers of hosting are willing to tolerate VPN endpoints in the same way they don't like hosting tor exit nodes.

Honestly the answer depends on your personal requirements. If you want a product exactly like Google's offering you are not likely to find it. Somewhat like if you buy into the Apple ecosystem, buying into the Google ecosystem is designed to be a first class experience and everything else to feel slightly second class. This is of course a sort of faustian bargain, but it is up to you if you take it.

There are alternatives that do e-mail, cloud storage, contacts and calendars if you're prepared to research them. I won't post a list but mention some categories of options: there are companies offering similar products (fastmail, proton), you can sometimes rent managed next/owncloud/e-mail such as exchange from some suppliers, or you can self host some or part of your needs (e.g. I know people who tailscale to NAS drives). My google account is only used for paid-for android apps, for example. I'm one of the self-hosters (but I keep an eye on the managed offerings from local companies). I don't use tailscale as I can wireguard to my router, but tailscale works well when you just want stuff that plugs in and works. Synology NAS drives apparently can be tailscale endpoints.

Ultimately, I try to avoid Google as much as possible and to a lesser extent other large cloud providers. This stems from exactly the kind of incidents the OP faces, along with the usual concerns about ads/tracking (and specifically not contributing to this as a business model).

I am not at all related to the business or the poster, and I have lived in Switzerland for a long while now.

This is a fairly standard range for software engineer salaries. 100k is on the junior end, 140k is on the senior end.

Agree. Plus recruiters also sometimes reach out. There is quite a high signal to noise as always, but, it can be worth it. You don't need to engage in all the influencer crap at all, just ignore that and use it to be found by recruiters and to see some open positions.

I have been using evolution as well.

I have a relatively niche use case where thunderbird would no longer find my smime certificate on my smart card. But only in the compose/send UI, not in settings.

While I understand not many people are doing this, it also... Used to work, and I would have thought that detecting regressions in X.509 cert validation should be well covered by tests.

In comparison, evolution works.

Obviously. But I was responding to "what is sinister about a GET request". To put it a slightly different way, it does not matter so much whether the request is a read or a write. For example DNS amplfication attacks work by asking a DNS server (read) for a much larger record than the request packet requires, and faking the request IP to match the victim. That's not even a connection the victim initiated, but that packet still travels along the network path. In fact, if it crashes a switch or something along the way, that's just as good from the point of view of the attacker, maybe even better as it will have more impact.

I am absolutely not a fan of all these "are you human?" checks at all, doubly so when ad-blockers trigger them. I think there are very legitimate reasons for wanting to access certain sites without being tracked - anything related to health is an example.

Maybe I should have made a more substantive comment, but I don't believe this is as simple a problem as reducing it to request types.

Furthermore if you have held* a green card for the last 8 (of 15 years) i.e. you hold permanent resident status you also become in-scope for the tax expatriation law that apply to US Citizens, and possible ongoing declaration requirements: https://www.expatriationattorneys.com/green-card-u-s-exit-ta...

I've never been US-resident; the reason I know about this is talking to someone who relinquished theirs when I asked if they could keep it.

*from the U.S. Government's point of view.