faeranne · HackerTrans

12 miesięcy temudiscuss

Checkout passage: https://github.com/FiloSottile/passage which has done part of this by using age instead of pgp. I used it for a while, and last I checked there was sadly no android app (the pass android app hardcoded too much PGP to be a useful base, so I was told), but the work is def there.

faeranne

w zeszłym rokudiscuss

Not even curl can connect... seems whatever this is on about isn't important enough for them to let people even try to read.

faeranne

w zeszłym rokudiscuss

It appears that the public side of X is sent as the first part of the handshake, without any login info yet, and can be verified as part of B, thus a varying X would be easy to detect... I think.

faeranne

w zeszłym rokudiscuss

looking at it from a high level, it doesn't appear the final token ever leaves the client till it's being redeemed. There's a middle step that does get signed, but this part is not what is sent.

faeranne

w zeszłym rokudiscuss

Assuming the cryptography does what they say it does (am not a cryptography expert, so I can't verify that part), this would completely disjoin a search request from any account info. The account generates several "search tokens", and for each search request, one of those tokens is spent. The tokens are generated on-device, and until spent, never leave the device, so in theory there's no way for Kagi to know which account generated the token just from the token alone. This doesn't fix fingerprinting or IP associations (though the plugin for Firefox and Chrome supposedly takes efforts to try and limit fingerprinting too), but this isn't any better/worse than simply using Google or Duckduckgo, and functions on Tor if you really want some privacy.

Again, not sure on how the tokens are proven legit without ever sharing them, but there's probably some ~~zero-knowledge proof~~ stuff going on that covers that.

Edit: Not zero-knowledge proof. Seems to be Blind Signature?

faeranne

2 lata temudiscuss

Part of a library's primary purposes is the preservation of history and culture. In the modern cycle, one of a company's largest competitors is their own history and back catalog. Destruction of historical artifacts is becoming necessary to ensure customers keep coming back, as we have reached a point of diminishing returns at most corporate scales. If a corporation's motive is to destroy history, and a library's goal is to preserve, there is no compromise.

faeranne

2 lata temudiscuss

As I mentioned in a sibling comment, the entirety of IA's existence is a "critical failure of risk assessment" now. Their existence forces companies to deal with the one competitor they can't beat, their past selves. The question we begin to ask here is "This is the only place that was able and ready to accept and preserve these otherwise permanently lost works. Do we let copyright ensure the destruction of itself, or is culture and history more important?"

faeranne

2 lata temudiscuss

Probably they're thinking "This person brought us something that is about to be extinct, our job is to keep things from going extinct."

The entirety of IA is the idea that culture and history are to be preserved for future generations. The job of these big companies like UMG is to make as much money as possible, and destroying history eliminates a core competitor, themselves. IA's existence is poking the bear (just look at how often the Web Archive's existence is used by others to show off back actors in companies). Compromise left a long time ago.

faeranne

2 lata temudiscuss

The sought damages is $621 Million. Internet Archive reported having about $7 Million in assets and $30 Million in revenue (for those who accidentally read over that, revenue is before factoring in costs, which for IA budgets around $37 Million annually as well.) (EDIT: in 2022. I've been rewriting this a few times and forgot to re-add that part in the final comment)

If the suit is found in favor of UGM and enforced at full effect (not impossible, but Hachette v. Internet Archive was not either), then IA will be on the hook for the full $621 Million. You can guess how that ends.

But even if they don't enforce at full effect (and given Web Archive has been successfully used to provide evidence against UMG and Sony multiple times now, they have a pretty strong incentive to get it burned down), a sizable portion of the 400,000 recordings are from disks that quite literally broke down after capture. Those disks are the last copies of those recordings. Ever. Should UMG and Sony succeed, it is a very safe assumption, given they already confirmed they don't have those recordings (and based on that, don't want them), that those recordings immediately become lost media.

faeranne

2 lata temudiscuss

> why don't we see HN crying about the need to show a national ID ... when buying a mobile phone?

Mmm, very possibly because there are at least a few ways to get a phone without using any ID. I picked up a used phone about a year ago, and use Tello. Tello had 0 info on me for years, only an old UPS box that I got the card delivered to. I eventually gave them my first name so Caller ID was correct, but short of that or putting in a correct address if you want 911 support, there's no reason to need any valid info with them. They don't do credit checks, just prepay.

> The solution is secure boot plus attestation That's the second option they presented "Closing the platform". The issue with all these options is that it consolidates power, and thanks to already partially consolidated power, any option selected will, by necessity, obligate everyone to partake, whether or not they are ok with it.

> The average normie user does not care about anonymity, nor privacy, on the Internet.

It's true that often "normies" don't care (or at least think they don't care, but that's a completely different point I don't feel like trying to make), and it's also true that often "normies" don't want the status quo changed. But often "normies" also ignore when people are kidnapped due to their heritage being revealed. Is it acceptable to actively create a hostile environment for people already disadvantaged? Do we gain something worth their safety? Who gains from this higher level of scrutiny?

If we look at the smaller web, most sites never get enough traffic to be under active threat, and passive threat is easy enough to quell using honeypot forms and questions. Maybe the "normie" internet is the problem. Passive people passively consuming. "Normies" love watching stolen content, and praise thieves for harassing anyone who points out that what their doing is wrong. "Normies" enjoy watching someone livestream themselves flying down a highway at 100 mph over the speed limit.

I think maybe we should acknowledge that what we're defending with things like hCaptcha is not actually worth defending. Maybe the "normal" internet does need to be deprecated over "small" internet? We did pretty good before with things like Wikipedia. The "small" internet from before had a lot of chaff, but good things have grown from it, and a lot of it still exists as a "small" internet. Maybe it's ok that we have a lot of "crap content", so long as the internet can keep changing?

faeranne

2 lata temudiscuss

I think maybe it's easier to realize you don't care when working apart from a company structure. I suspect most people don't care nearly as much about the company as the company would like. There's a constant push for "Corporate Family" and what not, which at large scales stops being a two way street and def becomes more indoctrination. Being separated def allows one to start viewing their relationship with work from a third party perspective, and often can show the unhealthy lines.

But of course companies that implement these indoctrination practices really don't want that, and will do whatever it takes to keep that control in place.

faeranne

2 lata temudiscuss

> they affect less than a hundredth of a percent of Android devices, and do not matter.

2 reasons I can confidently disagree: 1. Unlike desktop platforms, most android devices cease receiving "official" updates long before the chipset stops receiving updates, thus maintaining them requires an alternative rom. While most people will just buy a new phone, the percent usually on the fence about something like switching from Windows to Linux are gonna be pushed harder into looking into alternatives. 2. Well over 1% of desktop users use Linux. Even if you debate the methods to get the current 4%, there's simply no debate on at least 1%.

The two combine to suggest that, on android, there's a very good change that more than 1% of android users are using some rom, and all roms help each other.

Don't screw up your otherwise valid argument by trying to "put tech nerds in their place" like that. These roms do matter, even if the judge 100% didn't "screw up". Everything else you said is both true and important, and probably matters more than what parent wanted, but it doesn't diminish the value of the roms, just suggests that parent was misguided.

faeranne

2 lata temudiscuss

I'd argue the line gets drawn when the driver is barred from stopping the distracting element themselves. Everything else can be stopped, disabled,refused, or removed by the driver. If an element is designed to be another source for focus (the entire infotainment system is this) it must be able to be turned off by the driver. In theory simply disabling the infotainment system should cover this, but now you have to argue if removing things like modern navigation is an acceptable option, and frankly, these ads only serve to line pockets. This isn't a radio situation where the feed is free, the car is (in theory) already paid for. (and don't try to argue that the car is cheaper because of the ads. TV manufacturers already turned that argument into swiss cheese when they stopped bothering to sell TVs without preloaded ads.)

faeranne

2 lata temudiscuss

Why is digital scarcity a good thing? Why is scarcity at all a good thing? Is there any reason for this, outside of trying to sell them at an ever higher price? And how does sharing a read-only e-ink card benefit over a regular card, or a card with an NFC tag in it?

I get the feeling people think because things are scarce already, scarcity is good. but... it really isn't. outside of a store-of-value, there is no real benefit to it, is there?

faeranne

2 lata temudiscuss

You're not entirely wrong, but often these AI systems need some pretty clear audio to work. It's kinda shocking how good we are at working around bad audio when it comes to conversation, and I'm certain most people know how bad these intercom systems get. The issue isn't that they need to be fixed at all, it's how far they can go before they must be fixed. And the one thing we can do that AI can't is have face-to-face conversations. If the speaker simply doesn't work, it's a bit of a drag, but you can just pull up to the window directly and skip the entire audio system. Or just walk inside. Both options eliminate the problem hardware, where as AI would need additional hardware to do those jobs.

faeranne

2 lata temudiscuss

Oh it definitely is, it's just also a requirement for reasonable living in most of the US too. It's not a good combo.

faeranne

2 lata temudiscuss

Someone want to setup a wiki for this? Seems like a good place for things like replacing the head unit correctly or other "make it my own" instructions.

faeranne

2 lata temudiscuss

Thing is, we do have that "document API". CAN bus has been a thing for a long time (and is still in use even today), and has documented ways of communicating with everything modern Body Control Units and Engine Control Units do. For everything else, we have the ever valid DIN size standard. Both of these together make for an easy to upgrade system, including options to use Open Source head units. Just looking for a radio and nothing else? Go for it. Want all the fancy bells and whistles that Android Auto or Car Play provides? You got it. Even the steering wheel controls have a standard.

So the question is, why do they keep re-designing the head unit as a monolithic brick, and make it non-replaceable? I can't say for sure why, but my guess is that they've since added their own team for "Smart this" and "subscription that", and removing those sources of revenue is far more expensive than rebuilding the head unit each year.

faeranne

2 lata temudiscuss

Ignoring the problematic details of this specific implementation (Seriously? they didn't make encryption the first thing to implement?), I think the biggest thing to remember is that, while the only sure-fire way to prevent this data from being stolen is to not record it, the likelihood some 2-bit hacker is gonna access this data goes way up when it's easy to expect it to be there.

CoPilot Recall is a massive target because if you break into a system, there would be a good chance that data is there since it was opt-out by default. open-source recall implementations are not only opt-in, but require additional overhead to install, so the likelihood that one would find this data on the drive is such a low target as to be not worth including in an automated scanner.

Remember that surface-area does matter in things like this. If you believe you're a large enough target for some amount of focus (and you might be if your involved in mid-scale open-source projects, like XZ apparently), then it's good to be cautious. If you're not that kind of target, then just remember you only need to be more complex than the average person, and something like this absolutely qualifies as "more complex".

faeranne

2 lata temudiscuss

Exact source is a bit convoluted, because most US law is convoluted, but is covered in multiple subsections of section 1201 of Public Law 105–304 (the technical name for DMCA). There are exceptions for things like making things interoperable and security research (kinda), but beyond that simply glancing at one of these locks can be a violation of DMCA. Sadly the document is excessivly long (60 pages plus references to other laws), and the available source PDF is so poorly formatted as to be nearly impossible to follow (nothing is aligned correctly, and subsections regularly form a very confusing pattern)

comments