1.  

    Also, stop with the flat and “clean” design. If there’s something your users are supposed to click on, make it look like something you can click on. Make links that look like links, buttons that look like buttons, etc. Even lobsters fails at this, there’s a menu at the top of the page but it doesn’t look anything like a menu, it’s just a horizontal line of gray words.

    1.  

      Um… those gray words are all just links to other pages. No hamburger menus on Lobsters!

      1.  

        Also, the names of the words make a user think they might be menu options. Then, the user hovers over them to see the link icon appear. There is an investigate step there vs links that are obviously links which is a usability loss. I don’t the loss is significant, though, given nature of our community. We’re technologists and explorers. Heck, the whole point of the site was coming to look for good links. :)

    1.  

      The takeaway here is: your job is to find solutions to problems

      Nope! It’s not. It’s to make the client happy, both long- & short-term. Here we go again, reaching for the Technical Hammer when we have a People Problem.

      1.  

        Not happy usually, just content enough that he pays you and maybe even does business with you again.

        1.  

          For us, finding solutions to problems is part of making the client happy. That is why we wrote:

          Like captain Spock, we combine the worlds of logical thinking with the human dimension, which may seem irrational when analyzed through the cold prisma of mathematical rationality but has its own logic and meaning. And we need to develop skills in both areas, because, ultimately, we are humans working for other humans — code is just our tool.

          1.  

            How do you make the client happy?

            1. 2

              There’s a little bit of tinfoil-hattery going on in that article, but I don’t think he’s totally wrong. The Internet has matured to the point now where most of the walled gardens are about as big as they’re going to get, so the only growth potential left is destroy the community gardens. It’s not at all unlike Ford and GM’s deliberate nationwide dismantling of public transportation throughout the 20th century.

            1. 3

              My blog is blog.bityard.net. I went through a dry spell for a couple years but I’m starting to write more about Linuxy, SysAdminy, and hopefully devopsy stuff soon.

              http://blog.bityard.net/

              1. 0

                If both http:// and https:// is available, I think Chrome should redirect to the https:// page instead of complaining about the http:// counterpart.

                1. 10

                  There’s no guarantee that the site on port 80 is the site as the one on port 443. That’s why HTTPS Everywhere is a whitelist of sites where this is true.

                  1. 1

                    Are there even many websites left that don’t redirect themself to the secure version? I know there used to be a bunch but pretty much everything I see does now.

                  1. 8

                    To be fair, they should also mark as “Not Secure” any page running JavaScript.

                    Also, pointless HTTPS adoption might reduce content accessibility without blocking censorship.
                    (Disclaimer: this does not mean that you shouldn’t adopt HTTPS for sensible contents! It just means that using HTTPS should not be a matter of fashion: there are serious trade-offs to consider)

                    1. 11

                      By adopting HTTPS you basically ensure that nasty ISPs and CDNs can’t insert garbage into your webpages.

                      1. [Comment removed by author]

                        1. 5

                          Technically, you authorize them (you sign actual paperwork) to get/generate a certificate on your behalf (at least this is my experience with Akamai). You don’t upload your own ssl private key to them.

                          1. 3

                            Why on earth would I give anyone else my private certificate?

                            1. 4

                              Because it’s part of The Process. (Technical Dark Patterns, Opt-In without a clear way to Opt-Out, etc.)

                              Because you’ll be laughed at if you don’t. (Social expectations, “received wisdom”, etc.)

                              Because Do It Now. Do It Now. Do It Now. (Nagging emails. Nagging pings on social media. Nagging.)

                              Lastly, of course, are Terms Of Service, different from the above by at least being above-board.

                          2. 2

                            No.

                            It protects against cheap man-in-the-middle attacks (as the one an ISP could do) but it can nothing against CDNs that can identify you, as CDNs serve you JavaScript over HTTPS.

                            1. 11

                              With Subresource Integrity (SRI) page authors can protect against CDNed resources changing out from beneath them.

                              1. 1

                                Yes SRI mitigate some of the JavaScript attacks that I describe in the article, in particular the nasty ones from CDNs exploiting your trust on a harmless-looking website.
                                Unfortunately several others remain possible (just think of jsonp or even simpler if the website itself collude to the attack). Also it needs widespread adoption to become a security feature: it should probably be mandatory, but for sure browsers should mark as “Not Secure” any page downloading programs from CDNs without it.

                                What SRI could really help is with the accessibility issues described by Meyer: you can serve most page resources as cacheable HTTP resources if the content hash is declared in a HTTPS page!

                              2. 3

                                WIth SRI you can block CDNs you use to load JS scripts externally from manipulating the webpage.

                                I also don’t buy the link that claims it reduces content accessiblity, the link you provided above explains a problem that would be solved by simply using a HTTPS caching proxy (something a lot of corporate networks seem to have no problem operating considering TLS 1.3 explicitly tries not to break those middleboxes)

                                1. 4

                                  CDNs are man-in-the-middle attacks.

                              3. 1

                                As much as I respect Meyer, his point is moot. MitM HTTPS proxy servers have been setup since a long time, even though usually for a far more objectionable purposes than content caching. Some companies even made out of the box HTTPS URL filtering their selling point. If people are ready or forced to trade security for accessibility, but don’t know how to setup HTTPS MitM proxy, it’s their problem, not webmasters’. We should be ready to teach those in needs how to setup it of course, but that’s about it.

                                1. 0

                                  MitM HTTPS proxy servers have been setup since a long time, even though usually for a far more objectionable purposes than content caching. […] If people are ready or forced to trade security for accessibility, but don’t know how to setup HTTPS MitM proxy, it’s their problem, not webmasters’.

                                  Well… how can I say that… I don’t think so.

                                  Selling HTTPS MitM proxy as a security solutions is plain incompetence.

                                  Beyond the obvious risk that the proxy is compromised (you should never assume that they won’t) which is pretty high in some places (not only in Africa… don’t be naive, a chain is only as strong as its weakest link), a transparent HTTPS proxy has an obvious UI issue: people do not realise that it’s unsafe.

                                  If the browsers don’t mark as “Not Secure” them (how could them?) the user will overlook the MitM risks, turning a security feature against the users’ real security and safety.

                                  Is this something webmasters should care? I think so.

                                  1. 4

                                    Selling HTTPS MitM proxy as a security solutions is plain incompetence.

                                    Not sure how to tell you this, but companies have been doing this on their internal networks for a very long time and this is basically standard operating procedure at every enterprise-level network I’ve seen. They create their own CA, generate an intermediate CA key cert, and then put that on an HTTPS MITM transparent proxy that inspects all traffic going in an out of the network. The intermediate cert is added to the certificate store on all devices issued to employees so that it is trusted. By inspecting all of the traffic, they can monitor for external and internal threats, scan for exfiltration of trade secrets and proprietary data, and keep employees from watching porn at work. There is an entire industry around products that do this, BlueCoat and Barracuda are two popular examples.

                                    1. 5

                                      There is an entire industry around products that do this

                                      There is an entire industry around rasomware. But this does not means it’s a security solution.

                                      1. 1

                                        It is, it’s just that word security is better understood as “who” is getting (or not) secured from “whom”.

                                        What you keep saying is that MitM proxy does not protect security of end users (that is employees). What they do, however, in certain contexts like described above, is help protect the organisation in which end users operate. Arguably they do, because it certainly makes it more difficult to protect yourself from something you cannot see. If employees are seen as a potential threat (they are), then reducing their security can help you (organisation) with yours.

                                        1. 1

                                          I wonder if you did read the articles I linked…

                                          The point is that, in a context of unreliable connectivity, HTTPS reduce dramatically accessibility but it doesn’t help against censorship.

                                          In this context, we need to grant to people accessibility and security.

                                          An obvious solution is to give them a cacheable HTTP access to contents. We can fool the clients to trust a MitM caching proxy, but since all we want is caching this is not the best solution: it add no security but a false sense of security. Thus in that context, you can improve users’ security by removing HTTPS.

                                          1. 1

                                            I have read it, but more importantly, I worked in and build services for places like that for about 5 years (Uganda, Bolivia, Tajikistan, rural India…).

                                            I am with you that HTTPS proxy is generally best to be avoided if for no other reason because it grows attack surface area. I disagree that removing HTTPS increases security. It adds a lot more places and actors who now can negatively impact user in exchange for him knowing this without being able to do much about it.

                                            And that is even without going into which content is safe to be cached in a given environment.

                                            1. 1

                                              And that is even without going into which content is safe to be cached in a given environment.

                                              Yes, this is the best objection I’ve read so far.

                                              As always it’s a matter of tradeoff. In a previous related thread I described how I would try to fix the issue in a way that people can easily opt-out and opt-in.

                                              But while I think it would be weird to remove HTTPS for an ecommerce chart or for a political forum, I think that most of Wikipedia should be served through both HTTP and HTTPS. People should be aware that HTTP page are not secure (even though it all depends on your threat model…) but should not be mislead to think that pages going through an MitM proxy are secure.

                                    2. 2

                                      HTTPS proxy isn’t incompetence, it’s industry standard.

                                      They solve a number of problems and are basically standard in almost all corporate networks with a minimum security level. They aren’t a weak chain in the link since traffic in front of the proxy is HTTPS and behind it is in the local network and encrypted by a network level CA (you can restrict CA capabilities via TLS cert extensions, there is a fair number of useful ones that prevent compromise).

                                      Browser don’t mark these insecure because to install and use a HTTPS proxy requires full admin access to a device, at which level there is no reason to consider what the user is doing as insecure.

                                      1. 2

                                        Browser don’t mark these insecure because to install and use a HTTPS proxy requires full admin access to a device, at which level there is no reason to consider what the user is doing as insecure.

                                        Browsers bypass the network configuration to protect the users’ privacy.
                                        (I agree this is stupid, but they are trying to push this anyway)

                                        The point is: the user’s security is at risk whenever she sees as HTTPS (which stands for “HTTP Secure”) something that is not secure. It’s a rather simple and verifiable fact.

                                        It’s true that posing a threat to employees’ security is an industry standard. But it’s not a security solution. At least, not for the employees.

                                        And, doing that in a school or a public library is dangerous and plain stupid.

                                        1. 0

                                          Nobody is posing a threat to employees’ security here, a corporation can in this case be regarded as a single entity so terminating SSL at the borders of the entity similar to how a browser terminates SSL by showing the website on a screen is fairly valid.

                                          Schools and public libraries usually have the internet filtered yes, that is usually made clear to the user before using it (atleast when I wanted access to either I was in both cases instructed that the network is supervised and filtered) which IMO negates the potential security compromise.

                                          Browsers bypass the network configuration to protect the users’ privacy.

                                          Browsers don’t bypass root CA configuration, core system configuration or network routing information as well as network proxy configuration to protect a user’s privacy.

                                          1. 1

                                            Schools and public libraries usually have the internet filtered yes, that is usually made clear to the user before using it [..] which IMO negates the potential security compromise.

                                            Yes this is true.

                                            If people are kept constantly aware of the presence of a transparent HTTPS proxy/MitM, I have no objection to its use instead of an HTTP proxy for caching purposes. Marking all pages as “Not Secure” is a good way to gain such awareness.

                                            Browsers don’t bypass root CA configuration, core system configuration or network routing information as well as network proxy configuration to protect a user’s privacy.

                                            Did you know about Firefox’s DoH/CloudFlare affair?

                                            1. 2

                                              Yes I’m aware of the “affair”. To my knowledge the initial DoH experiment was localized and run on users who had enabled studies (opt-in). In both the experiment and now Mozilla has a contract with CloudFlare to protect the user privacy during queries when DoH is enabled (which to my knowledge it isn’t by default). In fact, the problem ungleich is blogging about isn’t even slated for standard release yet, to my knowledge.

                                              It’s plain and old wrong in the bad kind of way; it conflates security maximalism with the mission of Mozilla to bring the maximum amount of users privacy and security.

                                              1. 1

                                                TBH, I don’t know what you mean with “security maximalism”.

                                                I think ungleich raise serious concerns that should be taken into account before shipping DoH to the masses.

                                                Mozilla has a contract with CloudFlare to protect the user privacy

                                                It’s bit naive for Mozilla to base the security and safety of milions of people world wide in the contract with a company, however good they are.

                                                AFAIK, even Facebook had a contract with his users.

                                                Yeah.. I know… they will “do no evil”…

                                                1. 1

                                                  Security maximalism disregards more common threatmodels and usability problems in favor of more security. I don’t believe the concerns are really concerns for the common user.

                                                  It’s bit naive for Mozilla to base the security and safety of milions of people world wide in the contract with a company, however good they are.

                                                  Cloudflare hasn’t done much that makes me believe they will violate my privacy. They’re not in the business of selling data to advertisers.

                                                  AFAIK, even Facebook had a contract with his users

                                                  Facebook used Dark Patterns to get users to willingly agree to terms they would otherwise never agree on, I don’t think this is comparable. Facebook likely never violated the contract terms with their users that way.

                                                  1. 1

                                                    Security maximalism disregards more common threatmodels and usability problems in favor of more security. I don’t believe the concerns are really concerns for the common user.

                                                    You should define “common user”.
                                                    If you mean the politically inepts who are happy to be easily manipulated as long as they are given something to say and retweet… yes, they have nothing to fear.
                                                    The problem is for those people who are actually useful to the society.

                                                    Cloudflare hasn’t done much that makes me believe they will violate my privacy.

                                                    The problem with Cloudflare is not what they did, it’s what they could do.
                                                    There’s no reason to give such power to a single company, located near all the other companies that are currently centralizing the Internet already.

                                                    But my concerns are with Mozilla.
                                                    They are trusted by milions of people world wide. Me included. But actually, I’m starting to think they are much more like a MitM caching HTTPS proxy: trusted by users as safe, while totaly unsafe.

                                                    1. 1

                                                      So in your opinion, the average user does not deserve the protection of being able to browse the net as safe as we can make it for them?

                                                      Just because you think they aren’t useful to society (and they are, these people have all the important jobs, someone isn’t useless because they can’t use a computer) doesn’t mean we, as software engineers, should abandon them.

                                                      There’s no reason to give such power to a single company, located near all the other companies that are currently centralizing the Internet already.

                                                      Then don’t use it? DoH isn’t going to be enabled by default in the near future and any UI plans for now make it opt-in and configurable. The “Cloudflare is default” is strictly for tests and users that opt into this.

                                                      they are much more like a MitM caching HTTPS proxy: trusted by users as safe, while totaly unsafe.

                                                      You mean safe because everyone involved knows what’s happening?

                                                      1. 1

                                                        I don’t believe the concerns are really concerns for the common user.

                                                        You should define “common user”.
                                                        If you mean the politically inepts who are happy to be easily manipulated…

                                                        So in your opinion, the average user does not deserve the protection of being able to browse the net as safe as we can make it for them?

                                                        I’m not sure if you are serious or you are pretending to not understand to cope with your lack of arguments.
                                                        Let’s assume the first… for now.

                                                        I’m saying the concerns raised by ungleich are serious and could affect any person who is not politically inept. That’s obviously because, anyone politically inept is unlikely to be affected by surveillance.
                                                        That’s it.

                                                        they are much more like a MitM caching HTTPS proxy: trusted by users as safe, while totaly unsafe.

                                                        You mean safe because everyone involved knows what’s happening?

                                                        Really?
                                                        Are you sure everyone understand what is a MitM attack? Are you sure every employee understand their system administrators can see the mail they reads from GMail? I think you don’t have much experience with users and I hope you don’t design user interfaces.

                                                        A MitM caching HTTPS proxy is not safe. It can be useful for corporate surveillance, but it’s not safe for users. And it extends the attack surface, both for the users and the company.

                                                        As for Mozilla: as I said, I’m just not sure whether they deserve trust or not.
                                                        I hope they do! Really! But it’s really too naive to think that a contract is enough to bind a company more than a subpoena. And they ship WebAssembly. And you have to edit about:config to disable JavaScript
                                                        All this is very suspect for a company that claims to care about users’ privacy!

                                                        1. 0

                                                          I’m saying the concerns raised by ungleich are serious and could affect any person who is not politically inept.

                                                          I’m saying the concerns raised by ungleich are too extreme and should be dismissed on grounds of being not practical in the real world.

                                                          Are you sure everyone understand what is a MitM attack?

                                                          An attack requires an adversary, the evil one. A HTTPS Caching proxy isn’t the evil or enemy, you have to opt into this behaviour. It is not an attack and I think it’s not fair to characterise it as such.

                                                          Are you sure every employee understand their system administrators can see the mail they reads from GMail?

                                                          Yes. When I signed my work contract this was specifically pointed out and made clear in writing. I see no problem with that.

                                                          And it extends the attack surface, both for the users and the company.

                                                          And it also enables caching for users with less than stellar bandwidth (think third world countries where satellite internet is common, 500ms ping, 80% packet loss, 1mbps… you want caching for the entire network, even with HTTPS)

                                                          And they ship WebAssembly.

                                                          And? I have on concerns about WebAssembly. It’s not worse than obfuscated javascript. It doesn’t enable anything that wasn’t possible before via asm.js. The post you linked is another security maximalist opinion piece with little factual arguments.

                                                          And you have to edit about:config to disable JavaScript…

                                                          Or install a half-way competent script blocker like uMatrix.

                                                          All this is very suspect for a company that claims to care about users’ privacy!

                                                          I think it’s understandable for a company that both cares about users privacy and doesn’t want a marketshare of “only security maximalists”, also known as, 0%.

                                                          1.  

                                                            An attack requires an adversary, the evil one.

                                                            According to this argument, you don’t need HTTPS until you don’t have an enemy.
                                                            It shows very well your understanding of security.

                                                            The attacker described in threat model are potential enemies. Yorr security depends on how well you avoid or counter potential attacks.

                                                            I have on concerns about WebAssembly.

                                                            Not a surprise.

                                                            Evidently you never had to debug neither an obfuscated javascript nor an optimized binary (without sources or debug symbols).

                                                            Trust one who did both: obfuscated javascript is annoying, understanding what an optimized binary is doing is hard.

                                                            As for packet loss caching at all, you didn’t reas what I wrote, and I won’t feed you more.

                                                            1.  

                                                              According to this argument, you don’t need HTTPS until you don’t have an enemy.

                                                              If there is no adversary, no Malory in the connection, there is no reason to encrypt it either, correct.

                                                              It shows very well your understanding of security.

                                                              My understanding in security is based on threat models. A threat model includes who you trust, who you want to talk to and who you don’t trust. It includes how much money you want to spend, how much your attacker can spend and the methods available to both of you.

                                                              There is no binary security, a threat model is the entry point and your protection mechanisms should match your threat model as best as possible or exceed it, but there is no reason to exert effort beyond your threat model.

                                                              The attacker described in threat model are potential enemies. Yorr security depends on how well you avoid or counter potential attacks.

                                                              Malory is a potential enemy. An HTTPS caching proxy operated by a corporation is not an enemy. It’s not malory, it’s Bob, Alice and Eve where Bob wants to send Alice a message, she works for Eve and Eve wants to avoid having duplicate messages on the network, so Eve and Alice agree that caching the encrypted connection is worthwile.

                                                              Malory sits between Eve and Bob not Bob and Alice.

                                                              Evidently you never had to debug neither an obfuscated javascript nor an optimized binary (without sources or debug symbols).

                                                              I did, in which case I either filed a Github issue if the project was open source or I notified the company that offered the javascript or optimized binary. Usually the bug is then fixed.

                                                              It’s not my duty or problem to debug web applications that I don’t develop.

                                                              Trust one who did both: obfuscated javascript is annoying, understanding what an optimized binary is doing is hard.

                                                              Then don’t do it? Nobody is forcing you.

                                                              As for packet loss caching at all, you didn’t reas what I wrote, and I won’t feed you more.

                                                              I don’t think you consider that a practical problem such as bad connections can outweigh a lot of potential security issues since you don’t have the time or user patience to do it properly and in most cases it’ll be good enough for the average user.

                                      2. 2

                                        My point is that the problems of unencrypted HTTP and MitM’ed HTTPS are exactly the same. If one used to prefer the former because it can be easily cached, I can’t see how setting up the latter makes their security issues worse.

                                        1. 3

                                          With HTTP you know it’s not secure. OTOH you might not be aware that your HTTPS connection to the server is not secure at all.

                                          The lack of awareness makes MitM caching worse.

                                  1. 65

                                    This blogpost is a good example of fragmented, hobbyist security maximalism (sprinkled with some personal grudges based on the tone).

                                    Expecting Signal to protect anyone specifically targeted by a nation-state is a huge misunderstanding of the threat models involved.

                                    Talking about threat models, it’s important to start from them and that explains most of the misconceptions in the post.

                                    • Usable security for the most people possible. The vast majority people on the planet use iOS and Android phones, so while it is theoretically true that Google or Apple could be forced to subvert their OSs, it’s outside the threat model and something like that would be highly visible, a nuclear option so to speak.
                                    • Alternative distribution mechanisms are not used by 99%+ of the existing phone userbases, providing an APK is indeed correctly viewed as harm reduction.
                                    • Centralization is a feature. Moxie created a protocol and a service used by billions and millions of people respectively that provides real, measureable security for a lot of people. The fact is that doing all this in a decentralized way is something we don’t yet know how to do or doing invites tradeoffs that we shouldn’t make. Federation atm either leads to insecurity or leads to the ossification of the ecosystem, which in turn leads to a useless system for real users. We’ve had IRC from the 1990s, ever wonder why Slack ever became a thing? Ossification of a decentralized protocol. Ever wonder why openpgp isn’t more widespread? Noone cares about security in a system where usability is low and design is fragile. Ever tried to do key rotation in gpg? Even cryptographers gave up on that. Signal has that built into the protocol.

                                    Were tradeoffs made? Yes. Have they been carefully considered? Yes. Signal isn’t perfect, but it’s usable, high-level security for a lot of people. I don’t say I fully trust Signal, but I trust everything else less. Turns out things are complicated when it’s about real systems and not fantasy escapism and wishes.

                                    1. 34

                                      Expecting Signal to protect anyone specifically targeted by a nation-state is a huge misunderstanding of the threat models involved.

                                      In this article, resistance to governments constantly comes up as a theme of his work. He also pushed for his tech to be used to help resist police states like with the Arab Spring example. Although he mainly increased the baseline, the tool has been pushed for resisting governments and articles like that could increase perception that it was secure against governments.

                                      This nation-state angle didn’t come out of thin air from paranoid, security people: it’s the kind of thing Moxie talks about. In one talk, he even started with a picture of two, activist friends jailed in Iran in part to show the evils that motivate him. Stuff like that only made the stuff Drew complains about on centralization, control, and dependence on cooperating with surveillance organization stand out even more due to the inconsistency. I’d have thought he’d make signed packages for things like F-Droid sooner if he’s so worried about that stuff.

                                      1. 4

                                        A problem with the “nation-state” rhetoric that might be useful to dispel is the idea that it is somehow a God-tier where suddenly all other rules becomes defunct. The five-eyes are indeed “nation state” and has capabilities that are profound; like the DJB talk speculating about how many RSA-1024 keys that they’d likely be able to factor in a year given such and such developments and what you can do with that capability. That’s scary stuff. On the other hand, this is not the “nation state” that is Iceland or Syria. Just looking at the leaks from the “Hacking Team” thing, there are a lot of “nation states” forced to rely on some really low quality stuff.

                                        I think Greg Conti in his “On Cyber” setup depicts it rather well (sorry, don’t have a copy of the section in question) and that a more reasonable threat model of capable actors you do need to care about is that of Organized Crime Syndicates - which seems more approachable. Nation State is something you are afraid of if you are political actor or in conflict with your government, where the “we can also waterboard you to compliance” factors into your threat model, Organized Crime hits much more broadly. That’s Ivan with his botnet from internet facing XBMC^H Kodi installations.

                                        I’d say the “Hobbyist, Fragmented Maximalist” line is pretty spot on - with a dash of “Confused”. The ‘threats’ of Google Play Store (test it, write some malware and see how long it survives - they are doing things there …) - the odds of any other app store; Fdroid, the ones from Samsung, HTC, Sony et al. - being completely owned by much less capable actors is way, way higher. Signal (perhaps a Signal-To-Threat ratio?) perform an good enough job in making reasonable threat actors much less potent. Perhaps not worthy of “trust”, but worthy of day to day business.

                                      2. 18

                                        Expecting Signal to protect anyone specifically targeted by a nation-state is a huge misunderstanding of the threat models involved.

                                        And yet, Signal is advertising with the face of Snowden and Laura Poitras, and quotes from them recommending it.

                                        What kind of impression of the threat models involved do you think does this create?

                                        1. 5

                                          Who should be the faces recommending signal that people will recognize and listen to?

                                          1. 7

                                            Whichever ones are normally on the media for information security saying the least amount of bullshit. We can start with Schneier given he already does a lot of interviews and writes books laypeople buy.

                                            1. 3

                                              What does Schneier say about signal?

                                              1. 10

                                                He encourages use of stuff like that to increase baseline but not for stopping nation states. He adds also constantly blogged about the attacks and legal methods they used to bypass technical measures. So, his reporting was mostly accurate.

                                                We counterpoint him here or there but his incentives and reo are tied to delivering accurate info. Moxie’s incentives would, if he’s selfish, lead to locked-in to questionable platforms.

                                        2. 18

                                          We’ve had IRC from the 1990s, ever wonder why Slack ever became a thing? Ossification of a decentralized protocol.

                                          I’m sorry, but this is plain incorrect. There are many expansions on IRC that have happened, including the most recent effort, IRCv3: a collectoin of extensions to IRC to add notifications, etc. Not to mention the killer point: “All of the IRCv3 extensions are backwards-compatible with older IRC clients, and older IRC servers.”

                                          If you actually look at the protocols? Slack is a clear case of Not Invented Here syndrome. Slack’s interface is not only slower, but does some downright crazy things (Such as transliterating a subset of emojis to plain-text – which results in batshit crazy edge-cases).

                                          If you have a free month, try writing a slack client. Enlightenment will follow :P

                                          1. 9

                                            I’m sorry, but this is plain incorrect. There are many expansions on IRC that have happened, including the most recent effort, IRCv3: a collectoin of extensions to IRC to add notifications, etc. Not to mention the killer point: “All of the IRCv3 extensions are backwards-compatible with older IRC clients, and older IRC servers.”

                                            Per IRCv3 people I’ve talked to, IRCv3 blew up massively on the runway, and will never take off due to infighting.

                                            1. 12

                                              And yet everyone is using Slack.

                                              1. 14

                                                There are swathes of people still using Windows XP.

                                                The primary complaint of people who use Electron-based programs is that they take up half a gigabyte of RAM to idle, and yet they are in common usage.

                                                The fact that people are using something tells you nothing about how Good that thing is.

                                                At the end of the day, if you slap a pretty interface on something, of course it’s going to sell. Then you add in that sweet, sweet Enterprise Support, and the Hip and Cool factors of using Something New, and most people will be fooled into using it.

                                                At the end of the day, Slack works just well enough Not To Suck, is Hip and Cool, and has persistent history (Something that the IRCv3 group are working on: https://ircv3.net/specs/extensions/batch/chathistory-3.3.html)

                                                1. 9

                                                  At the end of the day, Slack works just well enough Not To Suck, is Hip and Cool, and has persistent history (Something that the IRCv3 group are working on […])

                                                  The time for the IRC group to be working on a solution to persistent history was a decade ago. It strikes me as willful ignorance to disregard the success of Slack et al over open alternatives as mere fashion in the face of many meaningful functionality differences. For business use-cases, Slack is a better product than IRC full-stop. That’s not to say it’s perfect or that I think it’s better than IRC on all axes.

                                                  To the extent that Slack did succeed because it was hip and cool, why is that a negative? Why can’t IRC be hip and cool? But imagine being a UX designer and wanting to help make some native open-source IRC client fun and easy to use for a novice. “Sisyphean” is the word that comes to mind.

                                                  If we want open solutions to succeed we have to start thinking of them as products for non-savvy end users and start being honest about the cases where closed products have superior usability.

                                                  1. 5

                                                    IRC isn’t hip and cool because people can’t make money off of it. Technologies don’t get investment because they are good, they get good because of investment. The reason that Slack is hip/cool and popular and not IRC is because the investment class decided that.

                                                    It also shows that our industry is just a pop culture and can give a shit about good tech .

                                                    1. 4

                                                      There were companies making money off chat and IRC. They just didn’t create something like Slack. We can’t just blame the investors when they were backing companies making chat solutions whose management stayed on what didn’t work in long-term or for huge audience.

                                                      1. 1

                                                        IRC happened before the privatization of the internet. So the standard didn’t lend itself well for companies to make good money off of it. Things like slack are designed for investor optimization, vs things like IRC being designed for use and openness.

                                                        1. 2

                                                          My point was there were companies selling chat software, including IRC clients. None pulled off what Slack did. Even those doing IRC with money or making money off it didn’t accomplish what Slack did for some reason. It would help to understand why that happened. Then, the IRC-based alternative can try to address that from features to business model. I don’t see anything like that when most people that like FOSS talk Slack alternatives. Then, they’re not Slack alternatives if lacking what Slack customers demand.

                                                          1. 1

                                                            Thanks for clarifying. My point can be restated as… There is no business model for federated and decentralized software (until recently , see cryptocurrencies). Note most open and decentralized tech of the past was government funded and therefore didn’t face business pressures. This freed designets to optimise other concerns instead of business onrs like slack does.

                                                    2. 4

                                                      To the extent that Slack did succeed because it was hip and cool, why is that a negative? Why can’t IRC be hip and cool?

                                                      The argument being made is that the vast majority of Slack’s appeal is the “hip-and-cool” factor, not any meaningful additions to functionality.

                                                      1. 6

                                                        Right, as I said I think it’s important for proponents of open tech to look at successful products like Slack and try to understand why they succeeded. If you really think there is no meaningful difference then I think you’re totally disconnected from the needs/context of the average organization or computer user.

                                                        1. 3

                                                          That’s all well and good, I just don’t see why we can’t build those systems on top of existing open protocols like IRC. I mean: of course I understand, it’s about the money. My opinion is that it doesn’t make much sense to insist that opaque, closed ecosystems are the way to go. We can have the “hip-and-cool” factor, and all the amenities provided by services like Slack, without abandoning the important precedent we’ve set for ourselves with protocols like IRC and XMPP. I’m just disappointed that everyone’s seeing this as an “either-or” situation.

                                                          1. 2

                                                            I definitely don’t see it as an either-or situation, I just think that the open source community typically has the wrong mindset for competing with closed products and that most projects are unapproachable by UX or design-minded people.

                                                    3. 3

                                                      Open, standard chat tech has had persistent history and much more for decades in the form of XMPP. Comparing to the older IRC on features isn’t really fair.

                                                      1. 2

                                                        The fact that people are using something tells you nothing about how Good that thing is.

                                                        I have to disagree here. It shows that it is good enough to solve a problem for them.

                                                        1.  

                                                          I don’t see how Good and “good enough to solve a problem” are related here. The first is a metric of quality, the second is the literal bare minimum of that metric.

                                                  2. 1

                                                    Alternative distribution mechanisms are not used by 99%+ of the existing phone userbases, providing an APK is indeed correctly viewed as harm reduction.

                                                    I’d dispute that. People who become interested in Signal seem much more prone to be using F-Droid than, say, WhatsApp users. Signal tries to be an app accessible to the common person, but few people really use it or see the need… and often they are free software enthusiasts or people who are fed up with Google and surveillance.

                                                    1. 1

                                                      More likely sure, but that doesn’t mean that many of them reach the threshold of effort that they do.

                                                    2. 0

                                                      Ossification of a decentralized protocol.

                                                      IRC isn’t decentralised… it’s not even federated

                                                      1. 3

                                                        Sure it is, it’s just that there are multiple federations.

                                                    1. 28

                                                      That is a very reductionist view of what people use the web for. And I am saying this as someone who’s personal site pretty much matches everything prescribed except comments (which I still have).

                                                      Btw, Medium, given as a positive example, is not in any way minimal and certainly not by metrics given in this article.

                                                      1. 19

                                                        Btw, Medium, given as a positive example, is not in any way minimal and certainly not by metrics given in this article.

                                                        Chickenshit minimalism: https://medium.com/@mceglowski/chickenshit-minimalism-846fc1412524

                                                        1. 13

                                                          I wouldn’t say medium even gives the illusion of simplicity (For example, on the page you linked, try counting the visual elements that aren’t blog post). Medium seems to take a rather contrary approach to blogs, including all the random cruft you never even imagined existed, while leaving out the simple essentials like RSS feeds. I honestly have no idea how the author of the article came to suggest medium as an example of minimalism.

                                                          1. 8

                                                            Medium started with an illusion of simplicity and gradually got more and more complex.

                                                            1. 3

                                                              I agree with your overall point, but Medium does provide RSS feeds. They are linked in the <head> and always have the same URL structure. Any medium.com/@user has an RSS feed at medium.com/feed/@user. For Medium blogs hosted at custom URLs, the feed is available at /feed.

                                                              I’m not affiliated with Medium. I have a lot of experience bugging webmasters of minimal websites to add feeds: https://github.com/issues?q=is:issue+author:tfausak+feed.

                                                          2. 3

                                                            That is a very reductionist view of what people use the web for.

                                                            I wonder what Youtube, Google docs, Slack, and stuff would be in a minimal web.

                                                            1. 19

                                                              Useful.

                                                              algernon hides

                                                              1. 5

                                                                YouTube, while not as good as it could be, is pretty minimalist if you disable all the advertising.

                                                                I find google apps to be amazingly minimal, especially compared to Microsoft Office and LibreOffice.

                                                                Minimalist Slack has been around for decades, it’s called IRC.

                                                                1. 2

                                                                  It is still super slow then! At some point I was able to disable JS, install the Firefox “html5-video-everywhere” extension and watch videos that way. That was awesome fast and minimal. Tried it again a few days ago, but didn’t seem to work anymore.

                                                                  Edit: now I just “youtube-dl -f43 ” directly without going to YouTube and start watching immediately with VLC.

                                                                  1. 2

                                                                    The youtube interface might look minimalist, but under the hood, it is everything but. Besides, I shouldn’t have to go to great lengths to disable all the useless stuff on it. It shouldn’t be the consumer’s job to strip away all the crap.

                                                                  2. 2

                                                                    That seems to be of extreme bad faith though.

                                                                    1. 11

                                                                      In a minimal web, locally-running applications in browser sandboxes would be locally-running applications in non-browser sandboxes. There’s no particular reason any of these applications is in a browser at all, other than myopia.

                                                                      1. 2

                                                                        Distribution is dead-easy for websites. In theory, you have have non-browser-sandboxed apps with such easy distribution, but then what’s the point.

                                                                        1. 3

                                                                          Non-web-based locally-running client applications are also usually made downloadable via HTTP these days.

                                                                          The point is that when an application is made with the appropriate tools for the job it’s doing, there’s less of a cognitive load on developers and less of a resource load on users. When you use a UI toolkit instead of creating a self-modifying rich text document, you have a lighter-weight, more reliable, more maintainable application.

                                                                          1. 3

                                                                            The power of “here’s a URL, you now have an app running without going through installation or whatnot” cannot be understated. I can give someone a copy of pseudo-Excel to edit a document we’re working together on, all through the magic of Google Sheet’s share links. Instantly

                                                                            Granted, this is less of an advantage if you’re using something all the time, but without the web it would be harder to allow for multiple tools to co-exist in the same space. And am I supposed to have people download the Doodle application just to figure out when our group of 15 can go bowling?

                                                                            1. 4

                                                                              They are, in fact, downloading an application and running it locally.

                                                                              That application can still be javascript; I just don’t see the point in making it perform DOM manipulation.

                                                                              1. 3

                                                                                As one who knows JavaScript pretty well, I don’t see the point of writing it in JavaScript, however.

                                                                                1. 1

                                                                                  A lot of newer devs have a (probably unfounded) fear of picking up a new language, and a lot of those devs have only been trained in a handful (including JS). Even if moving away from JS isn’t actually a big deal, JS (as distinct from the browser ecosystem, to which it isn’t really totally tied) is not fundamentally that much worse than any other scripting language – you can do whatever you do in JS in python or lua or perl or ruby and it’ll come out looking almost the same unless you go out of your way to use particular facilities.

                                                                                  The thing that makes JS code look weird is all the markup manipulation, which looks strange in any language.

                                                                                  1. 3

                                                                                    JS (as distinct from the browser ecosystem, to which it isn’t really totally tied) is not fundamentally that much worse than any other scripting language

                                                                                    (a == b) !== (a === b)

                                                                                    but only some times…

                                                                                    1. 3

                                                                                      Javascript has gotchas, just like any other organic scripting languages. It’s less consistent than python and lua but probably has fewer of these than perl or php.

                                                                                      (And, just take a look at c++ if you want a faceful of gotchas & inconsistencies!)

                                                                                      Not to say that, from a language design perspective, we shouldn’t prize consistency. Just to say that javascript is well within the normal range of goofiness for popular languages, and probably above average if you weigh by popularity and include C, C++, FORTRAN, and COBOL (all of which see a lot of underreported development).

                                                                              2. 1

                                                                                Web applications are expected to load progressively. And that because they are sandboxed, they are allowed to start instantly without asking you for permissions.

                                                                                The same could be true of sandboxed desktop applications that you could stream from a website straight into some sort of sandboxed local VM that isn’t the web. Click a link, and the application immediately starts running on your desktop.

                                                                              3. 1

                                                                                I can’t argue with using the right tool for the job. People use Electron because there isn’t a flexible, good-looking, easy-to-use cross-platform UI kit. Damn the 500 mb of RAM usage for a chat app.

                                                                                1. 4

                                                                                  There are several good-looking flexible easy to use cross-platform UI kits. GTK, WX, and QT come to mind.

                                                                                  If you remove the ‘good-looking’ constraint, then you also get TK, which is substantially easier to use for certain problem sets, substantially smaller, and substantially more cross-platform (in that it will run on fringe or legacy platforms that are no longer or were never supported by GTK or QT).

                                                                                  All of these have well-maintained bindings to all popular scripting languages.

                                                                                  1. 1

                                                                                    QT apps can look reasonably good. I think webapps can look better, but I haven’t done extensive QT customization.

                                                                                    The bigger issue is 1) hiring - easier to get JS devs than QT devs 2) there’s little financial incentive to reduce memory usage. Using other people’s RAM is “free” for a company, so they do it. If their customers are in US/EU/Japan, they can expect reasonably new machines so they don’t see it as an issue. They aren’t chasing the market in Nigeria, however large in population.

                                                                                    1. 5

                                                                                      Webapps are sort of the equivalent of doing something in QT but using nothing but the canvas widget (except a little more awkward because you also don’t have pixel positioning). Whatever can be done in a webapp can be done in a UI toolkit, but the most extreme experimental stuff involves not using actual widgets (just like doing it as a webapp would).

                                                                                      Using QT doesn’t prevent you from writing in javascript. Just use NPM QT bindings. It means not using the DOM, but that’s a net win: it is faster to learn how to do something with a UI toolkit than to figure out how to do it through DOM manipulation, unless the thing that you’re doing is (at a fundamental level) literally displaying HTML.

                                                                                      I don’t think memory use is really going to be the main factor in convincing corporations to leave Electron. It’s not something that’s limited to the third world: most people in the first world (even folks who are in the top half of income) don’t have computers that can run Electron apps very well – but for a lot of folks, there’s the sense that computers just run slow & there’s nothing that can be done about it.

                                                                                      Instead, I think the main thing that’ll drive corporations toward more sustainable solutions is maintenance costs. It’s one thing to hire cheap web developers & have them build something, but over time keeping a hairball running is simply more difficult than keeping something that’s more modular running – particularly as the behavior of browsers with respect to the corner cases that web apps depend upon to continue acting like apps is prone to sudden (and difficult to model) change. Building on the back of HTML rendering means a red queen’s race against 3 major browsers, all of whom are changing their behaviors ahead of standards bodies; on the other hand, building on a UI library means you can specify a particular version as a dependency & also expect reasonable backwards-compatibility and gradual deprecation.

                                                                                      (But, I don’t actually have a lot of confidence that corporations will be convinced to do the thing that, in the long run, will save them money. They need to be seen to have saved money in the much shorter term, & saying that you need to rearchitect something so that it costs less in maintenance over the course of the next six years isn’t very convincing to non-technical folks – or to technical folks who haven’t had the experience of trying to change the behavior of a hairball written and designed by somebody who left the company years ago.)

                                                                                    2. 1

                                                                                      I understand that these tools are maintained in a certain sense. But from an outsider’s perspective, they are absolutely not appealing compared to what you see in their competitors.

                                                                                      I want to be extremely nice, because I think that the work done on these teams and projects is very laudable. But compare the wxPython docs with the Bootstrap documentation. I also spent a lot of time trying to figure out how to use Tk, and almost all resources …. felt outdated and incompatible with whatever toolset I had available.

                                                                                      I think Qt is really good at this stuff, though you do have to marry its toolset for a lot of it (perhaps this has gotten better).

                                                                                      The elephant in the room is that no native UI toolset (save maybe Apple’s stack?) is nowhere near as good as the diversity of options and breadth of tooling available in DOM-based solutions. Chrome dev tools is amazing, and even simple stuff like CSS animations gives a lot of options that would be a pain in most UI toolkits. Out of the box it has so much functionality, even if you’re working purely vanilla/“no library”. Though on this points things might have changed, jQuery basically is the optimal low-level UI library and I haven’t encountered native stuff that gives me the same sort of productivity.

                                                                                      1. 3

                                                                                        I dunno. How much of that is just familiarity? I find the bootstrap documentation so incomprehensible that I roll my own DOM manipulations rather than using it.

                                                                                        TK is easy to use, but the documentation is tcl-centric and pretty unclear. QT is a bad example because it’s quite heavy-weight and slow (and you generally have to use QT’s versions of built-in types and do all sorts of similar stuff). I’m not trying to claim that existing cross-platform UI toolkits are great: I actually have a lot of complaints with all of them; it’s just that, in terms of ease of use, peformance, and consistency of behavior, they’re all far ahead of web tech.

                                                                                        When it comes down to it, web tech means simulating a UI toolkit inside a complicated document rendering system inside a UI toolkit, with no pass-throughs, and even web tech toolkits intended for making UIs are really about manipulating markup and not actually oriented around placing widgets or orienting shapes in 2d space. Because determining how a piece of markup will look when rendered is complex and subject to a lot of variables not under the programmer’s control, any markup-manipulation-oriented system will make creating UIs intractably awkward and fragile – and while Google & others have thrown a great deal of code and effort at this problem (by exhaustively checking for corner cases, performing polyfills, and so on) and hidden most of that code from developers (who would have had to do all of that themselves ten years ago), it’s a battle that can’t be won.

                                                                                        1. 5

                                                                                          It annoys me greatly because it feels like nobody really cares about the conceptual damage incurred by simulating a UI toolkit inside a doument renderer inside a UI toolkit, instead preferring to chant “open web!” And then this broken conceptual basis propagates to other mediums (VR) simply because it’s familiar. I’d also argue the web as a medium is primarily intended for commerce and consumption, rather than creation.

                                                                                          It feels like people care less about the intrinsic quality of what they’re doing and more about following whatever fad is around, especially if it involves tools pushed by megacorporations.

                                                                                          1. 2

                                                                                            Everything (down to the transistor level) is layers of crap hiding other layers of different crap, but web tech is up there with autotools in terms of having abstraction layers that are full of important holes that developers must be mindful of – to the point that, in my mind, rolling your own thing is almost always less work than learning and using the ‘correct’ tool.

                                                                                            If consumer-grade CPUs were still doubling their clock speeds and cache sizes every 18 months at a stable price point and these toolkits properly hid the markup then it’d be a matter of whether or not you consider waste to be wrong on principle or if you’re balancing it with other domains, but neither of those things are true & so choosing web tech means you lose across the board in the short term and lose big across the board in the long term.

                                                                        2. 1

                                                                          Youtube would be a website where you click on a video and it plays. But it wouldn’t have ads and comments and thumbs up and share buttons and view counts and subscription buttons and notification buttons and autoplay and add-to-playlist.

                                                                          Google docs would be a desktop program.

                                                                          Slack would be IRC.

                                                                          1. 1

                                                                            What you’re describing is the video HTML5 tag, not a video sharing platform. Minimalism is good, I do agree, but don’t mix it with no features at all.

                                                                            Google docs would be a desktop program.

                                                                            This is another debate around why using the web for these kind of tasks, not the fact that it’s minimalist or not.

                                                                      1. 2

                                                                        It’s a good effort but if this was done as part of a university class, I hope the professor points out the fatal flaw in their research: the voluntary response bias. This is the kind of bias you get when you tell someone what the survey is about before they get a chance to decide whether or not to take it. The results of the survey end up biased because those with strong opinions on the topic are more likely to complete the survey than those with weak or no opinions. It’s probably fair to guess that in this particular case, those with the strongest opinions were opposed to the acquisition.

                                                                        1. 3

                                                                          A few months old, but a pretty good read with lots of what look like hard-earned lessons.

                                                                          1. 3

                                                                            On top of that, it links to a lot of stuff Lobsters might enjoy if messing around with embedded projects.

                                                                            1. 1

                                                                              So literally the only thing I ever use netstat for is showing listening network ports with: netstat -luntp. I’ve tried to get the same output with ss, but this is the closest I’ve come: ss -lpf inet and ss -lpf inet6. It seems that “inet” and “inet6” are mutually exclusive. Short of shell trickery, is there any way to get both in one command?

                                                                              1. 1

                                                                                Do you mean the explicit notation of tcp6 and udp6?

                                                                                shanssian:~ $ sudo netstat -tulpn | awk '{print $1}' | grep '.*6'
                                                                                tcp6
                                                                                udp6
                                                                                udp6
                                                                                udp6
                                                                                udp6
                                                                                shanssian:~ $ sudo ss -tulpn | awk '{print $1}' | grep '.*6'
                                                                                shanssian:~$
                                                                                

                                                                                It looks like for ss you kinda have to guess based on the format of Local Address:Port

                                                                            1. 1

                                                                              No. Python interpreter startup time is too slow for these tools. The amount of wasted CPU time worldwide from scripts, monitoring tools, etc executing these commands rewritten as python is simply unforgivable.

                                                                              1. 1

                                                                                I install glances on every physical host and most of the VMs I manage. It does have quite a few dependencies but almost all of them are optional depending on what you need. It works great. Its one of the first things I go to when troubleshooting a problem. Speed is literally not an issue.

                                                                              1. 1

                                                                                Nice summary of some of the most common technologies behind a medium-sized application. I’ve worked with most of these to some degree or another. Seems like a good bookmark to have handy whenever I run into someone getting started in this space.

                                                                                1. 4

                                                                                  “If you’re not an experienced web developer, you’ll likely find it complicated. “

                                                                                  If you are then you’ll likely find it overkill and over-engineered.

                                                                                  1. 2

                                                                                    It’s all a matter of scale. You can host a website on nginx running on a raspberry pi from your home DSL connection. Or if you’re Google or Facebook, your one website requires multiple datacenters spread across multiple continents just to stay online. Almost everything else is somewhere in between, distributed along the entire spectrum.

                                                                                  1. 7

                                                                                    Cory always scares me.

                                                                                    1. 21

                                                                                      This was from 2012. Arguably, we’re already there. Tons of popular computers run signed bootloaders and won’t run arbitrary code. Popular OS vendors already pluck apps from their walled garden on the whims of freedom-optional sovereignties.

                                                                                      The civil war came and went and barely anyone took up arms. :(

                                                                                      1. 5

                                                                                        It’s not like there won’t always be some subset of developer- and hacker-friendly computers available to us. Sure, iPhones are locked down but there are plenty of cheap Android phones which can be rooted, flashed with new firmware, etc. Same for laptops, there are still plenty to choose from where the TPM can be disabled or controlled.

                                                                                        Further, open ARM dev boards are getting both very powerful and very cheap. Ironically, it might even be appropriate to thank China and its dirt-cheap manufacturing industry for this freedom since without it, relatively small runs of these tiny complicated computers wouldn’t even be possible.

                                                                                        1. 9

                                                                                          This is actually the danger. There will always be a need for machines for developers to use, but the risk is that these machines and the machines for everyone else (who the market seems to think don’t “need” actual control over their computers) will diverge increasingly. “Developer” machines will become more expensive, rarer, harder to find, and not something people who aren’t professional developers (e.g. kids) own.

                                                                                          We’re already seeing this happen to some extent. There are a large number of people who previously owned PCs but who now own only locked down smartphones and tablets (moreover, even if these devices aren’t locked down, they’re fundamentally oriented towards consumption, as I touched on here).

                                                                                          Losing the GPC war doesn’t mean non-locked-down machines disappearing; it simply means the percentage of people owning them will decline to a tiny percentage, and thus social irrelevance. The challenge is winning the GPC war for the general public, not just for developers. Apathy makes it feel like we’ve already lost.

                                                                                          1. 0

                                                                                            Arguably iPhones are dev friendly in a limited way. if you’re willing to use Xcode, you can develop for your iPhone all you want at no charge.

                                                                                            1. 7

                                                                                              Develop for, yes, within the bounds of what Apple deems permissible. But you can’t replace iOS and port Linux or Android to it because the hardware is very locked down. (Yes, you might be able to jailbreak the phone through some bug, until Apple patches it, anyway.)

                                                                                              Mind you, I’m not bemoaning the fact or chastising Apple or anything. They can do what they want. My original point was just that for every locked-down device that’s really a general-purpose computer inside, there are open alternatives and likely will be as long as there is a market for them and a way to cheaply manufacture them.

                                                                                              1. 4

                                                                                                Absolutely! Even more impressive is that with Android, Google has made such a (mostly) open architecture into a mass market success.

                                                                                                However it’s interesting to note that on that very architecture, if you buy an average Android phone, it’s locked down with vendorware such that in order to install what you want you’ll likely have to wipe the entire ecosystem off the phone and substitute an OSS distribution.

                                                                                                I get that the point here is that you CAN, but again, most users don’t want the wild wild west. Because, fundamentally, they don’t care. They want devices (and computers) that work.

                                                                                                1. 6

                                                                                                  Google has made such a (mostly) open architecture into a mass market success.

                                                                                                  Uh, I used to say that until I looked at the history and the present. I think it’s more accurate that they made a proprietary platform on an open core a huge success by tying it into their existing, huge market. They’ve been making it more proprietary over time, too. So, maybe that’s giving them too much credit. I’ll still credit them with their strategy doing more good for open-source or user-controlled phones than their major competitors. I think it’s just a side effect of GPL and them being too cheap to rewrite core at this point, though.

                                                                                                2. 2

                                                                                                  I like to think that companies providing OSes are a bit like states. They have to find a boundary over how much liberty over safety they should set, and that’s not an easy task.

                                                                                                3. 3

                                                                                                  This is not completely true. There are some features you can’t use without an Apple developer account which costs $100/yr. One of those features is NetworkExtension.

                                                                                                  1. 2

                                                                                                    friendly in a limited way.

                                                                                                    OK, so you can take issue with “all you want” but I clearly state at the outset that free development options are limited.

                                                                                            2. 6

                                                                                              Over half a million people or 2 out of 100 Americans died in the Civil War. There was little innocent folks in general public could do to prevent it or minimize losses Personally, I found his “civil war” to be less scary. The public can stamp these problems out if they merely care.

                                                                                              That they consistently are apathetic is what scares me.

                                                                                              1. 5

                                                                                                Agreed 100%.

                                                                                                I have no idea what to do. The best solution I think is education. I’m a software engineer. Not the best one ever, but I try my best. I try to be a good computing citizen, using free software whenever possible. Only once did I meet a coworker who shared my values about free software and not putting so much trust in our computing devices - the other 99% of the time, my fellow devs think I’m crazy for giving a damn.

                                                                                                Let alone what people without technical backgrounds give a damn about this stuff. If citizens cared and demanded freedom in their software, that would position society much better to handle “software eating the world”.

                                                                                                1. 6

                                                                                                  The freedoms guaranteed by free software were always deeply abstruse and inaccessible for laypeople.

                                                                                                  Your GNOME desktop can be 100% GPL and it will still be nearly impossible for you to even try to change anything about it; even locating the source code for any given feature is hard.

                                                                                                  That’s not to say free software isn’t important or beneficial—it’s a crucial and historical movement. But it’s sad that it takes so much expertise to alter and recompile a typical program.

                                                                                                  GNU started with an ambition to have a user desktop system that’s extensible and hackable via Lisp or Scheme. That didn’t really happen, outside of Emacs.

                                                                                                  1. 6

                                                                                                    Your GNOME desktop can be 100% GPL and it will still be nearly impossible for you to even try to change anything about it; even locating the source code for any given feature is hard.

                                                                                                    I tried to see how true that is with a random feature. I picked brightness setting in the system status area. Finding the source for this was not so hard, it took me a few minutes (turns out it is JavaScript). Of course it would have been better if there was something similar to browser developer tools somewhere.

                                                                                                    Modifying it would probably be harder since I can’t find a file called brightness.js on my machine. I suppose they pack the JavaScript code somehow…

                                                                                                    About 10 years ago (before it switched to ELF) I used Minix3 as my main OS for about a year. It was very hackable. We did something called “tracking current” (which apparently is still possible): the source code for the whole OS was on the disk and it was easy to modify and recompile everything. I wish more systems worked like this.

                                                                                                    1. 6

                                                                                                      Remember when the One Laptop Per Child device was going to have a “view source” button on every activity?

                                                                                                      1. 1

                                                                                                        Oh yes, that would have been so nice…

                                                                                              2. 3

                                                                                                Cory always brings so much more work that needs to be done to the table.

                                                                                              1. 2

                                                                                                I think we all could do with more introspection. Before buying something or doing that thing, ask yourself, what value does this really deliver to me in the long term? Am I doing this solely for short-term pleasure? Will not doing this lead to better health and happiness later on? What’s one important thing I could be doing right this moment to help ensure my future success?

                                                                                                BTW, if you like those books, you’re going to love Mr Money Mustache: http://www.mrmoneymustache.com/

                                                                                                Another reasonably good book is The Subtle Art of Not Giving a Fuck https://markmanson.net/not-giving-a-fuck

                                                                                                1. 2

                                                                                                  This saddens me but does not surprise. Just yesterday I was taking a third or fourth look into hosting my own OpenID provider until I realized that practically nobody uses it anymore.

                                                                                                  The problem with a universal, distributed, federated identity/authentication system is that nobody wants their user database to be dependent upon third-parties. Or to put it another way, they want all of their users to live in their garden, not just visiting on the way through.

                                                                                                  My only hope now is that if we are now condemned to manage hundreds of individual online accounts ourselves, hopefully some day soon we will be doing it in a more scalable way like hardware token auth or GRC’s SQRL.

                                                                                                  1. 13

                                                                                                    Eh, not a bad read and in principle I don’t disagree. Google is essentially trying to mold the world into their politically-correct version of what it should be. As an uninformed non-UX-trained mere user of their products, I find that there is plenty of things that Just Work material design and several things that are a mistake (like that damn floating plus button to add or do something new… I keep looking for a real button, not one floating over the content in the middle of the screen).

                                                                                                    But also keep in mind who wrote the article. They don’t want you taking a free off-the-shelf design framework when you could instead be paying them to build you a custom one.

                                                                                                    1. 6

                                                                                                      Arguing publicly that using the same or similar design language to what Google uses is a political choice - with the implication that making that choice is bad - is itself a political choice. I’m no fan of Google, but if another agent tells me that being inspired by their work to create my own designs means that I am representing Google, and that’s bad and should be discouraged, I’m well within my rights to look skeptically at the interests of the people telling me that.

                                                                                                      1. 1

                                                                                                        …being inspired by their work to create my own designs means that I am representing Google…

                                                                                                        Okay, you must realize this is hyperbole. The actual argument is that deriving from their branding extends their influence.

                                                                                                    1. 10

                                                                                                      Neat surprise, I maintain this (and similar) pages. Originally started because I wanted to show de-facto support for modern crypto but now I refer back to the pages as a starting point in choosing software that does one particular task or another. I think modern crypto has basically “won” even if there are still gains to be made. One thing I’ve noticed is that the de-facto support goes way beyond de-jure support to a degree that looks suspicious for standards bodies. It’s been the main factor in convincing me that standards bodies need to be taken down a notch – let’s have more public competition and less “design by committee.” I think the community is moving more in that direction and it’s good to see.

                                                                                                      There are over 1700 unique outbound links on these pages. I scan their http status codes with automated scripts several times a week and make other efforts to prevent link rot and outdated info. It takes a surprising amount of time. For instance some people say they support a cryptographic primitive but you look at the code and it’s something else, so you have to check, and it takes time. Good example of the importance of useful, correct documentation.

                                                                                                      Minor thing I noticed: a handful of github pages were deleted after the Microsoft purchase, but not as many as one might have expected based on public discussion. Now that things have settled I’ll check each one manually to look for “page moved to gitlab” type messages where the github repos remain with http 200 status codes, but emptied out. It takes a lot of time to maintain these pages but it’s helped some people so it feels good.

                                                                                                      1. 3

                                                                                                        Yea it was a quite awesome link, and seeing i2p in it warmed my heart<3 (disclamer; I’m a i2p dev)

                                                                                                        1. 2

                                                                                                          Was pleasantly surprised to see Yggdrasil, a project I work on, listed there too!

                                                                                                        2. 2

                                                                                                          Not sure if you’re aware but the font size on that site is absolutely huge on Chrome on Linux. I have to dial it down to 67% the original size to make it readable. Here’s a screenshot to illustrate, with lobsters for comparison: http://i.imgur.com/4I8eegV.png

                                                                                                          1. 1

                                                                                                            Thank you for the feedback! Yeah, font size is an issue these days and it’s something I’ve wrestled with. A while back there was an article about how font sizes haven’t kept pace with monitor / screen resolution increases, which I think is hard to disagree with. The situation is compounded by the large variety of “monitors” from phones to what amount to widescreen TVs. If you have a simple suggestion for HTML/CSS that doesn’t use any JS and makes everyone happy I’d be very interested in hearing it.

                                                                                                          2. 1

                                                                                                            Thank you for all your work! I’m pleased to have two projects in the list. I wonder if there will be an equivalent for post-quantum crypto once the algorithm advice stabilises.

                                                                                                            1. 1

                                                                                                              Yes, there already is a pqcrypto list but it’s kinda shabby IMO (check the links under the homepage). The pqcrypto situation is very fluid at the moment, even chaotic. As one example of many, the front-runner library is libpqcrypto which contains 77 cryptographic systems (50 signature systems and 27 encryption systems). There are more post-quantum algorithms than apps using those algorithms. Also libpqcrypto doesn’t even compile on OpenBSD, a bummer for me personally. IMO for certain things like VPNs, combining an ephemeral X25519 key exchange with a pre-shared key, like WireGuard can optionally do, is a sensible thing to do in 2018 until we get real pqcrypto off the ground.

                                                                                                          1. 3

                                                                                                            Okay, that was interesting as well as entertaining.