1. 1

    It’s ironic how the title states the value of simple solutions, yet when I open the page in my browser that does not send a user agent, it answers with 400 Bad Request. The HTML code includes the following interesting snippet:

    <p id="status-page">Please visit <a href="https://status.squarespace.com">status.squarespace.com</a> for updates</p>
    

    What does Squarespace have to do with this? It feels like it’s a Rube Goldberg machine rendering this page for me.

    1. 2

      There are some great alternatives. I’m not going to tell you to go use IRC like some cranky old Thinkpad-toting unixbeard who doesn’t recognize that mobile apps are a hard requirement for meaningful social collaboration these days

      The author appears to be unfamiliar with WeeChat and Glowing-Bear, which together give you a very decent mobile experience, despite not being as pretty as Slack or Discord.

      1. 2

        I guess this is not entirely on-topic for the thread… but why would motivate using weechat and glowing-bear instead of a client agnostic bouncer like ZNC?

        1. 2

          I do use ZNC behind WeeChat. But I’ve never gotten ZNC to work the way I like, which is per-client buffers. I hate that I connect with my phone, get missed messages and then when I connect on my desktop the messages are not there. Of course you can set the option to not clear the buffer, but then you will also get all messages repeated when you reconnect from the same client.

        2. 1

          A quick search of the Apple App store seems to indicate these are not available for iOS users.

          1. 2

            They are. WeeChat runs in tmux somewhere, Glowing-Bear is a webapp that you can add to your homescreen on iOS. Either you use the webapp hosted by the project (glowing-bear.org) or you set up a static webserver somewhere. Glowing-Bear connects to your WeeChat client-side, it has no server-side logic.

            1. 4

              I don’t mean to nit-pick, but both these solutions seem to require the user to host WeeChat on a separate server (the referenced webapp for Glowing-Bear does not appear in their instructions).

              1. 1

                That’s correct. WeeChat works as an irssi-like console client, and it can listen on a TCP port offering a websocket (with or without TLS). The webapp the connects to this websocket and that’s how it does its work. You need both to get IRC on your phone but only WeeChat you must host yourself; Glowing-Bear is optional to host yourself.

                Personally I use WeeChat through tmux through SSH from my desktop and laptop. On iOS I have added a self-hosted Glowing-Bear to my home screen, which connects to the websocket offered by the same WeeChat, behind an sniproxy. Took me an afternoon to set up and I have been using it for years now. IRC is now a lower mental barrier than Slack for me.

                1. 8

                  That setup falls firmly into what the OP called “Thinkpad-toting unixbeard” territory, so I don’t think you’ve made your point.

                  1. 6

                    As a thinkpad-toting unixbeard, I agree.

                    We need solutions for people uninterested in recreational sysadmin.

        1. 8

          I’m curious -

          in the linked article, you state

          Unrelated to this article: in general, for private messaging, you should use Signal.

          In this thread on this site, multiple people lambast Signal for requiring a phone number, thus impacting anonymity:

          How does this square with your critique of Discord’s lack of affordances for anonymity?

          1. 4

            Signal’s requirement of a phone number was a design decision to permit Signal to not have to store contact lists on their servers. Strangely enough, an attempt at preserving privacy actually front-loaded a small amount of the privacy concerns. It’s a necessary evil in this instance, and one they’re working on fixing. It’s absolutely not used for censorship, though, as it is in the Discord sense.

            You can also easily use burner numbers that are not tied to your identity for Signal. Doing this is a lot harder when the service is using a phone number explicitly as an anti-spam censorship feature, like on Discord.

            Additionally, the phone number used for Signal is only authed once at device login time, and then you can happily connect to the signal service via Tor. No additional hoops are required (such as endless captchas).

            If it’s a dealbreaker, you can always just wait a spell and Signal is going to have other login methods.

            1. 5

              After reading this, I tried signing up for Signal using a data-only SIM card. These have a functioning, though very long phone number in my country which does work with iMessage. Signal refused the number without trying.

              The argument that Signal somehow needs phone numbers while it’s a privacy problem with Discord seems incorrect to me, and I think it’s damaging in any discussion with Discord users, as it gives the strong impression of having double standards.

              1. 4

                In defense of @sneak, he said that the mention of Signal was unrelated to the purpose of the linked post. He was kind enough to expand on questions I had regarding Signal specifically.

                1. 2

                  I would let OWS know; that sounds like a bug.

                2. 4

                  I’ve never used Signal, but if I undersand it correctly, it uses numbers for an authentication SMS, right? If it does transmit the number to the servers for the auth process, how do I know that it’s not storing it?

                  1. 3

                    Telephone numbers deanonymize you. Not many realize this, but a telephone number is one instant, low-cost API call to a data broker away from your name, physical address, associated/other email addresses, date of birth, et c. The US has no meaningful privacy or data protection laws. You may think I’m exaggerating, but if you live in the US, right this moment, dozens of companies with whom you do business have already provided data brokers with the complete set of your name, phone number, email address, and street address. These lookups are commonly for sale by API and used by many other companies to detect potential fraud, spam risks, et c.

                    Phone numbers are a simple lookup identifier to all of your commonly used personal information. That’s why everyone asks you for them! It’s not to call you. The same goes for your email address.

                    I still do not think those well-reasoned objections are compatible with a suggestion to use signal. Even if you firmly believe they only use the phone number for good reasons, once, to authenticate you, they (and any LEOs whose authority they are subject to) are one instant, low-cost API from deanonymizing you.

                    1. 3

                      You don’t need to use a number that is in any way connected with you.

                      Signal’s goal was to get good cryptographic private messaging with a minimal amount of server side metadata collection into the hands of millions of people.

                      This would not have been achieved with a different design. Everyone already has phone contact lists. They refused to store contact lists on the server, so phone-as-username was the only option.

                      I understand they are working on a privacy-preserving system for those who do not have access to an anonymous phone number or otherwise object to using such.

                      1. 2

                        You don’t need to use a number that is in any way connected with you.

                        Fair enough, but going out and getting a burner phone number feels more onerous and less useful to me than hiding my location using a VPN, when it comes to barriers to participation.

                        FTR, I agree with your macro point that discord is best avoided by organizations that care about open participation. I’m just adding that Signal makes me worry in similar ways. I believe the Signal foundation (or even the Signal Messenger company) are unlikely to abuse the information I choose to share with them if I use their tooling, and I believe that their leadership is on the same side as I am when it comes to privacy and censorship. But if inability to reasonably use tor with a product is a dealbreaker, handing out my phone number is a bigger dealbreaker. For the precise reasons you enumerated, coupled with the significantly higher friction to getting a phone number that’s not connected to me as opposed to getting an IP address that’s not connected to me.

                        1. 2

                          Totally reasonable! FWIW, I think they are working on a username-based system that allows them to avoid storing contact lists, which is a novel problem and not exactly easy.

                        2. 2

                          You don’t need to use a number that is in any way connected with you.

                          There are plenty of jurisdictions where know-your-customer (KYC) rules require showing and recording ID when purchasing a prepaid SIM card (https://www.gsma.com/publicpolicy/wp-content/uploads/2013/11/GSMA_White-Paper_Mandatory-Registration-of-Prepaid-SIM-Users_32pgWEBv3.pdf, map on p. 5). In that case, you’d have to add travel expenses to get a burner phone from another country where they are available, and deal with the roaming charges that come with it.

                          1. 2

                            https://dtmf.io

                            takes bitcoin, has a hidden service :)

                            1. 1

                              The website is down.

                      2. 2

                        Thanks for clarifying!

                        Edit I’m not a user of Signal, but I’ve read up on it in conjunction with the referenced post. I find your explanation regarding the requirements of a phone number plausible.

                        I’m fascinated by the stated aversion to Marlinspike’s person. From what I can see, he’s firmly embedded in the culture of security and encryption. It seems his views on open source (specifically for Signal’s codebase) are literally heretical in this context, hence the aversion.

                    1. 65

                      What should people use instead?

                      Real secure messaging software. The standard and best answer here is Signal,

                      Oh please. They aren’t even close to sharing the same level of functionality. If I want to use Signal, I have to commit to depending on essentially one person (moxie) who is hostile towards anyone who wants to fork his project, and who completely controls the server/infrastructure. And I’d have to severely limit the options I have for interfacing with this service (1 android app, 1 ios app, 1 electron [lol!] desktop app). None of those are problems/restrictions with email.

                      I don’t know what the federated, encrypted ‘new’ email thing looks like, but it’s definitely not Signal. Signal is more a replacement for XMPP, if perhaps you wanted to restrict your freedom, give away a phone number, and rely on moxie.

                      1. 12

                        I think Matrix is getting closer to being a technically plausible email and IM replacement.

                        The clients don’t do anything like html mail, but I don’t think I’d miss that much, and the message format doesn’t forbid it either.

                        1. 27

                          If you can’t send patches to mailing lists with them then they’re not alternatives to email. Email isn’t just IM-with-lag.

                          1. 5

                            Email can be exported as text and re-parsed by Perl or a different email client.

                            Until that functionality is available, I won’t consider something a replacement for email.

                            1. 4

                              In all fairness: cmcaine says “Matrix is getting closer”.

                              1. 3

                                Matrix is a federated messaging platform, like XMPP or email. You could definitely support email-style use of the system it’s just that the current clients don’t support that. The protocol itself would be fine for email, mailing lists and git-send-email.

                                The protocol also gives you the benefits of good end-to-end encryption support without faff, which is exactly what general email use and PGP don’t give you.

                                1. 2

                                  Adding patch workflow to Matrix is no different to adding it to XMPP or any other messaging solution. Yes, it is possible but why?

                                  I can understand you like Matrix but it’s not clear how Matrix is getting closer to e-mail replacement with just one almost-stable server implementation and the spec that’s not an IETF standard. I’d say Matrix is more similar to “open Signal” than to e-mail.

                                  1. 2

                                    “Getting closer” is a statement towards the future, yet all of your counter arguments are about the current state.

                                    1. 2

                                      If I only knew the future I’d counter argument that but given that the future is unknown I can only extrapolate the current and the past. Otherwise Matrix may be “getting closer” to anything.

                                      Do you have any signs that Matrix is getting e-mail patch workflow?

                                2. 2

                                  Mailing lists could move to federated chatrooms. They moved from Usenet before, and in some communities moved to forums before the now common use of Slack.

                                  I’m not saying it would be the best solution, but it’s our most likely trajectory.

                                  1. 6

                                    Mailing lists existed in parallel with Usenet.

                                    1. 5

                                      Both still exist :)

                                      I do think, actually, that converting most public mailing lists to newsgroups would have a few benefits:

                                      1. It’d make their nature explicit.
                                      2. It’d let us stop derailing designs for end-to-end encryption with concerns that really apply only to public mailing lists.
                                      3. I could go back to reading them using tin.

                                      Snark aside, I do think the newsgroup model is a better fit for most asynchronous group messaging than email is, and think it’s dramatically better than chat apps. Whether you read that to mean slack or any of the myriad superior alternatives to slack. But that ship sailed a long time ago.

                                      1. 4

                                        Mailing lists are more useful than Usenet. If nothing else, you have access control to the list.

                                        1. 2

                                          Correct, and the younger generation unfamiliar with Usenet gravitated towards mailing lists. The cycle repeats.

                                        2. 4

                                          Mailing lists don’t use slack and slack isn’t a mailing list. Slack is an instant messaging service. It has almost nothing in common with mailing lists.

                                          It’s really important to drive this point home. People critical of email have a lot of good points. Anyone that has set up a mail server in the last few years knows what a pain it is. But you will not succeed in replacing something you don’t understand.

                                          1. 4

                                            The world has moved on from asynchronous communication for organizing around free software projects. It sucks, I know.

                                            1. 3

                                              Yeah. Not everyone, though.

                                              Personally I think that GitHub’s culture is incredibly toxic. Only recently have there been tools added to allow repository owners to control discussions in their own issues and pull requests. Before that, if your issue got deep linked from Reddit you’d get hundreds of drive by comments saying all sorts of horrible and misinformed things.

                                              I think we’re starting to see a push back from this GitHub/Slack culture at last back to open, federated protocols like SMTP and plain git. Time will tell. Certainly there’s nothing stopping a project from moving to {git,lists}.sr.ht, mirroring their repo on GitHub, and accepting patches via mailing list. Eventually people will realise that this means a lower volume of contributions but with a much higher signal to noise ratio, which is a trade-off some will be happy to make.

                                              1. 2

                                                Only recently have there been tools added to allow repository owners to control discussions in their own issues and pull requests. Before that, if your issue got deep linked from Reddit you’d get hundreds of drive by comments saying all sorts of horrible and misinformed things.

                                                It’s not like you used to have levers for mailing lists, though, that would stop marc.org from archiving them or stop people from linking those marc.org (or kernel.org) threads. And drive-bys happened from that, too. I don’t think I’m disputing your larger point. Just saying that it’s really not related to the message transfer medium, at least as regards toxicity.

                                                1. 3

                                                  Sure, I totally agree with you! Drive-bys happen on any platform. The difference is that (at least until recently) on GitHub you had basically zero control. Most people aren’t going to sign up to a mailing list to send an email. The barrier to sending an email to a mailing list is higher than the barrier to leaving a comment on GitHub. That has advantages and disadvantages. Drive-by contributions and drive-by toxicity are both lessened. It’s a trade-off I think.

                                                  1. 3

                                                    I guess I wasn’t considering a mailing list subscription as being meaningfully different than registering for a github account. But if you’ve already got a github account, that makes sense as a lower barrier.

                                      2. 5

                                        Matrix allows sending in the clear, so I suppose this has the “eventually it will leak” property that the OP discussed?

                                        (A separate issue: I gave up on Matrix because its e2e functionality was too hard to use with multiple clients)

                                        1. 5

                                          (A separate issue: I gave up on Matrix because its e2e functionality was too hard to use with multiple clients)

                                          and across UA versions. When I still used it I got hit when I realized it derived the key using the browser user agent, so when OpenBSD changed how the browser presented itself I was suddenly not able to read old conversations :)

                                          1. 2

                                            Oh! I didn’t know that!

                                      3. 5

                                        Functionality is literally irrelevant, because the premise is that we’re talking about secure communications, in cases where the secrecy actually matters.

                                        Of course if security doesn’t matter then Signal is a limited tool, you can communicate in Slack/a shared google doc or in a public Markdown document hosted on Cloudflare at that point.

                                        Signal is the state of the art in secure communications, because even though the project is heavily driven by Moxie, you don’t actually need to trust him. The Signal protocol is open and it’s basically the only one on the planet that goes out of it’s way to minimize server-side information storage and metadata. The phone number requirement is also explicitly a good design choice in this case: as a consequence Signal does not store your contact graph - that is kept on your phone in your contact store. The alternative would be that either users can’t find each other (defeating the point of a secure messaging tool) or that Signal would have to store the contact graph of every user - which is a way more invasive step than learning your phone number.

                                        1. 9

                                          even though the project is heavily driven by Moxie, you don’t actually need to trust him

                                          Of course you must trust Moxie. A lot of the Signal privacy features is that you trust them not to store certain data that they have access to. The protocol allows for the data not to be stored, but it gives no guarantees. Moxie also makes the only client you can use to communicate with his servers, and you can’t build them yourself, at least not without jumping hoops.

                                          The phone number issue is what’s keeping me away from Signal. It’s viral, in that everyone who has Signal will start using Signal to communicate with me, since the app indicates that they can. That makes it difficult to get out of Signal when it becomes too popular. I know many people that cannot get rid of WhatsApp anymore, since they still need it for a small group, but cannot get rid of the larger group because their phone number is their ID, and you’re either on WhatsApp completely or you’re not. Signal is no different.

                                          And how can you see that a phone number is able to receive your Signal messages? You have to ask the Signal server somehow, which means that Signal then is able to make the contact graph you’re telling me Signal doesn’t have. They can also add your non-Signal friends to the graph, since you ask about their numbers too. Maybe you’re right and Moxie does indeed not store this information, but you cannot know for sure.

                                          What happens when Moxie ends up under a bus, and Signal is bought by Facebook/Google/Microsoft/Apple and they suddenly start storing all this metadata?

                                          1. 5

                                            Signal is a 501c3 non-profit foundation in the US, Moxie does not control it nor able to sell it. In theory every organization can turn evil but there is still a big difference between non-profits who are legally not allowed to do certain things vs corporations who are legally required to serve their shareholders, mostly by seeking to turn a profit.

                                            And how can you see that a phone number is able to receive your Signal messages? You have to ask the Signal server somehow, which means that Signal then is able to make the contact graph you’re telling me Signal doesn’t have.

                                            There are two points here that I’d like to make, one broader and one specific. In a general sense, Signal does not implement a feature until they can figure out how to do that securely and with leaking as little information as possible. This has been the pattern for basically almost every feature that Signal has. Specifically, phone numbers are the same: The Signal app just sends a cryptographically hashed, truncated version of phone numbers in your address book to the server, and the server responds with the list of hashes that are signal users. This means that Signal on the server side knows if any one person is a Signal user, but not their contact graph.

                                            1. 3

                                              In theory every organization can turn evil

                                              Every organization can also be bought by an evil one. Facebook bought WhatsApp, remember?

                                              The Signal app just sends a cryptographically hashed, truncated version of phone numbers in your address book

                                              These truncated hashes can still be stored server-side, and be used to make graphs. With enough collected data, a lot of these truncated hashes can be reversed. Now I don’t think Signal currently stores this data, let alone do data analysis. But Facebook probably would, given the chance.

                                              1. 6

                                                Every organization can also be bought by an evil one. Facebook bought WhatsApp, remember?

                                                WhatsApp was a for-profit company, 501(c)3 work under quite different conditions. Not saying they can’t be taken over, but this argument doesn’t cut it.

                                          2. 3

                                            The phone number requirement is also explicitly a good design choice

                                            No, it’s an absolutely terrible choice, just like it is a terrible choice for ‘two factor authentication’

                                            Oh but Signal users can always meet in person to re-verify keys, which would prevent any sim swap attack from working? No, this (overwhelmingly) doesn’t happen. In an era where lots of people change phones every ~1-2yr, it’s super easy to ignore the warning because 99% of the time it’s a false positive.

                                            The alternative would be that either users can’t find each other (defeating the point of a secure messaging tool)

                                            This is a solved problem. I mean, how do you think you got the phone numbers for your contacts in the first place? You probably asked them, and they probably gave it to you. Done.

                                          3. -8

                                            Careful there… you can’t say bad things about electron in here….

                                          1. 3

                                            There’s a lot to like and a lot to dislike in this post. But in any case, the most important part to me is the link to age. I’ve heard a lot of complaints about gpg lately, and agree with a lot of them, but my question has always been, “so what’s a good alternative for signing and encryption then?”

                                            Combine age with minisign, and I think I may have finally found an alternative to gpg.

                                            1. 6

                                              I miss key handling in both minisign and age. Not that GPGs keychain is anything to be proud of, but minisign just expects you to handle the keys yourself, while age conveniently integrates with a Microsoft-acquired cloud service which was never even intended as a key store (Github) to do key discovery, and trusts it blindly.

                                              1. 2

                                                I find that for release signing, you have to handle the keys yourself anyway, and small keys used by sifnify/minisign are definitely easier to handle.

                                            1. 29

                                              for those people, encrypted email is LARP[0] security.

                                              [0]: https://www.google.com/search?q=larp

                                              Linking to a google search is both pedantic and unhelpful. Pedantic because it means that you care more about telling your readers “Why don’t you just figure it out” instead of providing the information directly (and you even took the extra time to make it a link!), and unhelpful because google search is now heavily impacted by previous user searches, localisation, etc…

                                              For me, a french hobbyist using duckduckgo on a daily basis, LARP is an Algorithm and Problem solving software. I’m still not sure what the author mean here, but it definitely pissed me off.

                                              1. 12

                                                I thought about Live Action Role Playing, and interpreted LARP Security as a snobby way of saying “Security Theatre”. It’s not a term I would use myself.

                                                1. 5

                                                  It’s probably just a setup for this zinger:

                                                  Users are encouraged to rotate their PGP keys in the same way that LARPers are encouraged to sharpen their play swords: not only does nobody do it, but the whole system would probably fall apart if everyone did.

                                                  1. 6

                                                    Makes sense indeed. My point about linking to a google search rather than giving a real definition still stands though.

                                                  2. 3

                                                    Phrases like that are one reason I suggested the “rant” tag for this post. It comes across as pretty hostile to me.

                                                    1. 1

                                                      I wasn’t sure what the author meant by this either.

                                                    1. 5

                                                      PGP is dead and shouldn’t be used, however, I haven’t found a great alternative to sign/encrypt my stuff.

                                                      How do I prove I am me speaking without a PGP signed message? How do I encrypt blobs of text?

                                                      Any recommendations?

                                                          1. 6

                                                            Woah! So I guess they really are faced with no serious alternatives.

                                                            So is PGP really dead afterall? I mean, the government uses it. ;)

                                                          2. 8

                                                            How is PGP dead? The author mentions it, links to one vulnerability, and moves on.

                                                            It seems to me that if I have someone’s public key, and they have mine, I can use GPG to encrypt messages and send them back and forth. Aside from this being complicated, if followed on both sides it should work.

                                                            1. 4

                                                              From the same author, and discussion here:

                                                              https://lobste.rs/s/7rkfsu/pgp_problem

                                                              1. 4

                                                                Thanks for linking this. I wish I was around to contribute to the discussion back then.

                                                                I don’t think author should discount PGP, if that’s his complaints. I think his use case is very different than mine.

                                                                For regular stuff encrypted email means transport between me and my email server. That’s enough. When I have something important, I use PGP. When I need to sign a GitHub commit, I use PGP.

                                                                It’s both hard to send and read an encrypted email. I do it rarely, but when I do, I trust that PGP works.

                                                                The authors concerns may be valid for him, but they conflate privacy and encryption. I don’t need forward secret for this purpose. I’d rather have a shared key than manage session keys for all eternity. That’s outside the scope of PGP, although I could use PGP to negotiate session keys if I really wanted.

                                                                I don’t care that PGP leaks metadata, the intent is to identify a message to me, so having the subject visible is a feature not a bug. If I wanted anonymity I would use a fake subject and distribute it in ways that preserve my identity.

                                                                There are many flaws, but for situations where I just must have encryption, PGP works. I have set it up with desktop clients before and it works well with stuff like Outlook. But since I mainly use webmail, I don’t set it up because it seems kind of pointless to trust a third party with my private key. That would make me have to have a super private key or something.

                                                                1. 2

                                                                  I think OP’s beef with PGP in general is that it’s a huge ball of mud that tries to do everything.

                                                                  For every use case of PGP, there are alternatives that are more modern and more debuggable.

                                                            2. 4

                                                              My hope is that modern tools like https://age-encryption.org/ will catch on.

                                                              1. 6

                                                                I don’t think you can use Age for the first use case, “prove I am me”, as Age wil only allow you to encrypt. Age will also not help you in proving that a key belongs to a certain user.

                                                            1. 3

                                                              This is really cool, but it’s very Btrfs-heavy. I would give extra nerd points for making Windows run on Ext4, XFS or ZFS. We already have https://github.com/openzfsonwindows (great avatar) so who knows? :)

                                                              1. 5

                                                                Heh, I’d like to see NTFS support. At that point it can be a drop in replacement for winload, and from there, it can be taken in many different directions.

                                                                Another thought is to access files from a redirector or hypervisor so that a Windows OS can boot where its files aren’t owned by a local block device at all, similar to DosBox. This in turn opens the door to sharing files across a fleet of Windows VMs, so each VM only needs to record different files. Taken to an extreme, the storage cost of an instance could be as small as a copy of the registry, even after updates are applied.

                                                              1. 1

                                                                Speaking of Macbooks, even Apple fanboys are fed up with them these days

                                                                Yes! I still have the latest non-retina MacBook Air model. It’s the best MacBook ever, and if Apple continues down the road they seem to have chosen, that will never change.

                                                                The retina models overheat and cannot get a decent framerate for the UI of the operating system they ship with it. It feels old and outdated right out of the box. Meanwhile my non-retina Air happily runs the newest version of MacOS without any complaining.

                                                                1. 2

                                                                  In my experience, the only problem with FreeBSD is sleep/resume. I’ve read a while ago that this has to do with graphic card drivers, meaning that resume actually works, except for turning the screen on.

                                                                  I see that resume works here, although “weird”? That’s further than I’ve ever gotten.

                                                                  1. 2

                                                                    I’ve never had resume fail because of Intel graphics. I’ve heard that everything’s fine for people with Ryzen Mobile laptops as well.

                                                                    The most infamous cause of hanging on resume is the TPM. If it’s enabled, the OS has to talk to it on suspend, otherwise it will break resume. At some point the FreeBSD driver didn’t seem to do this correctly on some ThinkPads (??) but most importantly you just have to load it at all :)

                                                                  1. 21

                                                                    Catalina runs best on Macs with hardware specifications that Apple marketing isn’t yet prepared to make the baseline for models such as the iMac.

                                                                    So MacOS Catalina is like Windows Vista?

                                                                    1. 7

                                                                      Yes. Having been a Windows user at that time, all I feel are unpleasant flashbacks.

                                                                      1. 2

                                                                        In that case, on the upside macOS in 2-3 years is going to be absolutely fantastic for 5-7 years!

                                                                        1. 3

                                                                          You jest but I’m looking forward to it.

                                                                          1. 3

                                                                            And then it will be cursed to become a user-hostile ad platform that you have to pay for, until the end of time.

                                                                        2. 1

                                                                          Using any new piece of software triggers roughly two dozen security prompts, so yes.

                                                                        1. 1

                                                                          Now don’t get me wrong, sometimes there are situations where people who know just enough to be dangerous will say “that’s really complex, why can’t you just do X?” and you do need to let them know that you are the expert here and they don’t really know what they’re talking about… But there’s still a right way and a wrong way of going about that.

                                                                          And just like that, he jumps over the hardest communication problem there is. Trying to explain that a problem is more complex than it sounds without being condescending or giving the impression to overcomplicate things.

                                                                          1. 4

                                                                            As always, when you get a message from $company, you go the website of $company yourself and you do not click the opaque link in the email.

                                                                            1. 1

                                                                              When can you ever click a link in an email then? :)

                                                                              1. 1

                                                                                Any link where you don’t expect to need authentication. For example, here is a nice article I found on lobste.rs: [link].

                                                                            1. 1

                                                                              I think Chrome and Firefox still have the CAs for Google and Facebook pinned?

                                                                              1. 1

                                                                                IIRC, they do, but it’s hard-coded in the browser, and can’t be activated for other sites by HTTP headers or anything.

                                                                              1. 1

                                                                                This seems like a really useful project! I’m wondering what kind of mail backends this would support? I think using this with GMail might be out of the question, the forwarded mail might be stopped due to SPF. The document gives information about setting up DKIM/SPF, but the way I read this it’s only for outgoing mail (from me to the party I’m hiding my real address from). Or is there some rewriting in place?

                                                                                Maybe I’ll try setting this up, but I’m not a big fan of Docker, especially when the application has specific network requirements. I didn’t check the Dockerfile yet, but I hope this will be easy enough to run in a FreeBSD jail.

                                                                                Anyway, great work! We need more projects like these.

                                                                                1. 1

                                                                                  wondering what kind of mail backends this would support?

                                                                                  What do you mean by “mail backend”? SimpleLogin uses Postfix to send and receive emails. You could also config Postfix for it to send emails from other mail servers (e.g. Gmail) but then SPF check would fail.

                                                                                  Or is there some rewriting in place?

                                                                                  I created a small diagram to show how SimpleLogin works here https://whimsical.com/2BfXodQqkWi2p12QXJyfAH Basically what it does is to rewrite the email headers to:

                                                                                  • forward received emails to your personal email inbox
                                                                                  • send emails from the alias when you reply

                                                                                  I think you could deploy SimpleLogin without Docker as it mostly used Python and its dependencies are relatively simple.

                                                                                  1. 1

                                                                                    forward received emails to your personal email inbox

                                                                                    Ah, from the diagram I see you use SRS rewriting. I’m not sure about this, but I was kinda hoping ARC (Authenticated Receive Chain) would solve this without rewriting?

                                                                                    1. 2

                                                                                      ARC is indeed a good idea to handle email forwarder case. Its status is still experimental though.

                                                                                      ARC wouldn’t be useful for SimpleLogin though as it rewrites both the “from” and “to” header to implement the “reply flow” so when user replies, the email is routed through SimpleLogin.

                                                                                1. 8

                                                                                  Add a “show” tag, and perhaps consider not having your username be your project name (looks like advertisement).

                                                                                  1. 10

                                                                                    Yeah. I PMd to tell him to knock off the self-promotion.

                                                                                    1. 3

                                                                                      An open source project, where there is also a cloud-hosted version by the author, is not necessarily a spam post. Goat Counter does exactly the same thing and got a lot of upvotes on Lobste.rs. Whether the link goes to the Github README or a separate blog shouldn’t make much of a difference methinks?

                                                                                      The only sketchy thing here is that the Lobste.rs username matches the project name. But that doesn’t make the project itself bad. Maybe they’ll change their username to something more personal.

                                                                                      1. 7

                                                                                        I’m really careful in not promoting/spamming GoatCounter too much here. For example, I wrote some things on my website about it that I didn’t post here, and I tend to refer to it as “the project I’m working on” in comments when I don’t really need to reference it by name. Additionally, I’ve been posting here for a while with quite a number of comments/submissions. I also just happen to be developing this product, but that’s not why I’m here.

                                                                                        I’m sure Son has the best of intentions (SimpleLogin uses GoatCounter, and provided some pretty useful feedback), but I’ve seen several SimpleLogin stories in the last few weeks, and IMHO it’s a little bit too much. Self-promotion is fine IMHO, but it’s all about the balance.

                                                                                        1. 1

                                                                                          Hey what’s funny is some trending posts about SimpleLogin aren’t even posted by us, I learnt about them when they are trending on Reddit.

                                                                                          We are preparing an official launch so are posting about “the project we’ve been working on” ;) a bit everywhere. Lot of constructive feedbacks, some haters (obviously) but so far so good.

                                                                                          1. 3

                                                                                            Yeah, it’s just some things I noticed here. Maybe my impressions are wrong 😅 Also, as someone else pointed out having the username “simplelogin” probably isn’t helping. You can change it in Lobsters on your profile at any time.

                                                                                            1. 2

                                                                                              Yeah I just changed my username.

                                                                                        2. 2

                                                                                          He’s pushing it too much (see his previous submission and the discussion underneath).

                                                                                          1. 0

                                                                                            Self-advertising is not bad per se, I discovered some cool projects by their authors and I have met a lot of amazing people who support SimpleLogin via my “self-promotion” posts. For me, what’s more important is the content itself.

                                                                                            It’s sad that people don’t even look at the post before classifying it as “spam”.

                                                                                            1. 1

                                                                                              I think maybe the match between your username here and the name of the product causes a knee-jerk reaction. Have you considered using the same username here that you use on Github?

                                                                                              1. 2

                                                                                                I use the product name as username on reddit and HN so anyone could know immediately that I’m self-promoting and not trying to fake a positive review. Anw just changed my username :).

                                                                                        1. 2

                                                                                          Combining ZFS and Linux is a GPL violation anyway, so Linus could not include it in Linux without violating the GPL unless Oracle gave explicit permission (or an exemption) for this, as Linus alluded to.

                                                                                          For more details, including why Canonical is violating the GPL by distributing ZFS in Ubuntu, see https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/ (disclosure: I work for Conservancy).

                                                                                          1. 4

                                                                                            Combining ZFS and Linux is a GPL violation anyway

                                                                                            That’s a strong statement. From what I understand, it’s not allowed to distribute Linux together with ZFS, but building ZFS yourself and using it on your own machine is not a GPL violation, right?

                                                                                            Linus could not include it in Linux

                                                                                            I’m with you there. But I don’t think anyone here has asked him to include it. Rather, this seems to be about Linus making changes to the kernel that make it harder to get ZFS to work on Linux.

                                                                                            1. 1

                                                                                              Distributing a combination is not the only problem when dealing with the copyright of ZFS on Linux: While I don’t like it, one can also be held liable for copyright infringement that others committed, e.g. by inducement of it. That means this is also a question for when one were to contribute to or distribute ZFS on Linux without combining it.


                                                                                              On a more general matter: It is said, though disputed, that Bryan Cantrill ( on here as @bcantrill ) was one of the biggest proponents of the CDDL. If he were to read this I would like to know from him (and anyone contributing under CDDL, if you care about having/giving a license):

                                                                                              1. Do you suggest anyone to use the CDDL for new software?
                                                                                              2. Would you like to have existing software under CDDL move to a different license if that was easy?
                                                                                              3. Is it worth it to make sure new contributions to existing CDDL software are also available under another license that is less intentionally incompatible with other licenses (like 2-BSD, Apache 2.0 or something)?
                                                                                              1. 1

                                                                                                The relevant Wikipedia pretty much answers your questions, including quotes from @bcantrill. https://en.wikipedia.org/wiki/Common_Development_and_Distribution_License

                                                                                                #3 CDDL is generally not incompatible with any OSS license, except MAYBE the GPL. The FSF thinks it’s incompatible, and Linus clearly has a perspective here, but he isn’t really saying it’s a Legal issue, mostly an Oracle is evil issue (which everyone already knows). See the above wikipedia entry for the details. But either way it’s never been tested in court, so it’s still unknown if it’s actually incompatible. Certainly the spirit of both GPL and CDDL licenses are compatible.

                                                                                                Plus CDDL is an interesting license as it’s file based, i.e. it’s attached to individual files, not to a project as a whole. Which makes it unique in the OSS license tree. So you could only make new files in the repository/project dual-licensed. You can’t really change a CDDL licensed file unless you also happen to own the copyright(s) to the entire file, which in the case of OpenZFS is now quite broad, and not limited to Oracle alone.

                                                                                                Basically there is OpenZFS which everyone uses (across multiple different platforms), except Oracle, which nobody uses (unless forced, for non-technical reasons). Oracle can not import any of the OpenZFS changes back into their tree (legally speaking) because the Oracle version is no longer CDDL licensed.

                                                                                                OpenZFS has a lot of awesome features that Oracle can’t import into their version. The latest new feature Oracle can’t import is data encryption on disk.

                                                                                              2. 1

                                                                                                That the GPL and CDDL are incompatible is mostly legal opinion at this point. Certainly the Conservancy has an opinion and the FSF has an opinion, which coincides with your statement of “fact”, but it’s never been tested in courts, and plenty of other lawyers have an opposing viewpoint to yours, so much so that Canonical is willing to bet their business on it. More about the various opinions can be found on the CDDL wikipedia page: https://en.wikipedia.org/wiki/Common_Development_and_Distribution_License

                                                                                                I think most people can agree that in spirit, both are compatible, to some degree, but there is a difference in that GPL is a project based license, and the CDDL is a file-based license(which makes it unique).

                                                                                                I don’t think either perspective can be called fact until the various court systems have ruled one way or another, and I don’t really see anyone itching to find out enough to dump a team of lawyers in front of the court.

                                                                                                I’m certainly not going to say you are wrong, and Linus has made it very clear he has no intention of incorporating OpenZFS into the Linux tree anytime soon, but I think even if everyone on the planet agreed legally that it could be incorporated I would like to think he(and many others) would hesitate anyway. The Linux tree is already pretty giant, and OpenZFS’s codebase is no slouch either (it’s in the millions of LoC). Plus, there isn’t really a huge benefit in incorporating OpenZFS into the kernel tree, since OpenZFS is cross-OS (Unix, BSD, macOS, Windows, Linux, etc) and the Linux kernel … isn’t.

                                                                                              1. 2

                                                                                                One of the comments on the linked site state

                                                                                                However, the change that broke SIMD for ZFS was not a technical one; rather, it was a symbol switching from EXPORT to EXPORT_GPL. From the outside, it seemed a deliberate choice to hamper 3rd party module. And it would be fine even in this case, but it somewhat suprised me.

                                                                                                What exactly does EXPORT_GPL mean? I’m not a kernel dev..

                                                                                                1. 2

                                                                                                  It’s a signal from kernel developers that they expect anything using EXPORT_GPL to also be GPL’d code. it’s a legal stance, and not a technical one.

                                                                                                  i.e. if you use EXPORT_GPL, then they expect the GPL license (sometimes called “infection”) to apply to your code as well. If you use just EXPORT, then they don’t expect the GPL license to apply to that code.

                                                                                                  to be clear: where they is the kernel developers.

                                                                                                  1. 2

                                                                                                    Symbols which are EXPORTed are considered free to be used by any (out of tree) kernel module, irrespective of the license of that out-of-tree module. “EXPORT_GPL” symbols are intended only to be used by modules licensed under the GPL.

                                                                                                    1. 1

                                                                                                      There is no such permission given in the license of Linux. I remember at least one Linux copyright holder explicitly saying multiple times that they reserve the right to sue for copyright infringement irrespective of how the symbol is marked.

                                                                                                      While EXPORT_GPL shows that there is at least one person who reserves the right to sue for copyright infringement when using in a module under an incompatible license, EXPORT doesn’t tell you anything more than the text of the license (GPL 2) in itself. EXPORT is not EXPORT_MIT or something like that.

                                                                                                  1. 4

                                                                                                    I recall reading a comment from someone who has contributed code in FFS that essentially claimed the “problem” with ZFS is that there are only a handful of people who know how it works, they don’t work on it now, and none of that knowledge was available for new contributors.

                                                                                                    I am emphatically inexpert in this domain - please don’t take the above claim as anything more than hearsay - but this is one of the rationales that consistently leads me towards caution and skepticism about anything that pursues robustness using complexity rather than simplicity.

                                                                                                    Is there anyone here who would be capable of - or would know anyone else capable of - developing a clean room ZFS? Licensing aside, this is the same reason I use boring old BSD file system technology: because it isn’t as sophisticated.

                                                                                                    1. 2

                                                                                                      see: https://github.com/zfsonlinux/zfs/graphs/contributors

                                                                                                      More than 300 contributors so far, and FreeBSD is just now in the process of upstreaming their ZFS changes to that repo, so some/most of the FreeBSD ZFS people are not necessarily included in that. Plus it’s looking like macOS and Windows ports are also going to upstream to that repo.

                                                                                                      I haven’t heard about the Illumos(and friends) people and if they are planning to upstream to that repo or not.

                                                                                                      But regardless, there are active maintained ports across multiple OS’s, so I think it’s hard to say there is not enough developer interest to keep it alive at least.

                                                                                                      I don’t think anyone really cares enough for a clean-room re-implementation under gpl. The current CDDL license is plenty good enough for all the OS’s except Linux, and the linux types just shove it in as a kernel module, and it works without issue. Ubuntu has gone so far as to distribute the binaries right alongside their OS, so clearly their lawyers don’t see a problem with their approach either. Plus the ZFS codebase is HUGE it’s millions of lines of code, so a clean-room re-implementation would be a serious, serious undertaking for no big benefit, especially since Linus’s long-standing stance is, he doesn’t really want the codebase directly in the kernel(which is already plenty big enough!).

                                                                                                      1. 1

                                                                                                        see: https://github.com/zfsonlinux/zfs/graphs/contributors

                                                                                                        More than 300 contributors so far […]

                                                                                                        Sure, but how many of those contributors actually have much of an understanding of its inner workings? Judging by 5 minutes of skimming commit subject lines from a handful of the top few dozen people listed there, I’d guess there are maybe 10 (and I feel like that’s probably a generous estimate).

                                                                                                        1. 3

                                                                                                          Sure, but how many of those contributors actually have much of an understanding of its inner workings?

                                                                                                          Enough apparently to implement new features, judging the addition of native encryption to 0.8.0.

                                                                                                      2. 1

                                                                                                        I’ve listened to BSD Now episodes, where Alan Jude is a co-host. He has also done a lot of great work in ZFS lately. And this was before FreeBSD merged with ZoL, so now that these two projects have joined forces I think there’s enough manpower to keep OpenZFS afloat for a while.

                                                                                                      1. 2

                                                                                                        I’ve tried Nextcloud on FreeBSD for a year, but then I moved to ownCloud which seems a lot more mature, at least on FreeBSD. All management can be done with the commandline, so the actual webUI doesn’t need to be able to write to itself. Nextcloud is supposedly also able to work this way but I didn’t get that to work.

                                                                                                        1. 1

                                                                                                          I did not used ownCloud since ages but good to hear that it also has some point.

                                                                                                          These are examples of command line Nextcloud setup but maybe ownCloud is more sophisticated here …

                                                                                                          su -m www -c 'php /usr/local/www/nextcloud/occ config:system:set memcache.local --value="\OC\Memcache\APCu"'
                                                                                                          su -m www -c 'php /usr/local/www/nextcloud/occ config:system:set redis host --value="/tmp/redis.sock"'
                                                                                                          su -m www -c 'php /usr/local/www/nextcloud/occ config:system:set redis port --value=0 --type=integer'
                                                                                                          su -m www -c 'php /usr/local/www/nextcloud/occ config:system:set memcache.locking --value="\OC\Memcache\Redis"'
                                                                                                          su -m www -c "php /usr/local/www/nextcloud/occ config:system:set overwrite.cli.url --value=\"http://${HOST_NAME}/\""
                                                                                                          su -m www -c 'php /usr/local/www/nextcloud/occ maintenance:update:htaccess'
                                                                                                          su -m www -c "php /usr/local/www/nextcloud/occ config:system:set trusted_domains 1 --value=\"${HOST_NAME}\""
                                                                                                          su -m www -c 'php /usr/local/www/nextcloud/occ app:enable encryption'
                                                                                                          su -m www -c 'php /usr/local/www/nextcloud/occ encryption:enable'
                                                                                                          su -m www -c 'php /usr/local/www/nextcloud/occ background:cron'
                                                                                                          

                                                                                                          Regards.