alwayslikethis

They are more dangerous. They contain significant amounts of lithium metal, the thing that bursts into flames when in contact with water. There are similar restrictions on them for air travel.

NAT may go away, but stateful firewalls won't. There will still be many environments where you can't easily get a point to point connection even though the IP is addressable and there is a route.

Git gives you a full history of changes which is convenient for many other reasons. I also do sometimes put dated and less often timestamped entries when desired.

If you use org-mode, you can just set up a git repo which auto-commits with gitwatch. And run magit-blame when you want the timestamps. With the advantage that it doesn't distract you when you don't need to see them, but super useful when you want to check when a note is written.

I wish sites offered a way to opt out of 2FA if your password has enough entropy (128 bit random string). These are not getting cracked anytime soon. I store my TOTPs in keepassxc with the other passwords anyway. The keepassxc database is the "something you have" and its password is "something you know", and the random string is a testament to that. Also stop forcing SMS 2FA please. I don't want to need to have a phone.

Even if it's free I doubt they would have wanted it. Supporting DRM is the opposite of what KOreader is for.

I wish browsers had better support for local web apps. If local files can access persistent storage easily, this can open it up a lot of opportunities for quick and easy GUI apps. Basically the opposite of electron.

Unfortunately, RCS on Android requires google apps, so this isn't really a solution to anyone who doesn't want to be tracked by Google everywhere they go.

I'm still a little confused as to what problem RCS is supposed to solve. It is just as centralized as any other chat app, and is a bit more invasive (often requiring device attestation). Is it really worth all this hassle just to not have to install, let's say, Signal?

Liquid nitrogen (boiling at -196 C) is a semi-common substance that people would have heard of, though not everyone would have seen or interacted with it.

Any claim of fees for hosting a distribution platform is nullified by the lack of alternatives. I don't get to kidnap you can then charge you rent and food costs.

Piracy has always existed and will always exist. The issue is that it only takes one determined pirate to overcome the DRM and that piece of information is freed from DRM. You can already do all this even without a legally recognized right of ownership.

I assume plenty of people are willing to pay for things they appreciate. Maybe the carrot can be some kind of recognition: you get to make a digital signature from that token that you can display as a part of your digital identity. There could be discussion forums that require you to have such a token to participate in.

This is a part of it, but I don't think it's all there is. Words mean little when there is such a large power and information asymmetry between consumers and sellers.

The law should formalize the concepts of rentals (licenses) and purchases. Purchases create non-waivable rights of transferability and allows the owner to demand compensation when a service closes: for example if I shut down my movie platform, you should get to download a copy of everything you own.

Licenses on the other hand do not confer such rights, but should still be transferable under a certain value and have a set period during which its terms must be fulfilled, otherwise the licensee needs to be compensated. No "we change the terms at our sole discretion at any moment" nonsense.

Vendors can give you extra rights (like prorated returns or exchanges), but they can't take any of the codified rights away. I assume there needs to be some details about companies just setting a license of one day but never revokes access to avoid the regulation, but someone smarter than me can probably figure that out.

For larger licenses I think the customer (usually customers) has a greater negotiating leverage, so it isn't as necessary to codify these terms, but of course this is contingent on there not existing trillion-dollar corporations, which is not the world we live in.

In fact, the DMA doesn't even explicitly require that gatekeepers allow third party app stores; they can only allow direct distribution (e.g. via web sites) instead, if they want.

Is Apple actually complying with the DMA then? They are still requiring notarization, which means apps still have to be approved by them.

digital “purchases” are transferrable and have all of the rights and privileges afforded to physical goods.

I concur. We need to establish a "secondary markets act", which would allow individuals to transact accounts and digital items worth under a certain amount (let's say $10k, as a non-waivable right, so it wouldn't apply to larger B2B contracts). Essentially, these things should be viewed as property of the consumer and be freely sold. Without the freedom to transact, there can't be a free market.

Oh, I wasn't aware that slashes can follow the #. In that case it seems to be. Thanks for the correction. So the only concern here is injecting js to exfiltrate the key then.

It doesn't seem to be.

But isn't the key just in the url? If the key is sent to the servers in any way, it can be used to decrypt and read the files. I'm not sure that this achieves anything more than a pinky promise of "we won't read your files" because when push comes to shove the keys will be logged and turned over to the authorities.

any examples in mind for Apple

Their image scanning proposal? The recent UK E2EE backup thing?

For the first, although they eventually backtracked, proposing it alone should be ruinous they are actually a privacy-oriented company.

Although the second situation is forced by a government, it is still a self-inflicted problem where iCloud is the only way you can back up your stuff. Not being able to have encrypted backups is a serious QoL issue.

I mostly avoid cloud usage, iCloud or otherwise, and when I do use it, I treat all content as public

This is also my attitude toward "the cloud" in general.

Someone with everything to lose if they break it. Most large companies do not. Perhaps smaller companies whose main selling point is privacy? Proton? Signal? I don't use either but they seem relatively plausible.

Even when using Firefox (with RFP) I often get captchas that say "You have been blocked" after you solve it. I don't bother with sites asking for captchas anymore. If I see a captcha, I close the tab, since there is no guarantee I'll be getting the page if I solve it anyways. Sorry, I'm not training your AI for free. I hope someone will sue captcha providers for accessibility, which if it succeeds, will break captchas forever.

a fully self-sovereign life, with no dependence on trust or agents, is an unrealizable ideal

I agree with this part, but relying Apple is quite far from self-sovereignty compared to many other practical alternatives: not relying on external clouds, GrapheneOS, Linux. By relying on Apple, you not only pay a tax to essentially bribe them to not attack you (perhaps a viable strategy, not too different from taxes to governments), but more importantly you give up the ability to resist without serious compromises (can't have E2EE backups on your own cloud if they said so). This is akin to trying to be paying taxes to the government to get better police coverage, and they decide to ban locks, security cameras, and leaving the walled garden.

The problem with the current computing security paradigm is that it puts too much trust in entities that do not deserve it, because the entities are simply too powerful and do not suffer consequences when they break that trust.

Your analogy doesn't really work because a food poisoning attack is hard to scale (across restaurants, locations) without being detected, whereas one backdoor can compromise everyone all at once if they all have the same software.

If Apple adds a backdoor to their E2EE (by sending their servers the key) via a software update, and they don't do anything with the secrets exposed, they can compromise a large proportion of users over just a few weeks and there is a big chance you'll be among the "first", because the "first" is now a large set.

It is specifically with these smaller projects, not something like Linux or Chromium, that AI can accelerate. In particular, companies would probably not bother using an (A)GPL'd library, and would instead recreate them from scratch with help from AI. I don't have specific evidence for this, though.

I would have said this in the past, but at this point I don't think it matters that much anymore.

1. Code copyright has devalued a lot in general, as you can code significantly faster with LLMs and use them to launder GPL'd code into whatever you want.

2. Big tech seems to be getting away with most other forms of abuses these days, GPL wouldn't really stop them from doing anything important.

To the extent that code is being devalued, I would say that these LLMs are a benefit to open source overall, as devaluing of code also reduces the opportunity cost of open sourcing software. They also somewhat level the playing field between single-contributor open source projects and companies with teams of developers, because an individual is almost always limited by the rate at which he/she can write or architecture code, whereas teams have significant non-code overheads (meetings, reviews, bureaucracy).

The main benefit of having US monopolies is the spying capabilities that it enables. No other country ever had such a global surveillance network.

For the average American, both the efficient parts of monopolies (reduced redundancy which means fewer well-paying jobs) as well as the inefficient parts (reduced competition, higher prices, reduced standards of living) are net negatives. The political influence inherent to monopolies are also a negative effect on democracy, whereas foreign monopolies tend to have a harder time maintaining political influence.

If Google sells Chrome keeps control over Chromium, I don't see this benefiting users. They'll continue with their anti-user efforts (Manifest V2 phaseout, Web Integrity), and the only difference is that the new Chrome will come with a new set of spyware, probably a worse one than Google because no one is in as good of a position to benefit from the lock-in as Google does, so they have to be more aggressive with their monetization, like with ads inserted into pages.

But at the same time maintaining Chromium is a pretty thankless endeavor and I don't see any entity with that capability. It's much bigger than Linux, and the developers are employees, not volunteers.

The best possible outcome I can imagine is if Google is required to spin off Chromium into a nonprofit that would be independent but they are required to fund it for many years. The nonprofit would need some kind of oversight from adversarial companies to avoid collusion with Google or any other company.

You can get the age quite quickly with a binary search. If everyone is between 1 and 100, that's no more than 7 requests. The only way this wouldn't hurt privacy excessively is that it has to work the other way around. You, not the app, requests a verification token from a government API that only says you are above 18 which expires once in a while. The token should bear no other information about you and be single use so it cannot be correlated between different sites. For the US, it should also be on a federal level (the verification scheme, not the age verification requirement) to reduce the bits from knowing your state, which is a lot for small states.

Syncthing works great for this if you have an always on computer. If you don't you can use a server and add it as an untrusted recipient if you have to, though I would not bother since the database is encrypted with your password anyways, and is not vulnerable if you never reuse your db password and there is enough entropy.

Wouldn't it also make you lose everything in a recovery scenario? If all your computers are lost in a fire or flood, you would lose the recovery key, and having your password would not be enough to recover your database. I use keepassxc with a somewhat long password with a high PBKDF iterations count, which would not require having any devices in the event of a loss.

The shopping experience on Amazon is meh

I wouldn't say it's especially good, but most others are worse. As a start, many online shops show me a captcha from Cloudflare before saying "You have been blocked" or refuse to show me anything altogether on Firefox with RFP. Amazon has never given me a captcha to buy something, at least.