6 ms·

Some of us hackers feel the same way. I'm the author of a paid-but-GPLv3+ program called RCU[1] that almost 400 people use because they don't want to, or legall

by davisr 6y ago

Some of us hackers feel the same way. I'm the author of a paid-but-GPLv3+ program called RCU[1] that almost 400 people use because they don't want to, or legally can't, interface with a cloud. I never connect my tablet to the net except to get software updates. [1]: http://www.davisr.me/projects/rcu/ http://www.davisr.me/projects/rcu/

reginaldo 6y ago
Thanks for the software and documentation you've written for the reMarkable. I've taken a different approach for running Debian buster, but your guide [1] saved me a lot of time nonetheless. [1] http://www.davisr.me/projects/parabola-rm/ http://www.davisr.me/projects/parabola-rm/ chroot for now, systemd-nspawn as soon as I have time to hack on it later, as I want to be able to switch between whatever I'm running and reMarkable's original software.
- davisr 6y ago
  I'm really glad you found it useful! Do you think it saved you $20 worth of time? :) Parabola-rM is really a labor of love, and half of the proceeds are donated to the FSF and Parabola project. It would mean a tremendous amount to have your financial support for independent free software development (and if you have already bought a copy, thank you!).
  - reginaldo 6y ago
    It did, and I'd been meaning to show my appreciation. I just bought it (finally).
    - davisr 6y ago
      Thank you!
      - lovelyviking 6y ago
        Would love to buy once I restore access to online payments after pandemic. As I understood you do provide sources if I am correct? I am thinking about porting to rM some programming languages and curios how you've managed with framebuffer .
pkage 6y ago
In what situations would someone not legally be allowed to interface with a cloud? Something like GDPR, or a personal injunction? Just out of curiosity, I've not heard of such a restriction.
- davisr 6y ago
  Doctors, lawyers, psychologists, teachers grading papers--lots of instances where people can't share their data with third parties.
pabs3 6y ago
FYI: I noticed that https on your site times out but http works.
- davisr 6y ago
  I don't have HTTPS on my site (I do when people download files, on files.davisr.me, but not on my www).
  - pabs3 6y ago
    Ah. I see the issue, the HTTPS-Only mode of Firefox and the Encrypt-all-sites mode of HTTPS-Everywhere thinks that you do, because closed TCP ports on your server don't respond to TCP SYN requests at all, whereas normally servers indicate connection refused by sending a TCP RST packet. So anything trying to access HTTPS on your site will just time out.
    - davisr 6y ago
      Thank you for that tip. Yes, I was blocking all connections to 443 on my firewall but I didn't realize that clients like those had such long timeout periods. Those connections should now be explicitly refused.
      - Cyberspy 6y ago
        Out of curiosity, why do you blocks HTTPS when you otherwise seem very privacy conscious?
        davisr 6y ago
        There are a few reasons, but since you worded that question ambiguously, I'm not sure if you know that HTTPS doesn't protect privacy. It can verify data in-transit is not tampered (maybe--see NSA note below), but nothing is anonymous (both sides of the connection, and everyone in the middle, know who they're talking to). Maybe the URL is private, but that's a very low bar for privacy. There's also a problem with how certificate authorities are run which I strongly disagree with. People trust them because corporations trust them, which is already bad, because those same corporations are in-bed with NSA and probably other "security" agencies (which are hard to tell apart from criminal syndicates). If we moved to an HTTPS-only world (Universe, please forbid) there would be an absolute CA racket, and any website could be censored by having the CA revoking its certificate. I fear very much for that possibility, and I completely disagree with the direction that corporate browsers are taking by moving towards HTTPS-only, and especially false messaging like when Chrome reports websites as "non-secure". Firefox, which along with Mozilla is almost entirely funded with Google dollars, is going the same direction. Another problem is if an ISP is tampering with a customer's connection, that is a social problem and not a technical one. Sure, some technical measures may mitigate that from happening, but ultimately the problem is social and users of that network should stop using it, or start tunneling their traffic some other way. I provide HTTPS as a convenience for people downloading my software who otherwise wouldn't check my PGP sigs. Browsers like Chrome have false messaging claiming sites are "not secure" and techno-illiterate users don't understand what that really means, and they complained, so I listened but still advise everyone to check the signatures anyway. Another major reason is that I don't care to support HTTPS for the rest of my life on my personal website. If I were to start supporting it, then everyone will start linking to the HTTPS version, then I could never get rid of that because redirecting back to HTTP requires HTTPS. I never collect any kind of data through my website--there are no form submissions, it's read-only and purely serves .html pages (not even server-side rendering). There's not really a purpose to a secure connection for that. This only scratches the surface of these problems. I won't even get into how certificate authorities assign, then revoke, bogus certificates all the time--but that happens more than they will ever admit to. If you do a search for that, even just on Ars Technica, you'll find a lot of examples. My biggest complaints may be summarized as, "we need completely distributed human-to-human trust without any corporate authorities."

by davisr 6y ago

reginaldo 6y ago

Thanks for the software and documentation you've written for the reMarkable. I've taken a different approach for running Debian buster, but your guide [1] saved me a lot of time nonetheless. [1] http://www.davisr.me/projects/parabola-rm/ http://www.davisr.me/projects/parabola-rm/ chroot for now, systemd-nspawn as soon as I have time to hack on it later, as I want to be able to switch between whatever I'm running and reMarkable's original software.

davisr 6y ago
I'm really glad you found it useful! Do you think it saved you $20 worth of time? :) Parabola-rM is really a labor of love, and half of the proceeds are donated to the FSF and Parabola project. It would mean a tremendous amount to have your financial support for independent free software development (and if you have already bought a copy, thank you!).
- reginaldo 6y ago
  It did, and I'd been meaning to show my appreciation. I just bought it (finally).
  - davisr 6y ago
    Thank you!
    - lovelyviking 6y ago
      Would love to buy once I restore access to online payments after pandemic. As I understood you do provide sources if I am correct? I am thinking about porting to rM some programming languages and curios how you've managed with framebuffer .

pkage 6y ago

In what situations would someone not legally be allowed to interface with a cloud? Something like GDPR, or a personal injunction? Just out of curiosity, I've not heard of such a restriction.

davisr 6y ago
Doctors, lawyers, psychologists, teachers grading papers--lots of instances where people can't share their data with third parties.

pabs3 6y ago

FYI: I noticed that https on your site times out but http works.

davisr 6y ago
I don't have HTTPS on my site (I do when people download files, on files.davisr.me, but not on my www).
- pabs3 6y ago
  Ah. I see the issue, the HTTPS-Only mode of Firefox and the Encrypt-all-sites mode of HTTPS-Everywhere thinks that you do, because closed TCP ports on your server don't respond to TCP SYN requests at all, whereas normally servers indicate connection refused by sending a TCP RST packet. So anything trying to access HTTPS on your site will just time out.
  - davisr 6y ago
    Thank you for that tip. Yes, I was blocking all connections to 443 on my firewall but I didn't realize that clients like those had such long timeout periods. Those connections should now be explicitly refused.
    - Cyberspy 6y ago
      Out of curiosity, why do you blocks HTTPS when you otherwise seem very privacy conscious?
      - davisr 6y ago
        There are a few reasons, but since you worded that question ambiguously, I'm not sure if you know that HTTPS doesn't protect privacy. It can verify data in-transit is not tampered (maybe--see NSA note below), but nothing is anonymous (both sides of the connection, and everyone in the middle, know who they're talking to). Maybe the URL is private, but that's a very low bar for privacy. There's also a problem with how certificate authorities are run which I strongly disagree with. People trust them because corporations trust them, which is already bad, because those same corporations are in-bed with NSA and probably other "security" agencies (which are hard to tell apart from criminal syndicates). If we moved to an HTTPS-only world (Universe, please forbid) there would be an absolute CA racket, and any website could be censored by having the CA revoking its certificate. I fear very much for that possibility, and I completely disagree with the direction that corporate browsers are taking by moving towards HTTPS-only, and especially false messaging like when Chrome reports websites as "non-secure". Firefox, which along with Mozilla is almost entirely funded with Google dollars, is going the same direction. Another problem is if an ISP is tampering with a customer's connection, that is a social problem and not a technical one. Sure, some technical measures may mitigate that from happening, but ultimately the problem is social and users of that network should stop using it, or start tunneling their traffic some other way. I provide HTTPS as a convenience for people downloading my software who otherwise wouldn't check my PGP sigs. Browsers like Chrome have false messaging claiming sites are "not secure" and techno-illiterate users don't understand what that really means, and they complained, so I listened but still advise everyone to check the signatures anyway. Another major reason is that I don't care to support HTTPS for the rest of my life on my personal website. If I were to start supporting it, then everyone will start linking to the HTTPS version, then I could never get rid of that because redirecting back to HTTP requires HTTPS. I never collect any kind of data through my website--there are no form submissions, it's read-only and purely serves .html pages (not even server-side rendering). There's not really a purpose to a secure connection for that. This only scratches the surface of these problems. I won't even get into how certificate authorities assign, then revoke, bogus certificates all the time--but that happens more than they will ever admit to. If you do a search for that, even just on Ars Technica, you'll find a lot of examples. My biggest complaints may be summarized as, "we need completely distributed human-to-human trust without any corporate authorities."