11 ms·

This is the kind of sunset you love to see. Retirement because they succeeded and therefore became redundant, rather than due to failure. If there's one organiz

by Taywee 4y ago

This is the kind of sunset you love to see. Retirement because they succeeded and therefore became redundant, rather than due to failure. If there's one organization I love to see succeed, it's the EFF.

user3939382 4y ago
That’s how I used to feel until I found out they accepted millions in donations from companies like Google and Facebook/their executives/their executives’ charities. I’m just some guy on the Internet but IMHO their being OK with massive conflicts of interest means I no longer trust them.
- metacritic12 4y ago
  Serious question: is there a popular charity that by rule doesn't accept donations from really rich people?
- cbozeman 4y ago
  Then nut up and donate the millions yourself.
  - yjftsjthsd-h 4y ago
    That doesn't follow. Do you really want to argue that the only way someone is allowed to disagree with millionaires is by being one themselves?
    - blowski 4y ago
      What's the EFF to do? 1. Achieve its mission with no money, or 2. Find money from sources deemed acceptable, or 3. Take money from sources deemed unacceptable I'm OK with option 3, so long as its transparent, because I agree with the agenda the EFF are pushing. If they start pushing an agenda I disagree with, I'll stop supporting them, whether or not they receive money from Google et al.
- yuliyp 4y ago
  What would you have them do? Not accept those donations, and be unable to work on as wide a range of issues that they do? EFF works on a wide range of issues, ranging from anti-censorship, software patent reform, online free speech, just to name a few. Many of those areas are where their values align with those of the Facebook/Google executives which donate to them. That they are able to receive those donations in spite of the areas where they disagree speaks more to EFF's track record of being an effective and powerful force for good in tech.
- Taywee 4y ago
  Would you turn down millions of dollars in no-strings-attached donations if you were running a charity? What was the negative result of those donations that you can point to? I'm not a fan of Google or Facebook, but I also don't outright boycott everything that they've ever touched. They donate money and developer time to tons of projects that I use regularly (including Linux), and it would be hypocritical of me to look down on the EFF for benefiting from the companies that I also benefit from. I don't like the bad behavior from Google or Facebook, but I don't think donating millions to the EFF is bad behavior, nor do I think getting tens of thousands of pull requests merged into public FOSS projects from Google and Facebook employees is bad behavior. Black and white guilt-by-association doesn't work when you have companies of this size, with hundreds of thousands of employees, and tons of varying internal cultures.
  - user3939382 4y ago
    It’s not bad from Google or Facebook’s perspective, it’s bad for the EFF. Accepting money from the organizations you’re supposed to be monitoring is a conflict of interest. You shouldn’t have to question whether that money affected their behavior towards those organizations and now you do. They should not have accepted it, arguably they didn’t need to.
leokennis 4y ago
Plus: * Long sunset period * Instructions to make sure you can enjoy the same security after they sunset
da_chicken 4y ago
Eh, kind of. It's successful as far as the Internet, which is great. But Internet web pages isn't everything. There's still a real issue with infrastructre that has web configuration. Everything from home routers to video cameras and so on. Not being able to ship with a certificate that passes browser security checks is a problem that essentially nobody has addressed. When people connect to an IOT device, they need to be able to connect with a web browser and not jump through hoops to say, "No, really I know that this is a secure connection." Because we can't keep teaching people to dodge secure connections when they should care about having secure connectinos. As much as I don't like IOT, but this is an issue that needs to be easier than "understand cyrptography configuration, generate your own keys, and install them wherever you need them". That's all besides the vendor "solution" of "install this phone app that will maybe barely work except for the parts that track your data forever LOL thx sucker".
- elldoubleyew 4y ago
  Couldn't browsers just designate the .local tld to not check for SSL certs and enforce that it resolves to an IP on the current network? Seems like a simple solution for this.
  - humanwhosits 4y ago
    How do we define 'current network'?
    - marcosdumay 4y ago
      That's a thing for local software to decide. It's also something that can be done with a level of reliability that will impress incredulous people. But that there will always be somebody to complain that is not following the standard recommendations.
      - 0xbadcafebee 4y ago
        In that case you don't need a certificate. Just check that the .local FQDN's IP is on a local network. 1. Look up all local interfaces' networks (IP & subnet mask) 2. Determine if .local IP is within subnet range of one of the interfaces 3. If .local IP is not on a subnet of a local interface, drop the connection This is still "host-based networking" and there's always the possibility a rogue network could be attached to your host, such as a spoofed open access point, or an ISP with lax network security and a customer on the same subnet being attacker-controlled. What certs prove is "this host currently has a private key and cert, and at one time this private key was used to generate a CSR for this cert, and at one time it was validated that an IP resolvable by the domain name in the CSR was also controlled by whoever issued the CSR". It's a very awkward thing that doesn't really match up to local consumer devices. We need a vendor key registry, the way MAC address prefixes are mapped to vendors, so at least we could say "the key on this host came from vendor XYZ". The browser would need to pop up a warning saying "WARNING: You are now connected to a local device from Vendor XYZ! If you did not intend to connect to a local device, close this window!" Updates to the vendor registry could also invalidate previous entries if old keys got compromised. But this would be in combination with the aforementioned "is the site on a local network?" logic. Anyone using a .local would have to both compromise a local network and steal a key from a vendor, or be registered as a vendor, and then the user would have to be dumb enough to click through a big warning about a local device.
justaj 4y ago
Not entirely. They don't provide an alternative to "HTTPS Everywhere User Rules" as well as adding exceptions to HTTPS only sites (under "HTTPS Everywhere Sites Disabled"), which can be found in HTTPS Everywhere options. In Chromium I can only turn HTTPS on all sites, without exception. It also doesn't allow me to have mixed content (on certain sites)
- spixy 4y ago
  Well Firefox has also exceptions.

by Taywee 4y ago

user3939382 4y ago

That’s how I used to feel until I found out they accepted millions in donations from companies like Google and Facebook/their executives/their executives’ charities. I’m just some guy on the Internet but IMHO their being OK with massive conflicts of interest means I no longer trust them.

metacritic12 4y ago
Serious question: is there a popular charity that by rule doesn't accept donations from really rich people?
cbozeman 4y ago
Then nut up and donate the millions yourself.
- yjftsjthsd-h 4y ago
  That doesn't follow. Do you really want to argue that the only way someone is allowed to disagree with millionaires is by being one themselves?
  - blowski 4y ago
    What's the EFF to do? 1. Achieve its mission with no money, or 2. Find money from sources deemed acceptable, or 3. Take money from sources deemed unacceptable I'm OK with option 3, so long as its transparent, because I agree with the agenda the EFF are pushing. If they start pushing an agenda I disagree with, I'll stop supporting them, whether or not they receive money from Google et al.
yuliyp 4y ago
What would you have them do? Not accept those donations, and be unable to work on as wide a range of issues that they do? EFF works on a wide range of issues, ranging from anti-censorship, software patent reform, online free speech, just to name a few. Many of those areas are where their values align with those of the Facebook/Google executives which donate to them. That they are able to receive those donations in spite of the areas where they disagree speaks more to EFF's track record of being an effective and powerful force for good in tech.
Taywee 4y ago
Would you turn down millions of dollars in no-strings-attached donations if you were running a charity? What was the negative result of those donations that you can point to? I'm not a fan of Google or Facebook, but I also don't outright boycott everything that they've ever touched. They donate money and developer time to tons of projects that I use regularly (including Linux), and it would be hypocritical of me to look down on the EFF for benefiting from the companies that I also benefit from. I don't like the bad behavior from Google or Facebook, but I don't think donating millions to the EFF is bad behavior, nor do I think getting tens of thousands of pull requests merged into public FOSS projects from Google and Facebook employees is bad behavior. Black and white guilt-by-association doesn't work when you have companies of this size, with hundreds of thousands of employees, and tons of varying internal cultures.
- user3939382 4y ago
  It’s not bad from Google or Facebook’s perspective, it’s bad for the EFF. Accepting money from the organizations you’re supposed to be monitoring is a conflict of interest. You shouldn’t have to question whether that money affected their behavior towards those organizations and now you do. They should not have accepted it, arguably they didn’t need to.

leokennis 4y ago

Plus: * Long sunset period * Instructions to make sure you can enjoy the same security after they sunset

da_chicken 4y ago

Eh, kind of. It's successful as far as the Internet, which is great. But Internet web pages isn't everything. There's still a real issue with infrastructre that has web configuration. Everything from home routers to video cameras and so on. Not being able to ship with a certificate that passes browser security checks is a problem that essentially nobody has addressed. When people connect to an IOT device, they need to be able to connect with a web browser and not jump through hoops to say, "No, really I know that this is a secure connection." Because we can't keep teaching people to dodge secure connections when they should care about having secure connectinos. As much as I don't like IOT, but this is an issue that needs to be easier than "understand cyrptography configuration, generate your own keys, and install them wherever you need them". That's all besides the vendor "solution" of "install this phone app that will maybe barely work except for the parts that track your data forever LOL thx sucker".

elldoubleyew 4y ago
Couldn't browsers just designate the .local tld to not check for SSL certs and enforce that it resolves to an IP on the current network? Seems like a simple solution for this.
- humanwhosits 4y ago
  How do we define 'current network'?
  - marcosdumay 4y ago
    That's a thing for local software to decide. It's also something that can be done with a level of reliability that will impress incredulous people. But that there will always be somebody to complain that is not following the standard recommendations.
    - 0xbadcafebee 4y ago
      In that case you don't need a certificate. Just check that the .local FQDN's IP is on a local network. 1. Look up all local interfaces' networks (IP & subnet mask) 2. Determine if .local IP is within subnet range of one of the interfaces 3. If .local IP is not on a subnet of a local interface, drop the connection This is still "host-based networking" and there's always the possibility a rogue network could be attached to your host, such as a spoofed open access point, or an ISP with lax network security and a customer on the same subnet being attacker-controlled. What certs prove is "this host currently has a private key and cert, and at one time this private key was used to generate a CSR for this cert, and at one time it was validated that an IP resolvable by the domain name in the CSR was also controlled by whoever issued the CSR". It's a very awkward thing that doesn't really match up to local consumer devices. We need a vendor key registry, the way MAC address prefixes are mapped to vendors, so at least we could say "the key on this host came from vendor XYZ". The browser would need to pop up a warning saying "WARNING: You are now connected to a local device from Vendor XYZ! If you did not intend to connect to a local device, close this window!" Updates to the vendor registry could also invalidate previous entries if old keys got compromised. But this would be in combination with the aforementioned "is the site on a local network?" logic. Anyone using a .local would have to both compromise a local network and steal a key from a vendor, or be registered as a vendor, and then the user would have to be dumb enough to click through a big warning about a local device.

justaj 4y ago

Not entirely. They don't provide an alternative to "HTTPS Everywhere User Rules" as well as adding exceptions to HTTPS only sites (under "HTTPS Everywhere Sites Disabled"), which can be found in HTTPS Everywhere options. In Chromium I can only turn HTTPS on all sites, without exception. It also doesn't allow me to have mixed content (on certain sites)

spixy 4y ago
Well Firefox has also exceptions.