4 ms·

My guess is the more bravado a company shows, the more they are in bed with the security apparatus and have back doors. No CEO wants jail or crippling fines. Th

My guess is the more bravado a company shows, the more they are in bed with the security apparatus and have back doors. No CEO wants jail or crippling fines. The honest ones will leave. The dishonest ones will talk a big game and try to attract more users while secretly backdooring. The security services will complain for effect but actually won’t really punish the company since the more people they can drive to the company, the better for them.

867-5309 4y ago
not possible with open source
- patates 4y ago
  How do you make sure that the source you see is the one that's deployed?
  - 867-5309 4y ago
    depends on the party deploying it
  - cesarb 4y ago
    > How do you make sure that the source you see is the one that's deployed? With reproducible builds. Signal has done reproducible builds since 2016 (https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/), all you need to do is to get the APK from your device and compare it (see https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod... for a detailed step-by-step).
    - patates 4y ago
      The problem is, I have to trust my capability (and the others who actually read the source) to understand that the client doesn't trust the server, as long as I don't deploy the server too myself. Not to mention having to do the same for each update. In a nutshell, at some point, you practically have to trust someone.
bee_rider 4y ago
I’m sure companies will play up the bravado in the interest of getting more users. But there are non-malicious reasons to want more users, for example some companies provide services in exchange for money. More users, more money.
- RcouF1uZ4gsC 4y ago
  Thing is bravado is dangerous unless you are in bed with the security apparatus. A nation state has millions of ways of making your life miserable. Are you 100% GDPR compliant for all pedantic interpretations? Even if you are, how much would an extensive audit and investigation cost you. Unless you are a 100 billion dollar multinational, you don’t really have the means to survive if they decide to target you, even if you are completely innocent.
  - denton-scratch 4y ago
    GDPR is enforced in the UK exclusively by the Office of the Information Commisioner, which is hopelessly underfunded. There are no "expensive audits and invedtigations". Instead, the ICO sends you several letters containing friendly advice on how to come into compliance, before even thinking about actual enforcement.
throwawayffffas 4y ago
They are incorporated in a different jurisdiction, they are probably very certain that they will face no consequences for that bravado.
5350-uiop-1130 4y ago
if the company hasn't been raided by govt agencies they're probably not as legit as they say xkeyscore, prism so on shows that all these companies has to comply with patriot laws and they are legally not allow to talk about it
eternalban 4y ago
No PII to register, no bravado, rarely mentioned, and they don't look too cool (/g tip: hackers turned government employees always act and look too cool and out there - easy giveaway): https://posteo.de/en/site/about_posteo https://posteo.de/en/site/about_posteo https://posteo.de/en/site/transparency_report https://posteo.de/en/site/transparency_report "Posteo is an email service provider based in Berlin, Germany, offering paid email accounts for individuals and businesses. The service gained prominence during the aftermath of the post-2013 global surveillance disclosures,[2][3] especially for its high standard security features and relative anonymity as it does not require any private information in the registration process.[2] Posteo offers support for DNSSEC/DANE and PGP (through Mailvelope in the web interface, which is running Roundcube). Additionally they offer two-factor-authentication via TOTP and use Extended Validation certificates and HPKP for the HTTPS connection. In 2020, Posteo had approximately 425,000 active mail accounts."

867-5309 4y ago

not possible with open source

patates 4y ago
How do you make sure that the source you see is the one that's deployed?
- 867-5309 4y ago
  depends on the party deploying it
- cesarb 4y ago
  > How do you make sure that the source you see is the one that's deployed? With reproducible builds. Signal has done reproducible builds since 2016 (https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/), all you need to do is to get the APK from your device and compare it (see https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod... for a detailed step-by-step).
  - patates 4y ago
    The problem is, I have to trust my capability (and the others who actually read the source) to understand that the client doesn't trust the server, as long as I don't deploy the server too myself. Not to mention having to do the same for each update. In a nutshell, at some point, you practically have to trust someone.

bee_rider 4y ago

I’m sure companies will play up the bravado in the interest of getting more users. But there are non-malicious reasons to want more users, for example some companies provide services in exchange for money. More users, more money.

RcouF1uZ4gsC 4y ago
Thing is bravado is dangerous unless you are in bed with the security apparatus. A nation state has millions of ways of making your life miserable. Are you 100% GDPR compliant for all pedantic interpretations? Even if you are, how much would an extensive audit and investigation cost you. Unless you are a 100 billion dollar multinational, you don’t really have the means to survive if they decide to target you, even if you are completely innocent.
- denton-scratch 4y ago
  GDPR is enforced in the UK exclusively by the Office of the Information Commisioner, which is hopelessly underfunded. There are no "expensive audits and invedtigations". Instead, the ICO sends you several letters containing friendly advice on how to come into compliance, before even thinking about actual enforcement.

throwawayffffas 4y ago

They are incorporated in a different jurisdiction, they are probably very certain that they will face no consequences for that bravado.

5350-uiop-1130 4y ago

if the company hasn't been raided by govt agencies they're probably not as legit as they say xkeyscore, prism so on shows that all these companies has to comply with patriot laws and they are legally not allow to talk about it

eternalban 4y ago

No PII to register, no bravado, rarely mentioned, and they don't look too cool (/g tip: hackers turned government employees always act and look too cool and out there - easy giveaway): https://posteo.de/en/site/about_posteo https://posteo.de/en/site/about_posteo https://posteo.de/en/site/transparency_report https://posteo.de/en/site/transparency_report "Posteo is an email service provider based in Berlin, Germany, offering paid email accounts for individuals and businesses. The service gained prominence during the aftermath of the post-2013 global surveillance disclosures,[2][3] especially for its high standard security features and relative anonymity as it does not require any private information in the registration process.[2] Posteo offers support for DNSSEC/DANE and PGP (through Mailvelope in the web interface, which is running Roundcube). Additionally they offer two-factor-authentication via TOTP and use Extended Validation certificates and HPKP for the HTTPS connection. In 2020, Posteo had approximately 425,000 active mail accounts."