3 ms·

A couple of problems as noted already that will make this a show stopper: > Port 25 is blocked inbound on most residential accounts - preventing you from recei

by nadams 11y ago

A couple of problems as noted already that will make this a show stopper: > Port 25 is blocked inbound on most residential accounts - preventing you from receiving email > Many SMTP servers are configured to automatically bounce email from residential IPs - so sending would be a problem The point of GPG is to make sure that the only person that can read the message is the one you sent it to. Having a HTTPS site doesn't prevent the random person from viewing the link and doesn't verify the user. Now - this might be interesting if the web app that shows the email has as GPG library in Javascript requiring the user to have GPG keys. I think a better scenario is if keys haven't been exchanged - to send an email with "Alice would like to communicate over secure email - please download and generate a set of keys" with instructions on what to do. But I have no idea how not to make it look spammy. This is just hilarious: > Why shouldn't I trust and use any cloud email service with JavaScript client-side encryption? > Encryption is done in JavaScript, and therefore relies on browser's JavaScript engines, which 80% of the time [1] are proprietary software coming from Google, Microsoft, and Apple, most eminent NSA collaborators. The author does know that Chrome is open source right (well I guess technically Chromium but I hope it's based on the same code)? > Why not use a raspberry Pi? > Mainly because it cannot be trusted enough for this kind of application. [...] The Raspberry pi is provided with non-free software and the hardware needs non-free driver to work. I've used Debian Linux on it before and didn't need to install third party drivers?

swinglock 11y ago
If I remember correctly the GPU is heavily involved in booting and running code on the Raspberry Pi while the ARM CPU is more of a coprocessor, or something like that. The GPU require a proprietary binary blobs to be present on the SD card to boot. It's a pretty odd computer and not open at all.
- nadams 11y ago
  > The GPU require a proprietary binary blobs to be present on the SD card to boot. Apparently that's not true anymore - http://liliputing.com/2014/02/raspberry-pi-gets-true-open-source-graphics-drivers.html http://liliputing.com/2014/02/raspberry-pi-gets-true-open-so...
  - explorigin 11y ago
    This article makes no promises. It merely states the possibility of having some functionality. Can you find somewhere that provides a fully OSS build for Raspberry Pi?
  - makomk 11y ago
    As far as I know it's still true. Even if you're using those open source graphics drivers you still need the binary GPU blob in order to actually boot the Pi. The Pi's initial bootloader has to run on the VPU and those open source drivers don't - indeed, they're from a related chip that doesn't even have a VPU. Last time I looked there was no documentation for the VPU, no open-source version of the bootloader code, no compiler that targets the VPU, and the only assembler was based on unofficial reverse engineering.
mbrock 11y ago
"Will make this a showstopper" for whom? You can't imagine anyone having any use for this device? You're wrong about how the device uses HTTPS links, as other people have already pointed out elsewhere. What's hilarious about the inherent impossibility of secure closed source software? You "hope" Chrome is "based on" Chromium---what relevance does this hope have for a factual discussion? And what about Microsoft and Apple? And the many well-reasoned criticisms of browser-based encryption? Debian's wiki page about the Raspberry Pi explains about the non-free software required to even boot the device. You were probably using Raspbian, which is a Debian derivative that includes the necessary binary blobs.
- nadams 11y ago
  > You can't imagine anyone having any use for this device? No home users would be able to use this - and that is who they seem to be targeting their marketing towards. > What's hilarious about the inherent impossibility of secure closed source software? That you can't get around using closed source software/hardware. You have to put trust into closed source software at some point - do you drive a car? > You "hope" Chrome is "based on" Chromium---what relevance does this hope have for a factual discussion? Like I said before - relating to security I hope certain systems like OpenSSL and CAs are not compromised. I'm a realistic person and I assume they aren't. Do you check and pin every SSL certificate you come across? How do you know that you don't have a bad CA certificate in your store right now? I'm not saying I have irrevocable proof that Chrome's code is a fork of Chromium - but there are enough indications that suggest this[1]. I'm not saying you should or shouldn't use Chrome - go use lynx if that makes you feel better. > And what about Microsoft and Apple? What about them? I'm not saying they are perfect - but I'm also not totally paranoid that I'm going to refuse them on the basis that I can't see their code. > And the many well-reasoned criticisms of browser-based encryption? That's a loaded question if I ever saw one. Web applications like cryptocat are bad because they send the keys with Javascript. I'm no security expert - but something like this seems reasonable to me in the context of the use case of this box [2]. [1] - https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo... [2] - https://encrypt.to/ https://encrypt.to/
jack9 11y ago
> The author does know that Chrome is open source right (well I guess technically Chromium but I hope it's based on the same code)? What's hilarious is that you're relying on hope for security. That's not how security works. > Mainly because it cannot be trusted enough for this kind of application. [...] The Raspberry pi is provided with non-free software and the hardware needs non-free driver to work. The Raspberry Pi boots from its GPU and only non-free software is currently available for the GPU, even starting the machine requires a large (2MB) blob of non-free, unsupportable software
- nadams 11y ago
  > What's hilarious is that you're relying on hope for security. I hope that CAs don't get compromised and sign SSL certificates they aren't supposed to. Oh wait... I hope Debian doesn't release a version of software with a security hole in it. Oh wait... I hope OpenSSL doesn't have any bugs in it. Oh wait... Does this mean I completely disconnect sit in a corner and hope for the best? No - I'm realistic. Software like OpenSSL, Debian, and people who run CAs are made by humans and will make mistakes. They will fix their issues and life will go on. > The Raspberry Pi boots from its GPU and only non-free software is currently available for the GPU, even starting the machine requires a large (2MB) blob of non-free, unsupportable software And? Systems you use everyday use closed source non-free software. Do you use Android or iOS? As far as encryption goes in the Linux kernel - even Linus himself said it doesn't matter if the NSA has a backdoor to the random number generator [1]. If you feel that he is wrong please contact him and post his reply. [1] - https://www.change.org/p/linus-torvalds-remove-rdrand-from-dev-random-4/responses/9066 https://www.change.org/p/linus-torvalds-remove-rdrand-from-d... edit: forgot a word
JupiterMoon 11y ago
> Chrome is open source Chrome is in not open source by any common definition. Google claim that Chrome is Chromium with some extras. But how can you or I ever know (unless we get a job at Google...)? Open source with binary extras all compiled together != open source.

by nadams 11y ago

swinglock 11y ago

If I remember correctly the GPU is heavily involved in booting and running code on the Raspberry Pi while the ARM CPU is more of a coprocessor, or something like that. The GPU require a proprietary binary blobs to be present on the SD card to boot. It's a pretty odd computer and not open at all.

nadams 11y ago
> The GPU require a proprietary binary blobs to be present on the SD card to boot. Apparently that's not true anymore - http://liliputing.com/2014/02/raspberry-pi-gets-true-open-source-graphics-drivers.html http://liliputing.com/2014/02/raspberry-pi-gets-true-open-so...
- explorigin 11y ago
  This article makes no promises. It merely states the possibility of having some functionality. Can you find somewhere that provides a fully OSS build for Raspberry Pi?
- makomk 11y ago
  As far as I know it's still true. Even if you're using those open source graphics drivers you still need the binary GPU blob in order to actually boot the Pi. The Pi's initial bootloader has to run on the VPU and those open source drivers don't - indeed, they're from a related chip that doesn't even have a VPU. Last time I looked there was no documentation for the VPU, no open-source version of the bootloader code, no compiler that targets the VPU, and the only assembler was based on unofficial reverse engineering.

mbrock 11y ago

"Will make this a showstopper" for whom? You can't imagine anyone having any use for this device? You're wrong about how the device uses HTTPS links, as other people have already pointed out elsewhere. What's hilarious about the inherent impossibility of secure closed source software? You "hope" Chrome is "based on" Chromium---what relevance does this hope have for a factual discussion? And what about Microsoft and Apple? And the many well-reasoned criticisms of browser-based encryption? Debian's wiki page about the Raspberry Pi explains about the non-free software required to even boot the device. You were probably using Raspbian, which is a Debian derivative that includes the necessary binary blobs.

nadams 11y ago
> You can't imagine anyone having any use for this device? No home users would be able to use this - and that is who they seem to be targeting their marketing towards. > What's hilarious about the inherent impossibility of secure closed source software? That you can't get around using closed source software/hardware. You have to put trust into closed source software at some point - do you drive a car? > You "hope" Chrome is "based on" Chromium---what relevance does this hope have for a factual discussion? Like I said before - relating to security I hope certain systems like OpenSSL and CAs are not compromised. I'm a realistic person and I assume they aren't. Do you check and pin every SSL certificate you come across? How do you know that you don't have a bad CA certificate in your store right now? I'm not saying I have irrevocable proof that Chrome's code is a fork of Chromium - but there are enough indications that suggest this[1]. I'm not saying you should or shouldn't use Chrome - go use lynx if that makes you feel better. > And what about Microsoft and Apple? What about them? I'm not saying they are perfect - but I'm also not totally paranoid that I'm going to refuse them on the basis that I can't see their code. > And the many well-reasoned criticisms of browser-based encryption? That's a loaded question if I ever saw one. Web applications like cryptocat are bad because they send the keys with Javascript. I'm no security expert - but something like this seems reasonable to me in the context of the use case of this box [2]. [1] - https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoogleChrome https://code.google.com/p/chromium/wiki/ChromiumBrowserVsGoo... [2] - https://encrypt.to/ https://encrypt.to/

jack9 11y ago

> The author does know that Chrome is open source right (well I guess technically Chromium but I hope it's based on the same code)? What's hilarious is that you're relying on hope for security. That's not how security works. > Mainly because it cannot be trusted enough for this kind of application. [...] The Raspberry pi is provided with non-free software and the hardware needs non-free driver to work. The Raspberry Pi boots from its GPU and only non-free software is currently available for the GPU, even starting the machine requires a large (2MB) blob of non-free, unsupportable software

nadams 11y ago
> What's hilarious is that you're relying on hope for security. I hope that CAs don't get compromised and sign SSL certificates they aren't supposed to. Oh wait... I hope Debian doesn't release a version of software with a security hole in it. Oh wait... I hope OpenSSL doesn't have any bugs in it. Oh wait... Does this mean I completely disconnect sit in a corner and hope for the best? No - I'm realistic. Software like OpenSSL, Debian, and people who run CAs are made by humans and will make mistakes. They will fix their issues and life will go on. > The Raspberry Pi boots from its GPU and only non-free software is currently available for the GPU, even starting the machine requires a large (2MB) blob of non-free, unsupportable software And? Systems you use everyday use closed source non-free software. Do you use Android or iOS? As far as encryption goes in the Linux kernel - even Linus himself said it doesn't matter if the NSA has a backdoor to the random number generator [1]. If you feel that he is wrong please contact him and post his reply. [1] - https://www.change.org/p/linus-torvalds-remove-rdrand-from-dev-random-4/responses/9066 https://www.change.org/p/linus-torvalds-remove-rdrand-from-d... edit: forgot a word

JupiterMoon 11y ago

> Chrome is open source Chrome is in not open source by any common definition. Google claim that Chrome is Chromium with some extras. But how can you or I ever know (unless we get a job at Google...)? Open source with binary extras all compiled together != open source.