dlmetcalf

11 ms·

31.
by dlmetcalf 10y ago
> What in the world do you think our motivation is, then? I didn't have much doubt before. But once you double-down on technical strategies that entrench concentrated power of Google, Apple, etc and leave users without open source o
32.
by dlmetcalf 10y ago
I wonder who voted this down. I didn't know Google tax lawyers hung out on Hacker News. PR bot? http://www.taxjustice.net/tag/google/
33.
by dlmetcalf 10y ago
I think this guy said it best: https://twitter.com/LauriLoveX/status/733137222539567106 i.e. Don't pretend to be "Open", altruistic, acting only in users security interests, selling benefits of open
34.
by dlmetcalf 10y ago
It's ironic that WhatsApp runs fine on open source Android, but Signal won't. Are you _sure_ that wasn't part of the deal @moxie? ;)
35.
by dlmetcalf 10y ago
Thanks @Arathorn. That's great to hear an FDroid candidate's available. Great turn around! The only device I'd have to test it on right at the moment, unfortunately doesn't take 3rd party APKs (FDroid's been signed,
36.
by dlmetcalf 10y ago
Regarding entitlement, it's not just an advertising company the 'product' is tied to. Google is of course one of the most aggressive global profit-shifters for tax 'minimisation'. I would prefer to call it avoidanc
37.
by dlmetcalf 10y ago
Come on @moxie, you didn't just say you'd prefer them not to, you expressly forbid it: "I'm not OK with LibreSignal using our servers, and I'm not OK with LibreSignal using the name \"Signal.\" You're
38.
by dlmetcalf 10y ago
Yep, the rest of the world has moved on. Olm already provides what Signal protocol did and the app itself is now useless to many. Signal app itself still can't run on Android Open Source, because it forces centralised metadata collecti
39.
by dlmetcalf 10y ago
It's not just Intel you're trusting, it's the OEMs, who also have an EXTREMELY poor record. Just take a look at the ENORMOUS number up BMC and auto-update vulnerabilities. They really just either couldn't care less, or a
40.
by dlmetcalf 10y ago
I followed what you meant and understand baseband management controllers are more similar to IME in terms of risk profile. They're not (generally?) on-chip though, so it's at least up to individual OEMs, and purchasers have slight
41.
by dlmetcalf 10y ago
IME is horrible and we should be railing against all horrible implementations. I can assure you I let my OEM know full well how I felt about insecure automatic update software (even though I wipe the system as soon as I get it, something I
42.
by dlmetcalf 10y ago
Vocally support Power8 and RISC-V projects and ensure Intel knows you're angry.
43.
by dlmetcalf 10y ago
No doubt some of the bigger ones probably will. When it's BSD (not bound by restrictive commercial licensing agreements) though, it massively lowers the barriers to entry for manufacturers who will offer security. Anyway, here's a
44.
by dlmetcalf 10y ago
Totally agree. She's brilliant. Deepest respect to her. One of the extremely few people with genuine understanding of hardware security, who's working on the side of users & humanity. The first time I read her work, I was floo
45.
by dlmetcalf 10y ago
Yeah, right. I suppose we're just supposed to take their word for that. There's an enormous difference between the concepts of trusted and trustworthy. You're extremely naive or clearly never read anything Snowden released if
46.
by dlmetcalf 10y ago
Let me make this totally clear. The top OEM hardware manufacturers couldn't give a CRAP about your security. https://duo.com/blog/out-of-box-exploitation-a-security-anal... e.g. http://teletext.zaibatsu
47.
by dlmetcalf 10y ago
RISC-V architectures hold the most promise there AFAIAA. BSD-licensed, cutting-edge architecture and it's got the right backers. FreeBSD is already ported to it. There'll be a range silicon implementations. Cambridge's lowRIS
48.
by dlmetcalf 10y ago
I hope these guys get lots of orders and prices fall (Raptor's Talos Secure Workstation): https://www.raptorengineering.com/TALOS/prerelease.php With Google having ported all their software to Power8, I'm loo
49.
by dlmetcalf 10y ago
Seriously, watch this ^. It's pretty much the canonical coverage of the topic.
50.
by dlmetcalf 10y ago
Wow, no one here has mentioned Johanna Rutkovska's (Invisible Things Lab & QubesOS), "Intel x86 Considered Harmful"? http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf http:/&#x2F
51.
by dlmetcalf 10y ago
Thanks Arathorn. Matthew's confirmed that to me also. I expected that'd be the case.
52.
by dlmetcalf 10y ago
Yes, see https://matrix.org/docs/spec/olm.html . An implementation of that spec is in final testing and expected to land into master within a couple of weeks. It's a double-ratchet, very similar to Signal prot
53.
by dlmetcalf 10y ago
I know Olm is open: "The Olm specification (this document) is hereby placed in the public domain.", https://matrix.org/docs/spec/olm.html ). Is the Matrix Spec public domain too?
54.
by dlmetcalf 10y ago
Am I missing something here? What license is the Matrix Specification itself under? (I know most of the implementations themselves are ASLv2). It seems really unclear from the site & repo: https://github.com/matrix-org&
55.
by dlmetcalf 10y ago
I should add, that the ability to bridge networks, means that XMPP, IRC and others won't/don't need to be cut off from Matrix either. That's kind of the point and interop is one of the big features it will have going.
56.
by dlmetcalf 10y ago
I actually think it's very good thing that people are asking that question (why not fix XMPP)!! We know from Bob Metcalfe's Law, that starting new networks has a very high cost, either in adoption/migration, lost investments
57.
by dlmetcalf 10y ago
Nice! I really am excited for you (and us)! Re OWS; yes, I still keep some small hope that they've just been too preoccupied and not completely thought/worked things through. People are human and they've clearly had a lot goi
58.
by dlmetcalf 10y ago
It's great to see how open you are to community feedback. Hats off for your responsiveness!
59.
by dlmetcalf 10y ago
I hadn't tried it, no. Was just going on what others had said here. That's great to hear it has at least some sort of fallback! Polling however is typically too battery draining to be practical. Battery drain was one of the bi
60.
by dlmetcalf 10y ago
Leaving people no option but to use Google's infrastructure (if they want to participate with anything better than a browser) seems an ENORMOUS gap, given the rest of the project's goals. If you want to use it on mobile, it IS s

More ›