• 0 Posts
  • 87 Comments
Joined 6 months ago
cake
Cake day: September 7th, 2024

help-circle

  • and its usage will result in your immediate death

    This all-or-nothing approach, where compromises are never allowed, is my biggest annoyance with some privacy/security advocates, and also it unfortunately influences many software design choices. Since this is a nice thread for ranting, here’s a few examples:

    • LibreWolf enables by default “resist fingerprinting”. That’s nice. However, that setting also hard-enables “smooth scrolling”, because apparently having non-smooth scrolling can be fingerprinted (that being possible is IMO reason alone to burn down the modern web altogether). Too bad that smooth scrolling sometimes makes me feel dizzy, and then I have to disable it. So I don’t get to have “resist fingerprinting”. Cool.
    • Some of the modern Linux software distribution formats like Snap or Flatpak, which are so super secure that some things just don’t work. After all, the safest software is the one you can’t even run.
    • Locking down permissions on desktop operating systems, because I, the sole user and owner of the machine, should not simply be allowed to do things. Things like using a scanner or a serial port. Which is of course only for my own protection. Also, I should constantly have to prove my identity to the machine by entering credentials, because what if someone broke into my home and was able to type “dmesg” without sudo to view my machine’s kernel log without proving that they are me, that would be horrible. Every desktop machine must be locked down to the highest extent as if it was a high security server.
    • Enforcement of strong password complexity rules in local only devices or services which will never be exposed to potential attackers unless they gain physical access to my home
    • Possibly controversial, but I’ll say it: web browsers being so annoying about self-signed certificates. Please at least give me a checkbox to allow it for hosts with rfc1918 addresses. Doesn’t have to be on by default, but why can’t that be a setting.
    • The entire reality of secure boot on most platforms. The idea is of course great, I want it. But implementations are typically very user-hostile. If you want to have some fun, figure out how to set up a PC with a Linux where you use your own certificate for signing. (I haven’t done it yet, I looked at the documentation and decided there are nicer things in this world.)

    This has gotten pretty long already, I will stop now. To be clear, this is not a rant against security… I treat security of my devices seriously. But I’m annoyed that I am forced to have protections in place against threat models that are irrelevant, or at least sufficiently negligible, for my personal use cases. (IMO one root cause is that too much software these days is written for the needs of enterprise IT environments, because that’s where the real money is, but that’s a different rant altogether.)









  • Yep, the clarification doesn’t really clarify anything. If they’re unable to write their terms of service in a way that a layperson in legal matters can understand the intended meaning, that’s a problem. And it’s impossible for me to know whether their “clarification” is true or not. Sorry, Mozilla, you’ve made too many bad decisions already in the recent years, I don’t simply trust your word anymore. And, why didn’t they clarify it in the terms of service text itself?

    That they published the ToS like that and nobody vetoed it internally, that’s a big problem too. I mean, did they expect people to not be shocked by what it says? Or did they expect nobody would read it?

    Anyway, switching to LibreWolf on all machines now.


  • Sigh. Not long ago I switched from Vivaldi back to Firefox because it has better privacy-related add-ons. Since a while ago, on one machine as a test, I’ve been using LibreWolf, after I went down the rabbit hole of “how do I configure Firefox for privacy, including that it doesn’t send stuff to Mozilla” and was appalled how difficult that is. Now with this latest bullshit from Mozilla… guess I’ll switch everything over to LibreWolf now, or go back to Vivaldi…

    Really hope they’ll leave Thunderbird alone with such crap…

    I often wish I could just give up on web browsers entirely, but unfortunately that’s not practical.










  • Thanks for adding the extra context! As I said, I don’t have the necessary level of knowledge in physics (and also in cryptography) to have an informed opinion on these matters, so this is helpful. (I’ve wanted to get deeper in both topics for a long time, but life and everything has so far not allowed for it.)

    About your last paragraph, do you by chance have any interesting links on “criticism of the criticism of string theory”? I wonder, because I have heard the argument “string theory is non-falsifiable and weird, but it’s pushed over competing theories by entrenched people” several times already over the years. Now I wonder, is that actually a serious position or just conspiracy/crank stuff?