[0] https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng

  - software that are not monetised by their manufacturers should not be considered to be a commercial activity. 
  - supply of products with digital elements qualifying as free and open-source software components intended for integration by other manufacturers into their own products with digital elements should be considered to be making available on the market only if the component is monetised by its original manufacturer. 
  - development of products with digital elements qualifying as free and open-source software by not-for-profit organisations should not be considered to be a commercial activity provided that the organisation is set up in such a way that ensures that all earnings after costs are used to achieve not-for-profit objectives. 
  - does not apply to natural or legal persons who contribute with source code to products with digital elements qualifying as free and open-source software that are not under their responsibility.

I would say "I'm sure the mean well", but given that parties like Yubico benefit from getting more competitors, the cynic in me is a bit worried.

Yeah, I wouldn't say that. It's clear from their public comments[1,2,3] that the spec authors don't believe the private key actually belongs to the user to do what they want with. They see services restricting what users may do with their own logins as a feature of Passkeys. It's really a shame it went in this direction. Replacing passwords with an easy-to-use keypair auth system would be a massive security improvement. But the Passkey ecosystem is poisoned at this point. Unless they remove the client ID & attestation features, it should be considered a proprietary protocol.

[1] Threatening an open-source passkey client with server-side bans because they don't implement passkey storage on the client device in the way the spec authors prefer. https://github.com/keepassxreboot/keepassxc/issues/10406

[2] Maintaining a list of "non-compliant" clients, including the above open-source one, presumably for use in server-side bans. https://passkeys.dev/docs/reference/known-issues/

[3] I actually emailed the two involved spec authors on the above issue, politely asking how their interpretation of the Passkey spec could possibly be compatible with open source software. Neither replied.

> Since then Passkeys are now seen as a way to capture users and audiences into a platform. What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials that can't be extracted or exported in any capacity.

https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...

Fingers crossed the Passkey user experience remains so bad no one accepts them & they just die on the vine.

Better to store passkeys in password manager. Then they become more secure passwords. The big advantage is that they can't be phished, and sites don't use 2FA with them. It also means you can choose password manager that you trust and work better than Apple and Google.

It’ll be incredibly easy to lock dissenters out of modern society. It’s too bad the vast majority of users will happily concede autonomy for a tiny bit of short term convenience.

And web attestation, which almost became a thing about a year ago. It is gone for now, but it will only be a matter of time before it decides to rear its ugly head again.

Speech: https://www.youtube.com/watch?v=HUEvRyemKSg

Transcript: https://en.wikisource.org/wiki/The_Coming_War_on_General_Com...

(Of course, Stallman warned of this type of thing much earlier as well.)

He said a bunch of things. They've all been collected here: https://stallman-report.org/

What I love about that report is that the author created it with the intention of making Stallman look bad. And if you look at the author's summaries, he looks bad. However, the author also made us the favour of collecting all the statements in one single place. And if you look at the things that Stallman actually said (as opposed to the author's summaries) he doesn't look bad, he looks strictly correct.

Like, someone says "C assaulted B". And Stallman says "If A forces B to offer herself to C, C didn't assault B". Which is obivously correct. It could only be incorrect if you were redefining words to serve your purposes.

I had a look at what Stallman said and what Minsky allegedly did.

Apparently, Minsky had sex with one of Epstein's girls, who later said she was forced into it. Now, his wife denies the allegation, as she was apparently with him at all times on Epstein's island.

Now, I can believe that he went once, and maybe had sex with someone he didn't know was not doing so willingly. But, what about his wife? Was he cheating on her? Was she a part of it?

And why did he return a second time? And after Epstein's conviction in 2011???

And here comes Stallman, and he's not even denying that he's slept with someone, potentially cheating on his wife? His issue is with the wording?

Nobody in this situation looks good.

Any sane person hears "assault" and thinks that means "assault" instead it means something else.

What is happening is that the meaning of words are being changed for the purpose of using pre-existing laws. Example, you think that Bla is very bad and isn't punished enough by the law. There's law that severaly punishes Fleem. So, whenever you see Bla you call it Fleem and argue that the anti-Fleem law applies. That way you can effectively re-purpose a law. Specific example: "catcalling" is now "sexual assault" in the UK. It's easier to do it this way, than to argue that people should be punished for catcalling.

It feels like Stallman wants to defend his friend, but doesn't really have any way to do that. So, instead, he pivots to pedantry.

Like ok, assuming that Marvin really did not know, it's wrong to label him as a sexual assaulter(?). Though legally a sexual assault still occured.

But, it still doesn't explain, justify or deny that he allegedly slept with someone , possibly behind his wife's back. And it also doesn't explain that they went *BACK* to Epstein's island after knowing he was a sex trafficker. And that presumably the girl he slept with might have also been trafficked.

Correct, it's the abuse of the legal system.

> Though legally a sexual assault still occured.

Just because something is true legally doesn't mean it's ok, good, correct, moral or ethical.

We're talking about sex trafficking, which we know did occur and Epstein was convicted of. Twice.

And possibly rape/sexual assault, even though the "perpetrator" did not know about it.

You're getting awfully close to defending Epstein there.

I also can't help but notice that you ignored everything else in my comment?

Coerced/forced by whom? Are you actually stupid or just pretending?

Anyway, I get that you're confused. However, I've lost interest in talking to you.

Pretty obviously.

He is a weird, socially awkward, maybe autistic guy. And such people tend to be quite pedantic and focused on strange details that "normal" people just jump over.

https://news.ycombinator.com/item?id=45722901

I disagree it's "pedantic". I think it's taking advantage of the system.

Many big institutions lean heavily on mobile apps and other gated computing.

I live in BC Canada and by far the easiest way to authenticate a login to provincial sources involves using the BC ID App as a second factor, even when logging in via desktop. Many banks now also use their app as a second factor, rather than a generic OTP option that can run on any hardware.

There were also issues like running Netflix DRM in browser on Linux for a while.

General purpose computers won’t go away, but they will continue to be gated from more and more services until you are more or less required to have a phone or locked down ecosystem device.

This is one I’m willing to tolerate, as long as it’s optional. Something I don’t understand though is banking app setup. When I got a new phone this year, the RBC app made me submit some kind of live selfie.

The thing is, I know they can scan your debit card with NFC and authenticate the PIN. I’ve used it for a password reset in the past. Why is a selfie better than that when they presumably have nothing to compare it to?

It would be quite a scandal, legally and socially, if it was discovered that a bank was creating a database of images of their customers without consent.

According to ChatGPT: Only Illinois, Texas, and Washington really constrain that, and Illinois is the only one with real teeth.

A financial institution I have an account with requires MFA to log in, and the only options they support are SMS MFA and their proprietary smartphone app. This is acutely annoying to me, because it means I have to get up and get my phone if I want to log into this site from my PC (or rig up a complicated Android emulator setup).

* Auth app deploys to one or two app stores. No financial incentive to do otherwise.

* App stores remain within walled gardens. Tracking, DRM, proprietary drivers come with.

I think it's pretty uncontroversial that there is a global trend towards authoritarianism, but I'm happy to hear other opinions.

> At the moment, anyone can use Linux; it's better and easier than ever.

Maybe Linux will save us.

This was a fascinating thing to watch for me (pewdiepie telling people to install Linux): https://www.youtube.com/watch?v=pVI_smLgTY0

My bet is that the momentum is strong enough that:

- A critical mass of PC makers will continue to offer a Linux preinstalled option, or at least some path to installing Linux.

- If Windows and macOS take more rights away, it'll just help Linux's market share.

So Linux's share will probably grow not only because Linux is getting better but because the corpo OSes trying to take away general purpose computing

I am happy to use a browser on my computer to log into my bank's website.

Piracy https://en.wikipedia.org/wiki/Widevine

They can't stop it, likely never will but they do keep fighting it.

Hum... It was foolish, but it was decades after the trend started.

Looks to me that the real trend was started mostly by the wide distribution of TV and the subsequent media consolidation (that happened everywhere).

Also, who is "we" here? Because it was exactly the authoritarian-wannabes that created most of it.

All I really want is a computer that allows me to fully control the permissions and filesystem access of all the programs that I manually install on my system. Almost every program (in my case) needs 0 filesystem access outside of what it installed itself and shouldn't be looking or snooping at anything that isn't in its own process space.

I want a clear and simple way to limit the blast radius of how badly a program could actually screw up my system or have access to my files.

I recently experienced the opposite of this on Android, where I tried to install a very well reviewed ebook reader called MoonReader. But MoonReader seems to require complete access to every file on my Android device to work correctly. That is insane. I looked it up a bit more and it seems that Google has simplified (or something) permissions, but now there isn't much choice other than asking for full file access (I just want to give it access to one directory).

Anywho, just a minor vent, that we are insisting that the only way to make things secure is this sort of attestation path, but we don't spend any energy just making it possible to limit the blast radius of software on most OS'.

But try looking into QubesOS. You create domains where applications can do whatever in the domain (a contained VM). So your personal domain is separate from your bank domain, which is separate from your media domain.

Of course, domains themselves can do naughty things. But they cant cross over to others.

And system resources are a separate domain, as is networking.

Some downsides - gaming is a no go mostly. And if you do SDR stuff, the USB domain is a heavy hit on performance. You really need dedicated machines for those things.

In which folders it can hide, which data to access, and which hardware resources to use.

So hopefully in 8 years or so when I need a new machine, there's some decent options available to me.

But nice aint worth the cost when it comes at the expense of supporting something which is undermining everything else you believe in.

Somewhat related, but if x86 loses dominance it will be even more difficult if not impossible to install Linux or other alternate OS's on ARM devices. The majority of consumer ARM electronics make it hard enough, and normally requires you to run a specific patched (and most likely outdated) Linux kernel in order to boot.

There are ARM devices which meet the ARM System Ready standard which allows you to boot whatever OS you want, but they are mostly enterprise devices such as servers. Cheapest one I've seen which your average consumer might buy was an ARM workstation with a starting price of about $1500

Broadcom SOCs preferred by Raspberry Pi require proprietary blobs to function, and much of their functionality is buried under a mountain of NDAs.

I hope more people come around and recognize that Richard Stallman deserves a big, resounding "you were right, we're sorry" after being attacked for his dislike of "trusted computing" and TPMs [0].

[0]: https://www.gnu.org/philosophy/can-you-trust.en.html