jalami

I think people trust too much generally. That's not going to change with any paradigm put forth. However if you're running binaries from vendors you don't trust, you're playing with fire even in a regulated app store.

Most people don't change their default browser, adding third party repos would be similar. Removing the ability for the owner of a device to install software they want fixes one symptom, not the main issue of trust. Also it makes your device into a glorified feature phone. No thanks.

Oops, was writing on my mobile. Can't edit it now, thanks though.

You trust Facebook when you log into Facebook.com. Facebook.com/fdroid would be the hypothetical trusted endpoint for Facebook apps. You should not have one gatekeeper that ensures everything is safe. They can sensor content, fail to catch something or prioritize some apps over others. Having a default repo where there are restrictions, rules and vigilance makes sense, but you should be able to opt into another circle of trust AND get notified of updates, changes, version numbers etc. If you can't trust a company enough to run their binary, then don't add their repo.

The alternative is download static apks today and maintain updates yourself(bad) or remove the freedom to install what you want on your device.

Fdroid allows you to run your own repo and up your own builds. MicroG does this, so these are built by them. More devs should do this. Fdroid building everything isn't scalable nor is it a good trust paradigm. I agree with them that they should only build from source, but others should maintain their own. Email is federated, why not app stores?

Edit: [0] https://f-droid.org/wiki/page/Setup_an_FDroid_App_Repo

I'd be happy if they just released it DRMfree on GOG or something. It existed long before tying your game to Steam's API was ever a thing. I'd buy it again, especially if it was the original version (before they killed LAN multiplayer).

I mean, have we really learned nothing from tying our multiplayer to GameSpy?

Open source would be best, but I'm sure they want to re-release it on every DRM cloud platform to pop up for the next 20 years. Also, legal, etc.

I use prosody and it's really slick.

Extensions that implement server-side XEPs are really easy to add on as well. Just git pull the community XEP repo and then add a line to the ini and you can add more superpowers. I have it on a cheap VPS. I'm using conversations with it and it has been mostly flawless. Now I just need a good linux application that understands OMEMO. There's a Gajim hack, but it's kind of messy.

[0]: https://prosody.im/

This is good to see. I feel like self-hosting is no longer really a priority for a lot of people, even privacy advocates. As things get more cloudy, people end up trusting these third party services more and more. Even businesses and schools are using cloud services like crazy.

I think there should be more talk about federation, exporting and importing data. It also seems like serverless is the new hotness and getting a lot of former self-hosted advocates' eyeballs.

Self-hosting is a lot of work for the everyman, but distributed trust (family, work, neighborhood, school, etc) federation seems better than the status quo. This might not be a popular position since most startups depend on roping people into centralized clouds, but eh.

I wrote some about it and the Decentralized Web Summit here[0].

[0] https://www.alami.io/post/decentralized-web-summit-2016/

SCOTUS seems to disagree with you[0][1]. I try to read or at least skim what I agree to. Some companies have an opt-out of their binding arbitration (eg. Ting), which I try to make use of, but most don't allow you to opt out of the class action waiver.

If you don't like the terms, email them and tell the company why you won't sign up. I rarely get a response, but someone on their staff knows there's at least some push back.

[0] https://en.wikipedia.org/wiki/AT%26T_Mobility_LLC_v._Concepc...

[1] https://en.wikipedia.org/wiki/DIRECTV,_Inc._v._Imburgia

IANAL, but it looks like when you agree to the Microsoft TOS you waive your right to bring a Class Action suit against Microsoft

>Class action lawsuits, class-wide arbitrations, private attorney-general actions, and any other proceeding where someone acts in a representative capacity aren’t allowed. Nor is combining individual proceedings without the consent of all parties.

I believe that's why companies are taking MS to small claims for $10,000 despite losing way more than that in downtime.

[0]https://www.microsoft.com/en-us/servicesagreement/

The "new" Microsoft was a change in business model, not a sudden thawing of the heart.

Windows used to be the product, now Windows users are. This is similar to Google and Facebook's offerings. Very few companies still strictly sell software anymore.

The open sourcing of tools is marketing and a consequence of prioritizing adoption over exclusivity. Like Android, Windows isn't going to be the bare foundation you build on, but the cushy, fully furnished condominium... complete with cameras and microphones.

I dual boot on my PC, Ubuntu and Windows. I'm writing this from my Arch laptop. I only drop into Windows if I want to play a Windows-only game, but thankfully that's happening less and less. I've stopped buying games for Windows entirely so I won't have this problem in the future.

When I installed Windows10, I did the hour long dance of trying to find all the places where I could turn off tracking, even temporarily. Then I ran this[0] which does a pretty good job in a magic black box kind of way. It's a patch job, I don't recommend using Windows10 as a daily driver or putting too much faith into any gui setting or external patch.

Also updates are important. Software developers know maintaining multiple old versions and backporting fixes is more art than science and even with the best intentions is prone to incompleteness. Update your software. If you find you can't because upstream is consistently invasive/lacking/gross, chose a different project or you know... fork.

[0]: https://github.com/10se1ucgo/DisableWinTracking

I agree, they're really late to the game. It seems like a slam dunk business-wise as they can get the android and IOS market on the same app and cultivate a household name.

They would have been better doing so before the E2E craze went mainstream-ish, again from a business perspective. Now they can still leverage meta data, but it's not a juicy and lucrative as say, reading everyone's emails.

I'm still putting my money on vector.im and matrix.org. Closed source communication apps are not appealing to me, even if they come with an E2E promise.

From a business perspective this makes sense for Google. A big problem with Skype was always the lack of ubiquity. Lot of people had it, but it required another install and explicit configuration. Now that Skype is nearly bundled with W10 and WebRTC has made skype.com trivial, the gap for Google to move in is closing. If this rolls out with Google branded Android, people will use it irrespective of its merits (a la bundled Internet Explorer). Interop on iOS makes it stand out from Facetime. There's always room to change terms later when it becomes a household name.

Also, with all these services adding an E2E sticker on their communications, Google's hand was forced, they're not trend setters here and they shouldn't be applauded for being extremely late to the privacy game.

Different strokes.

I think maintaining the LAMP Wordpress stack, extensions, admin panel auth security, whatever versionpress is etc. is more hassle than editing a text file and pushing code. To devs, this editing is second nature.

Also, I'd take my desktop editor to a contentEditable any day.

You could throw Jekyll, Middleman, Pelican or Hugo on the server and run their build command with a git hook. Then you'd get the same result, but a completely static website without the server needing flask to piece together pages when a user hits the site.

The build times wouldn't be instantaneous as it would need to regenerate all the pages, but Hugo is still really snappy for even a large site. You probably post less than users access anyway.

This would still check all your boxes:

No database

No server side auth

Non-public drafts (metadata)

Commit from anywhere

Bonus: Dumb serving (only prebuilt static pages)

Optional bonus: Shortcodes, themes, bells whistles

The site would be built on the server so it wouldn't be completely dumb like rsync-ing static pages to nginx or something, but that's the rub if you want to be able to use clients with only git as a dependency.

Yours is a good solution, I'm just throwing an idea out there for a pre-baked alternative. My original use case didn't call for mobile blogging (not a fan), I run my own gitolite server so auth is already in my camp and I have a multi-tooled build that I didn't want on the server. If something breaks, it happens on my machine instead of on my server.

Also just a tip, maybe you want to put a <noscript> tag around an expanded copy of your hamburger menu. Without javascript, your website navigation is broken because you can't expand the menu.

Edit: by client, I mean blog-editing-computer not blog-reader's-computer.

I considered doing this with my hugo blog, but decided I wanted to do the work on my client and keep my server stupid. In order to build my site, I have a lot of minification, pdf generation, syntax highlighting etc, that requires a few packages to be installed on the client.

If my server had to rebuild after a git push of a new post, I'd have to install all of the tooling on the server. I just commit my post, then run npm deploy which rsyncs all the static assets to the server after building on the client. This also makes it so I can see everything on my client easily before deploying. If I was building a blog for someone else though, this would make sense, stupid client, smart server, commit from anywhere.

On one hand, I like that Stallman is opinionated and forward about his politics and how we wants the world to work. So many people are silent or inactive about the things they care about, wishing for people at large to just change. You ruffle some feathers when you open up and say what's on your mind, but hopefully after enough rational argument, you come off better and with a better message.

On the other, I don't really like everything he says, despite being a pretty firm OSS supporter. He conflates so much with open source it's nauseating. People choose a license for all kinds of reasons and I understand he's a cheerleader, I am too, but conflating everything hurts open source as much as it hurts proprietary actors.

It's a market. Some people will want to buy your product because they see its open nature as a benefit they are willing to pay more for, others don't care and will not pay more. The same goes for privacy promises, DRM or which devices you support, the color etc. If people buy or sell things that you would rather not, that's cool. Pointing out that everyone at every level of a proprietary agreement is duped by some nefarious puppet-master and the entire machine should fail is childish. Furthermore, throwing in things like economics and employment fairness into the mix really confuses the message to the determent of OSS developers. In like kind, I may be a vegetarian, but PETA certainly doesn't speak for me.

I realize he thinks the current market is trash and slight deviations from the status quo won't bring real change, but most people just don't care enough about what many of us care about. That's the hard truth. Slinging mud and building straw-men isn't how we fix this problem. It just makes OSS proponents look out of touch.

Also, some people commented on his sometimes hypocritical impurity. eg. making phone calls on locked down phones and using closed source websites occasionally. Being OSS pure in 2016 is crazy hard and getting harder, again due to market forces. I think there's a lot to fault Stallman on, but his deviation from OSS purity is not one of them.

In the US you can't do research about a product then go out and buy quality product from a quality provider. That's really where I see a lot of the problems with all of this.

Yes there's a failure of information somewhere and people that fall through the cracks should be able to find their way out again, but the root of the problem stems from publicly vilifying people and actions that should be legal. Regulating all drugs like cigarettes, for example, would make it so they wouldn't have to get grade E stuff from some alley, we'd stop imprisoning people that may just need help and we could have discussions in the open about abuse. Privately vilify all you want, but the government should be mute on people's preferences as long as they are capable of making decisions, there's mandatory information disclosure surrounding dangerous drugs and companies can't lie about what they're selling.

Heroine for better or worse is a product that people are willing to go far out of their way to purchase and that goes for nearly all drugs. I would never do it and I believe if you made it legal, most people not doing it today wouldn't pick it up. We really need to get the idea that legal === government endorsement out of our heads.

We do things because the pros of doing them outweigh the cons of not doing them. Information around drugs, proper, honest and often, deters dangerous adoption.

Fiber will be a dumb pipe company until it serves Alphabet's interests that it not be. Right now market adoption and growth is more important than trying to capitalize on their users in creative ways. Look at Chrome for example, adoption was the name of the game for years and then suddenly your browser now has an, arguably opt-in, superpower where it can send analytics back itself on sites you visit. It's not crazy to think that could happen to fiber sometime down the line.

I feel the municipal internet infrastructure should be publicly owned, like streets, but service on those pipes is carried by competing companies. These turf wars are getting old.

>The complete failure of IT privacy in the US proves that voting with your dollar and voice doesn't work. The very existance of companies like Google, Facebook and thousands of others whose main purpose if data analytics proves that.

I don't think voting with your dollar is a failure, I just think it's currently too niche a hobby to move mountains. From my completely unscientific empiricism, it seems only super hot button issues, regarding religion for example, cause enough Americans to weigh a company's economic policies vs their ideological ones in large enough numbers while also making enough noise about it. Many consumers seem to make one dimensional decisions when choosing a product or service: How much does it cost? This is exacerbated by the amount the public sphere is taking over private decision making, not ameliorated.

For example, citizens concerned with wage disparity aren't buying goods whose executives pay their workers fairly; they're shopping at Walmart. For some reason, economic or ideological issues that stem from the market aren't the market's problem, but become a problem for Washington. Do I think putting the mean and median wage of non-executive employees on the package would help here? Not until we decide these are problems of the market, but honest information disclosure will be important then.

On top of that, a great many consumers are happy with the status quo. "Personal information" is some nebulous magical currency that they can get free stuff for. Just because you or I value this doesn't mean most people do. I've talked with a great many, otherwise intelligent, people that would have it no other way. They can use Facebook for free and to them the value gained far and wide exceeds the costs.

You and I personally think this calculation is short sighted and incorrect, but if you assume the consumer is too stupid to make decisions for themselves regarding their own information then where does that lead us as a society? (not to mention the regulatory overhead)

I won't use a Microsoft Windows computer as my daily driver due to dark patterns, privacy issues, new business model etc, but I also wouldn't advocate for strict legislation in this area. The only legislation I think I would back is mandatory information disclosure on install. EULAs are important and it is to detriment of the consumer that we agree to terms we aren't aware of. Still, if there's an opt out toggle buried somewhere, then the company is aware someone wants to do so.

How we decide what information is important to consumers is debatable, but consumers can't make informed decisions if they don't have the information available or are not presented a choice. If information isn't provided by primary sources, many of whom would rather not provide it in an easily digestible manner, then it's a guessing game. Things like applying whack-a-mole patches to fix the shortcomings post-install is essentially plugging a sponge boat blindfolded. Even grouped settings toggles in a customer-fronting GUI can be broken out and flipped on individually without your explicit approval tomorrow so your Windows Firewall IP hack is just that, a well-meaning, but messy and temporary hack.

I'm a firm supporter of "vote with your dollar", however I think voting with your voice is also important. If you're unhappy with something a company is doing, shoot an email or call someone if possible and explain why you're not using their product. Hell, even and maybe especially if you are a customer, let them know you're not happy about a policy. Just like in the public sphere, private companies don't know whether you're an ideological abstainer or simply someone they haven't advertised hard enough to yet. Part of this problem is due to companies knowing full well they're acting against the consumers, but consumers often shut up and move along silently after getting their wallets out. I've emailed Microsoft multiple times about their policies on binding arbitration, their dark patterns and privacy policies. I may not be a customer, but they sure as hell know why.

I agree with his points. If I had to prescribe to a political ideology, libertarianism would probably be the closest to how I reason things out. I've always thought, though, that it can only really apply to conscious human adults capable of weighing the pros and cons of their actions and relationships. When consequences or side-effects of their actions are pushed onto external parties incapable of disagreement (eg. the environment, children, animals) it gets murkier as actions become unilaterally beneficial to the party making each proposal. Here I think there is room for public consensus to come in and speak for the parties incapable of doing so.

I think most political arguments happen over how you decide who or what fits into this group of parties incapable of speaking for themselves. Some say 3-year olds should represent themselves in immigration court while others say even adult consumers aren't capable of adequately representing themselves and need protections. I don't believe it's inconsistent libertarianism to say that some groups with no independent legal voice should get public protection. Libertarians draw that line in different places, however.

Side note, but it's kind of strange that images on their site require cookies enabled to view. I didn't dig into a reason, I just white-list the sites I want to use cookies and found it odd that there were big white spaces before doing so.

I hadn't seen your post before I posted, but there's Chromium Inox which tries to remove the Google from Chromium you might want to check out.

There's Chromium Inox[0] which is just a patchset on top of the Chromium build to remove much of the mothership home-calling. Inox seems to be much closer to Chromium than many of the other Chrome-privacy spinoffs. Contrary to popular belief, Chromium still has a lot of Google in it.

I always feel like artificially patching a project that doesn't care about your concerns natively to be plugging holes in a sponge boat, but I realize sometimes you need to use that boat because reasons.

I installed it from the AUR and it seems to work pretty well for the testing I do in it anyway. I don't daily driver it or Chrome.

[0] https://github.com/gcarq/inox-patchset

I just use hugo for site generation, isso for self hosted comments, rsync for dumping files on the server and postcss for all the styling. All the scripts are in a package.json so I can download and run everything with an npm run build-init. I don't think most people's personal blogs need to worry about high availability, multiple servers and the complexity that goes along with it, but I'm sure some do. I simply don't have that traffic.

The orange line is neat, I opted for a css avatar replace as isso tags the generated avatars with an id I can grab. The two columns I'd have to get used to, maybe I'm just easily distracted.

Thanks for posting this.

Sandstorm is simple an intuitive which is what a lot of our decentralized projects really need a good helping of. I watched the recent Decentralized Web Summit, and there was so much talk about decentralization, yet so little talk about self-hosting, federation or the projects that are out there doing the dirty work today. It made me sad. People are looking for alternatives to silos, not every one of course, but a lot of people just get overwhelmed with the thought of self-hosting. Sandstorm is helping with that it seems. I wrote more about this here[0] if you're curious.

Keep up the good work!

[0] https://www.alami.io/post/decentralized-web-summit-2016/

Wow neat, thanks for this. I was just looking for extensions for some reason. It's on F-droid as well if that's preferred. Pretty slick.

Source: https://github.com/maxpower47/PinDroid

Pinboard provides a simple service with well defined boundaries that you're aware of when signing up. Iterating indefinitely isn't always the solution, especially when your intention is to keep your problem space small, your project easily maintainable and the tools you provide relatively sharp. Every feature you add you have to either maintain or kill off to the detriment of your users. I'm not saying Pinboard couldn't use a little polish, but I like the principled keep it stupid simple stance: Links aren't hard, don't overdo it.

If Pinterest looks interesting, then yeah you probably really hate Pinboard. I think it's a feature that I don't hit those annoying nag walls, get inundated with ads and tracking, load hundreds of images on a page, and require cookies and lots of JS to just browse feeds. Different strokes for different folks.