mikegerwitz

I don't need "modern alternatives" to things that aren't broken. I'm not interested in replacing my one tool with N others when I understand my threat model and understand the benefits of my existing, battle-tested tooling.

The opening paragraph is off-putting:

> Did your last Yubikey just break?

Is this supposed to imply that I'm not supposed to be inconvenienced by my security token breaking? Of course I am. I've lost and misplaced my Nitrokey on numerous occasions, leaving me completely locked out of my systems without physical access. That's a feature, and that's intended.

> Perhaps you forgot an offline backup password.

What does that have to do with PGP?

> Maybe you're just tired of living like a spy and never using smartphones.

That absolutely has nothing to do with PGP.

> Linux distributions and many other software update mechanisms use PGP signatures to prevent malicious mirrors or network attackers from altering the contents of their packages.

GnuPG's use here is hidden from the user by the package manager. Most users have no idea it's using PGP, and don't understand what it is. They work through a package manager's abstractions. If you replaced PGP with something else, the user would likely be none the wiser. Why does it matter? Also, why do I want to abandon a keyring?

For manually verifying signatures: why does the weight of the tool matter? Is `gpgv' (which is probably already installed on your system) really weighing you down that much? Tools like signify emphasize keysize and speed compared to RSA. Do you _really_ notice as a user? Is that _really_ the bottleneck for what you're doing? It might be, but I suspect for your average user, it's not.

> I wrote one as a party trick last month – it's less than 200 lines of code and that includes some silly key parsing tricks.

Are we worried about attack surface? GPG is heavily audited---you're far more likely to be pwned through one of the 100s of other poorly audited programs on your computer. And in any case, I don't care how easy it is to write---leave the crypto to the experts. An easy-to-understand implementation is great and certainly preferred where possible, but that's only part of the battle. And tools like GnuPG already have their implementations written and audited by numerous parties over the years. That doesn't mean they're bug-free, but it's not like we're starting from scratch here.

> Original need: You want to store individual pieces of data without making their contents accessible to anyone else on your system.

I'm not arguing against the use of other programs, but I see nothing wrong with GnuPG (or PGP) for this. Again, it's a widely supported tool that's probably already available on your system, and it probably came with your distribution image, so it probably can also be trusted. Directing users to install programs is a risk in its own unless it can be authenticated through the distribution's package manager---users must understand how to verify the program themselves otherwise.

Using GnuPG also gives you some other benefits for free, like support for a smartcard, even over SSH. (You should generally prefer symmetric algorithms for long-term secrets, but if you know your threat model, or have secrets that are easily changed or don't need to stay secret long term, asymmetric may be a fine choice for you if you gain the benefit of a security token.)

> Original need: You have files that you want to send to another person, but you don't want the data to be visible in transit or stored in the cloud. For this, folks often attach an encrypted ZIP file to an email.

> Modern alternative: magic-wormhole.

This works out great (or a tool like OnionShare) if it actually addresses your problem. But what if I want to encrypt files to N people who may be online at different times, and store that file somewhere? What if I _do_ actually want to communicate over email? I happen to do most of my communication with online communities via email.

PGP does suffer from many legitimate issues, like forward secrecy. Certainly use the right tool for the job. I'm not going to use PGP as an alternative to OMEMO, for example---they're fundamentally different.

Things that certain people see as weaknesses, like logistical issues surrounding the establishment and maintenance of a web of trust, aren't weaknesses to others. I have no problem with people suggesting useful tools for certain tasks. But I'm frustrated by the FUD around PGP, as if it's insufficient for any job. It does work, it is battle-tested, and it is trusted.

PGP is still widely deployed, whether you like it or not. "I don't like it" isn't a valid argument for considering something "legacy", when it works just fine for certain cases.

I'm a father of 7- and 5-year-olds, and I constantly think of this.

I have some anxiety issues and frequently have mild panic attacks, which can have symptoms similar to heart attacks. I have vasovagal responses triggered by odd and benign things. I also have bad muscle tension in my neck and upper back, which can extend around into my chest. And to top it all off, because I have children, I am often sleep deprived and drink too much caffeine. Heart-related issues are on my mind so frequently that I've almost convinced myself that I'm going to die of a heart attack one day, despite me being in good health.

I spend a lot of time worrying, so if I could share my advice with others: if you are worried, just see a doctor. It's not worth being wrong. One day I had symptoms of a heart attack for hours and went to an urgent care facility and got an EKG and x-ray of my heart. They found nothing, and attributed it to musculoskeletal pain. Considering I've been worrying about my heart for many years prior, those tests gave me a strong sense of relief and allowed me to focus on learning how to control my anxiety without getting into a feedback loop (anxiety -> heart attack symptoms -> more anxiety from worry). I can now calm myself down pretty quickly.

This may seem obvious, but getting extra sleep and cutting out caffeine helps immensely with all of the above symptoms. Easier said than done as a parent whose kids don't even sleep through the night. :)

rms refers to this combination as "GNU/kWindows". I wrote about GNU's perspective back in 2016:

https://mikegerwitz.com/2016/04/gnu-kwindows

Please remember that GNU is not just a collection of programs that fall under the umbrella of the GNU Project---GNU is a complete operating system, and it was an explicit decision to use existing free software when it was already available, and write replacements only for non-free components needed replacing. A detailed history of the development of GNU can be found here:

https://www.gnu.org/gnu/thegnuproject.html

As distro maintainers know, it is a lot of work to come up with the right combination of programs to produce a complete, working operating system using _existing_ free components and being able to draw inspiration from existing GNU/Linux distributions. Imagine how difficult this effort was 30 years ago when nobody had done it yet.

The fact that this comment was flagged is deeply troubling to me.

This is a late reply, but thanks for your input. I'll look into them further. What interests me is your replacing Dovecot + Sieve with your MUA; I'll have to see if I want to do that or not.

I haven't researched Notmuch, but I've heard some interesting things about it. I used to use Mutt back in the day. Whatever I use would have to have Org integration, though.

Tbh, I just haven't researched other things and I haven't had the time. But Gnus does seem to fit well how I organize my mail: I subscribe to a lot of mailing lists, each of which are filtered into their own folders via Sieve scripts, before they touch my MUA. I also organize normal mail similarly.

Most of my communication with various people/communities is done via mail. For those using Emacs:

I use a Kanban (or GTD, depending)-style workflow using Org mode and Gnus. Org mode recognizes `gnus:'-prefixed links. For certain types of mail, I use an Org capture template within Gnus which inserts a TODO item into an Org document, along with a link to the original message (which can be opened in Gnus using C-c C-o).

You can then go through your usual workflow as you would with any other item; mail is just another source of data.

Considering that the task originated via mail, chances are it'll require some back-and-forth, potentially over the course of weeks and perhaps with a handful of people involved. I also keep detailed timestamped logs of correspondence and my actions, linking to important messages as needed. This is particularly useful for large threads, since I highlight the most important information. Since I'm logging via Org mode (and not my MUA), my logs can also include any other additional information and time tracking that has nothing to do with mail, so this creates a useful timeline that combines both actions and correspondence into a single view.

Because this is married with the rest of my Org-based task management, my mail also shows up in my agenda and reporting.

For more information, see the GNU Coding Standards:

https://www.gnu.org/prep/standards/standards.html#References

In particular:

> A GNU program should not recommend, promote, or grant legitimacy to the use of any non-free program. Proprietary software is a social and ethical problem, and our aim is to put an end to that problem. We can’t stop some people from writing proprietary programs, or stop other people from using them, but we can and should refuse to advertise them to new potential customers, or to give the public the idea that their existence is ethical.

Excluding material isn't censorship---GNU stands by its principles. You wouldn't expect a vegan organization to advertise means of obtaining meat, for example.

I also want to highlight what I wrote in 2015 about GitLab's commitment to free software: https://about.gitlab.com/2015/05/20/gitlab-gitorious-free-so...

> Note IceCat is not very well maintained.

Its maintainer is working on upgrading to the latest ESR now. If anyone is interested in helping maintain IceCat, please e-mail [email protected].

Good catch:

https://www.gnu.org/software/taler/

I'll contact Christian Grothoff today and make sure nothing suspicious is going on and ask him to update the GNU forward if the domain has indeed changed.

Those interested in how prototypes and classical inheritance relate (and don't) may be interested in work I did on GNU ease.js, which works with ECMAScript 3+. I have since extended it to support Scala-like traits.

https://www.gnu.org/software/easejs/manual/easejs.html#Imple...

I also wrote a paper on some of the concepts:

https://mikegerwitz.com/papers/coope/coope.pdf

The `class' keyword in JS still leaves much to be desired; it's just syntatic sugar around the prototype model. There's nothing wrong with that model---it's just important to understand how it differs from what OOP developers traditionally expect.

That's orthogonal to the issue. Of course you have the freedom to refrain from use of any technology, unless you're somehow being mandated by law to use it.

No. You aren't being denied your freedoms on someone else's computer because you have no right to exercise them to begin with---it's not yours.

It's the same concept with the AGPL---I have no right to modify the source code on someone else's server; I'd need to install it on my own.

If you had to have access to the source code for everything you used, it'd be an almost impossible burden. rms takes public transportation in Boston, for example. Those terminals are interactive touchscreens, required for payment and printing tickets. He'd be unable to use the transit system.

From stallman.org:

> However, if I am visiting somewhere and the machines available nearby happen to contain non-free software, through no doing of mine, I don't refuse to touch them. I will use them briefly for tasks such as browsing. This limited usage doesn't give my assent to the software's license, or make me responsible its being present in the computer, or make me the possessor of a copy of it, so I don't see an ethical obligation to refrain from this. Of course, I explain to the local people why they should migrate the machines to free software, but I don't push them hard, because annoying them is not the way to convince them.

> Likewise, I don't need to worry about what software is in a kiosk, pay phone, or ATM that I am using. I hope their owners migrate them to free software, for their sake, but there's no need for me to refuse to touch them until then. (I do consider what those machines and their owners might do with my personal data, but that's a different issue, which would arise just the same even if they did use free software. My response to that issue is to minimize those activities which give them any data about me.)

> That's my policy about using a machine once in a while. If I were to use it for an hour every day, that would no longer be "once in a while" — it would be regular use. At that point, I would start to feel the heavy hand of any nonfree software in that computer, and feel the duty to arrange to use a liberated computer instead.

> Likewise, if I were to ask or lead someone to set up a computer for me to use, that would make me ethically responsible for its software load. In such a case I insist on free software, just as if the machine were my own property.

https://stallman.org/stallman-computing.html

So using someone else's computer is a similar problem to SaaSS---you're relying on someone else for your computing:

https://www.gnu.org/philosophy/who-does-that-server-really-s...

You need to do it properly; the comic is misleading on its own.

https://www.eff.org/deeplinks/2016/07/new-wordlists-random-p...

I use Automake and Autoconf (which generates the Makefile) for GNU ease.js:

https://git.savannah.gnu.org/cgit/easejs.git/tree/Makefile.a... https://git.savannah.gnu.org/cgit/easejs.git/tree/configure....

The nice thing with using Automake is that it gives all the standard build targets with little additional effort (for example, `make dist` for producing the distribution tarball, and `make distcheck` for verifying that it's good).

I use a much simpler one for a project at work:

https://gitlab.com/lovullo/liza/blob/master/Makefile.am https://gitlab.com/lovullo/liza/blob/master/configure.ac

I use them frequently. Having to write something like `(car (car (cdr foo)))` is common (`caadr`).

Conventions exist in every language. `car', `cons', and `cdr' are also part of certain standards (e.g. RnRS). And, honestly, they compose a bit better than `first', and `rest' for combinations like `caddr' and `caaddr'. I suspect that you're going to be even more unhappy with those constructions.

The same can be said about older languages like C, which also have standardized notations.

Why fix what isn't broken?

Yes, you're correct. R7RS at least explicitly reserves brackets and braces, and only acknowledges parenthesis in its syntax.

Some lisps use parenthesis and brackets interchangeably. Some people prefer to strategically alternate them, but you're free to use them exclusively.

Guile Scheme, for example:

  scheme@(guile-user)> [list 1 2 3] 
  $1 = (1 2 3)
  scheme@(guile-user)> (list 1 2 3) 
  $2 = (1 2 3)
  scheme@(guile-user)> [car '[1 2 3]]
  $3 = 1

I'm giving a talk in March at LibrePlanet 2018 entited "The Ethics Void". The lack of ethics in CS education is a core component of the talk. I'm neck-deep in my talk research right now, so if you are a, student, educator, or anyone else with thoughts on ethics in CS, I'd love to hear from you:

https://mikegerwitz.com/talks

Unfortunately, the codes of ethics, courses, etc that do exist largely ignore user freedoms (in a software freedom sense) and the host of ethical concerns that come with it. If you have examples that _do_ address those issues, I'd really appreciate hearing about it.

And please join us at LP2018 (hosted at MIT)!

I can't speculate what the norm might be today if businesses were talking about free software instead of "open source". It might have provided benefit to the movement, or it might have diluted the term. Ironically, in making the distinction between open source and free software, we have the opportunity to clarify its meaning and make a clear distinction between methodology and ethics/ideology.

Open source---regardless of whether history would have been different if the term had never originated---has contributed significantly to the dissemination of free software and the amount of software released under free licenses. But it's completely disproportionate to the amount it has advanced the principles of software freedom.

Is it good that more people are using free software? Is it good that there is so much of it available? Absolutely---I'm able to run a fully free system, down to the BIOS. But I'm among a small group that does so on principle, and will not abandon freedom for proprietary software that is more feature-rich, performant, etc.

> and I think it's important to remember that both want user freedom

As a free software activist, I haven't found that to be true. Remember that the term "open source" was created explicitly to sell the development methodology to businesses without talking about the ethical issues.

When developers write software under the umbrella of "open source", many aren't even aware of software freedom issues---they may be doing it because their peers are doing it; because they were told they should do it for a portfolio to get a job; or maybe because they like sharing their software with others. Some businesses liberate their code merely for contributions or press.

That's certainly not the case for all open source developers---there is, as you said, an overlap. But it's important to use the term "free software" and talk about software freedom to start those discussions and get people thinking about software freedom.

> There are a lot of examples, but the most notable is the endorsement / promotion of the X60 / X200 with non-free EC firmware

See https://www.gnu.org/philosophy/free-hardware-designs.en.html

> I'll believe it when I see it. We have become too dependent on core components that are not being properly maintained, lack funding or both. [...] more funding is put towards critical GNU components (instead of new bloated projects).

The GNU Project is a separate entity from the FSF. The FSF provides infrastructure and does provide fundraising / direct funds for certain projects, but otherwise, GNU projects are maintained by individuals with no connection to the FSF. To offer you program to GNU, you send it to GNU volunteers for evaluation (I am one of two active evaluators), after which it is sent directly to rms for final determination. The FSF is involved only if we need to get the sysadmins involved for something.

If you support a GNU package, donate directly to that project (or via the FSF's fundraising page, if applicable).

> I still support the idea of Libre / Free Software, just not the religion and church that popped up around it.

You criticize the FSF for "making compromises", and then criticize them for sticking hard to their principles.

I disagree that they are compromising on their principles.

Yes that's a different problem different than software freedom:

https://www.gnu.org/philosophy/who-does-that-server-really-s...