• 14 Posts
  • 102 Comments
Joined 1 year ago
cake
Cake day: July 23rd, 2023

help-circle
  • The metadata in the headers can be avoided using Memoryhole and similar protocols which embed the headers inside the encrypted payload. The problem is again barrier to entry. Low-tech users generally can’t even handle app installs on desktops.

    When you say “worry”, that’s not the right word for it. My boycott against Google is not fear-driven. I will not feed Google anything it can profit from as an ethical stance. Even if an expert linux tor user were on Google, I’m not sure we could exchange email in a way that ensures Google gets no profitable data. If we use PGP coupled with Memoryhole to strip out the headers, I’m not sure Google would accept a msg with a missing or bogus From: header. But if so, Google still possibly learns the user’s timezone. Though that may be useless if Google learns nothing else about that user. But we’re talking obscure corner cases at this point. Such an expert user would have no Google dependency anyway.

    MS/google-dependent friends are generally extremely low-tech. They don’t know the difference between Firefox and the Internet. They don’t know the difference between Wi-Fi and Internet. Linux – what’s linux? They would say. At best, they just think of it as a mysterious nerd tool to be avoided. So what can I do wholly on my end to reach them via gmail without Google getting a shred of profitable data? Nothing really. So I just don’t connect directly with a large segment of friends and family. Some of them are probably no longer reachable. Some are in touch with people who connect to me via XMPP, so sometimes info/msgs get proxied through the few XMPP users. It’s still a shitshow because Google still gets fed through that proxied inner circle of friends and family. In the past when someone needed to reach me directly, they would create a Hushmail or Protonmail mail account for that temporary purpose (like coordinating a trip somewhere). But that option is mostly dead.

    I just had to reach out to plumbers for quotes. All of them are gmail-served. All I could do is refuse to share my email address and push them to use analog mechanisms. They are not hungry enough for business to alter their online workflow or create protonmail accounts.


  • That’s exactly what I did with hushmail. I would tell low-tech folks to get a hushmail account then I would use hushtools.com to do all the key management, putting my key on the keyring and grabbing their key. So the other person did not need to know anything or take any special steps. That was best option of my time. But last time I checked hushmail was still entirely non-gratis.

    Protonmail emerged when HM became non-gratis and messed with hushtools. But PM requires every one of their own users to do key management which creates a barrier to entry. I would have to walk a PM user through adding my key to my record in their address book and walk them through sending me their key. That effort is a show stopper for many. I might as well walk them through setting up a PGP-capable MUA. But then if they keep their gmail or MS acct the metadata still feeds those corps.


  • I give out my XMPP address and offer Snikket accounts. Some go along with it and some do not. I lost touch with some friends. Some people are in contact via phone but that’s not ideal some connections are lost as phone numbers change.

    I used to push some people toward Hushmail until they dropped the gratis plans. Then for a while I pressured people onto Protonmail but then distanced myself from PM when the brought in Google reCAPTCHAs and killed off Hydroxide. Tuta is a non-starter because Tuta’s variety of e2ee is incompatible with open standards, thus forcing me to periodically login to a web UI (also due to them sabotaging their Android app by way of forced obsolescence pushed in the most incompetent way).

    So it’s a shitty state of affairs. 2024 and simply sending a msg to someone has become a total shitshow.





  • Both… functional art.

    The original problem is that there was a water shut-off valve for the whole floor in the shower. Very ugly to have a valve in the corner on the floor and somewhat in the path of the water if someone were to point the showerhead slightly outside the pan. The valve handle was rusting. It was embedded in a solid block of concrete with the handle sticking out. The valve started to fail (did not completely shut off the water). And it was the kind of valve where the whole valve needed to be replaced. Terrible work by the builders. I had to demolish the concrete to reach the valve.

    So I replaced the valve with the kind of valve that has a replaceable cartridge. But I also refused to embed it in concrete again. I will build a removable sealed box around it. But the box could not be both waterproof and also easily removable on the fly whenever the valve needs to be accessed. So I put a hole in the wall (shower to bedroom). Then I attached a 90° gearbox drill accessory and a shaft to that goes through the wall. On the bedroom side, I could have just put a handle. But I found a wood helm to a ship (miniaturized). I thought that would be the perfect steampunkish valve handle. But it did not clear the wall (in a corner). So i got carried away and put a bicycle sprocket on the shaft, and mounted the helm to another sprocket, which i attached to the wall higher up. And wrapped a chain between them.




  • product 1:

    • maintenance: 2 caps/week (a cap is big, looks like ~100ml if i eyeball it)
    • clog clearing: 500ml (½ bottle)

    product 2:

    • maintenance: 25ml/2 weeks
    • clog clearing: 300ml (⅓ bottle)

    product 3:

    • maintenance: 25ml/week
    • clog clearing: not mentioned for this purpose

    Going from memory I rotated between the products and I think I poured in about ⅓ of the clog clearing doses on the first two every few days… because I was a cheap bastard and just wanted to constantly have the enzymes in there. But yeah, probably a mistake. I think I tried a 300ml dose of product 2 just once. But I probably should have tried a full dose more often.












  • Better or worse depends on who you ask.

    I boycott Cloudflare and I avoid it. Some CF hosts are configured to whitelist Tor so we don’t encounter a block screen or captcha. For me that is actually worse because I could inadvertently interact with a CF website without knowing about the CF MitM. I want to be blocked by Cloudflare because it helps me avoid those sites.

    The CF onion (IIUC) cuts out the exit node which is good. But CF is still a MitM so for me that’s useless.

    Some users might not care that CF has a view on all their packets - they just don’t want to be blocked. So for them the onion is a bonus.



  • W.r.t CSAM, CF is pro-CSAM. When a CF customer was hosting CSAM, a whistleblower informed Cloudflare. Instead of taking action against the CSAM host, CF doxxed the ID of the whistleblower to the CSAM host admin, who then published the ID details so the users would retaliate against the whistleblower. (more details)

    There is no way to “disable” cloudflare if an instance has chosen to use it. It will sit between you and the server for all traffic.

    Some people use CF DNS and keep the CF proxy disabled by default. They set it to only switch on the CF proxy if the load reaches an unmanageable level. This keeps the mitm off most of the time. But users who are wise to CF will still avoid the site because it still carries the risk of a spontaneous & unpredictable mitm.