tomgag

After Hetzner, another big German IT service provider is raising their prices. Existing customers just got this: "As a valued existing customer, you benefit from a transition period until 31 August 2026. Until then, you can keep your current price for the years ahead by extending your subscription. The more subscription time you add, the longer you will continue to use mailbox at your current price. After that, the new prices will apply."

Every time I see a post praising ATProto on HN I cannot shake the feeling that this might be the product of a concerted (and VC-backed) marketing effort.

ATProto is "decentr-washing" as far as I'm concerned. Even if you self-host as much as possible, if Bluesky's relay declines to crawl your PDS, or its AppView declines to index/serve your records, then to essentially the entire audience you simply don't exist. did:plc controlled by a Swiss Verein, as if this could be a reason to drop all self-sovereignty worries! Credible exit was actually always working well on ActivityPub already, and if you self-host your instance you probably won't even need it anyway. Regardless, there is FEP-ef61 now, so I genuinely don't understand why to prefer ATProto over ActivityPub, even in the foreseeable future.

Let's not even talk about Nostr, that natively solves all the issues that ATProto seems to care about. Nostr is IMHO a much superior technology, unfortunately plagued by ecosystem/people and Bitcoin-dictated technical choices (BIP-340 keypairs, brrr).

Yes, totally agreed, but the problem is that most people tend to simplify this as "let's just bother with PQ encryption, forget about signatures". I know experts can handle the nuance, but execs and most industry folks can't. Or, at least, this is the trend that I have personally observed countless times, maybe I was just unlucky with my data points, but I have seen this in "technical" settings as well (case in point: GnuPG prioritized inclusion of PQ hybrid encryption, to the point of rushing the standard against OpenPGP, the well-known "GnuPG schism", but I'm not aware of concrete plans for PQ signature adoptions there).

Refreshing! Not wanting to be the "told you so" guy, I've been saying this for at least 2 years now:

> Post-quantum authentication is no longer a problem the Web PKI ecosystem should defer. Long-lived keys (root certificate authorities, code-signing keys, identity systems) are particularly valuable targets, and new technology takes years to gain broad adoption, so the work has to start early.

This is a problem that I have met so many times talking with people: they parrot the "Harvest-Now-Decrypt-Later is the only urgent problem, signatures can wait" mantra, and this piece of misinformation has spread so much that even AI repeats it (because it has been trained on open data, where the overwhelming sentiment has been following this trend), thereby reinforcing the problem. Ask Claude/ChatGPT/Gemini about the problem, and they will invariably tell you that signatures are less urgent because theyr are not subjective to retroactive compromise.

There are two problems here.

The first one is included by the Letsencrypt announcement: the migration path for signatures/certificates is typically longer and more complex than encryption: long-lived certificates, firmware update keys, secure boot certificates, these are all objects that are painful to migrate.

The second one, even more serious in my opinion, is: "retroactive" in respect to what? "Retroactive" presupposes you can observe the trigger (the arrival of a cryptanalytically-relevant quantum computer), but this is precisely the kind of capability an adversary keeps secret, and a quantum forgery is operationally indistinguishable from, e.g., key exfiltration, a library bug, or a classical break. You may see a forged signature, a drained wallet, a failing certificate, and have no way to attribute it to quantum cryptanalysis. The threat is dark: reactive migration against an unobservable trigger is structurally impossible.

This is not to say that Harvest-Now-Decrypt-Later is a less urgent threat, but it's not so asymmetric as people have been believing so far. Glad to see things are changing!

Hi, just a personal blog post. The sad story of Gandi.net is a textbook example of enshittification, which I think is interesting to talk about, because of the many expectations that were betrayed, and the deeper reflection linking to vampire capitalism. I also report the user-hostile process that I had to undergo in order to migrate away from them.

Can confirm, I use mailbox.org with my own domain and can send from any *@mydomain

Author of the whine post here, feedback is very welcome. I am in no way expert on the topic of AI/LLM, and I'm happy to learn new things and correct myself. My point on the "China has won the AI race", while admittedly provocative, is not meant in the technological sense, but in a broader, social + usability sense: I know that there are good open source models by Western companies, I know Heretic and similar abliteration techniques, and yet all the trending models on HF are Qwen and friends, and sovereign and/or private attempts at personal inference like Euria, Confer, etc use these models under the hood. While you might or not be right that "there is no Chinese company that can release a model as good as the American ones" (and BTW, this statement sounds difficult to prove to me), how do you explain the observable, objective facts above? Thanks.