xoa

Thanks for the reply, and I'm definitely all in favor of assessing things in light of threat model! That said:

>I'm more worried about being lawfully murdered in front of my family than I am going to jail because my ssh sessions were read

I guess I'd ask if you're really sure about that as a threat model? The fact is that such things are really really rare, particularly for anything white collar-ish. They get press precisely because they're unicorns. The "lawful" bit as well, one of the whole things here is that it's, at best, very dubiously lawful at all; they've been able to skirt that question so far via keeping it all secret and trying to hide from individual suit. Can't do that if a warrant from a local magistrate judge is needed and a private residence is raided though.

In contrast "you can beat the rap but not the ride" seems less dramatic but a lot more common, and in particular more than actual jail all the little ways the government has tried to fuck with people (like putting them on travel lists) that are opaque and much more difficult to even prove are the result of an organized scheme. I'm personally more worried in the near future about "chilling effects at a scale", not hundreds of activists in gulags but millions of people who get pressure in terms of financials or tax investigations or pressure on employers or always getting pulled in the security lines and on and on, and then some sizable fraction change their behavior as a result. It feels more concretely productive and practical to focus on making sure the government would have trouble both scaling and hiding unconstitutional behavior.

>Well, and what are you concretely suggesting here?

Having your own server and infra, at least in part.

>Having my own door kicked down and my dog shot so they can get at my personal home server?

The government doesn't have infinite resources, nor is it immune to political considerations (obviously, that's the problem here!). There is an enormous, qualitative and quantitative difference between:

  1) we must get an actual warrant in a lot of different physical jurisdictions across the country all with different judges and then spend the money and availability to send physical meat agents to said locations, often rural and remote, across the country to an unknown physical situation with at least some areas where people might shoot at us, and all equipment needed for that, and will by definition have to disclose everything to our targets

vs

  2) an agent can comfortably from their central office chair use a preexisting automated system to a central cloud portal to demand info secretly from companies that will just comply without any question

Scale is inherent in the topic here. It's not just "why", "HOW" is "ICE running one of the largest anti-left surveillance ops"? Well, in part because they can do so so cheaply, efficiently, and stealthily via purely electronic means. They aren't kicking down ten million doors and shooting ten million dogs, and indeed they CAN'T do that, not because they wouldn't like to but because it's physically impossible with their resources and would provoke furious (undoubtedly including some lethal) pushback.

And again, even if absolutely nothing else, it means something to know they're after you. Nothing stops you from immediately surrendering your server when asked, but you can then also instantly get a lawyer/support and push back right then and there. You can't adapt to what you either never even realize happened or only realized too late.

>gerrymandering

I don't know the specifics of Brazil's system, but at least in the US gerrymandering has nothing to do with the Presidency or Senate, only the House. It's also not without risk. Gerrymandering is bad, but it doesn't change the totals of votes; it attempts to reapportion "excess" votes yielding a large win margin in one area to give winning, but necessarily smaller, margins in more areas. Amongst other challenges though that smaller margin means if there is a wave then a gerrymander can turn into a "dummymander" where previously safe districts get flipped.

>funny business

This is actually pretty dang hard in anything but a total sham, and even then is at least obvious it happened. Some timy fiddling at the margins may be possible to sneak through, and yeah some elections that might make the difference. But that can't counter any serious victory. The more common technique seems to be trying to suppress the vote. But as well as also not being trivial it also too risks backfiring by motivating people much harder. There is a lot of human psychology around "loss", people often absolutely hate things being taken from them even if they were complacent about having them.

>Why is there still an exorbitant "cleaning fee"

Are you serious? I do the dishes and take out trash/recycling (and other regular cleaning work) as an obvious matter of course to not live in a total stinky shithole. But also once a month we pay for a real service to do a serious cleaning that gets into all the corners and under furniture and ceiling and descaling in the bathroom (hard water) etc etc, which my SO wants kept up with and I think that's reasonable. Between kids, pets, guests and so on more accumulates in a house then trivial regular clean up deals with. They're not the same thing; everyone is expected to do their dishes and contribute to taking out the trash or other chores, but not necessarily to putting on heavier duty protective kit and dealing with bathroom tile or oven accumulation. And obviously there's a fee for that (and putting it off to 2-4 months isn't actually necessarily helpful if it ends up meaning each cleaning takes much longer and thus costs more).

Not having used in forever nor ever run an AirBnB, I will say that yes, I can see it being annoying to get charged if you were just there overnight and caused no issues. And I strongly think that anything which is part of standard practice after every single visit should also be part of the upfront price not a "fee". Extra fees should only be for unique things, like someone actually creating a big mess that takes extra time. But I also think basic humanity that takes a few minutes is different from something that takes an hour and extra equipment. If you leave a sink full of dirty dishes or trash laying around that's disrespectful, gross, will get worse much more quickly then dust bunnies. I'd be ok with dinging someone for that. Cleaners aren't lesser people servants, they're specialist professionals there to help not be maids to spoiled brats. A hotel room (or BnB) mini kitchen isn't a full service restaurant. If you want that level of help that to me feels reasonable to say is extra.

>Taking out a loan for something that depreciates as fast as a car seems like the dumbest thing a person could do.

...what? For most the world by area (so at least 20-30% of the population, even in Europe) arbitrary point to point mechanical transportation is a requirement for work/life at least a significant chunk of the year. Most will also either flat out need, or find quite valuable: 1) Having that capability on demand. 2) Being able to permanently customize it to suit their needs (be it accessibility, having tools and organizational systems onboard, or most basically having what can be transported along with them match their common/rare needs).

The most economical way to manage that in general is owning your own vehicle. But it's a large capital expenditure upfront. Getting a loan to spread that out over time is one of the most basic purposes of debt. The ROI is in the actual utility, not in some sort of asset appreciation. Which is how most economics is right? I didn't replace all my incandescent bulbs with LED bulbs because I expected to be able to resell them later for more money, I bought them because they deliver far more useful visible wavelength photons per watt, and with more precise tuning and far less toxicity and other concerns then fluorescent. If I needed to replace 10k bulbs and wanted to get a loan for it the economics would be pretty straightforward to pencil out even with the expectation the entire value of the bulbs would go to zero wouldn't it? Taking out a loan for an EV car isn't any different.

From the second paragraph in the article:

>In 1875, Charles Darwin posited that some species from the genus Saxifraga—a group of flowering plants typically found in alpine environments—may be carnivorous because of their sticky glandular hairs, which can trap insects. However, there has been a lack of conclusive evidence to support this hypothesis.

Can you clarify how you got "But Darwin, if I understand correctly, classified the plant as carnivorous" out of that? Because it sounds like Darwin observed that there existed this feature on the plants that appeared adapted to carnivorous behavior, but didn't actually observe it in action (and of course he didn't have isotopic tracking to provide hard proof of molecular absorption either). So it was a hypothesis based on feature observation, and now someone has gotten around to proving that as fact via experiment. Not something radically new in terms of technique sure, could have been proved long ago in principle (this sort of tracking was core to what settled the original DNA/protein genetics debates), but still fun to read about and nice to see more getting learned about the species in our world.

I think it's a bad sign when someone immediately resorts to strawmen and argument from incredulity in their counter-argument:

>If a consumer website decided tomorrow that it would only accept attested passkeys, it would lock out almost all of its own users, instantly. What website is going to do that?

The original didn't argue that, nor has absolutely anyone else concerned, nor has that been what has happened in historical examples people were concerned about. Because yeah of course that's ridiculous, it's "boiling a frog" by throwing it in already boiling water, that's not how it works. If anyone has freedom-reducing longer term plans for use of passkey attestation, the emphasis is on "longer term", being malicious doesn't mean being stupid. Step 1 is obviously getting people into the passkey ecosystem and out of passwords at all, which could well take years. And importantly as much as possible into closed passkey ecosystems. This is indeed one of the initial danger signs, because the author:

>iCloud Keychain, Google Password Manager, 1Password, Bitwarden

Is mixing together things that aren't like the other. Quick author, what's the EXPORT story for each of these ecosystems? Of those, Bitwarden can export a passkey into a plain JSON if you want. Do the others support that too, or at best only "app to app" encrypted transfer, creating a closed ecosystem? Already, can I get passkeys from iCloud/Google/1Pass into KeePass? Or is this restricted """for my protection :^)"""?

Author doesn't even touch on the lock-in that's already beginning. And right now everyone can technically claim "oh no of course you're not locked in! You just have to use an official option, or you can merely visit hundreds of sites individually and register new passkeys in all of them". Is it hard to see how players like Bitwarden would be pressured on continuing to offer plain export?

Then when most of the population is using passkeys everywhere in a closed ecosystem, now what is the response if friction slowly starts getting added. OK, you can still use what you like, but only export to other approved players. OK, you can still use unattested, but it's off by default now, "advanced users" can go enable it with this checkbox in the settings. OK, manual is still an option, but now it's buried deep and behind dark patterns and requires a text command. Hi everyone, we have statistics to show that only 0.85% of our users still use unattested keys. The support burden and security risk is now too high."

Like, we've seen this movie before.

>IMHO, that also should be addressed from the legal perspective very strongly

Then do that FIRST (or at the same time). Don't give us, yet AGAIN, the tired bs song and dance about how you'll make things worse first and then totally someday address the other part properly, and oops what a surprise that turns out to be too hard nevermind.

>But forcing Safari for every Apple owner is certainly not the solution.

Objectively it is a solution though. Because it's been done, and it's been more effective than nothing, while meanwhile nothing has happened from a legal or political angles. If a better solution can be done down the road great, but a hack dealing with a problem non-optimally can absolutely be better then just having the problem completely unaddressed. And count me skeptical that any government is going to have the will or capability to actually address what a lot of us already hate about not just the Chrome monopoly but that entire approach (I don't in fact want my web browser to be a full lowest common denominator operating system with low level hardware access thanks). I dislike much of what Apple does now but I'm glad their selfish interests have happened not to align that way either. Until monopoly lock-in gets better addressed, one of the main ways to push back is via another monopoly lock-in that has different incentives.

>You can easily have you own configuration without logging in.

Are you trying to gaslight/troll us now? Separate user accounts is precisely the mechanism of having your own configuration on a multiuser system. Log out of Hacker News right now (or open in a private window or whatever), and then tell us how to "easily" configure showdead/noprocrast/topcolor etc without an account. How do I sit down at my Mac or BSD or Linux machine and have everything the way I want with no logging in?

Seriously, what the fuck are you talking about?

>Because the minimum wage under US law for a tipped job is $2.13/hour and most find it socially and morally problematic to deny that person their primary source of income.

This is a common but incorrect meme and misunderstanding. Setting aside that the federal min wage of $7.25/hr is a universal floor and states can (and many do) go much higher, the difference for tipped jobs is that it becomes a "guaranteed minimum" instead of "guaranteed payment". Ie, for an untipped job, the employer must simply pay minimum wage or higher, period. For a tipped job, the employer must pay the $2.13/hr no matter what, but if the amount of tips the employee gets plus averages out to being equal or greater than $7.25/hr the employer doesn't need to pay more. However, if the employee does not get enough tips to reach $7.25/hr, the employer must make up the difference. So ultimately nobody is allowed to end up with less than minimum wage. The law just allows a different path to get there for tipped employees. If nobody tipped at all, employees would still get minimum wage (or higher).

Of course, it's completely reasonable to argue that federal minimum wage itself is disgustingly low. It doesn't auto-adjust to reflect inflation, and the highest purchasing power it ever had was back in 1968. Congress last increased it to $7.25 in 2009 and has left it that way 17 years later. Even by official definitions of the federal poverty line (themselves grossly outdated underestimates), minimum wage is below it. But it's still not good to confuse the matter by claiming any employer is legally allowed to let their employees end up with below minimum wage (that some certainly break the law is important too of course).

Edit: Straight from the horse's mouth (department of labor's FLSA page):

>The Fair Labor Standards Act (FLSA) requires payment of at least the Federal minimum wage to covered, nonexempt employees. An employer of a tipped employee is only required to pay $2.13 an hour in direct wages if that amount plus the tips received equals at least the Federal minimum wage, the employee retains all tips and the employee customarily and regularly receives more than $30 a month in tips. If an employee's tips combined with the employer's direct wages of at least $2.13 an hour do not equal the Federal minimum hourly wage, the employer must make up the difference.

>Some states have minimum wage laws specific to tipped employees. When an employee is subject to both the Federal and state wage laws, the employee is entitled to the provisions which provides the greater benefits.

>Arguably, you'd still have better productivity had you not have to sign-in.

No, that is not arguable for anyone who takes more than a few seconds to think about it. Signing in has nothing to do with authentication, it's about things like "I want to have my own preferences set for showdead/noprocrast/etc. I want to maintain my own lists of favorites." Authentication & security are about making sure others don't access/alter your account or use your property or the like without permission, not about there being infinite resources and everyone being perfectly identical.

>So you are still making a trade-off

Nope.

>You are paltering.

No, I'm honestly engaging with the topic and your post, vs tossing around insults.

>The premise was not to enhance security, but to design a world where security and productivity are not tradeoffs.

And I gave you examples, including engaging with your own example/question. You claimed that "most people would certainly be more productive if they hadn't had to authenticate themselves". But IDing and authenticating are different operations, people would need to ID regardless even in a world where no security was necessary. So if the marginal cost of auth over ID is zero, then by definition that means there is no tradeoff between security and productivity. Something like a security key/card is an example of accomplishing that. Plugging that in and typing 6 numbers or touching it is not merely no extra effort vs typing my user name alone, it's literally faster.

And again to other examples, anything transparent to the user is, again, by definition not an impact on productivity. For another not merely "common" but "near universal" example, see full disk encryption (which is now often the default even with no authentication at all). FDE definitely addresses a few classes of threat scenario. What do you argue is the tradeoff in productivity?

>So did the Democrats.

How did Democrats have the choice of Haley vs Trump?

>Absolving them of fault and putting 100% of the blame on Trump voters is the fantasy of the Left.

No, it's sanity of the remaining non-radical Right, and has nothing to do with the Left at all. The Democrats were not in charge of the Republican primary. Only Republicans were. Only Republicans were responsible for Trump being their coalition's nominee, all three times. They had every possibility to eliminate him with no Democrat input at all. They wanted him as POTUS vs every single other Republican possibility in a nation of hundreds of millions of people, that's all there is to it.

>I would love to hear about a world where security and productivity are not counter acting forces.

Well, it's this one? Or at least for a wide array of practices. To take a trivial example, can you explain how switching encryption from DES to AES (a clear improvement to security) is counteractive to productivity? Of course not, whether it's AES or ChaCha20-Poly1305 or ROT13 the choice of underlying cipher is transparent to the higher level user/application. Or how about reducing memory overflow bugs? That improves security, while also reducing a certain class of crashes. How is reducing software crashes counteractive to productivity?

Even if we take your silly example you clearly intend as a gotcha:

>For a start, most people would certainly be more productive if they hadn't had to authenticate themselves.

People have to identify themselves though in a multi-user environment anyway. Even completely putting aside any sort of security, we all of course have our own preferences for work environment, our own collections of data, etc etc etc. Duh. When we access a system (be it via GUI or CLI or web site) we need to say "I want to use xyz account" anyway. So the marginal cost to auth well can be zero. Using a password manager means "entering user name" and "entering user name and password at the same time" both have the exact same cost: 1 click of a button. Or if using a smartcard/USB PIV token or the like instead, it again can be the same effort: insert it, tap something.

Certainly it's true that sometimes there are unavoidable tradeoffs. But there's a lot of low hanging fruit where things can be made more convenient/productive and more secure at the same time.

>In this particular case the credit goes go the opposite side. They screwed up so much as to make this possible.

I'm sorry, but this is complete horse manure, albeit it's become a favorite fantasy/apologist/woe-is-me take on the right as the Trump disaster continues to unfold. But the opposition had NOTHING to do with Trump being chosen for POTUS. The Right had a perfectly decent choice: Nikki Haley. She had plenty right policies and no doubt would have made much of the left very upset, but she is also intelligent, sane, and cares to the normal degree about the country and basics of the constitution. She'd have been fine. She'd also have trivially creamed Democrats, and be holding Congress vastly better fwiw.

But out of the entirety of the US, only a single state (Vermont) voted against Trump. Every single last bit of the rest of the country chose Trump. There were no Democrats on the list for the Republican primary. Republicans could have sent Trump packing no problem, and then taken the WH and a bigger chunk of the House/Senate to boot. Trump being in the general and then WH was and forever will be 100% on the GOP.