[GNU/consensus] Why support "Reset the Net" ? I don't get it

[carlo von lynX]

Heya.. I saw the FSF logo on the
https://www.resetthenet.org page.

Yet the things the page recommends are band-aids.
If it was that simple we could have done such a
campaign the same day the revelations came out.

- 1st of all, the main problem is mail and chat,
so you don't solve that by HSTS

- The recommended solutions for mail and chat
are obnoxious for normal users to install and
will be obsolete in a year or so, since no-one
should stick to mail and chat that does not
protect the social graph "meta" data.

- The idea that all HTTP sites should upgrade
to HTTPS, without at least convincing one CA
to hand out free *.domain certificates, is just
an amazing promotional campaign for the CA industry.

- HSTS is the greatest of all band-aids, much weaker
than DANE, still if you use it wrong you condemn
yourself to buying certificates for potentially a
veeery long time. Would be better to go for the
less bad band-aid: DANE.

- Would be better if the web browsers were supporting
proper pinning of self-signed certificates. Or
supporting cacert.org so people can reasonably get
free certs. They can show the sites with a yellow
box instead of a green one (if Mozilla thinks cacert
is less safe, which in the current situation is a
ridiculous assertion anyway), but leaving the web in
a state of utter brokenness is sick.

- Would be better to fix the scalability of Tor hidden
services so we can use .onion instead of the broken
HTTPS thing. Or if that doesn't work, use GNUnet for
the "light web"

- Would be better to deploy opportunistic forward
secrecy implemented in JS over HTTP (naif has been
working on that)

- Would be better if campaign websites weren't themselves
collecting personal data before even saying anything
(the first thing it shows is a prompt to drop your
e-mail into a box.. very reassuring).

So I don't see the point in a superficial campagin that
doesn't actually fix anything about the status quo, instead
it is likely to foster further damage by not offering long-term
solutions.

If you think this makes sense, please forward it to the
appropriate people in the FSF and other listed organizations.

Best,

[Michael Rogers]

- The recommended solutions for mail and chat are obnoxious for
normal users to install and will be obsolete in a year or so, since
no-one should stick to mail and chat that does not protect the
social graph "meta" data.

Be careful about inferring 'will' from 'should'. ;-) I bet you a
bitcoin we're both still using email this time next year.

Cheers,
Michael

[carlo von lynX]

Post by Michael Rogers
Be careful about inferring 'will' from 'should'. ;-) I bet you a
bitcoin we're both still using email this time next year.

I don't own that much bitmoney, but saying that e-mail will be
obsolete doesn't mean it takes less than a year to get rid of it.

I am saying we'll have something better soon, and then it depends
on how quickly people adopt it. This very mailing list may have
become very quiet next year... because we migrated to something better.

[Michael Rogers]

Post by carlo von lynX

Post by Michael Rogers
Be careful about inferring 'will' from 'should'. ;-) I bet you a
bitcoin we're both still using email this time next year.

I don't own that much bitmoney, but saying that e-mail will be
obsolete doesn't mean it takes less than a year to get rid of it.
I am saying we'll have something better soon, and then it depends
on how quickly people adopt it. This very mailing list may have
become very quiet next year... because we migrated to something better.

If email will still be around next year (and in ten years) then
improving the security of email isn't a wasted effort. The world is
full of obsolete systems that we maintain and patch until we can
finally get rid of them - Linux, representative democracy, TCP/IP,
nation states...

I *should* be using Qubes, but I still install security patches on my
Linux box, and I'm grateful that someone wrote those patches.

You spend a lot of energy criticising people for working to improve
obsolete systems - I guess you think they should be working on
replacement systems instead. But both are valuable. We need to improve
email *and* replace it, because even if the whole world starts using
Pond tomorrow, email (and HTTP, and all the other obsolete junk) will
be around for a long time.

Cheers,
Michael

[carlo von lynX]

Post by Michael Rogers
If email will still be around next year (and in ten years) then
improving the security of email isn't a wasted effort. The world is

Yes it is wasted, because if you need to install a software to have
secure email it should't try to use SMTP underneath. It's pointless.
There is no gain in encrypted e-mail once a new system is available.

And it is a detrimental effort, teaching people to use PGP
- wastes some of their precious time and brain cells
- gives them a false sense of security
- builds up resistancies against embracing a proper solution
(the harshest negative reaction i always get from those that
somehow accepted the mess that PGP over SMTP is)

Post by Michael Rogers
full of obsolete systems that we maintain and patch until we can
finally get rid of them - Linux, representative democracy, TCP/IP,
nation states...

You mention 3 examples where you can't easily say there are alternatives
which are a lot better and it's silly not to use them.

Whereas for representative democracy, I believe it can be replaced.
Liquid democracy is a great prototype, it needs refinement.
Unlike the new distributed mail system, LD still needs some brain time.

Post by Michael Rogers
I *should* be using Qubes, but I still install security patches on my
Linux box, and I'm grateful that someone wrote those patches.

Qubes is a Linux too, but an interesting one.
Can it be recreated fully from source?

Post by Michael Rogers
You spend a lot of energy criticising people for working to improve
obsolete systems - I guess you think they should be working on
replacement systems instead. But both are valuable. We need to improve
email *and* replace it, because even if the whole world starts using
Pond tomorrow, email (and HTTP, and all the other obsolete junk) will
be around for a long time.

That I think is the #1 fallacy the Internet is suffering from.
Band-aids are costing us enormous energy - especially since 99%
of competent people choose to focus on those, thinking they are
low-hanging fruit, which is also a fallacy - because they end up
getting tangled up in complexities that are worse then getting
started fresh from the new paradigms of the GNU internet.

Of course email will be around, but it is humbug to think of it as
something that could be secure. Just stop using it for anything
private. It's like saying we really really need postcard encryption.

[Andreas Kuckartz]

Post by carlo von lynX
I am saying we'll have something better soon, and then it depends
on how quickly people adopt it. This very mailing list may have
become very quiet next year... because we migrated to something better.

I really do not see much value in such promises about the future
adoption of an alternative to mail which allegedly will exist in the future.

Cheers,
Andreas

[J.B. Nicholson-Owens]

Post by carlo von lynX
Yet the things the page recommends are band-aids.

None of the problems you cite are easily fixed. The FSF can't easily get
people to stop using non-free software despite over 30 years of positing
robust counterarguments that rely on unchanging principles--ethics--and
demonstrating doing ethical computing via their own acts. That challenge
doesn't mean it's time to give up on software freedom.

Post by carlo von lynX
- The recommended solutions for mail and chat
are obnoxious for normal users to install and
will be obsolete in a year or so, since no-one
should stick to mail and chat that does not
protect the social graph "meta" data.

I won't argue that email is sometimes problematic but, as others have
pointed out, email isn't going away anytime soon (a lot of other stuff
depends on email). I'd also argue that decentralized approaches to
electronic communication should not go away because decentralization is
critical to regaining privacy by running one's own servers. I understand
that the FreedomBox hackers are working from this basis as well for the
services that computer will use.

Post by carlo von lynX
- The idea that all HTTP sites should upgrade
to HTTPS, without at least convincing one CA
to hand out free *.domain certificates, is just
an amazing promotional campaign for the CA industry.

Or one could consider the Firefox add-on that avoids using CAs
altogether. As I'm guessing you're aware, Moxie Marlinspike had a
lecture about the CA problem at the 2011 Black Hat security conference
titled "SSL And The Future Of Authenticity"[Future of Authenticity].
He's also behind the Convergence Firefox add-on[Convergence] which
offers a practical means of avoiding the CA system while still using
HTTPS websites.

Post by carlo von lynX
- Would be better if the web browsers were supporting
proper pinning of self-signed certificates. Or
supporting cacert.org so people can reasonably get
free certs. They can show the sites with a yellow
box instead of a green one (if Mozilla thinks cacert
is less safe, which in the current situation is a
ridiculous assertion anyway), but leaving the web in
a state of utter brokenness is sick.

Running a CA isn't easy and recommending any particular CA is risking
this part of one's message on the future behavior of that CA. If that
CA's methods fail and browser programmers remove that CA from the
browser, website admins who used that CA are left to pick a new CA. This
is the DigiNotar problem all over again.

Post by carlo von lynX
- Would be better to fix the scalability of Tor hidden
services so we can use .onion instead of the broken
HTTPS thing. Or if that doesn't work, use GNUnet for
the "light web"

Tor is great but this objection is a bit inconsistent with your
objections above -- it can't be that bad to expect non-technical
computer users to install a browser add-on if you're okay with expecting
them to switch to using Tor.

Post by carlo von lynX
- Would be better to deploy opportunistic forward
secrecy implemented in JS over HTTP (naif has been
working on that)

Javascript has its own problems for privacy protection. For example, JS
is quite powerful and capable of reading information which few websites
can legitimately justify collecting. JS can track mouse/keyboard
activity, for instance.

Post by carlo von lynX
- Would be better if campaign websites weren't themselves
collecting personal data before even saying anything
(the first thing it shows is a prompt to drop your
e-mail into a box.. very reassuring).

This is better directed at the people who run
https://www.resetthenet.org/ and not the FSF.

I have JS turned off by default in my browser, so if they're using JS to
hide some or all of the site until you submit an email address I never
noticed that. When I visited https://www.resetthenet.org/ I saw a direct
link to the WebM movie for the site, I was able to read all the text, I
could have downloaded the site graphics, and I was able to scroll
through the site information all without supplying an email address. I
really don't think I missed anything that site has to offer.

The FSF-written webpages which refer to the "Reset the Net" campaign:

https://fsf.org/blogs/community/reset-the-net
https://emailselfdefense.fsf.org/

do not ask for one's email address to read the FSF's take on the matter.



[Future of Authenticity]

Unfortunately I don't know of another source for this talk than YouTube
which, when used in the normal fashion, needs non-free JS to use.
Therefore I recommend not visiting the site in the normal way but
instead use youtube-dl to download the video, or turn off JS for YouTube
and visit this URL with the "UnPlug" Firefox add-on installed to get the
video.

[Convergence] http://convergence.io/

[carlo von lynX]

Post by J.B. Nicholson-Owens

Post by carlo von lynX
Yet the things the page recommends are band-aids.

None of the problems you cite are easily fixed. The FSF can't easily

What? It is difficult to add cacert.org to Firefox to name
one thing in the list?

Post by J.B. Nicholson-Owens
get people to stop using non-free software despite over 30 years of
positing robust counterarguments that rely on unchanging
principles--ethics--and demonstrating doing ethical computing via
their own acts. That challenge doesn't mean it's time to give up on
software freedom.

Did I say anything about that? Where is the context?
By the way, the FSFE has not adhered to resetthenet
for similar reasons to mine.

Post by J.B. Nicholson-Owens

Post by carlo von lynX
- The recommended solutions for mail and chat
are obnoxious for normal users to install and
will be obsolete in a year or so, since no-one
should stick to mail and chat that does not
protect the social graph "meta" data.

I won't argue that email is sometimes problematic but, as others
have pointed out, email isn't going away anytime soon (a lot of

I didn't say that. I said that it will be obsolete
because there will be a better alternative. I didn't
say fax machines disappeared instantly with the advent
of email. Pond is already out there, and soon there will
be at least one secure mail system that supports all the
use cases of e-mail.

Post by J.B. Nicholson-Owens
other stuff depends on email). I'd also argue that decentralized
approaches to electronic communication should not go away because
decentralization is critical to regaining privacy by running one's
own servers. I understand that the FreedomBox hackers are working
from this basis as well for the services that computer will use.

There is a big wrong assumption there. Your own server is not
owned by you. Your FreedomBox is, but the server that stands in
some rack and whose RAM is easily made available to authorities
isn't. That's why decentralization is no longer enough. We need
distributed systems.

Post by J.B. Nicholson-Owens

Post by carlo von lynX
- The idea that all HTTP sites should upgrade
to HTTPS, without at least convincing one CA
to hand out free *.domain certificates, is just
an amazing promotional campaign for the CA industry.

Or one could consider the Firefox add-on that avoids using CAs
altogether. As I'm guessing you're aware, Moxie Marlinspike had a
lecture about the CA problem at the 2011 Black Hat security
conference titled "SSL And The Future Of Authenticity"[Future of
Authenticity]. He's also behind the Convergence Firefox
add-on[Convergence] which offers a practical means of avoiding the
CA system while still using HTTPS websites.

Yes, unfortunately that exposes your interest in websites
to the Convergence network. Whatever you do, as long as the
website is identified by a domain name rather than a public key,
it's all band-aids. Still, what you suggest would be a better
band-aid than what resetthenet offers.

Post by J.B. Nicholson-Owens

Post by carlo von lynX
- Would be better if the web browsers were supporting
proper pinning of self-signed certificates. Or
supporting cacert.org so people can reasonably get
free certs. They can show the sites with a yellow
box instead of a green one (if Mozilla thinks cacert
is less safe, which in the current situation is a
ridiculous assertion anyway), but leaving the web in
a state of utter brokenness is sick.

Running a CA isn't easy and recommending any particular CA is
risking this part of one's message on the future behavior of that
CA. If that CA's methods fail and browser programmers remove that CA
from the browser, website admins who used that CA are left to pick a
new CA. This is the DigiNotar problem all over again.

You sound like you are not familiar with the cacert.org project.
And of course I'm not suggesting a long-term solution since there
IS no long-term solution that carries X.509 in its name.

Post by J.B. Nicholson-Owens

Post by carlo von lynX
- Would be better to fix the scalability of Tor hidden
services so we can use .onion instead of the broken
HTTPS thing. Or if that doesn't work, use GNUnet for
the "light web"

Tor is great but this objection is a bit inconsistent with your
objections above -- it can't be that bad to expect non-technical
computer users to install a browser add-on if you're okay with
expecting them to switch to using Tor.

Eh? Who said it is bad to expect people to install a browser add-on?
Also aren't we talking about a major campaign? Shouldn't we be
as a campaign powerful enough to make Mozilla ship with Tor?

Isn't that a much more realistic goal than to sell certificates to
millions of websites that couldn't afford them as yet?
I mean, if a website doesn't have https these days it might be
because of the price tag. Making a campaign for these people
to please spend money in certification could be insulting.

Post by J.B. Nicholson-Owens

Post by carlo von lynX
- Would be better to deploy opportunistic forward
secrecy implemented in JS over HTTP (naif has been
working on that)

Javascript has its own problems for privacy protection. For example,
JS is quite powerful and capable of reading information which few
websites can legitimately justify collecting. JS can track
mouse/keyboard activity, for instance.

Yes, I agree, also because you are off-topic.
PFS over JS is better than nothing and it costs less
then certification.

Post by J.B. Nicholson-Owens

Post by carlo von lynX
- Would be better if campaign websites weren't themselves
collecting personal data before even saying anything
(the first thing it shows is a prompt to drop your
e-mail into a box.. very reassuring).

This is better directed at the people who run
https://www.resetthenet.org/ and not the FSF.

They heard the message and didn't change anything.
Maybe if the FSF tells them, it would matter.
But if just about everything is wrong about that website
why should I expect to be able to convince these folks to
take it down? But since I spend lifetime dedicating software
to the FSF, maybe I can expect something from the FSF?

Post by J.B. Nicholson-Owens
I have JS turned off by default in my browser, so if they're using
JS to hide some or all of the site until you submit an email address
I never noticed that. When I visited https://www.resetthenet.org/ I

You're again talking of things I didn't say. I didn't see the video
because the first thing I saw was a big box asking for my email address.
I was mostly attracted by "The solution" because it was obvious
there couldn't possibly be a real solution there, and so there wasn't.

Uh oh, even Edward and Bruce have praised the project saying that
it will do some good. I wished it was so. Who gets to decide what
the things are that resetthenet promotes? How do we get it to make
more reasonable recommendations? Democracy? Meritocracy? Or just
oligarchy?

Now that I saw the video... well yes, it is actually very beautiful.
Why o why is it so hard to make recommendations that actually
make sense?