Conversation

Notices

  1. # and # developer Mike Macgirvin listed some of the challenges of # between web apps
    http://qttr.at/1s0v

    Tuesday, 11-Apr-17 10:25:40 UTC from quitter.se
    1. @strypey :]

      > Can you retract a private mail message? How?
      No. Not in any openly federated system because of the laws of physics (you know, time only goes forward etc.).

      > Can you retract a post? How?
      No. Not in any openly federated system because of the laws of physics (you know, time only goes forward etc.).

      The answers are also true for any other, also closed and centralised, system eventually being sent (copied) to any machine the message author does not control.

      Tuesday, 11-Apr-17 10:45:27 UTC from social.umeahackerspace.se at 63°49'42"N 20°15'34"E
      1. @mmn assuming that the federation of servers doesn't have a protocol for tracking what server(s)/ account(s) a mail or post was delivered to

        Tuesday, 11-Apr-17 10:49:28 UTC from quitter.se
        1. @mmn and a protocol for the sending server requesting the receiving server(s) to delete the mail/post. I think # allows that? @bob

          Tuesday, 11-Apr-17 10:50:22 UTC from quitter.se
          1. @strypey Yeah, but as you don't control the remote server you have no guarantee whatsoever that the protocol is actually fulfilled.

            I'm guessing the trick to ignore these retractment requests are about 1 commented line in # for example. (not to mention backups etc. etc.)

            Tuesday, 11-Apr-17 11:09:39 UTC from social.umeahackerspace.se at 63°49'42"N 20°15'34"E
          2. @strypey For example !GNUsocial allows for remote deletion but there is no guarantee that anyone cares about the requests. Take older # installations for example, they don't support the 'delete' verb.

            Tuesday, 11-Apr-17 11:10:31 UTC from social.umeahackerspace.se at 63°49'42"N 20°15'34"E
            1. @mmn I think was the point of Mike's question in the set you were quoting from ;)

              Tuesday, 11-Apr-17 11:27:37 UTC from quitter.se
              1. @strypey ...but he uses it as a selling point for # that everything is ultramegasuperprivate and whenever you delete something from one place it's gone everywhere etc. etc. which makes me a bit doubtful.

                Tuesday, 11-Apr-17 11:33:38 UTC from social.umeahackerspace.se at 63°49'42"N 20°15'34"E
                1. @mmn I share these concerns. I think part of the problem is that our language for discussing these issues is currently limited...

                  Tuesday, 11-Apr-17 11:55:58 UTC from quitter.se
                  1. @mmn to some cartoonishly vague terms like "private", "secret", and "secure"

                    Tuesday, 11-Apr-17 11:56:41 UTC from quitter.se
                    1. @mmn let's say if I want to keep online comments about my non-mainstream sexual fetishes "private". How "private" they need to be depends...

                      Tuesday, 11-Apr-17 11:58:16 UTC from quitter.se
                      1. @mmn on whether people finding out will result in a) embarrassment b) losing my job c) my family rejecting me d) thugs beating me to death

                        Tuesday, 11-Apr-17 11:59:16 UTC from quitter.se
                        1. @mmn in the case of a) even the "private" message option in a proprietary SaaSS offering is probably enough...

                          Tuesday, 11-Apr-17 12:00:46 UTC from quitter.se
                          1. @mmn but if it's d) users should realise nothing involving an internet-connected computer can be "secure" enough to guarantee "privacy"

                            Tuesday, 11-Apr-17 12:04:09 UTC from quitter.se
                        2. @strypey I gave a talk on this exact distinction a couple of years ago. My aim was to scrape together a useful definition of privacy, which was ultimately this: "Privacy is having control over who gets what information when." —the context around that being that someone who sends naked selfies on SnapChat has a very different interest in who sees what than Edward Snowden. If you want to maximise privacy you have to maximise the ability to pick and choose, fine-grained.

                          Tuesday, 11-Apr-17 12:07:18 UTC from gs.sdf.org
                          1. @thomask infosec folks and (sometimes) activists understand granular 'threat models', but I feel like a whole new set of terms is needed

                            Tuesday, 11-Apr-17 12:09:51 UTC from quitter.se
                            1. @thomask each term could be used as a prefix before "private" or "secure" to indicate the risk level involved. Eg a) could "blush-privacy"

                              Tuesday, 11-Apr-17 12:10:59 UTC from quitter.se
                              1. @thomask d) could be "death-privacy"

                                Tuesday, 11-Apr-17 12:11:19 UTC from quitter.se
                              2. @strypey Interesting idea. I'm not sure how you would break down the different cases but it would be a good project for some researcher.

                                Tuesday, 11-Apr-17 21:38:08 UTC from gs.sdf.org
                      2. My suggestion is that you use a pseudonym for your sexual fetish discussion (in case this is confidential) that has no connection (tor etc. helps jere) with your actual account instead of rely on sysadmins and developers to be perfect beings.

                        Tuesday, 11-Apr-17 13:52:16 UTC from social.umeahackerspace.se at 63°49'42"N 20°15'34"E
                        1. @mmn a person in this hypothetical would use a nym, but that's only as helpful as the "secure" tools that sandbox it from their flesh self

                          Wednesday, 12-Apr-17 02:45:46 UTC from quitter.se
                          1. @mmn again, the level of acceptable security risk is very different depending on the worst case scenario; eg embarrassment vs. death

                            Wednesday, 12-Apr-17 02:48:44 UTC from quitter.se
            2. @mmn having said that, you can't trust that any other server will implement any protocol properly.

              Tuesday, 11-Apr-17 11:28:16 UTC from quitter.se
              1. @mmn yet most email gets delivered, and here we are chatting between different servers, so...

                Tuesday, 11-Apr-17 11:28:49 UTC from quitter.se