• 6 Posts
  • 98 Comments
Joined 11 months ago
cake
Cake day: July 9th, 2023

help-circle
  • You are conflating the concept and the implementation. PFS is a feature of network protocols, and they are a frequently cited example, but they are not part of the definition. From your second link, the definition is:

    Perfect forward secrecy (PFS for short) refers to the property of key-exchange protocols (Key Exchange) by which the exposure of long-term keying material, used in the protocol to authenticate and negotiate session keys, does not compromise the secrecy of session keys established before the exposure.

    And your third link:

    Forward secrecy (FS): a key management scheme ensures forward secrecy if an adversary that corrupts (by a node compromise) a set of keys at some generations j and prior to generation i, where 1 ≤ j < i, is not able to use these keys to compute a usable key at a generation k where k ≥ i.

    Neither of these mention networks, only protocols/schemes, which are concepts. Cryptography exists outside networks, and outside computer science (even if that is where it finds the most use).

    Funnily enough, these two definitions (which I’ll remind you, come from the links you provided) are directly contradictory. The first describes protecting information “before the exposure” (i.e. past messages), while the second says a compromise at j cannot be used to compromise k, where k is strictly greater than j (i.e. a future message). So much for the hard and fast definition from “professional cryptographers.”

    Now, what you’ve described with matrix sounds like it is having a client send old messages to the server, which are then sent to another client. The fact the content is old is irrelevant - the content is sent in new messages, using new sessions, with new keys. This is different from what I described, about a new client downloading old messages (encrypted with the original key) from the server. In any case, both of these scenarios create an attack vector through which an adversary can get all of your old messages, which, whether you believe violates PFS by your chosen definition or not, does defeat its purpose (perhaps you prefer this phrasing to “break” or “breach”).

    This seems to align with what you said in your first response, that Signal’s goal is to “limit privacy leaks,” which I agree with. I’m not sure why we’ve gotten so hung up on semantics.

    I wasn’t going to address this, but since you brought it up twice, running a forum is not much of a credential. Anyone can start a forum. There are forums for vaxxers and forums for antivaxxers, forums for atheists and forums for believers, forums for vegans and forums for carnivores. Not everyone running these forums is an expert, and necessarily, not all of them are “right.” This isn’t to say you don’t have any knowledge of the subject matter, only that running a forum isn’t proof you do.

    If you’d like to reply, you may have the last word.




  • I think this conflates “ecosystem” with “closed ecosystem” or “walled garden.”

    I agree that closed ecosystems are frustrating lock-in tactics. But open ecosystems exist - KDE connect actually shows a good example. It was built for the KDE ecosystem (desktop environment, apps, and services that integrate and work well with each other), but makes the protocol open, so clients can exist for Gnome, and other platforms.

    I recognize this is mostly semantics, but wanted to call it out because I think the integration and interoperability afforded by an “ecosystem” is extremely user friendly in general. It only becomes a problem when it is weaponized to lock you in.







  • This is not entirely correct. Messages are stored on their servers temporarily (last I saw, for up to 30 days), so that even if your device is offline for a while, you still get all your messages.

    In theory, you could have messages waiting in your queue for device A, when you add device B, but device B will still not get the messages, even though the encrypted message is still on their servers.

    This is because messages are encrypted per device, rather than per user. So if you have a friend who uses a phone and computer, and you also use a phone and computer, the client sending the message encrypts it three times, and sends each encrypted copy to the server. Each client then pulls its copy, and decrypts it. If a device does not exist when the message is encrypted and sent, it is never encrypted for that device, so that new device cannot pull the message down and decrypt it.

    For more details: https://signal.org/docs/specifications/sesame/


  • Google is certainly guilty of killing off lots of products, but:

    The video demonstrates the ecosystem working now, using features that have existed for years, most of which work across hardware platforms from multiple vendors, as well as multiple operating systems (i.e. features that won’t disappear on Google’s whim, because they don’t actually control the tech, they leverage open standards, etc).

    Let’s also not pretend like Apple has never killed a product, service, or feature. Ecosystems grow, shrink, and change all the time. If you prefer one offering over the other, use it. That’s the entire point of the video.




  • Because of the rotary valves and trigger? Or for some other reason?

    If that’s the only difference you’re calling out, it’s worth noting rotary valves and triggers show up on other instruments as well. In particular, tubas often have rotary valves, and it’s not uncommon to see trigger valves on trombones.

    Having played both piston valves and rotary, the difference is negligible.



  • “Desktop publishing” is the category of software you want. I’ve not used it, but I believe Scribus is the standard FOSS tool for this. If you want a simple graphical way to make your album, this is the way.

    Many people have metnioned LaTex - I would not recommend it for this purpose. LaTex, while powerful, will have a steep learning curve, and isn’t really made for artistic tasks - its purpose is for writing technical papers. From literally the first two sentences on the project site:

    LaTeX is a high-quality typesetting system; it includes features designed for the production of technical and scientific documentation. LaTeX is the de facto standard for the communication and publication of scientific documents.

    It’s probably possible to make a beautiful photo album with LaTex, but without a lot of work, it’s more likely to come out looking like a calculator manual.



  • This kind of reminds me of Crispin Glover, from Back to the Future. He tried to negotiate a higher pay for the second movie, so the producers hired a different actor to play the role, but deliberately made the actor up to look like Glover. In response, Glover sued the producers and won. It set a critical precedent for Hollywood, about using someone’s likeness without consent.

    The article mentions they reached out to her two days before the launch - if she had said ‘OK,’ there’s no way they could have even recorded what they needed from her, let alone trained the model in time for the presentation. So they must have had a Scarlett Johansson voice ready to go. Other than training the model on movies (really not ideal for a high quality voice model), how would they have gotten the recordings they needed?

    If they hired a “random” voice actress, they might not run into issues. But if at any point they had a job listing, a discussion with a talent manager, or anything else where they mentioned wanting a “Scarlett Johansson sound-alike,” they might have dug themselves a nice hole here.

    Specifically regarding your question about hiring a voice actor that sounds like someone else - this is commonly done to replace people for cartoons. I don’t think it’s an issue if you are playing a character. But if you deliberately impersonate a person, there might be some trouble.