Will Palmer

every time I look into increasing my security slightly, I am faced with options that are somewhere along the lines of: 1. a definite improvement 2. a possible improvement if I jump through a bunch of hoops 3. containing a giant obvious hole which completely invalidates (1) and (2), is apparently completely standard practice across all industries, and the only work-around would be to manually perform a line-by-line audit that I am not qualified to do.

I think my opinion on generative #AI can be summarised as: If you only imagine a technology to be used in a way that billionaires want it to be used, of course it's going to sound awful.

"Automate the job you have, so you can do the one that's in your contract" - not sure if motivational, but I do like automating tasks.

I don't see a point in migrating to #Firefox if I then log in to everything the same way, resulting in the same level of tracking and cross-site identity association. This has made me picky about what I use Firefox for, to the point that I just rarely use Firefox outside of "private mode" (which I have set to open by default as my url handler)

Continued use of chrome winds up being an admission of the state of tracking. "If I'm going to be tracked, I may as well benefit from convenience"

@Mer__edith@mastodon.world I am always one to tout that security, privacy, and error-prevention, not only have a lot of overlap, the implementation details are the same. ie: don't make the wrong thing difficult to do, make it impossible to do.

@Mer__edith@mastodon.world "being correct" by itself isn't a strategy, but perhaps an important point is: whenever something is an extremely obvious example of why strong privacy is important, don't hesitate to point out the obvious. random example: LastPass was hacked. If they had strong privacy by default, this would not have been nearly as big of an issue. And they, ostensibly, *do* encrypt. But by considering some things to fall outside of "strongly private by default", it's much worse.

@pixelpusher220@universeodon.com @Jakeout@mastodon.social @jake@fediverse.jarv.is @jensimmons@front-end.social there are behavioural issues, but if there is no protocol-level support for a good solution, then being a bad-actor becomes the default. Good protocols can make it so that good behaviour is easy to the extent that bad behaviour looks suspicious.

@pixelpusher220@universeodon.com @Jakeout@mastodon.social @jake@fediverse.jarv.is @jensimmons@front-end.social a shorter way of saying that would be: in summary, not very well, which is among the reasons why I think that mastodon needs serious work around identity management, with identity migration being a prime example of an important use-case.

@pixelpusher220@universeodon.com @Jakeout@mastodon.social @jake@fediverse.jarv.is @jensimmons@front-end.social it would allow opportunity for identity verification means to be distributed beforehand through a well-known location, meaning that it could be more-readily known beforehand. In the event of sudden dismissal / lock-out, others may already have what amounts to a "migration token" available to them. Of course, bad actors could update the key id after the fact, but this would not erase history.

@pixelpusher220@universeodon.com @Jakeout@mastodon.social @jake@fediverse.jarv.is @jensimmons@front-end.social good protocols leave room for extensions that others can use to fill gaps. I suppose the Mastodon equivalent would be the "metadata slots". One could theoretically fill those with a PGP key ID, but those are traditionally tied to email, which is these-days considered private.

@pixelpusher220@universeodon.com @Jakeout@mastodon.social @jake@fediverse.jarv.is @jensimmons@front-end.social if anyone ever says "reputable people won't do that" it is a guarantee that there are serious issues on the protocol level.