No matter how much investors and tech companies want you to believe that they are on the verge of super intelligence, nothing I've seen to date can not easily be explained by "correlation engine", including the "novel" math solutions, all of which appear to just be "a composition of solutions humans have developed and documented elsewhere" upon deeper inspection.

I remember, after the Snowden leaks, when anyone warned that governments could use the patriot act and the various other "intelligence" power grabs to destroy democracy and implement totalitarian dictatorship, they would be deemed insane conspiracy theorists. The hilarious part is most of them (including me) were warning about a distant future... yet it barely took a decade for America to collapse into fascist populism, declare ANTI-FAscists the real terrorists, and turn the surveillance apparatus against them.

No it's not. The point of E2EE is that only the client apps decrypt/encrypt content, and the server just processes the encrypted bits. Most E2EE service providers do this by encrypting your encryption key. That's how you can login on other devices without you having to store and import an encryption key every time. When you login they send you an encrypted blob that contains your encryption key, which is decrypted client side, then the key is used to decrypt your data locally on the client. This does not break E2EE, but it does mean you have to trust the provider, which is why most of them are entirely open source.

Sharing and emergency access also use similar public key cryptography techniques to provide shared access to E2EE data. A similar principle applies to your phones encryption aswell, and is the reason you can wipe/reset your device in seconds, instead of minutes/hours. They only wipe the encryption key; not the encrypted data.

It's not necessarily more secure than managed providers either, simply because you are probably not a security engineer, and have far less resources to secure your server. It does prevent Google/iCloud from scraping your data, but it certainly does not mean Hetzner can't access your data. They control the overarching hypervisor and control plane managing your servers/VM's, so there's no way to know what capabilities have been implemented. The majority of what intelligence agencies are capable of has not been leaked or documented publicly.

There is no reason why E2EE services can't provide recovery or emergency access mechanisms, or implement plaintext export functionality from clients for storage elsewhere. Most reputable providers already have functionality to enable recovery and backup.

IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It should be standard for anything hosted on someone else's computer.

You might argue it's not neccessary for cat photos, but mistakes happen and you can accidentally upload things you don't intend to. You might argue it's not neccessary for games, ebooks or other copyrighted media, but the cloud provider could scan and delete anything you own that matches a hash of copyrighted material, at any time. You can accidentally paste a password, or other sensitive piece of text, into any text field of any website or application, and have it distributed to computers around the world.

E2EE can mitigate against numerous attack vectors, and reduces the surface area and blast radius of most attacks. That also applies to your own computers, if someone steals your hardware or hacks into your network. It is vital in the age of AI where all of your data could be exploited for training and profit, or used against you. The only data that should not be E2EE is situations where it is technically impossible, or the data is explicitly shared as "public" (e.g. the clearnet).

All current age verification measures open up a torrent of attack vectors on user PII and privacy. Limiting the number of entities that are able to access data is one of the best ways to prevent it's leak or abuse. Don't let perfection be the enemy of good.

But therein lies the fundamental problem with surveillance capitalism. Until the sale of personal data/metadata is outlawed, the practice of targeting content based on an individuals personal data/metadata is outlawed, there is a highly punitive cost for violations and leaks that make storage outside core business functionality a major criminal and financial risk, and the compilation of this data by "intelligence" agencies it treated as a critical attack vector to national security – the attack on each citizens civil rights that it truly is – most privacy laws and regulations are just virtue signals designed specifically avoid the root causes, and further entrench the power of monopolies and incumbents.

FYI I don't believe Google sells user data. They sell products which leverage user data to give them a critical advantage over every competitor who does not have trackers in everyones pockets/computers, does not store their entire web search/browsing history, etc. It's in the interest of big tech to protect their market advantage (like ZKP, which would prevent competitors from having a new gov-mandated vector to compile user data).

"Your papers, please"

Here's your problem. This is not a consumer or Apple-specific issue whatsoever. Computing hardware is critical infrastructure in the digital age. The AI boom is inflating the cost of almost all compute for every business, including the cost of all cloud computing.

It's alot like housing, in that the average cost of housing directly inflates the average cost of living, impacting the poorer many orders of magnitude more than the richer. When all governments, companies, and individuals depend on computers to amplify productivity or deliver services, a significant increase in price will impact every government, company, and indiviudal.

An extremely small number of individuals or orgs being able to dramatically impact critical infra, and the cost of living – regardless of why – is a major national security and supply chain failure. This is the entire reason why monopolies and too-big-to-fail entities are bad for everyone, and anti-trust laws were created to being with; to prevent an extreme minority from influencing markets in such a way that it is detrimental to consumers and other market players or sectors.

Treat yoself Tim Apple!

This is why I've voted with my wallet the only way I can, by moving all of my investments (including retirement) out of the American market. The rot is far too deep. The few bad apples have entirely spoiled the bunch. I'm not under any illusion other markets will be safe from the fallout, or that I'll make better returns long term, but I do not care. I'm voting the only way I can given the current system. If I'd moved my investments earlier, when I came to this conclusion, I would have actually made significantly larger gains over the last couple of years.

Considering the ties to Palantir and America's mass surveillance apparatus, one could even argue that a primary goal of the admin could be to use the USA's current AI lead to accelerate the adoption of web ID laws, and global push to deanonymize all web traffic.

I'm arguing FOR a base level of empathy and care FROM maintainers WHO CHOOSE to build for-profit products in the open, and that empathy for all parties should be the base expectation from a healthy community, rather than the narcissistic view of "nobody owes their communities anything, regardless of context".

The narssisist view leads to the behaviour of Minio, Bambu, etc becoming an accepted norm; to the abuse, exploitation, and deterioration of open source communities by for-profit orgs.

Just noticed who you are. Big fan of you're work and approach to problem solving! Do you have any similar posts about alternative protocols in this space, like nostr et al?

I've been ruminating on the incorporation of censorship resistance by adopting core concepts from tor/I2P and Monero using cryptographic techniques for validation and obfuscation that enable users to subscribe to specific communities, chatrooms, or channels within a PDS, so they also operate like private/public-PDS's to replace messaging providers with a uni/multi/any-cast rss. The reason I think this should coexist in the same protocol is that if the hosting provider itself is untrusted by default, and all comms are E2EE between all consumers from the ground up (public comms could contain a decryption key in the response, or one assembled by relays), the individual hosting providers can't choose to selectively filter or censor individual comms they disagree with at any layer, because they can't see the speech, where it's coming from, or where it's going; even for publicly broadcasted comms, until at least after the response has been transmitted to relays (enforced by the protocol).

It's analogous to saying "it's your fault because you didn't read the T&C's", when all the T&C's you've implicitly agreed to already would take more than a human lifetime to read and understand. That is not a reasonable implication or expectation for the vast majority of people, the vast majority of the time; therefore it is logically corrupt, and should not be entertained.

This is ofcourse a fair point of view for 1-few person codebases built for fun, or to solve their own problems, open sourced out of the kindness of their hearts, but when the open source code is built or maintained as part of a job function (receiving a paycheck) &/or to generate profit (either directly or indirectly to influence standards, gain market share, etc) the open-sourcing is more of a means to build trust and becon attention or adoption in the age of relentless enshittification.

Open sourcing should not be an accepted path for profit seeking orgs or individuals to exploit and screw over consumers, as though they are eternal beta testers whose trust and dependence are worthless externalities. It also completely ignores the time and effort consumers must invest themselves to learn your product, workaround any errors, and build it into their workflow. That is arguably worth significantly more than whatever fee they could pay you for your code.

How the system has self-corrected to empower the most greedy and sociopathic of behaviours, across all private and public institutions, the entire time; so much so that the average person can't even comprehend the root causes, or any solution beyond a simple band-aid non-solution.