Twitter has something like a half a billion users. So it wins I guess...

Comments URL: https://news.ycombinator.com/item?id=49270632

Points: 16

# Comments: 5

Comments URL: https://news.ycombinator.com/item?id=49270498

Points: 4

# Comments: 0

HTML email is just something that people semi-randomly do. It should be rejected/ignored if you are at all concerned about privacy and/or security.

Something like this would be good for transferring the public key(s) associated with some cryptographic messaging identity. This would allow that to happen entirely offline. The optical nature of the transfer would prevent a potential MITM. The idea that an identity is being transferred would be fairly easy to impart to the user.

So the lack of encryption would be a feature and not a bug. This would enable later encryption which could then use any medium for the transfer in a completely secure way.

* https://futurism.com/science-energy/us-military-gps-jamming-...

* https://briarproject.org/news/2026-maintenance-mode/

That isn't true for either thermal or electrical conductivity. So I don't know what is meant here.

The definition is quite clear. It does not apply when the implementation is not distributed by the same entity that creates it for example. There are other related issues but the message here is that web based cryptography has a particular weakness when it comes to things like end to end encrypted messaging which makes it so bad as to be worthless.

This effect was seen in the Apple vs FBI incident described in the article. The public perception of Apple as a brave defender of user privacy was greatly increased due to that dispute. For all we know, the FBI was in on the conspiracy. In return they might receive the fruits of such surveillance with the only limitation that they would have to disguise the source with parallel construction[2].

[1] https://en.wikipedia.org/wiki/Crypto_AG

[2] https://en.wikipedia.org/wiki/Parallel_construction

I think we should wait to see how the first satellite data centre works out. It seems fairly unlikely that it could be practical. It seems kind of nuts...

>Reflect Orbital, a US start-up, aims to launch a constellation of very large mirror-like satellites to provide sunlight at night, with reflected beams that span at least five kilometres on Earth's surface.

Straight up nuts with no practical value, even if it did work out.

>Clean-room design is usually employed as best practice, but not strictly required by law.

As the article points out, if this was actually true then we could change the licensing on code examples found in RFCs to fix the issue, but there doesn't seem to be any actual issue here. Imagine a world where simply reading some code caused licensing issues...

[1] https://en.wikipedia.org/wiki/Clean-room_design

The name part of the email address is also part of the same signature but is not being authenticated either.

https://www.ietf.org/archive/id/draft-adams-arc-experiment-c...

It will be interesting to see if Google can be convinced to move away from ARC to something else. Gmail is all about email server reputation these days so they can reliably treat email servers they don't like badly.

... and then the article goes on to talk about SPF, DKIM and DMARC which authenticates only the domain part of the "From" field. So just the reputation of the email server, not the entity that sent you the email. If things get as bad with AI generated deception as suggested by the article this wouldn't be good enough, we would have to start signing our emails again. Emails from entities we don't know would have to be treated with a high level of suspicion.

I am not convinced that things will for sure really get that bad. How can a AI figure out the email addresses of our correspondents? They are not magic.