Sven Slootweg @joepie91@pixie.town

That's not to say that we shouldn't be pushing for continuous improvements in software and tools.

But like, make sure you actually understand where the problems lie first, and that you understand the consequences of what you're campaigning for. And adjust your goals accordingly.

Your reminder if you're a Linux user to be careful what you wish for; a lot of things only work on Linux because it was made easy enough to support it through cross-platform tooling, particularly the tools that people complain about a lot like Electron and Java.

I have been using Linux for a long time, and the alternative to "half-assed cross-platform things" is usually "nothing at all" - and I can assure you that that was worse than what we have now.

(I do still feel that anarchism is ultimately a healthier long-term model, and a good goal to work towards, but I want to draw a distinction here between "things that are optimal" and "things that can work", which aren't quite the same list of things - the model described here may not be optimal but I think it can still work well enough)

Inspired by another thread, possibly my hottest take regarding politics: politicians are the least qualified to be making societal decisions, and a literal random selection from the population would yield better outcomes.

This is because the publicly-perceived power of any such job position selects for those with the most hunger for power and the least interest in maintaining a healthy society where everyone thrives.

So far, so anarchist - but crucially, I think that *any* political model that is built with this in mind could work, even if it is not strictly anarchist. Notably, this includes an elected executive branch where actual policymaking is done by a randomly selected set of citizens, and politicians do not have any power over *what* gets implemented.

That is, "politician" becomes a bureaucratic government job, a type of clerk and potentially advisor, rather than a position of power.

(This is strongly reminding me of the zeal with which people defended the Chromium sandbox as a replacement for memory safety, even in the face of significant evidence against their security strategy)

FYI: jumping into my mentions being weirdly defensive about Yubico and proprietary security keys without even engaging with what I said, is more likely to make me *distrust* security claims about proprietary keys than anything else, it's certainly not going to convince me that you've made a well-reasoned analysis

Despite my issues with the Matrix Foundation as an organization, their on-site COVID/health guidelines for the conference are looking excellent: https://2024.matrix.org/attend/#health-and-safety

Sure, sure, most people are unlikely to be affected by the Yubikey vulnerability in practice. But this attack raises two serious questions:

1. How, exactly, was a failure to implement constant time overlooked for 14 years despite many rounds of certification? This should have been caught.

2. I've frequently hear people claim that Yubikeys are safer than FOSS security keys, because the FOSS keys are not resistant against physical tampering. And sure, to some degree they're not, that's the point - but *is* a Yubikey actually any better, if we're treating this vulnerability as "not a big deal" anyway?

Remember when we thought browser toolbars were the worst problem to deal with?