sudneo

joined 8 months ago
[–] [email protected] 2 points 2 months ago (4 children)

Those look nothing like "tools" to me.

I will make it simpler: In this very thread a person talked about "high testosterone". Why they didn't say the same about the 99% of the women who won competitions? Probably because of a combination of factors:

  • The masculine aspect of this particular boxer, that doesn't fit the image that many people have of women
  • The media reporting the immediately pushed to a polarization of opinions -> you had to take a side
  • The previous IBA debacle that planted the seed of the doubt

To me the combination of the above is a much better explanation of the causes for which people attacked this particular boxer, and not the many other women of success, including black and including masculine (e.g., Simone Biles, or Grace Bullen).

historically of women whose success has been deliberately downplayed because she does not fit the stereotypical women in their head vs men who suffered from the same

I really don't see how this measurement can lead to any conclusion. How can you not measure the amount of women who don't fit the stereotypical woman aspect and yet whose success has not been downplayed due to their aspect (i.e., people called them men)?

[–] [email protected] 6 points 2 months ago (6 children)

I doubt that fight can be counted as "exceptionally good performance", but anyway why the same didn't happen for those that both performed exceptionally well and actually set records?

There are so many examples of that not happening that makes me seriously doubt it identifies the right cause(s).

[–] [email protected] -1 points 2 months ago

At the moment we don't have any concrete data, so in case it is based on a suspicion at most.

[–] [email protected] 1 points 2 months ago (15 children)

I am sure that's the case, but I think this has not to do with "breaking records" I.e. having success in sport. It might have to do with general gender stereotypes related to body types, for example, or with other stuff.

So either way the comment I was answering to seems counterfactual and sensationalistic.

[–] [email protected] 2 points 2 months ago (32 children)

Did she break any record? Also AFAIK the same didn't happen to previous medalists or generally the strongest female boxers. It also didn't happen with other monsters who broke tons of records (e.g. Katie Ledecky) just during this Olympics.

This makes me think that it's not what you are saying but there are probably other reasons in play. Probably the IBA and the media making a case after the first boxer withdrew are responsible.

[–] [email protected] 2 points 2 months ago (1 children)

You should definitely be! I take backups every 6h for my self hosted vaultwarden (easier to manage and to backup, but not official, YMMV). You can also restore each backup automatically and have a "second service" you can run elsewhere (a standby basically), which will also ensure the backup works fine.

I have been running bit/vaultwarden now for I think 6 years, for my whole family and I have never needed to do anything, despite having had a few hiccups with the server.

Don't take my word for it, but the clients (browser plugin, desktop app, mobile app) are designed to keep data locally I think. So the term cache might be misleading here because it suggests some temporary storage used just to save web requests, with a relatively quick expiration. In this case I think the plugin etc. can work potentially indefinitely without server - something to double-check, but I believe it's the design.

[–] [email protected] 1 points 2 months ago (2 children)

Interesting! That's very close to this blog post I read long time ago (unfortunately medium.com link)! Are you actually sending emails from those addresses? Like if you need to drop an email to your bank, do you use the banking one or your personal (or something else)?

Fwiw, I do something similar. I use a mix of domain aliases without address (e.g. [email protected]) and actual aliases. Since I have proton family (and the same when I used ultimate) I have unlimited hide-my-email aliases, so I have it integrated with my password manager, and I generate a random password and email for everything I sign up now. These though are receive-only addresses. In fact, with this technique I probably use 3-4 addresses in total, but I have probably 30 domain addresses that go to the catch-all one.

Spam on these addresses are basically non-existing and you can still create folders based on recipient without having a full address (e.g. [email protected], [email protected]). You can make folder categorization based on recipient regex and this way you also have the "stop bothering me" option: if some email gets into the wrong hands, you can create a spam rule for that dedicated address. However, my approach is that all of these are used just to receive emails, to send I have just a handful of actual addresses or -if really needed- I can create on-the-fly an address from a catch-all one, send the email and then disable it again (so it doesn't count towards the limit, but I still get inbound email to the catch-all).

Nice setup anyway!

[–] [email protected] 1 points 2 months ago (4 children)

Your requirements are totally fair tbh.

That said, I think you can use aliases for the use-case you have, you don't need full addresses. Proton supports "+ aliases" as well, so name+service@domain works, and most importantly they support catch-all addresses if you have your own domain. I now use actual aliases (the ones from simplelogin), which I generate on the fly, but if you can use whatever@domain and it will be redirected to your configured address. You don't even need to create this beforehand, so many times I was around and had to give an email address for some reason and I just made up an address on the fly. As long as you use your domain, the catch-all will get the email.

So the 10 addresses only include actual addresses, the ones you can write from. You can have as many as you want to receive emails (which is generally the use case for signing up to services, right?). Just a FYI in case tuta supports the same and you are making more effort than needed!

[–] [email protected] 2 points 2 months ago* (last edited 2 months ago)

If XMPP were to replace emails, that would’ve been great

Who knows :) But XMPP also needed all kind of extensions to support even relatively old security measures.

Anyway, I still don’t trust Proton. Have a great day.

That's fine, you can trust who you want, of course. The important thing is to have clear the risk model.

[–] [email protected] 4 points 2 months ago (2 children)

Encrypted or not, the fact that someone else has it stored somewhere in their computers is dangerous.

Of course. You are simply over-representing this risk, though. Besides, regular people realistically don't need to worry about Proton being backdoored, because their device is 10-100x more likely to be breached instead. Security is not a binary, it's a shade. Performing a software update is also "dangerous". Do you check every time you update the software its code, to verify no malicious backdoor is there? No, exactly, you trust the maintainers and the package infrastructure.

The only recommended way to store private keys are offline and encrypted.

So you don't store them on your device(s) (encrypted)? I store my GPG keys that I use to sign software on my yubikeys. That said, email is something I check from my phone and multiple computers (as most people). Do you really use a hardware key to do on-the-fly decryption, every time someone sends you a message, from each device?

As a security engineer, I also generally discourage such absolute "recommendations". My threat model is different from a regular Joe threat model, and both are different from Snowden's. There is no such thing as "only recommended way", because this is not a religion, it's a risk decision. Most people use Gmail, where the content of their email is literally available server side. Those same people can gain privacy and security using GPG via Proton, and in their threat model "provider gets compromised and software backdoored" is completely irrelevant. Is it relevant in your threat model? Good, then yes, you should only store keys offline and encrypted. Actually, you shouldn't use email at all, and you should use dedicated tools and protocols that are meant for security, where metadata is not transmitted in clear text, for example. You should also have virtually no session duration and perform a full login with 2FA every time, you should probably access the software that you use to communicate only from a secure machine dedicated for the purpose etc..

I think you trust Proton a bit too much.

I simply have clear in my mind what my threat model is and what risks are acceptable. I perfectly fit in the "Anyone with privacy concerns" category in the threat model they built. What about you?

[–] [email protected] 1 points 2 months ago

Oh that makes sense. Yeah, definitely simple encryption and exported (unencrypted) emails are not going to work together.

I am all in support for European tech companies, so I think that mailbox.org, tuta, proton etc. Are all good options.

[–] [email protected] 1 points 2 months ago (2 children)

From what I read though, the GPG security model for mailbox.org is the same as it is for Proton webmail (except for the browser plugin, where the difference is not really there). I like mailbox.org, to be clear, but I don't get how it is an alternative to the bridge.

view more: ‹ prev next ›