even with e2e email like pgp or s/mime, a lot of email metadata (even subject lines, commonly) gets leaked onto the wire. improving transport security prevents that.
It's an anti-separatist crackdown that can be compared to China's similar crackdown on Tibet. In fact, the top official (Chen QuanGuo) who ran and experimented with surveillance technology and forced assimilation in Tibet was transferred to Xinjiang in 2017 to essentially build up and run the same type of program, in less time, and for a much larger region (in both area and population). Hence, the camps.
In no way is any of it justified-- it's millions of people, and even the Uyghurs that escape are being continually hunted by the government.
In the majority of cases, TLS for SMTP (delivery between MTAs) is still trivially downgradeable. So they could presumably downgrade and read SMTP traffic that's going between MTAs in Norway and MTAs outside Norway.
Of course, as long as you're one of the parties involved in the SMTP communication.
The problem is that even though you're trivially able to detect that TLS is not in use, the vast majority of mail providers won't act on that knowledge by refusing to send mail unencrypted (except maybe for some hosts explicitly whitelisted for that approach).
Why? Too many broken TLS setups, historically. Might be better now, I vaguely remember some push towards that from the big providers.
From one party's perspective, it may just look like the other party does not support TLS. Without another point of reference, MTAs can't tell the difference between a lack of TLS support and a downgrade attack.
Alternatively, the government could also conduct a TLS certificate man-in-the-middle, which would work in most cases since almost no MTAs validate certificates outside of occasionally trying DANE (a spec for pinning certs over DNSSEC).
> Yes, the exact guidelines are going to be vague, that’s a good thing. It might just show they understand that it should be okay to allow art and breastfeeding and other forms of nudity that aren’t explicitly pornographic.
"Vagueness" and room for interpretation is not inherently bad, as you point out. But it's dangerous when your policies for automated filtering are vague, because filters almost always play it safe and end up creating a large number of false positives (i.e. wrongful content takedowns).
My father grew up in a neighboring town to Liqian, in Gansu. This is essentially an urban myth of sorts that several locals still believe, though as the article itself points out, it's been proven false a decade ago. In recent years they've constructed several faux monuments and landmarks in a cheesy emulation of Classical architecture in order to attract tourists.
People want to believe it; it's an interesting theory. However, the genetic diversity in this region comes primarily from Yugurs (a Turkic group related to the Uyghurs which converted to Tibetan Buddhism around a thousand years ago) and Mongolians.
Actually when you prod and poke at these myths, inevitably some damn fine archaeology or science or something else that is real and tangible falls out in some way, or some absolutely beautiful scenery is involved. I have a lot of examples and not enough room in this comment to encompass them all.
That would be fine, too, and reflects in part what MTA-STS is trying to do.
A point that may be obvious, but I would like to make explicit, is that unlike on web, end-users have no good way to express whether they prefer security over deliverability on a connection, which makes downgrade attacks more difficult to deal with. Everyone defaults to preferring deliverablity (falling back to plaintext). In the absence of user intent, it's more important for an email sender to know the recipient mailserver's intent: what level of security should they expect? This can be achieved at varying degrees through DANE, MTA-STS, or a "HSTS Preload List" equivalent for email, but there is currently no reliably deployed standard for this.
(edit: something I forgot to mention: of course, you'd have to trust the initial DNS lookup as well)
What would be more/also interesting would be a way of expressing this intent by a sender.
Seems like (with absolutely no thought here) a new header could me minted for this - eg. "Transport-Security: Require". Tough part as usual would be getting MTA and client support, but switching to a per message approach would at least allow incremental rollout - and critically I think - allow introspection by following bounces.
A point that is brought up occasionally, but probably not enough: Deleting Facebook really isn't possible for a nontrivial percentage of the world population, since Facebook is the internet in some places. Their monopoly over internet infrastructure in some developing countries is such that people can't afford non-Facebook internet packages, and seems to disincentivize actual low-cost internet infrastructure from being built out.
Absolutely correct. I've met people in Asia (Myanmar and Nepal) who have just accessed the internet for the first time in the past 12-24 months (through their Android smartphones). But they don't know the true internet - they only know the internet through the Facebook app. They use it like we use Google and web browsers.
To them, Facebook is the internet. They don't have email accounts. They don't use the browser. They don't search the web. I met someone in a small town who never even used the maps feature. I tried to think of what value the true internet might bring them, but when I suggested that "you can search for news and read other things", the response was that they already did that with the Facebook App.
One guy handed me his phone, so I could add myself as a friend on his Facebook. While I started typing my name, I noticed his search history... and to him, Facebook was even a substitute for what people in the USA might use Incognito mode for!
I would call Facebook their internet portal, but it's not really a portal to anything - Facebook is just the entire internet to them.
“Nobody asks, they don’t care about the email,” he said, explaining that most don’t know that creating an email address is free, and easy. “No one is using that. They have Facebook.”
>" I've met people in Asia (Myanmar and Nepal) who have just accessed the internet for the first time in the past 12-24 months (through their Android smartphones). But they don't know the true internet"
Yes and at one time AOL occupied a similar role. And everyone moved out of the walled garden and onto the real internet just fine.
Since you are as surprised as I was a month back, I've looked further and concluded that buzz feed actually funds very high quality journalism (yes yes shocking I know) and presents facts from both sides. They do it using the money generated from click baits. I'd even make what will sound like a hyperbole , if you are the sort that wants truth on both sides of political spectrum and not just an echo chamber , go to buzz feed, and not NY TIMES or wapo.
Many, many people don't realise there is an entirely separate section of BuzzFeed called BuzzFeed News. BuzzFeed News are the ones who first published the "Steele dossier" to the public (as far as I recall; if there was another organisation in partnership, I only remember BuzzFeed News).
I recall at the time that people kept nitpicking over the misspelling of a bank (in a way that suggested people of a certain expertise never make spelling errors, which is simply untrue). It was a sensational story at the time, but all one needs to do now is to look back and compare it to what we know now.
All of h3h3's videos are silly. That's his style of comedy.
You can't see that a video shaped entirely by left-wing identity politics that blames all men for the crimes of a few, that ignores practical realities contributing to the issue, has a left-wing bias? Are you serious?
This is the model for internet/Facebook access in several sub-saharan African countries and others:
https://en.wikipedia.org/wiki/Free_Basics#Participants
They've partnered up with large telecom operators in these regions to offer zero-rated Facebook access.
The Guardian has a couple of decent writeups about it too:
Facebook has been actively targeting developing countries that lack Internet infrastructure. They offer a walled garden consisting of Facebook and a few other sites for free. They initially called it Internet.org, but it’s since been renamed Free Basics.
I guess the concern is that people will confuse Facebook for the Internet, and they’ll think they’re getting the Internet for free. It then becomes very difficult for a real ISP offering full Internet access to enter the market.
> I'm not in favour of nationalization as a rule.
> we must control our own critically important infrastructure! (cheers)
You're conflating two things. If the US somehow lost all steel foundries without being able to spin things up in a reasonable amount of time, we're screwed in a war. You must indeed make sure that you're self-sufficient in things that are essential for living in case you're cut off due to circumstances.
