From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Richard Stallman Newsgroups: gmane.emacs.devel Subject: Re: Making package.el talk over Tor Date: Mon, 18 Dec 2023 22:52:38 -0500 Message-ID: References: <8734ybkqf4.fsf@disroot.org> <87sf54q2t8.fsf@posteo.net> <87o7etlzx7.fsf@posteo.net> <87zfy9kpwp.fsf@posteo.net> Reply-To: rms@gnu.org Content-Type: text/plain; charset=Utf-8 Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="40139"; mail-complaints-to="usenet@ciao.gmane.io" Cc: akib@disroot.org, emacs-devel@gnu.org To: Philip Kaludercic Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Tue Dec 19 04:53:27 2023 Return-path: Envelope-to: ged-emacs-devel@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1rFRAd-000A7D-1m for ged-emacs-devel@m.gmane-mx.org; Tue, 19 Dec 2023 04:53:27 +0100 Original-Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1rFR9t-0002KP-3l; Mon, 18 Dec 2023 22:52:41 -0500 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rFR9r-0002Id-5S for emacs-devel@gnu.org; Mon, 18 Dec 2023 22:52:40 -0500 Original-Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1rFR9q-0002fR-So; Mon, 18 Dec 2023 22:52:38 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=Date:References:Subject:In-Reply-To:To:From: mime-version; bh=CLJg8bEnMgah6AalrOIo3uflO05H+EG5XNQM+eZ/lko=; b=hWKSX8gCxJRM ryH1Qns9GSLFNwt43OR4HcJsf078YKmnJCPG5b0q8yD2eyERdVKI4K8NsgTEYdr9yfIl6TohHeTLv CVMyb5Pl4nwQRl510mA8m6G+BnjdafCbAiviR02tMTAAh9/laMBnpU+Es5iwVD0tY0biJJaLDxXgo 06wsXHt0oL2nXXZE1pCwc1X9jagz5+oMymT+YreYM7BJY0aT+mhiwpcNC8jScmdJkPFsggmBB6wKe 2DzZa3GOFZjLb426YvgGfndfA35ULKkxZxRVSBvK81JDETweXfXnLhKwwb19DniwwD5Pu1MRtfz4k xlv2L04+lXDkc+2ewnNU+g==; Original-Received: from rms by fencepost.gnu.org with local (Exim 4.90_1) (envelope-from ) id 1rFR9q-0002mH-D6; Mon, 18 Dec 2023 22:52:38 -0500 In-Reply-To: <87zfy9kpwp.fsf@posteo.net> (message from Philip Kaludercic on Sun, 17 Dec 2023 11:51:50 +0000) X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane-mx.org@gnu.org Xref: news.gmane.io gmane.emacs.devel:313994 Archived-At: [[[ To any NSA and FBI agents reading my email: please consider ]]] [[[ whether defending the US Constitution against all enemies, ]]] [[[ foreign or domestic, requires you to follow Snowden's example. ]]] > Compareed with the harm done by _running_ the page's Javascript, > giving evidence of not running Javascript is arguably a far lesser > evil. The person who set this default for IceCat has sttudied the situation csrefully; to dismiss his conclusions hastily is not wise. > The way I see this, this is a security/privacy vs freedom issue. If you > really want to blend in, you have to behave the way most people do. That simple heuristic is valid in many situations, but not in this one. With Javascript, the option you're calling "blending in" means letting each site take your fingerprints in its usual way. Trying to "blend in" that way will backfire completely: each site can precisely recognize you each time, and distinguish you from all the other visitors. > Tor hides your IP address, in which sense it acts like a trusted VPN > service, but I am just trying to emphasise that (in general) just using > Tor as a transport layer can give users a false sense of security. Indeed, just using Tor is not sufficient to stop a web site from recognizing me when I come back. I take other precautions too. Meanwhile, can anyone help me make it easy to use Tor when communicating with the Emacs package archive site. -- Dr Richard Stallman (https://stallman.org) Chief GNUisance of the GNU Project (https://gnu.org) Founder, Free Software Foundation (https://fsf.org) Internet Hall-of-Famer (https://internethalloffame.org)