From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Zelphir Kaltstahl Newsgroups: gmane.lisp.guile.user Subject: Re: Diversification [ branched from Re: conflicts in the gnu project now affect guile] Date: Tue, 22 Oct 2019 21:23:32 +0200 Message-ID: <907270af-1f2f-42f3-ec36-047fdd48a74f@posteo.de> References: <-IsD5PBFie-kW2VJSYNHx00LodtSHflKNWtY2vjNVQDN126iTMsqHrdxl8zeWE8a53TzM_27wskjsrylIh4bN5jIGVNYOBC6zmE3p1RGyBg=@protonmail.com> <87ftjk1us3.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="222579"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 To: guile-user@gnu.org Original-X-From: guile-user-bounces+guile-user=m.gmane.org@gnu.org Tue Oct 22 21:31:51 2019 Return-path: Envelope-to: guile-user@m.gmane.org Original-Received: from lists.gnu.org ([209.51.188.17]) by blaine.gmane.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1iMzsk-000vgs-LR for guile-user@m.gmane.org; Tue, 22 Oct 2019 21:31:50 +0200 Original-Received: from localhost ([::1]:42386 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iMzsj-0002LH-BM for guile-user@m.gmane.org; Tue, 22 Oct 2019 15:31:49 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:37128) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1iMzkq-0002Nx-73 for guile-user@gnu.org; Tue, 22 Oct 2019 15:23:42 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1iMzko-0000Cu-FC for guile-user@gnu.org; Tue, 22 Oct 2019 15:23:39 -0400 Original-Received: from mout02.posteo.de ([185.67.36.66]:35553) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1iMzkn-0000BR-T5 for guile-user@gnu.org; Tue, 22 Oct 2019 15:23:38 -0400 Original-Received: from submission (posteo.de [89.146.220.130]) by mout02.posteo.de (Postfix) with ESMTPS id C30452400E6 for ; Tue, 22 Oct 2019 21:23:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=posteo.de; s=2017; t=1571772214; bh=dNgqh8V4Il+zdoo1LKAY/Cq2HJN7JnSN2SWayhpE3Kw=; h=Subject:To:From:Date:From; b=fKTAj3OI90hNXfAALXinOmPWw84O+h89xUknHvBj1cq4KipcoAAdtXCHcnIB29Mxu JKn+U6qdK1/692Orh5vPEc9Gw9yKk0xIPbKdCrj3fwcsbP5ot7FSpb9Lfl87dobU42 x7tzEIxe5M1aHsfExFgLCtKasngvkv215HBUh6ymHaDZ3ZMaPQ1VJR9Tn3/NJUdE4k 9ySp71i6uzrXSaWZQsj7dF5v9NO82WqbwzgAeD2FsC220xw85uEduWogbithQFZ+n2 w2a6E6wbAKdary8iGssZWuNZ+GR3IPHDwf314tFsENo8e8RVlgKpB20ogZPkkY6hwW QnV+QH7Q6BC5w== Original-Received: from customer (localhost [127.0.0.1]) by submission (posteo.de) with ESMTPSA id 46yNhj4nxmz9rxR for ; Tue, 22 Oct 2019 21:23:32 +0200 (CEST) In-Reply-To: <87ftjk1us3.fsf@netris.org> Content-Language: en-US X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 185.67.36.66 X-BeenThere: guile-user@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: General Guile related discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guile-user-bounces+guile-user=m.gmane.org@gnu.org Original-Sender: "guile-user" Xref: news.gmane.org gmane.lisp.guile.user:15781 Archived-At: Hi! I just want to share my experience with Riot. I have used it before. In fact, I used it to communicate with only one person so far for reasons I will mention below. Today there was a strange thing, when Riot showed an error and warned, that it could be a replay attack. This is not the first time something happened. If you remember, that some time ago everyone had to upgrade their Riot.IM client, because someone had intruded in the server system (Iirc it was someone, who worked there before and still had access somehow. It was linked on Hackernews. Let's see if I can find it =E2=80=A6 Probably one o= f the search results of: https://hn.algolia.com/?q=3Driot.im). We would have to ask ourselves, whether Riot is sufficiently independent too. I believe it depends on the master server being up and running. If we could have our own, that would of course be better. The reason however, why I have only ever used Riot with one person is, surprise surprise, that most people are not willing to sacrifice the tiniest bit of comfort, for enhanced security. This one person I used it with tried to get 2 more people on board, who were even less tech-savy and whom I did not have the chance of helping directly, to get things set up and so we remained 1-on-1 on Riot.IM. Let me explain further: To verify another person's device, one has to exchange information via a second trusted channel. That information is a sequence of icons being shown. If they are the same, that the other person sends you via the second trusted channel, you can reasonably assume, that the device you are communicating with is under their control. When it comes to the step of exchanging information about what icons are displayed, most people will close the app and say "it's too complicated", because they do not understand it ("Huh? How strange! Why I have to do that? Are icons secure?") or do not want to do anything in order to have security. They are not willing to invest as much as 5min of effort, to have encrypted chat. What makes matters worse is, that when you use Riot.IM in the browser, it might happen, that every time you log in, the other person has to re-verify your device. Guess what people will do when facing that workflow =E2=80=A6 As much as I like Riot.IM, it did have its share of problems and does bring in some required effort for setting up communication. I would personally still like to use it, however, I very much doubt, that someone, who is not willing to use a mailing list, is willing to get Riot.IM set up and keep it running, while being aware of the security implications of trusting devices of other people, adhering to a good security aware workflow. And we are not even using GPG on the mailing list a lot, so people don't even have to deal with Enigmail yet, to post and read on the mailing list. Maybe offering Riot.IM as an alternative would still make sense, just to see how it goes, but don't bet on many people joining Riot.IM. I am willing to try! Best regards, Zelphir On 10/22/19 8:47 PM, Mark H Weaver wrote: > Hi Todor, > > Todor Kondi=C4=87 writes: > >> [...] I've set up my workflows around Guix, git(lab) >> and a customised Emacs installation (instead of R Studio). My small >> team of science students (majority female, various cultural >> backgrounds), never previously exposed to a GNU system to such an >> extent, managed to get a handle on it quite impressively. >> >> But, I doubt any of them would find it natural to take a step further >> and participate in GNU itself (ugh, now I sound like a preacher of a >> new age religion). To my knowledge, interaction within GNU communities >> is still mostly mailing lists and IRC. This _not_ my students' natural >> digital habitat. I am probably not saying anything new, though ... > You raise an important issue. If we can improve the situation without > causing other problems, I think we should. I don't know of any modern > replacement for mailing lists that has the properties we need, but I > *do* think there's a very promising alternative for live chat: Matrix. > Amirouche mentioned it elsewhere in this thread. > > https://matrix.org/ > > Matrix is supported by a very large and diverse set of free clients, > from modern Web-based interfaces to simple text programs, multiple > Emacs-based clients, and several gateways to other protocols such as > IRC, so that old-timers can use their preferred IRC client if they > prefer. > > https://matrix.org/clients/ > > Incidentally, there was recently an internal GNU project discussion > about how to better communicate with one another, and Matrix was > identified as an option that would meet our requirements. > > The client that would likely be most attractive for the younger > generation is Riot.im: > > https://about.riot.im/ > > What do you think? > > Thanks, > Mark >