• 8 Posts
  • 494 Comments
Joined 2 years ago
cake
Cake day: April 27th, 2024

help-circle
  • It always feels like YouTube is double dipping though. Not with what the post is about; that’s either/or, obviously.

    But Google makes a nice profit collecting user data and behavior, and then selling that to advertising companies. That happens regardless of using an adblocker, and I’d be shocked if it doesn’t also happen regardless of YT premium.

    But at the same time, Google also IS an advertising company; they use their user data collection platform to also show ads to users, getting paid again.

    So personally, even if YT wasn’t owned and operated by a shitstain of a capitalist eldritch horror company, I’d still have zero qualms blocking all their ads: they’re making money off of me regardless.










  • Not arguing that. Of course there’s worse things.

    But you must also acknowledge that it’s trivial to make this a non-issue. For example, I’ve seen lots of places where the door opens outwards with a kick. Or, even better (if slightly less space efficient) just have no door at all, and instead a short entrance with two 90 degree turns.

    I think this is something that more and more places do anyways, basically any modern-ish place I’ve been to in recent years do the no-door-thing.








  • Huh - you’re right. I went back to Signal’s X3DH spec because I was sure I was right, but it seems I misremembered how the “prekey bundles” work: Users publish these to the server, allowing (in my original assumption) for the server to just swap them out for a server/attacker-controlled key bundle for each Alice and Bob.

    However, when Alice wants to send Bob an initial message and she gets a forged prekey bundle, Bob will simply not be able to derive the same key and communication will fail, because Bob knows what his SPK private key is, while the server only knows the public key.


  • A compromised server would allow the server to man-in-the-middle all new connections (as in, if Alice and Bob have never talked to each other before, the Server/Eva can MITM the x3dh key exchange and all subsequent communication). That’s why verifying your contact’s signatures out-of-band is so important.

    (And if you did verify signatures in this case, then the issue would immediately be apparent, yes.)

    Edit: I was wrong. See below.