maybe he does? if you're giving up your freedom, the thing you swear your loyalty and dependence to had better be absolutely perfect, because you're giving up your ability to fix it, and quite often also the possibility of moving on from it
on the anniversary of the universal declaration of human rights, no less. I'm pretty sure the declaration mentions something about a right to an impartial court :-/
Got a GITLAB account??? Give us a star to help us become a fiscal sponsor for projects with opencollective! https://gitlab.com/drutopia/drutopia
Alexandre Oliva (moved to @lxo@gnusocial.jp) (lxo@gnusocial.net)'s status on Monday, 06-Dec-2021 18:33:48 EST
Alexandre Oliva (moved to @lxo@gnusocial.jp)the wasm is transferred from a server (that chooses the code) to a client (that runs it). you said the code running on the client wouldn't have access to client-local clocks. I retorted that was not as good as you thought, because NetSpectre enabled local clocks to be used to extract information from a remote host. if you find that confusing, we can swap "local" and "remote" reference points: a remote server can retrieve information local to a client running code supplied by the server without using local-to-the-client clocks for time-based side-channel attacks: server-side clocks, remote to the client, can be used for this purpose, as they were successfully used in NetSpectre
Alexandre Oliva (moved to @lxo@gnusocial.jp) (lxo@gnusocial.net)'s status on Monday, 06-Dec-2021 18:28:35 EST
Alexandre Oliva (moved to @lxo@gnusocial.jp)abandoning the project would be the most clear sign of realizing how harmful to users' freedom the project is second to that, means to enable users to install and run software locally (as opposed to straight from a web server), mechanically obtain and verify that binaries match the provided sources, to enumerate licenses and block execution of undesirable ones... in the odd case a freedom-concerned user opts to run software from a third-party web server, tools to aid users in checking that software has not been modified since last time, and designed-in license annotations for manual and mechanical authorization or blocking of individual components, with possibility of replacement with locally-selected versions on a per-component basis. LibreJS offers a little of this (enablement based on license annotations, tools to aid source auditing), there are other browser plugins under development for local replacements, fragile as it will be
local to the attackers on the server, that's pushing code to run on a remote computer they wish to extract information from. i.e., just the sort of scenario we're talking about. (why would I have even brought it up otherwise?)
Folks making alternatives: don’t recreate the systems of closed, centralised silos. They’re designed with the needs and success criteria of closed, centralised organisations. You cannot compete with them on their own terms. They have the resources to create centralised workflows, you do not. And your success criteria are the opposite of theirs. You do not want to centralise information, power, and wealth. Think about where your strengths lie and design from first principles according to those.