Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Sarah Jamie Lewis Profile picture
Sarah Jamie Lewis
@SarahJamieLewis
Executive Director @OpenPriv. Privacy Researcher https://t.co/3NovKkkNn3 @cwtch_im icyt7rvdsdci42h6si2ibtwucdmjrlcb2ezkecuagtquiiflbkxf2cqd
5 subscribers
Jun 16, 2022 • 9 tweets • 3 min read
Canada's new proposed privacy law:

* "De-identified" data doesn't actually mean de-identified.
* Organizations are explicitly allowed to subvert "de-identified" data in order to identify people "for testing".
* The commissioner can authorize organizations to de-identify data. Screenshot of Canada's new ...Screenshot of Canada's new ...Image There is also a long list of exceptions that allow personal data to be disclosed to a huge number of organizations (including hospitals, schools and libraries) under the ridiculously broad category of "socially beneficial purposes" ImageImage
Jun 16, 2022 • 5 tweets • 3 min read
Really excited about the upcoming @cwtch_im 1.8 release.

So much work has gone into the UX over the last couple of years and it really feels like we are moving closer to the goal of usable metadata resistant tools. Thinking back to where it all started, years ago, with just me hacking on a little extension to ricochet it really has come a ridiculously long way thanks to the work and dedication of so many people!

Jun 15, 2022 • 5 tweets • 2 min read
Last night I tested whether I could use the same antenna I use for GOES as a less-bulky hydrogen-line radio telescope. I swapped out the LNA and plugged it into the pipeline I wrote last year.

Turns out it works pretty well if you are looking for an off-the-shelf option. Here is the spectrum chart from last night. I didn't both calibrating so there is way more noise here that could be easily removed.
May 10, 2022 • 6 tweets • 1 min read
If you want a vision of the future, imagine an endless line of do-nothing, jobsworth, bureaucrats demanding you use ever less secure forms of communication – forever. I want to be very clear that there can be no compromise on this position. Any attempts at weakening end-to-end content encryption or demanding metadata surveillance must be seen clearly for what they are:

Attacks on democracy and free society.
Mar 7, 2022 • 4 tweets • 1 min read
Begging people to understand that given:

1) "We will not hand over data we collect"
2) "We cannot hand over data because we automatically delete it"
3) "We cannot hand over data because we never had it in the first place"

Only (3) is actually secure against a state. That includes super-duper promises made in press statements and pinky-swears.
Feb 20, 2022 • 7 tweets • 2 min read
Begging crypto twitter to stop conflating the orders of a Canadian Provincial court based on well established legal procedures with potential impacts from Federal emergencies act invocation.

There is a lot to criticize and be concerned about, but conflation muddies the water. I am very troubled by the invocation of the act - and more so with statements made by MPs to put forward legislation to make some of the powers relating to financial surveillance and/or censorship permanent.

Jan 26, 2022 • 10 tweets • 2 min read
Deletion in p2p systems is weird because it violates many of the expectations that people have from centralized solutions.

e.g. If Alice purges all data about Bob as a contact, then the next time Bob attempts to connect to Alice it will be interpreted as a fresh request. Alice is then left with 2 options: either add Bob as a contact again, or block Bob from all future conversations. Nether is great.

So "deletion" must mean something else to the app e.g. maybe we want to only display a new authentication request if Bob actually sends a message.
Jan 25, 2022 • 5 tweets • 2 min read
Pretty ominous considering the UK government:

1. has recently funded a propaganda campaign against end-to-end encryption

2. is pushing through laws which target the awful, and deliberately vague notion of "conduct that is not illegal but has the potential to cause harm". It's no secret that I have a hold "professional organizations" and "registries" as a whole in pretty low regard. One of the reasons I got into hacking in the first place was because it was one of the few paths where progress was not gate-kept by useless bureaucratic bullshit.
Jan 24, 2022 • 6 tweets • 1 min read
In one future: identity is "verified" through intrusive facial analysis & state documents. Data is hosted, & trivially censored, by large conglomerates.

In another future: identities are bound through cryptography & data is distributed through uncensorable overlay networks. There are laws being debated around the world right now that attempt to set the course for a future where human interaction is mediated through universal surveillance.

There is a very real choice to make regarding which future you want to contribute to, and build towards.
Jan 21, 2022 • 8 tweets • 2 min read
Metadata resistant app question of the day.

In @cwtch_im, file sharing is done via a torrent-like protocol where the file is chunked & each part can be requested individually (maybe from different people). Only the root hash is initially sent.

How should acks work? A few caveats:

(2) Is currently implicit in the protocol as all messages are acknowledged

(3) might not always be possible right away (in group contexts) and so requires some extra effort on the recipients end.
Jan 14, 2022 • 11 tweets • 2 min read
As PoS is seen as inevitable for some cryptos there is an interesting meta shift away from "stop saying our consensus is centralized" towards "yes, the consensus is 'technically' centralized but *how* we arrive at consensus is less important than *what* we do with the consensus" A few years ago i think I would have been under the impression that such rhetoric would effectively kill a community as they drop their committent to decentralization and concentrate power in a few hands.

lol
Jan 11, 2022 • 5 tweets • 2 min read
In a decentralized metadata resistant messenger where direct peer to peer messages may be unavailable because the other party is offline - what is the best way to order the conversation list: (Note: Any solution to offline delivery likely carries an additional security assumption either in order to protect the metadata inherent to the conversation or in the risk involved in outsourcing storage)
Dec 13, 2021 • 11 tweets • 3 min read
It's been a while since I've visited this topic, and with some vacation coming up I think I might want to dive into it some more. I would really like to find some kind of solution to this.

I'm going to dump some thoughts about approaches I've already tried in this thread. Failed Approach #1: Custom Wiki

What worked: flexible, linkable some nice features like reference embedding and basic term rewriting / derivation.

What didn't work: lack of formalization, everything felt too ad-hoc,

Perhaps salvageable with process.

Dec 11, 2021 • 6 tweets • 1 min read
Most software is a composition of layers of fossilised snapshots of the organizational understanding of the problem those layers were originally designed to solve - but we rely on it as if it is continually maintained critical infrastructure.

One of those has to give. What a system was designed to do, what it does, what it is supposed to do, and what people use it for are 4 mostly unrelated concepts.
Dec 9, 2021 • 4 tweets • 1 min read
My ongoing rage at papers that define an adversary strong enough to compromise any participant at will, but weak enough that they are incapable of arbitrary protocol violations. "We permit the adversary to perform all of these actions, but we assume they will never lie to the other members about it"
Nov 29, 2021 • 5 tweets • 2 min read
Many of the major trends in crypto right now are leading to the development of structures that are fundamentally aligned with anarcho-mutualism (community ownership and control, community credit).

You have to wipe off the icky layer of rentier capitalism settling on the surface. Seriously please wipe off the layer of rentier capitalism, it is what Adam Smith would have wanted.

Nov 13, 2021 • 24 tweets • 6 min read
I received quite a few requests for "how to get started" building something like this. So I'm going to dump some history and resources in this thread.

This isn't difficult. You can do it to. Getting to the level where it is peaceful instead of frustrating might take a while. I started programming simple real mode operating systems in my teens and it's fluctuated as a hobby for me over the course of the last 2 decades.

In between I've built hobby emulators, (dis)assemblers, fuzzers, compilers, and uncountable weird hybrids.
Nov 12, 2021 • 11 tweets • 3 min read
I spent my recent evenings writing an operating system in an assembly language that I also developed to compile to a custom bytecode that I also designed to run on an virtual machine that I also implemented.

A meditation on recursive complexity and what actually makes me happy. It is completely useless. All that work, and you can only run a few commands, and one of them is QUIT.

I have never loved a piece of software more.
Nov 12, 2021 • 4 tweets • 1 min read
Very sceptical about "metadata of the metadata".

Encrypted communication tools should be designed such that devs *don't* have access to things like "where [and when] accounts are created, how [data] travels, which [messages] are fastest to spread"

wired.com/story/encrypte… Basically this. The underlying expectation that "responsible encryption" requires some kind of metadata surveillance to be safe seems to be to be a deeply flawed narrative that can only result in greater and greater privacy harms.

Nov 12, 2021 • 4 tweets • 2 min read
Privacy-preserving offline delivery (avoiding all metadata) is a hard problem.

For now, the @cwtch_im groups experiment makes use of slow but explicitly untrusted servers that learn nothing about the messages they host.

Making them trivial to self-host is a critical goal: If you read our recent roadmap update carefully you might have surmised that there are two main directions of work taking place @cwtch_im

1. Development of protocols that avoid intermediate hosting (hybrid groups)

2. Making shared infrastructure as simple to host as possible.
Nov 11, 2021 • 10 tweets • 2 min read
Still stuck in the dream that maybe we can build p2p applications that aren't mediated through a global consensus layer.

Nonsense I know. With all the talk of web 3 I fear we have forgotten how we used to think of the future of the internet.