If I post something on U&L, and it is better suited on StackOverflow, what will happen?

@derobert So SpamAssassin is the teachable one, right?

If so, my email hosting provider is doing a staggeringly bad job of teaching it.

@StackExchangeforAll It can be migrated.

Excellent. I hope they will do so.

@Isaac Clearly you weren't paying attention to the Snowden revelations. Not only does Google work with the NSA, it's also been documented that they were initially funded by the NSA. A past guest pointed me to a very interesting article (or series of articles), that documented that the NSA funded the work of the Google founders when they were still Stanford grad students.

@derobert GPG is not properly integrated with most mail clients. So it's an unreasonable amount of overhead to use. Not even Pine/Alpine, which is very old, and relatively user friendly.

@derobert Is Signal better than Telegram?

@StackExchangeforAll You have to make a request.

But you could wait to see if you get responses on U&L first.

@FaheemMitha it cannot be migrated if the user cannot post questions on the target site: meta.stackexchange.com/q/309286/307535 (cc: @StackExchangeforAll)

why cc: @stackexchangeforall?

Because Faheem was answering your question and I wanted to make sure you both saw the update.

var fs = require('fs');
fs.writeFile('/dev/chat', 'Hello world!');

o/

Wat it do

GNU parallel is pretty awesome

@FaheemMitha I don't understand why you mention Snowden to me, but yes I am very aware of everything he said. No I don't trust Google secrecy. It has been proven beyond any reasonable doubt that the only secure encryption is the one you do yourself.

@FaheemMitha It has a bunch of learning stuff (including a Bayes implementation or two), yes. Its certainly not the only one. And usually teaching a filter for yourself, personally, is easier than an entire ISP. At least if you get enough mail to do so.

@FaheemMitha Both Mutt and Thunderbird have GPG. And K-9 on Android. No idea if you can get it in Outlook or webmail. That's only the surface of the problem, let's spend a day talking about securely storing keys, hardware tokens, and subkeys!

@FaheemMitha Signal is fully open source, and the encryption keys are at the endpoints, not available to the service provider.

@FaheemMitha (see also various major news organizations suggest Signal as one of the options for secure tips, I don't think any suggest Telegram — nytimes.com/tips nytco.com/careers/technology theguardian.com/help/ng-interactive/2017/mar/17/… )

@Isaac The context was your comment "That is assuming that Google is not open to three letters agency interference/action", which is demonstrably false.

Since big US corporations are most cooperative in assisting the US govt in illegal spying on their citizens.

I think everyone assumed that was the case (I remember making jokes in a lift once around 2012 about the NSA having access to everything in Facebook), but Snowden actually provided proof.

And as we all know, as a reward he's now living as a refugee in Russia, dependent for his freedom on a Russian despot.

@derobert That certainly seems like a good reason for using Signal. Do you use it, then?

@FaheemMitha I don't think Isaac meant it that way. He was just pointing out an assumption, which I think we both believe to be false.

@derobert Ok. But one should probably not make such assumptions, especially if one believes them to be false...

@FaheemMitha I have it, can't say I actually communicate with many people through it.

@FaheemMitha Well, no one was (making assumptions). Assumption isn't the right word, maybe caveat?

@derobert I have Telegram and Whatsapp installed. I'd prefer to not use the latter. But it seems to be like a virus. Hard to escape.

@derobert Well, I've now forgotten the context. I'd have to go back and look at it.

@FaheemMitha Whatsapp offers end-to-end encryption. It's probably better than Telegram.

@derobert So you think it makes sense to do ones own spam filtering if your email host provider is falling down on the job? Rather than switching to different email hosting?

(WhatsApp end-to-end encryption uses the same protocol as Signal, actually)

@derobert Oh. I thought Telegram was better than Whatsapp.

Someone here said so. I haven't really looked into it.

@FaheemMitha It think its pretty effective, but can be a time sink. If you're trying to stop a spam or two a day... it won't be worth it. At one point, before redoing my spam filtering, I was getting hundreds per day. It was definitely worth it then!

I think it might have been @Wildcard.

@derobert I'm getting a ton of them. A few every hour, or so, at least in the daytime.

I think my email hosting provider is a little crazy. One rule they have looks like:

message > 200kb -> basic spam filtering skipped.

I've been meaning to write to the owner and ask for an explanation.

CPU time

That rule actually accounts for quite a lot of my spam.

@derobert They're trying to save on CPU time?

@Isaac Ok. That didn't work, though, did it? :-)

@FaheemMitha Yes. Spam filtering is expensive. And more expensive the larger the message. Personally I don't send anything over 4MB to the spam filter. 200KB is a bit low.

@derobert Ok, I'll try my hand at spam filtering. For now it's probably easier than looking for a different email hosting provider.

@FaheemMitha Yes, the Signal protocol that Whatsapp use is demonstrably secure.

(I used to use 1MB, but had to up it last fall when spam kept having attachments)

@derobert Does checking for (probably Windows) viruses require special handling on a Debian machine?

@derobert 200 kb isn't much these days. And it's usually the sign of one or more attachments, which is actually statistically more likely to contain spam.

@FaheemMitha No, telegram use a "made up" encryption scheme never vetted by the security community.

@Isaac That's very comforting.

You can use clamav. I use it just to block some noise, but really it doesn't find that many. And not really needed if you avoid Windows and have only wary enough users.

So you're both saying that Whatsapp is actually better than Telegram?

@FaheemMitha Well, I am not the one doing the discussion.

@derobert There's only one user here, me. But I still object to having garbage dumped into my INBOX every hour.

I take it that my personal spam training would be more effective than a third party because I can tell the filter what I consider to be spam?

@FaheemMitha WhatsApp will surely disclose metadata to Facebook. But messages are end-to-end encrypted, so the expert consensus seems to be its a much better choice than Telegram. (And note its on those news organization pages, too.)

@derobert I see. Is Signal better than Whatsapp?

@FaheemMitha Right. But if it misses one, its not a disaster. If you had a bunch of clueless Windows users, each one potentially means a data breach, or at least time to go re-image a workstation/laptop.

@FaheemMitha The transport protocol in Whatsapp is quite better than in Telegram, yes. However the company that suplly whatsapp is not to be trusted, and the messages are backup to Google (NOT ENCRYPTED), so, overall, I don't know ...

@FaheemMitha Yes. It doesn't leak your metadata to Facebook.

@Isaac @derobert OK, So Signal > Whatsapp > Telegram?

@derobert Right, not a disaster, just annoying.

@FaheemMitha @derobert There is a message app called Signal Though, that seems quite safe.

@Isaac I'm confused. Is that different from Signal?

@Isaac You can turn off the Android backup service to avoid sending it to Google. Possibly even per-app. And as of Pie, they're encrypted client-side.

signal.org

@FaheemMitha Yes, that's my understanding

Yes, signal.org is the one I'm talking about too.

@FaheemMitha Which signal are you talking about?

@Isaac I don't know. Is there more than one app called Signal?

Or did you perhaps mean a protocol called Signal?

@derobert No, you were talking about the implementation of the signal protocol in whatsapp. Were you not?

@Isaac I think you made a typo there, that should be …app called Signal, though,…

Ok, so there is just one app called Signal?

@Isaac We were talking about both. Signal (the app) as first choice, WhatsApp end-to-end enabled second (which uses the same protocol)

@derobert I did say a message app called Signa

@Isaac you capitalized the "though" after it, making it look like the app is called "Signal Though". Hence a typo.

@derobert Yes, the same protocol but Not the same implementation nor the same actors in play

@derobert Yes, that was the source of my confusion.

Plus, I thought we were already talking about Signal.

So I thought there was maybe a second Signal app.

What I meant to say was: There is a message app called Signal. Though Note the missing dot, sorry, my mistake, better now?

If this Signal thing is better, probably I should use it.

Though if they are so nice, I wonder what their revenue model is.

Yeah. It's fine, typos happen, I think we're all clear that there is one Signal app (and if someone has uploaded another app with a confusingly similar name, don't touch it with a 10 foot pole)

Yes, Indeed, There are several Signal apps, or apps that implement the signal protocol

@FaheemMitha Signal is a 501(c)(3) (i.e., charity)

@derobert Hmm. Perhaps I should find that encouraging.

Search in google play, there are "Signal Private Messenger" and "Signal Plus Messenger", at least.

Sadly, yes, signal has no revenue model. They created an excellent protocol but are not the ones implementing it.

Better yet, there are links on signal.org to make sure you get the right app

Sorry, I meant to say: Implementing it in Whatsapp, the commercially successful version.

@FaheemMitha btw, weren't you going to email me a CV to read over? Also, I can email you my number if you want to try out Signal

@derobert About you comments in a previous message(s):

@derobert Indeed, I was going to, and am. It just isn't finished yet. I'm just very slow at everything.

Well, almost everything. I'm really fast at eating my way through chocolate.

@FaheemMitha I am very fast at forgetting what I was talking about .... :-(

And yes, if you can email me your number, I could send you a message via Signal.

But it won't be a very exciting one.

@Isaac In summary, email is hopeless for security, alas. Though nice in every other way. If you want security, use those dreadful mobile messaging apps.

Full disclosure: not really a fan of mobile phones. I mean, they're handy to call people sometimes.

@Isaac (1) "secure" isn't a binary question, or even a sensical one. You can't discuss how secure something is without a threat model. I think for most communications, its reasonable to ignore the possibility of security agencies targeting you; if not, suddenly communication becomes a lot more difficult. I think its reasonable to presume they passively eavesdrop on any non-encrypted communication (and avoid that). And, unfortunately, that they can get whatever out of Google/M$/etc.

@FaheemMitha No, if you want security use only two points: Encrypt yourself, nobody else, Hey, even winzip with AES128 could be a safe way to do it (not too complex or difficult to use) and make sure that you give the key to decript to the correct person/user/other party.

@Isaac (3) I'm not sharing state secrets with the general public. But I have friends that are "normal" people, and I want my conversations with them to stay private, too. They can't be expected to use GPG.

@derobert (1) yes, it is binary, you either are reasonably secure against some specific threat model or you are not. The more threat models you are not secure against, the less secure you are.

That's self-contradictory; there is no "less" or "more" with binary values

@derobert (3) Then use the proper tool to the proper "friends".

@Isaac (5) as pointed out earlier, since Pie the Android backups are encrypted (with a key derived using your lockscreen passphrase; Google can not decrypt them except via brute force, so they're not doing passive eavesdropping there—or at all with a good passphrase).

@derobert The question that each threat model asks is: are you secure against it? The answer is either yes or not. Nobody is secure if what you type on your keyboard is known. If you have a camera recording your every key typed. That is a threat model that is always: No I am not secure against that.

@Isaac (6) That's just wrong. Your ISP can redirect google.com wherever they want with DNS, true, but it'll only result in an error page from the browser. Google uses HSTS and is on the preload list in every major browser.

@Isaac No, it's not. "Am I secure against this?" is a risk assessment. It's a probability. I apply security patches, I have firewalls, but I can only guess if an attacker will deploy a zero-day, or at least before I manage to apply the patch.

@Isaac (7) Yes. CAs are a weakness. Thankfully we now have certificate transparency, which means that all issued certificates (including any to security agencies) are public. It's a browser requirement now to be a trusted CA. Even before that, that would be useful only for targeted attacks, and high-risk ones at that. Because the certificate details are available to the attacked, so the attack is visible.

@derobert Y(6) es, google use HSTS, that breaks what I said. Change the end name to some other less security savvy site like secure.site.xyz.com,

@Isaac That's probably true, they've already been decrypted and stored on your device. I don't have WhatsApp installed to check, but if it's using the built-in Android backup mechanism on Pie or later, it gets encrypted with a different key before being sent to Google. (If its doing its own backup to Google Drive directly, then of course its up to the app)

@Isaac Then it still gets a scary browser warning because the certificate is wrong. Which can, in that case, be bypassed. (And most of the popular sites use HSTS)

@derobert (5) You are mixing two things. One is the phone backups done by google, which yes are encrypted, no issue there, with the backups done by Whatsapp, which are not encypted, and never have been. You are talking about what you have not tested. Bad idea.

Well... if there is an optional feature to make insecure backups then, obviously, you should not enable that!

@derobert Ihave NOT enable any optional feature, You are wrong, thats it.

Ummm, faq.whatsapp.com/en/android/28000019 seems to say its an optional feature.

@derobert In the page you link to, it says: Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive.

@derobert What's your point now?

Sorry. I thought you were referring to the Android automatic app backup (which is now encrypted), not a WhatsApp feature that clearly warns you and appears to default to off. It'd appear that if you turn that on, your secure chats will be shared with Google. So I'd recommend don't do that.

@derobert Haven't I been saying that all along? No, I don't do "google drive" backups. But I am pretty sure that's not the end of it, Facebook is not the safest of companies. And yes, I use Whatsapp with my "not so savvy" friends. I have no problem with that. But I do know what I am doing, not guessing!!.n't

Sorry, I think I caused some confusion with "obviously, you should not enable that!". That was intended to be the plural you — not a singular you referring to you specifically. It would have been clearer as "anyone who wants to use it for secure communication should not enable it"

I didn't mean to imply you trust Google with your private conversations as, quite clearly, you do not.

@FaheemMitha BTW, I emailed you my cell number if you want to try Signal

@derobert But the default, and that is what most users use, is: "do insecure backups" and, to add insult to injury: To Google. Who is also reading all those messages in Google? Their partners?

@Isaac Probably not their partners, but I wouldn't be surprised if Google's advertising software is. And of course any three-letter agencies. Also, at least according to android.stackexchange.com/questions/189455/… the default is off, not on.

@derobert Yes, not activated on first install. But they have a nagging insistence on repeating "activate your backups, it is good for you", I do know, I have experienced it. Insisting every time they could. Try Whatsapp and learn.

I'd rather not send all my personal data to Facebook :-/ Well, metadata.

@derobert Yes, I received it. Thanks.

(╯°□°）╯︵ ┻━┻ too many tabs! pkill chrome

@derobert: I guess that SRE position that was up on our site was old and they aren't currently looking for people anymore, sorry :(

@Jesse_b Thanks for the heads up. Hopefully they'll keep me in mind should any positions open up.