Ok so you’re a troll then. Fearmongering doesn’t help the community. If you’re against something give evidence. There’s a balance between fearmongering and blind hype.

this reply adds nothing. Please explain your position

How do you send a threat to an IP address?

Unless, you’re thinking ISP involvement

There’s many ways to track somebody down via IP address, but yes ISPs can corroborate. You ever heard of people getting letters from the ISP for torrenting? You think the ISPs actually care about piracy? They are forced by legal pressure.

If the threat model is “lawyer”, developers will be fine

The threat model is massive fines and potential prison, depending on how the court case goes. Look up the Yuzu nintendo switch emulator and how that legal battle went. And I’m not arguing that those developers were the brightest of the bunch. I’m saying that those developers could use the privacy that Tor offers.

bittorrent will not be the right protocol for this anyway.

Bittorrent works well enough. Bittorrent works fine over I2P and is used plenty. Better to get something up and running before starting to design bespoke protocols.

P2P already gives you anti-censorship

until a lawyer joins the swarm and has the IP of every node. See which node pushes commits to the swarm first, and you found the dev. Send a couple of threats to the dev and watch the project grind to a halt.

Plugging into Tor or I2P is a easy way to give network anonymity, no need to re-invent the wheel. Though it seems like Radicle already supports Tor and I2P so not entirely sure what OP aims to do

You don’t have to pre-order, just wait until it’s released and buy it then. And in this case you can get a raspi and test the product for yourself, so why spread FUD?

Matrix. Bitwarden. Nextcloud. There are many examples of open-source, self-hosted applications that have for-profit companies that offer to host them for you as a service. Now if you use one of those Nextcloud providers to store your notes, can that providers read all your data? Of course. But for people who don’t want to self-host, it’s often a more trusted option than Google.

I don’t see the point of forking Radicle. Radicle itself barely has any users, how many users do you expect your fork to have? Think about re-writing Radicle in another language later. It’s not certain Radicle will even exist a year from now

Anonymity makes sense in this case. Radicle is often proposed as a solution to the censorship of projects in other repos, things like Nintendo Switch emulators, Hayase streaming client, etc. These projects want to remain anonymous to avoid legal threats on their actual identity

“they know you care about privacy” as opposed to the actual thing they know, which is simply that you mailed a letter

I should have been more specific. They are looking for somebody that mailed cash to an email service for account X. They know the mail came from postbox Y. They use surveillance footage and other factors to find the 10 people that used postbox Y that day. etc.

And yes the Monero blockchain is public, just like Tor traffic, but it’s all encrypted.

The opponent still has orders of magnitude more resources than you

Except with Tor and Monero, it’s not them vs you, its them vs everybody using Tor and Monero. That’s way harder. My point was that targeted surveillance is game over. Trying to break Monero is not a targeted attack. And the number of exploits on Tor and Monero are much more known than the number of exploits known for physical methods. You can look them up. Again, the fact that all this information is public is a good thing. It means security can improve over time. Hackers get better too, but if we look at history, in general computer security gets the upper hand over time. For example look at how hard it is to jailbreak an iPhone nowadays.

Physical methods is where there actually might be a million exploits. Nobody knows how secure they are, and anybody who claims to know is probably overconfident, with very little rigorous evidence.

These comments are why privacy products will always be behind. Why open-source is full of dead projects. These people are just trying to make a living off making privacy-focused products. And all the comments are like “They’re a for-profit company? They had marketing material prepped to reply to people’s comments?!”.

The code is open-source, self-hostable, built using commodity hardware (raspi), and they’re just trying to make it sustainable by providing an optional paid service. This is not the enemy.

I think they’re just a privacy-focused startup that just wants to make a living off their work

Better the devil you know than one you don’t. Physical methods involve too many unknowns, and chances are the people using them are overconfident, victims of dunning-kruger effect. The weaknesses of cryptography can be publicly studied. The blind spots in the surveillance network of your neighborhood are a big unknown. I’ve made enough security mistakes in the past to know that the biggest risk is the user, and the more you can offload to professional tools like Tor and Monero, the better.

Perhaps they find out they have a surveillance video of you going to the restaurant and getting lunch then mailing a letter and try to use it as evidence that you conducted a cash transaction using a nonce.

It’s not that simple. They have a rough idea of your location past on the post office box. They use surveillance footage to narrow down the list of suspects. They know that the suspect cares enough about privacy to mail cash to an email service. That’s at most 1/1000 individuals. So in a city of a million residents, that’s about 1000 people. Combined with surveillance footage, traffic cameras, and phone tracking to determine the movements of all citizens, as well as cameras around the post office box to get the height and build of the suspect, they can probably narrow it down to 5-10 people. Then they monitor those 5-10 people individually. Even using illegal methods like breaking in and installing mics, cameras, bugged hardware. Once they confirm who the suspect is, and find evidence, they use parallel construction to come up with some legal rational for how they found the evidence, hiding their illegal methods.

Imo targeted surveillance is game over. The enemy has magnitudes more resources on you, and you’ll never even know that it’s happening. The best you can do is avoid it in the first place. Hide amongst a million others, using Tor or Monero.

What do you mean the space for digital is unlimited and infinite? There’s finite resources on the planet. 2048-bit RSA is not getting brute-forced in our lifetime (without quantum). And if you are talking about password strength, all of what you mentioned should be factored in. Take the combined compute of all GPUs of the world, factor in Moore’s law with a 50 year horizon, and figure out how strong your password should be. I know some people use 128 bits of entropy but I think 100 bits is plenty. Use a word-based passphrase for easy memorization. Or just use a hardware key.

Now I’d love to know how to calculate what level of security is enough for physical methods. Anything rigorous?

I believe the UK too

I remember hearing the opposite, that strikes with a set duration were ineffective because management could just wait it out…

Second this one. I watched it months ago and still think about it. Be careful when you look it up. Tons of spoilers everywhere. At most just watch the official trailer (don’t read the comments) and decide if you want to watch it. It’s about a son with schizophrenia and his mother

how many countries has Signal pulled out of so far? I keep hearing about it

If they got their hands on a machine would they be able to replicate it? If it was such a massive advantage I imagine they would just take one by force, I mean look at how the US just took out two national leaders

I’m surprised they can’t just smuggle the chip designs and factory designs from Taiwan, they’re so close

I think this comment is a good example of why people don’t like physical methods. It just seems so hand-wavy, like homeopathic medicine. How do you judge how well it will work in a given situation? Physical privacy is just dependent on too many unknowns. And privacy techniques for the user have not improved in the past 100 years, meanwhile surveillance and location tracking algorithms for the authorities have progressed.

Digital privacy continues to improve every year. Andbody can use Tor and Monero, and benefit from the research and development behind them. Anybody can audit the tech, and build on top of it. Right now darknet markets are clunky to use, but they definitely feel better than they did 5 years ago, and they’ll keep getting better.

Anyways thanks for engaging in this discussing with me, it definitely helped me explore these ideas deeper.

Keep your nose clean out there, you never know whose gonna be looking in 20 years…

depending on your juridiction, the statute of limitations should save you after 20 years :)