Need to let loose a primal scream without collecting footnotes first? Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid: Welcome to the Stubsack, your first port of call for learning fresh Awful you’ll near-instantly regret.
Any awful.systems sub may be subsneered in this subthread, techtakes or no.
If your sneer seems higher quality than you thought, feel free to cut’n’paste it into its own post — there’s no quota for posting and the bar really isn’t that high.
The post Xitter web has spawned soo many “esoteric” right wing freaks, but there’s no appropriate sneer-space for them. I’m talking redscare-ish, reality challenged “culture critics” who write about everything but understand nothing. I’m talking about reply-guys who make the same 6 tweets about the same 3 subjects. They’re inescapable at this point, yet I don’t see them mocked (as much as they should be)
Like, there was one dude a while back who insisted that women couldn’t be surgeons because they didn’t believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I can’t escape them, I would love to sneer at them.
Proton, who I use for mail and various other services, has gone against the wishes of the majority of their userbase as measured by their own survey and implemented an LLM writing assistant in protonmail, which is a real laugh given Proton’s main hook is its services are end-to-end encrypted
(supposedly this piece of shit will run locally if you meet these incredibly high system requirements including a high end GPU or recent, high end Apple M chipset and a privacy-violating Chromium-based browser. otherwise it breaks e2e by sending your emails unencrypted to Proton’s servers, and they do a lot to try to talk over that fact)
Who is the target audience for this?
People who use Proton are privacy-conscious and mostly (I would argue) tech literate, and yet they shove spicy autocomplete that no one ever needed until two years ago and most people don’t want now because it produces complete horseshit, and spellchecking that every browser under then sun has built in by now.
And then they quietly say you need to use Chromium, so the people who use anything but (like, I don’t know, the majority of privacy-conscious folks who should be their main user base, lol) have their e2e broken?
I really hope they catch a raging firestorm for this.
(Also I’m really pissed right now because used to recommend them to people and now feel like a total jackass for doing that.)
(Also I’m really pissed right now because used to recommend them to people and now feel like a total jackass for doing that.)
don’t feel bad for making the best choice you could with the information of the past. until we get a workable, interoperable, federated, encrypted communication/online services platform, the choice was to recommend one of the centralized e2e providers. we both chose to recommend Proton and they did this shit, but it could have just as easily been tutanota.
now my brain’s going “e2e encrypted federated email but it preferably uses activitypub as a transport and classic email as a fallback, is that anything”
yep! that’s the game they’re playing. I really don’t give a fuck about Proton’s relatively tiny number of enterprise whales, but they make Proton a shitload of money in the short term.
the depressing part is, historically, online services that remain uncompromisingly user-focused tend to stick around roughly forever, while the ones that chase short-term gains and compromise everything else almost always enshittify and fizzle out pretty quick.
Saw this in passing earlier and I just laughed
Until indicated otherwise I’m going to presume it was some bizbro PM/PO/whatever pushing it because they really think it should be there “to be able to compete” (because of some laughably idiotic misunderstanding of their own value proposition and pitch)
Tangent: while I mostly run my own servers and services I did a recent assay on who’s reasonable for service shit. Proton kept popping up massively recommended while some occasional critical mentions from folks in anarchist circles, etc - made me a bit 🤨 and want to dig in more, but also just their product offerings aren’t great. Others I poked into are fastmail and tuta - both seem a fair bit better. Might be worth a look
Proton kept popping up massively recommended while some occasional critical mentions from folks in anarchist circles, etc - made me a bit 🤨 and want to dig in more,
No surprise that folks in anarchist circles are skeptical of Proton ha. That said, I do know quite a few people in the email “industry” who are broadly skeptical of Proton’s general philosophy/approach to email security, and the way they market their service/offerings.
Others I poked into are fastmail and tuta - both seem a fair bit better. Might be worth a look
Fastmail has a great interface and user experience imo, significantly better than any other web client I’ve tried. That said, they’re not end-to-end encrypted, so they’re not really trying to fill the same niche as Proton/Tuta.
From their website:
Fastmail customers looking for end-to-end encryption can use PGP or s/mime in many popular 3rd party apps. We don’t offer end-to-end encryption in our own apps, as we don’t believe it provides a meaningful increase in security for most users…
If you don’t trust the server, you can’t trust it to load uncompromised code, so you should be using a third party app to do end-to-end encryption, which we fully support. And if you really need end-to-end encryption, we highly recommend you don’t use email at all and use Signal, which was designed for this kind of use case.
I honestly don’t know enough to separate the wheat from the chaff here (I can barely write functional python scripts lol - so please chime in if I’m completely off base), but this comes across to me as an understandable (and fairly honest) compromise, that is probably adequate for some threat models?
Last time I used Tuta the user experience was pretty clunky, but afaik it is E2EE, so it’s probably a better direct alternative to Proton.
re fastmail, david mentioned a thing I wasn’t aware of so they’re off the list now, more or less just going to forget they exist except as a counter-recommendation
this comes across to me as an understandable (and fairly honest) compromise, that is probably adequate for some threat models?
they’re sorta saying “yeah just use external GPG like before”
albeit I will say their reasoning is a bit fucked in the head imo: that “if you can’t trust the server” shit applies equally for whether it’s serving you up the page elements to do message cryptography, or whether it’s serving you up a normal webmail client. I think I know/understand where they meant to go with it, but the wording they picked is quite shit
I set up a tuta domain for a thing about a month ago. it could’ve been a bit smoother (esp. domain/dns state checks) but I didn’t find anything immediately jarringly bad - and I was even drunk at the time (which means my diy-able supergrump comes out about this sort of shit). will see how it goes over some longer use :)
Jesus fucking christ…
So where do I switch now? Is this the moment I build my own email server and handle this shit myself? I really don’t wanna…
they have apparently promised they don’t plan on implementing anything AI-related which is good, though I’m honestly hoping for a system where our privacy isn’t entirely reliant on the promises of a single authority
and I’m not saying we should do our own federated e2e email service, but somebody should
…more realistically, I’ll probably switch to tuta when my proton account nears renewal, as I’m not a fan of how much pure unfiltered horseshit I’m seeing them output with the money I paid them
Setting up an email server is really straightforward with simple-nixos-mailserver, highly recommend. No idea how likely you are to be classified as spam though from a new domain
I host my own email and for my day job I run an institutional email system that handles ~50 million messages per week. I can’t recommend hosting email at either end of that scale (or anywhere in between), and I find it difficult to believe that anyone with experience running a mail server would claim it’s reasonable or straightforward.
i host my mail services for the last twenty seven years, and yeah, you’re talking shit. starting the smtp daemon is not the same as managing mail server.
I’ve posted at Proton on Mastodon about this with some details on why it’s real bad; no reply yet
I linked to your masto post on twitter https://x.com/fasterandworse/status/1813994815991980204
Not to downplay what proton mail is doing, but they’re saying that you can run this locally with a 2 core, 4 thread CPU from 2017 (the i3 7100, which is a 7000 series processor), and a RTX 2060, a GPU that was never considered high end. Perhaps they changed the requirements while you weren’t looking. Or Am I reading this wrong?
only one of the 8 computers I own (and I’m not being cheeky here and counting embedded or retro systems, just laptops and desktops) is physically capable of meeting the model’s minimum requirements, and that’s only if I install chromium on the Windows gaming VM my bigger GPU’s dedicated to and access protonmail from there. nothing else I do needs a GPU that big, professional or otherwise — that hardware exists for games and nothing else. compared with the integrated GPUs most people have, a 2060’s fucking massive.
do you see how these incredibly high system requirements (for a webmail client of all things), alongside them already treating the local model as strictly optional, can act as a funnel redirecting people towards the insecure cloud version of the feature? “this feature only works securely on one of the computers where you write mail, at best” feels like a dark pattern to me.
Unfortunately, “extremely expensive” and “high-end” aren’t really synonyms, thanks to, y’know, bitcoin. Of course, I don’t disagree with your argument that having to buy a GPU just to ensure your webmail does what it’s advertised to do is, well, dumb.
What I don’t know is what the LLM even is. Did they just tack on Llama to their webmail app and call it a day? Did they train a model? Was it trained on emails? If so, whose emails? What an advertisement that would be: “Use Protonmail to encrypt your emails so that companies like Protonmail can’t use them to train an LLM.”