spammers are more consistent at making SPF, DKIM, and DMARC correct
THE CANDID NAIVETY OF GEEKS by Ploum on 2025-03-28 https://ploum.net/2025-03-28-geeks-naivety.html I mean, come on! ================ Amazon recently announced that, from now on, everything you say to Alexa will be sent to their server. Pluralistic: Amazon annihilates Alexa privacy settings, turns on continuous, nonconsensual audio uploading (15 Mar 2025) (pluralistic.net) https://pluralistic.net/2025/03/15/altering-the-deal/ What surprised me the most with this announcement is how it was met with surprise and harsh reactions. People felt betrayed. I mean, come on! Did you really think that Amazon was not listening to you before that? Did you really buy an Alexa trusting Amazon to "protect your privacy"? Recently, I came across a comment on Hacker News where the poster defended Apple as protecting privacy of its users because "They market their product as protecting our privacy". I mean, once again, come on! Did you really think that "marketing" is telling the truth? Are you a freshly debarked Thermian? (In case you missed it, this is a Galaxy Quest reference.) The whole point of marketing is to lie, lie and lie again. What is the purpose of that gadget? =================================== The whole point of the whole Amazon Alexa tech stack is to send information to Amazon. That’s the main goal of the thing. The fact that it is sometimes useful to you is a direct consequence of the thing sending information to Amazon. Just like Facebook linking you with friends is a consequence of you giving your information to Meta. Usefulness is only a byproduct of privacy invasion. Having a fine-grained setting enabling "do not send all information to Amazon please" is, at best, wishful thinking. We had the same in the browser ("do-not-track"). It didn’t work. I’ve always been convinced that the tech geeks who bought an Amazon Alexa perfectly knew what they were doing. One of my friends has a Google Echo and justify it with "Google already knows everything about our family through our phones, so I’m trading only a bit more of our privacy for convenience". I don’t agree with him but, at the very least, it’s a logical opinion. We all know that what can be done with a tool will be done eventually. And you should prepare for it. On a side note, I also postulate that the reason Amazon removed that setting is because they were already gathering too much data to justify its existence in case there’s a complaint or an investigation in the future."How did you manage to get those data while your product says it will not send data?". But, once again, any tech person knows that pushing a button in an interface is not a proof of anything in the underlying software. Please stop being naive about Apple =================================== That’s also the point with Apple: Apple is such a big company that the right hand has no idea about what the left hand is doing. Some privacy people are working at Apple and doing good job. But their work is continuously diluted through the interests of quick and cheap production, marketing, release, new features, gathering data for advertising purpose. Apple is not a privacy company and has never been: it is an opportunistic company which advertise privacy when it feels it could help sell more iPhones. But deeply inside, they absolutely don’t care and they will absolutely trade the (very little) privacy they have if it means selling more. Sometimes, geek naivety is embarrassingly stupid. Like "brand loyalty". Marketing lies to you. As a rule of thumb, the bigger the company, the bigger the lie. In tech, there’s no way for a big company to not lie because marketers have no real understanding of they are selling. Do you really think that people who chose to advertise "privacy" at Apple have any strong knowledge about "privacy"? That they could simply give you a definition of "privacy"? I know that intelligent people go to great intellectual contortions to justify buying the latest overpriced spying shiny coloured screen with an apple logo. It looks like most humans actively look to see their freedom restricted. Seirdy calls it "the domestication of users". WhatsApp and the domestication of users (seirdy.one) https://seirdy.one/posts/2021/01/27/whatsapp-and-the-domestication-of-users/ And that’s why I see Apple as a cult: most tech people cannot be reasoned about it. The Cost of Being Convinced (ploum.net) https://ploum.net/the-cost-of-being-convinced/index.html You can’t find a technical solution to a lie ============================================ Bill Cole, contributor to Spamassassin, recently posted on Mastodon that the whole DNS stack to protect spammers was not working. than are legitimate senders. 🆘Bill Cole 🇺🇦: "@jwz@mastodon.social The stats we collect for the…" (toad.social) https://toad.social/@grumpybozo/114213600922816869 It is, once again, a naive approach to spam. The whole stack was designed with the mindset "bad spammers will try to hide themselves". But was is happening in your inbox, really? Most spam is not "black hat spam". It is what I call "white-collar spam": perfectly legitimate company, sending you emails from legitimate address. You slept in a hotel during a business trip? Now you will receive weekly emails about our hotel for the rest of your life. And it is the same for any shop, any outlet, anything you have done. Your inbox is filled with "white-collar" junk. And they know this perfectly well. In Europe, we have a rule, the RGPD, which forbid businesses to keep your data without your express consent. I did the experiment for several months to send a legal threat to every single white-collar spam I received. Guess what: they always replied that it was a mistake, that I was now removed, that it should not have happened, that I checked the box (which was false but how could I prove it?) or even, on one occasion, that they restored a backup containing my email before I unsubscribed (I unsubscribed from that one 10 years before, which makes it very unlikely). In short, they lied. All of them. All of them are spammers and they lie pretending that "they thought you were interested". In one notable case, they told me that they had erased all my data while, still having the cookie on my laptop, I could see and use my account. Thirty days later, I was still connected and I figured that they simply managed to change my user id from "ploum" to "deleted_ploum" in the database. While answering me straight in the face that they had no information about me in their database. Corporations are lying. You must treat every corporate word as a straight lie until proved otherwise. But Ploum, if all marketing is a lie, why trusting Signal? ========================================================== If you can’t trust marketing, why do I use Signal and Protonmail? First of all, Signal is open source. And, yes, I’ve read some of the source code for some feature I was interested in. I’ve also read through some very deep audit of Signal source code. Reviewing the Cryptography Used by Signal (soatok.blog) https://soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal/ I’m also trusting the people behind Signal. I’m trusting people who recommend Signal. I’m trusting the way Signal is built. But most importantly, Signal sole existence is to protect privacy of its users. It’s not even a corporation and, yes, this is important. Yes, they could lie in their marketing. Like Telegram did (and still does AFAIK). But this would undermine their sole reason to exist. I don’t say that Signal is perfect: I say I trust them to believe themselves what they announce. For now. What about Protonmail? ====================== For the same reasons, Protonmail can, to some extent, be trusted. Technically, they can access most of the emails of their customers (because those emails arrive unencrypted to PM’s servers). But I trust Protonmail not to sell any data because if there’s any doubt that they do it, the whole business will crumble. They have a strong commercial incentive to do everything they can to protect my data. I pay them for that. It’s not a "checkbox" they could remove, it’s their whole raison d’être. This is also why I pay for Kagi as my search engine: their business incentive is to provide me the best search results with less slop, less advertising. As soon as they start doing some kind of advertising, I will stop paying them and they know it. Or if Kagi starts becoming to AI centric for my taste, like they did for Lori: Why I Lost Faith in Kagi (d-shoot.net) https://d-shoot.net/kagi.html I don’t blindly trust companies. Paying them is not a commitment to obey them, au contraire. Every relation with a commercial entity is, by essence, temporary. I pay for a service with strings attached. If the service degrade, if my conditions are not respected, I stop paying. If I’m not convinced they can be trusted, I stop paying them. I know I can pay and still be the product. If I have any doubt, I don’t pay. I try to find an alternative and migrate to it. Email being critical to me, I always have two accounts on two different trustable providers with an easy migrating path (which boils down to changing my DNS config). Fighting the Androidification ============================= Cory Doctorow speaks a lot about enshitification. Where users are more and more exploited. But one key component of a good enshitification is what I call "Androidification". Androidification is not about degrading the user experience. It’s about closing doors, removing special use cases, being less and less transparent. It’s about taking open source software and frog boiling it to a full closed proprietary state while killing all the competition in the process. Android was, at first, an Open Source project. With each release, it became more closed, more proprietary. As I explain in my "20 years of Linux on the Desktop" essay, I believe it has always been part of the plan. Besides the Linux kernel, Google was always wary not to include any GPL or LGPL licensed library in Android. 20 years of Linux on the Desktop (part 3) (ploum.net) https://ploum.net/2025-03-08-linux_desktop3.html It took them 15 years but they finally achieved killing the Android Open Source Project: Google will develop the Android OS fully in private, here's why (www.androidauthority.com) https://www.androidauthority.com/google-android-development-aosp-3538503/ This is why I’m deeply concerned by the motivation of Canonical to switch Ubuntu’s coreutils to an MIT licensed version. Ubuntu 25.10 plans to swap GNU coreutils for Rust (go.theregister.com) https://go.theregister.com/feed/www.theregister.com/2025/03/19/ubuntu_2510_r... This is why I’m deeply concerned that Protonmail quietly removed the issue tracker from its Protonmail Bridge Github page (making the development completely opaque for what is an essential tool for technical Protonmail users). I mean, commons! ================ This whole naivety is also why I’m deeply concerned by very intelligent and smart tech people not understanding what "copyleft" is, why it is different from "open source" and why they should care. We need more of Richard Stallman, not less (ploum.net) https://ploum.net/2023-06-19-more-rms.html Corporations are not your friend. They never were. They lie. The only possible relationship with them is an opportunistic one. And if you one to build commons that they cannot steal, you need strong copyleft. On Open Source and the Sustainability of the Commons (ploum.net) https://ploum.net/2024-07-01-opensource_sustainability.html But firstly, my fellow geeks, you need to lose your candid naivety. I mean, come on, let’s build the commons!