Sebastian Kugler on KDE security

[GreyGeek]

Sebas (his nickname) is "a core developer and architect of Plasma, a Free software project offering a graphical user interface for laptops and mobile devices, much like Microsoft Windows and Apple’s MacOS. I have been an executive at KDE and am currently COO at Blue Systems, leading and managing the team working on KDE software. I am proficient in C++, Python, QML, Javascript, PHP and a few other programming languages. My focus areas are hardware integration, graphics and especially multi-screen support, mobile devices and user interface design."


He has some interesting thoughts on the future of KDE and privacy. He suggests:

KDE needs to make an effort to provide a comprehensive set of tools for most users' needs, for example:

• An email client allowing encrypted communication
• Chat and instant messaging with state-of-the art protocol security
• A web browser (self-provided) that has private default settings
• File storage and groupware solutions
• Other tools that allow offline operation and independence from popular cloud services
• Support for online services that can be operated as private instance, not depending on a 3rd party provider
• State-of-the-art support and integration for services like Tor, Matrix, Zeronet, etc.

and more.

I like his thinking.

[dequire]

I read the article - And I agree with the assessment. And, let's face it - Linux needs to lead the way in the areas outlined to protect user's privacy. After all, it's one of the prime differentiators from other OS's. The fact that the KDE Community would be taking a leadership role in this area just makes me more proud to be a tiny part of it all.

[jglen490]

The more grouped or centralized your files are, the less secure they are by definition. Risk goes up the farther away you are from your own information.

Not that your localized files storage is automatically secure, but having your data where others have their data presents a higher risk and a greater cost to you in security solutions and greater diligence required of you. Groupware is useful, but not as a default for privately owned data.

If you act as though your data is at risk, you will tend to be more careful about what is where.

Bottom line, don't entirely trust what anyone says about their security solution in software. Healthy skepticism is your friend.

[GreyGeek]

... Bottom line, don't entirely trust what anyone says about their security solution in software. Healthy skepticism is your friend.

Indeed. A story in Slashdot today is about online harrasment by a fellow who was using Protonmail, Tor and PureVPN. The FBI caught him because PureVPN kept logs. Their big print implied that they don't because "Hongkong doesn't require mandatory data capture". The fine print said the opposite. Apparently the guy never read the fine print.

Most, if not all, VPN vendors keep logs, regardless of what they claim.

[wizard10000]

Indeed. A story in Slashdot today is about online harrasment by a fellow who was using Protonmail, Tor and PureVPN. The FBI caught him because PureVPN kept logs. Their big print implied that they don't because "Hongkong doesn't require mandatory data capture". The fine print said the opposite. Apparently the guy never read the fine print.

Most, if not all, VPN vendors keep logs, regardless of what they claim.

I got an IP ban from /. back in the day for running a tor exit node.

[GreyGeek]

I got an IP ban from /. back in the day for running a tor exit node.

How far back in the day was that?

So too many anonymous visitors were showing your exit node IP address as "their" IP address and /. couldn't handle that?

[wizard10000]

How far back in the day was that?

So too many anonymous visitors were showing your exit node IP address as "their" IP address and /. couldn't handle that?

Almost 20 years. /. was getting trolled hard by folks using tor so they IP-banned all the exit nodes they could find. They were very quick about restoring my access once I took the node down, though. Running an exit node was pretty tough on my SOHO router so I was kinda glad to take the node down.

I wouldn't run a tor node these days, though. Back in the days before darkweb was a thing tor was the platform dissidents used to show their governments abusing citizens and I was all for that. These days running a tor node just flags you for increased scrutiny from NSA and the FBI

[GreyGeek]

I’ll wager that node killed your bandwidth too and made using your internet connection slow. In my testing of P2P networks that was my experience. Even a 60-70 Mbps bandwidth wasn’t enough when there were ~500+ peers connected.


Sent from my iPhone using Tapatalk

[oshunluvr]

The more grouped or centralized your files are, the less secure they are by definition. Risk goes up the farther away you are from your own information.

This seems contradictory. The statement reads "If your files are centralized (singularly located), they are less secure. If your files are dispersed (farther away), they are less secure."

"Centralized disbursement" is an oxymoron. Having your files close-at-hand (not far away) yet not centralized (grouped) is also an oxymoron. Either close-at-hand is more insecure or far away is more insecure but it can't be both. Clearly, I don't understand what you meant by this statement.