# articles

feed_id: http://about.okhin.fr//posts/Fallacies/
title: Crypto fallacies
uri: Crypto-fallacies
url: http://about.okhin.fr//posts/Fallacies/
content:
<p>This post is a follow-up on what I tweeted yesterday - hours before the
constitutional council gave its approval of the new French Intelligence
bill. First tweet is
<a href="https://twitter.com/okhin/status/624159562690596864">here</a></p>

<h1>Where I come from</h1>

<p>Before writing this article, I think it's important to give some context
about what I've done the last few years.</p>

<p>So, before joining the Telecomix Crypo Munition Buro and #telekompaketet, I
wasn't that much in security and crypto. I learned that on the late, and with
some specific goals in minds - I'll be back to that later. I was a mercenary
sysadmin, working for anyone willing to pay me to maintain their system.</p>

<p>I didn't understood the difference between free software and open source back
in the time, neither was I aware of a lot of issues in the world. Looking to
it through my small internet periscoped visor. Most of the news I was reading
back in the time were tied to computer, video games and - to some extent -
foreign diplomacy.</p>

<p>Not the mainstream media, but not much better. I worked for government and
the police - maintained the fingerprint database used by cops and sold by the
former Sagem - now known as Morpho XL. I worked for oen of the traditionalist
newspaper. For startup trying to build customer profile and senders of
millions of mails.</p>

<p>But I was reading those few news. I was joining the twitter (2009 … damn,
that's already 6 years?) and already having fight with people humping on the
Facebook boat.</p>

<p>Because what was clear for me was that my privacy should be kept under my own
personal control, not under the control of anyone or anything else. I always
been shy about sharing data over over public and free network who will track
you in the end.</p>

<p>I got this habit of watching for my privacy since high school. I accessed the
internet for the time at this time. And at home we even had high-speed
internet (512 Mbps in 1997, was part of an 31337, not chasing for those AOL
50h of free internet CD Roms).</p>

<p>I got this habit not because of the teaching of someone, but because of my
father. See, my father wasn't an abusive one. He was kinda distant, avoiding
me, but he was not an abusive one. At the time we had internet and when I
discovered some of the endless possibilities of the computers being connected
to each other, I also learned that my father was a paedophile. He has been
convicted for that. Twice. At least the second time it was related to
detention of pictures from internet.</p>

<p>Yep, that's about how I learned how it was important to understand how things
works and why it was paramount to protect your privacy. Because cops would
breaks into your house and seize your hardware for the sole purpose of you
living in the same house than a sexual offender.</p>

<p>So, everything started there for me. Since then I always had a full encrypted
drive, I've used the privacy mode in my browser as much as I could, I learned
to delete cookies and Internet Cache on a lot of browsers (from Netscape
Navigator and Mozaic to chrome to Internet Explorer 6).</p>

<p>This is when I started caring for the law about computers and communication.
And censorship. I did not really get a grasp of what politics where, but
still, I was keeping an eye at it.</p>

<p>Got a degree in computer science and got working, trying to earn my
independence and to get out of my parents house - almost 20 years later I
still can't speak to my father and yes, it's part of the reason I'm severely
depressed - and so on.</p>

<p>We're now in 2009, end of the year and I'm bored at work. There is a lot of
signal coming from Tunisia that things will getting ugly there. That's when I
started to act for someone else than me.</p>

<p>I was self hosted, so I had spaces. And root access to my servers. Slim
Ammanou was interviewed in some media I was reading (Cant' remember if it was
Read Write Web fr or the blog of Jean Marc Manach, not really important I
guess). And some people were doing mirrors of censored blogs in Tunisia.</p>

<p>I was bored, I did knew bash, so I scripted some things to help. WHen someone
figured out that the ATI was dropping the SSL around facebiik to catch login
and password, I crote a one line that could generates gigabytes of fake
password for a specific account.</p>

<p>And someone told me to join IRC and #telekompaketet@irc.telecomix.org. I
haven't fired up an IRC client since the 2000' so it felt a bit odd, but then
a lot of things changed for me, starting with the immolation of Mohamed
Bouazizi, the Egyptian revolution and the Syrian civil massacre.</p>

<p>During those last five years I developed my security and crypto skills, and
tried to train activists who needed it to communicate. I've quit my job and
worked for an NGO for nearly a year and a half, chain burning-out myself to
the point of severe anxiety disorder and depression, mixed with my attention
disorder it doeswn't goes well.</p>

<p>So this is where I come from. I hope that it will helps you to understand
what and why I'm going to say the next few things.</p>

<h1>Crypto fallacies</h1>

<p>The crypto fallacies is to think that your freedom relies on the tool you
use. That, if you use the correct tools, in the way they're intended to, then
you have nothing to fear from an oppressive regime.</p>

<p>It's false, first because IT security on the general computing is a disaster
- and I'm not sure it can be fixed anytime soon - but lmost of all it's
false because you're opposing an oppressive regime.</p>

<p>If you're not actively opposing an oppressive regime, you're silently
accepting it and then you're an accomplice. So, you're opposing an oppressive
regime. An oppressive regime as one specific characteristics, it's using
arbitrary detention and arrest to spread terror and keep thing under control.
And no amount of crypto can fight that.</p>

<p>I've seen kill list in Syria, written with a carbon pen on a piece of paper.
Based on denunciation by neighbors, assumptions by people or just because
people did not live in the correct address. I've seen people getting shot for
no other reason than their skin color, or the way they were dressed.</p>

<p>But most of all, I've seen people getting arrested, tortured and shot at
because they were protesting into the street. And that's the thing
cryptonerds needs to understand. In the end, the purpose of an activists, is
to get in the street, to oppose - violently - the state, and end up in jail
(in the bes case scenario). The crypto, or the tech gyzmo you can provides
them with won't prevent that.</p>

<p>Also, if your freedom relies on a specific piece of tech, or a specific
knowledge, it means that each and every people who has no access to it can't
be free. Which raises an issue that I have not seen adressed by the most
vocal voices in the OpSec for activists people. Sure, you can do IT Training
in Mali, but when you have power outtage several hours a day and when the
temperature will frequently raises above 40°C, most of our tech is made
unusable - believe me, we tried that.</p>

<p>I've also seen crypto nerds going <a href="https://blog.imhiril.fr/extremiste-et-fier-de-letre.html">extremists</a> and refusing to even
consider talking to an activists over an unencrypted channel. That's an
interesting stance since then, the activist would never know how to do that</p>

<p>That's also a good way to forbid communication, which is mandatory for
coordinating actions, getting information out, and care about people. If we
would follow those extremists, we would end up in an autistic mode without
communicating because it would exposes you to a risk. Risk that still needs
to be determined.</p>

<p>And, in the end, if you want to undermine and destroy an oppressive regime,
you need to accept the risks. You need to accept that you'll end up in jail.
You need to accept that you'll be beaten up. You need to accept the fact that
if you do not take the streets, then it's your opponent who have them. And
you need to take that back.</p>

<p>And you cannot do it from a computer.</p>

<p>Sure, sysadmin and service operators providing good opportunistic
cryptography, with fluid interface and where the security doesn't get in the
way of the user, while protecting their users from the government are needed
- and it's the path I've choose, but you have to accept that it's illegal in
most states. Even in NATO countries, or in the EU.</p>

<p>But those sysadmins won't be protected by crypto. Their freedom is at risk as
soon as they decide to fight and to help. And no crypto tool you can use can
tight your organisation to a point where no exterior influence can destroy
it. We've seen it before - with Sabu for instance - we'll see it again
because that's how things works.</p>

<p>The only thing crypto will buy you is time. This time should be used to
coordinate, to share, to care, but it won't get you out of jail (even TPB
founders did serve time). But that's about it, once you'll be in the street,
you'll end up in jail whatever the crypto you're using.</p>

<p>And that is called OpSec (Operation Security). The purpose of OpSec is to be
able to run an operation. If the crypto you're using makes you unable to run
it, then you've failed your OpSec. And running no Operation is also an
Operational failure.</p>

<p>So, yes, crypto is usefull, because it gives you time and space to breathe.
It allows you to get some room to distress and coordinates. But your freedom
does not rely on a piece of tech. It relies only on you to take it.</p>

<p>Go into the street.</p>


feed_id: http://about.okhin.fr//posts/Tired_of_this_shit/
title: Tired of this shit
uri: Tired-of-this-shit
url: http://about.okhin.fr//posts/Tired_of_this_shit/
content:
<p>[[!meta title="I'm tired of this shit']]</p>

<h1>Shooting the ambulance</h1>

<p>It seems that there's a national sport among crypto nerds, and it's shooting
the ambulance. Yeah, I know, I've been kind of naive thinking that some
people with common sense could be more vocable than the people who enjoy
ranting on stuff, saying that this is shit, and that only them know the
truth.</p>

<p>I'm speaking specifically about the <a href="https://www.own-mailbox.com/">own
mailbox</a> project and the torrent of flame and
more or less accurate accusation it received from @aeris in
<a href="https://blog.imirhil.fr/own-mailbox-charlatanisme-ou-incompetence.html">this</a>
<a href="https://blog.imirhil.fr/own-mailbox-la-reponse-a-la-reponse.html">three</a>
<a href="https://blog.imirhil.fr/own-mailbox-suite-et-fin.html">posts</a>. I also like
to point out that the <a href="https://www.own-mailbox.com/rep.html">answers</a>
provided by the Own Mailbox team doesn't makes them right. There are issues
with the project, but I do not think it's a reason for burning them alive,
but instead would have been interesting to help them to improve.</p>

<p>This is something aeris have an issue with - I already pointed that out in
the way <a href="https://about.okhin.fr/posts/Crypto_parties/">Crypto Parties</a> are
ran around here in Paris.</p>

<p>The point he's missing in those articles is - as always - what is the threat
model own mailbox tries to solve; as well as mixing up a lot of things
(blaming a mail server for the insecurity of TLS or for the possibility of
MitM attack is … out of scope).</p>

<p>So, let's try to think about that.</p>

<h1>Everything is broken</h1>

<p>First, as Quinn Norton once wrote, if you pretend to work in the security and
tries to improve the safety of people, you have to acknowledge that:
<a href="https://medium.com/message/everything-is-broken-81e5f33a24e1">Everything is
brooken</a>. It
basically states that there's no way to have a secure system. It does not
exists, it will not exists any time soon.</p>

<p>If you look at a project like own mailbox, where you will display decrypted
text on an end-point - because if you're not you're either using bad crypto
or no-one is actually reading the content.</p>

<p>Eventually, you'll have decoded data - sensitive data - displayed and stored
at least in memory of a computer. A computer which is flawed by malware,
spyware, adware and other nasty things. Whatever your crypto level is, even
if you have a fully patched computer with as few software as you need, you'll
probably have some 0-day active that a motivated attackers can exploit to get
access to this memory.</p>

<p>It means that, with a sufficient amount of time and of motivation, someone
else than the emitter and recipient of the message would be able to get their
hands on your data, for the simple reason that - at some point - you need to
read it.</p>

<p>And if you have a bullet-proof mailbox - which is the promises made by own
mailbox - well, it's way much easier to target the end-node and to read the
mails at the same time as the user.</p>

<p>After all, Hacking Team was doing basically exactly that. And there's no
reason to believe that they were the only one to do that.</p>

<p>And no, free software will not save you there, with so many attacks on web
browser, or PDF, it's not enough to run free software on your computer. One
way to solve this issue is to use an <a href="https://en.wikipedia.org/wiki/Air_gap_%28networking%29">air
gap</a> computer, a
computer that have never been and never will be connected to a network of a
kind. It means you need to burn your mails on a CDRom or a DVDROm and to
check them onto the airgap system.</p>

<p>And this is something you cannot do with the general public. Because
maintaining such a computer - set asides the financial costs - requires time.
Like at least one hour a day. Every day. And to get a good understanding at
how the computer works. Which is something a lot of people - because they do
not want to or because they cannot to - won't do.</p>

<p>Also, assuming that the average computer/smartphone/tablet/whatever security
is higher than the one of a small brick that cannot be easily improved and
extended is a hell of a mistake. Key generation whould only be done on airgap
computer with hardware random number generator if you want to have really
secure keys - and stored on a read-only devices.</p>

<h1>Never forget Jessica</h1>

<p>This is the second most important error done I think. We forget about
<a href="http://swiftonsecurity.tumblr.com/post/98675308034/a-story-about-jessica">Jessica</a>.
Specifically we make two mistakes. The first one, that everyone is willing to
spend a lot of time figuring out their safety and to protect themselves and
their relatives against a theoretical threat.</p>

<p>Let's stand back a little bit. We already have hard time to have people using
simple means to protect themselves against a <em>real</em> threat like AIDS,
syphilis or other STI - use condoms people. Seriously - how would we have them
protect themselves against philosophical and political threats?</p>

<p>Especially if we expect them to understand things that could take some months
or years to get by? What is the point of full-encrypted mail? What means
end-to-end? What's the NSA/GCHQ/insert-your-own-agency-here doing exactly?
And why they're doing it? They're trying to protect us, of course. Against
terrorism. That's what they said.</p>

<p>If you want user to actively use crypto, you need them to not think about
using it. And if you focus only on the technical issue, you're missing the
point that it's a political one. Because if your government wants to spy on
you, they will sub-contract a hacking team like, and you'll be screwed.</p>

<p>This is what - I think - aeris is missing. The people who'll actually get the
own-mailbox are people who already understand why they need to protect
themselves (yay, there's actually some of them out there), but who can't
afford to host themselves another way - essentially by a lack of time and of
skills.</p>

<p>People who will get these kind of devices are not the hard core activists who
tries to avoid cops enter their house to seize computer look-a-like devices.
Because, in this situation, hosting your mail in your office is useless at
best, dangerous at worst.</p>

<p>So, most of the people who will use this kind of device or services aren't
really people at risk of being sent in jail because they sent an email.
They're probably the one who will use it as a nice gadget, on a side.</p>

<p>This kind of devices have no chance to ever be used in life or death
situation. And even if they were, <a href="https://about.okhin.fr/posts/Fallacies/">crypto won't protect you from
bullets</a>.</p>

<p>Also, everyone seems to think actual people uses email. They're not. Less and
less. We're using Facebook messenger, twitter DM, GMail (which is less and
less compatible with third-party clients), WhatsApp, SnapChat, SMS, etc …</p>

<p>I'm not saying that it's a good thing. I'm trying to understand who are the
people who're gonna use this. And it won't be the social-media addict who
only uses a Mac and GMail, it won't be the Uber Nerd who uses only mutt and
altern.org emails, nor will it be company - because they can't handle the
load on those devices.</p>

<p>It won't neither be the poorest people who do not have access to a correct
enough ADSL line. So it will be people who already understand what it means
to being watch and wants to add a little bit more security on their devices.</p>

<p>The thing is, we won't get everyone doing key management the perfect way for -
 at least - two reasons. The first one being that no one know what is perfect
key management. The second one being that even the crypto nerds fails at it
on a regular basis.</p>

<p>So this is it.</p>

<p>I really think that own-mailbox commercial team have an issue. Their answer
is out of scope. There is some issues to be addressed. The funnier one is
pretending that needing JavaScript for a webmail client would be a security
issue … it will be if you're living in a place where there is MitM
interception on the line + a way to tamper with TLS. Which is typically the
case where you do not want to have a box with all your emails in your houses.</p>

<p>But going after them, saying that the devices is blatantly flawed <em>without
even having one at hand</em> in the first place is kind of stupid and counter
productive. There's an issue around the terms used (100% secure is always
false), but I believe that - since it's a free software project - aeris could
have, at least, open bugs or ticket. I did not find a repo for own-mailbox
though - didn't look for it hard neither.</p>

<p>But aeris choose to get out for blood. Yes, this porject is far from perfect,
but it's still a plus, and if it gets some people to use more opportunistic
crypto, then it's fine enough for me.</p>

<p>aeris, you really should understand that no, no one can use the tools you're
using as part of their regular routine. And in most case it's not even a
matter of will, but a matter of means.</p>


feed_id: http://about.okhin.fr//posts/GMail/
title: GMail … seriously?
uri: GMail-seriously
url: http://about.okhin.fr//posts/GMail/
content:
<h1>GMail: why it's not a good thing</h1>

<p>This post is an answer to <a href="https://blog.jbfavre.org/2015/09/29/Auto-hebergement-surveillance-de-masse/">jbfavre
post</a>[FR],
in which he state that - from a metadata point of view, your safer in the
mass and so in gmail for instance than if you self host yourself.</p>

<p>In the conclusion he goes on saying that the best choice would be to hand
over your mails to associations or small business - which I might agree
(under specific concerns).</p>

<p>But he's not the only one stating that your better with a gmail account than
one on your own domain name.
<a href="https://blog.imirhil.fr/own-mailbox-la-reponse-a-la-reponse.html#isso-135">manhack</a>
and others are also arguing that GMail is best to evade the mass
surveillance.</p>

<p>Those person suggest that using GMail, is simple and Google has a lot of cash
to invest in security. They're also trying hard to hinder NSA mass collection
of data effort, but I think saying that using Google service is a good way to
enforce your privacy is an intellectual bias.</p>

<p>I think this idea come from a misconception of what mass surveillance is.
Mass surveillance is the intricate surveillance of an entire or substantial
part of a population <a href="https://en.wikipedia.org/wiki/Mass_surveillance">WP</a>.</p>

<p>On the internet, the mass surveillance is done by a systematic collection of
all data and metadata, their archiving and indexing and the fact that action
and decisions are made on the results those data will show.</p>

<p>In France, there's a specific concern because it's now legal for our
government to intercept all the communication and analyze metadata. Then
there's a fallacy stating that if we all use the same host and the same
encryption, then it's impossible for the state to know who's talking to who
and when; opposed to the case where everyone have its own host and its
"relatively" easy to know who's speaking to who and when.</p>

<p>It comes from the fact that, if I'm the only one receiving and sending mail
from this computer, then you just need to get the TCP handshake to be sure
that someone is talking with me. So it would be safer to have some kind of
proxy somewhere, to mutualise those connections and to raise the cost of
surveillance isn't it?</p>

<p>Except that this answer is valid if and only if you have some conditions:
 - The proxy is not itself part of a mass surveillance system
 - The mass surveillance you're trying to hide from does not go further than
   just getting the TCP protocol of your connexion
 - Your correspondent also use this sort of mass proxy, or it would be easy
   to know when he's talking</p>

<p>So, let's see what's the case with gmail.</p>

<h1>Is Gmail involved in a mass surveillance system?</h1>

<p>The obvious reason would be yes. At least because they can be coerced by the
NSA to provide data to the NSA. Even if their was actually few uses of PRISM,
the fact that they're forced by law to collaborate is not a good thing.</p>

<p>You would argue that it's just the NSA spying on us, they cannot actually do
things to you if your not a US citizen which is false. Because there's at
least the <a href="https://en.wikipedia.org/wiki/Five_Eyes">Five Eyes</a> coalition,
meaning that data gathered on you by the NSA will be shared with other
agencies from other government.</p>

<p>Also, I think that saying that NSA mass surveillance has no effect in you is
a lack of understanding of what are the impact of mass surveillance, I will
not elaborate on that, <a href="http://www.pen.org/global-chill">others</a> are doing
that better than me.</p>

<p>But there's also something else that I want to elaborate, and that we miss
in the "governments are evil" stance. It's the fact that google is collecting
and analysing a lot of data. From your GMail data (and metadata) to your
search, video historic, or even the blogs you read. They analyse those data
and take actions - to present you more accurately targeted advertisement and
search recommendation. Basically, they're doing mass surveillance on their
own.</p>

<p>Google is part of the problem. They cannot be a part of the solution to get
out of mass surveillance. Sure, they won't kill someone simply based on
metadata you'll say. But they're doing something worse, they won't expose you
to information that they deems unrelated to your interests, and you won't
even notice it.</p>

<p>So yes, Google - and Gmail - is part of a mass surveillance system. They
might not be collaborate willingly with governments, but they do it at
least for their own profit.</p>

<h1>Are the mass surveillance system only targeting IP traffic?</h1>

<p>We know - since the exposure of a lot of the NSA nasty stuff - that a lot of
government have the capacity to intercept traffic on a global scale. The
fact that your traffic goes to a datasilo such as google ones, or goes to
your own server at home makes no difference, they're intercepted the same
way. What would change is that they would need to get the email metadata from
the email you send from gmail, while they do not need to decode them if
everyone is on their own box.</p>

<p>But.</p>

<p>They're
<a href="http://www.theguardian.com/us-news/2014/dec/04/nsa-accused-intercepting-emails-mobile-phone-employees">already</a>
<a href="https://www.washingtonpost.com/world/national-security/nsa-collects-millions-of-e-mail-address-books-globally/2013/10/14/8e58b5be-34f9-11e3-80c6-7e6dd8d22d8f_story.html">doing</a>
<a href="http://eandt.theiet.org/news/2013/aug/nsa-email-interception.cfm">that</a>.
Equipment setup to break TLS, intercept email communication and compromise
your endpoint are already used. So they do not get any benefits to going for
something lighter. If you send an email from gmail to another gmail account,
those natsec agencies can already read it and extract the metadata they need.</p>

<p>And since stuff like
<a href="https://en.wikipedia.org/wiki/Palantir_Technologies">Palantir</a>, <a href="https://en.wikipedia.org/wiki/Hacking_Team">hacking team</a>
 or <a href="https://en.wikipedia.org/wiki/FinFisher">gamma international</a> are all
known companies who are selling solutions to our government. Those solution
are based on the infection of your endpoint (your smartphone, tyablet or
computer) to not bother with breaking the cryptography of your
communications.</p>

<p>After all, if they can read what is displayed on your screen, why should they
bother intercepting your TLS connection to a hidden service in Tor?</p>

<p>So, thinking that, being alone on your node, is a compromise on your
anonymity is apparently wrong. You do not add metadata to the collection they
already have (they already get the headers of your emails, no matter what).</p>

<p>Also, there's a last one that nobody thinks about. If everyone is on GMail,
then you just need to compromise GMail to get all the ddata you need. Just
one company. Yes, hacking into Google is something out of my personal scope,
but if you're willing to, you can dot it. It has been done by
<a href="https://en.wikipedia.org/wiki/Operation_Aurora">China</a> before, and I see no
reason for things like that not happening again.</p>

<p>Hacking into GMail is just an enormous prize, you get it you can really
improve your intelligence. Especially if you stay undetected. Put all one's
eggs in one basket generally ends with an omelette. Even if it's a titanium
basket.</p>

<h1>Applying this principle, I then need to have my correspondent apply it</h1>

<p>Because communication is - at least - two ways, if you want to protect and
hide a communications, you need to protect both ends of communication. So,
applying this means that everyone should get a gmail account, because it's
safer for everyone.</p>

<p>I mean, You use GMail and I'm not. I'm running my own mail server. So, you
hiding in the crowd does not works, because if I'm getting compromised - and
since I do not have Google grade security - you're being compromised too
(after all, they'll be able to get metadata of the mail you sent me).</p>

<p>So, for this fallacy to be true, you need everyone have a GMail account.
Which will makes things worse because, hey, they're part of the problem - as
stated above.</p>

<p>Doing that is exactly than not encrypting data or using Tor because "it
would looks suspicious". It does not. Protecting your privacy should not
looks suspicious. If you think it is, then it's kind of too late, you've
already ate the states toxic memes of security. But let the ones who want to
fight them do it.</p>

<p>No, Gmail, Yahoo, Facebook, Twitter, Microsoft or Amazon will not ever be a
solution for privacy. They're part of the problem.</p>

<p>However, there is one specific case where GMail might be a not so bad
alternative: throw away mails (as suggestsed by
<a href="http://blog.totallynotmalware.net/?p=15">OaklandElle</a>. Besides that? No. It
will not improve your privacy, quite the other way around.</p>

<p>Solutions? Stop the dragnet and mass surveillance. Which you can do only at
societal and political level. And give a try to the [internetcu.be][] if
you're looking for self hosting, it works. Mostly. It won't give you better
security, but you'll definetly have better control. And even if you're still
monitored by state, at least you won't be monitored by an advertisement
selling company.</p>

<p>[UPDATE] After talking with jbfavre on twitter, it seems that I didn't
understoof his point. He did not want to advocate for a massive use of GMail
as a way of protecting yourself, but rather for small associative clusters.</p>

<p>I think that it's a good option. Simpler for most people than going full
self-hosting, and sufficiently decentralised to hinder the mass collection of
data. It's not the ideal choice - but then we cannot asks high risk people to
have their data in their home where it will be seized by cops - but it's I
think a good trade-off between privacy, ease of use and safety.</p>


feed_id: http://about.okhin.fr//posts/fluctuat_mergitur/
title: Fluctuat, mergitur
uri: Fluctuat-mergitur
url: http://about.okhin.fr//posts/fluctuat_mergitur/
content:
<h2>Fluctuat …</h2>

<p>I don't think I need to recall you the events of teh week-end. They're, like,
everywhere on the internet, just grab any website and get a deep look into
it.</p>

<p>I did not personally suffered from the shootings and the death of those
people. Nobody I know was there, and given my current mental state I kind of
grew an emotional dampening for this kind of horror. So, except for the
checking on people and the continuous anxious flow of data and information
coming from the TV of the twitter, I've essentially gone through the events
unaffected.</p>

<p>I did not join the spontaneous meetings - because I'm still having issues
with crowd, and paranoid crowds are the worse - but we did celebrate a
birthday in a bar Saturday evening. In one of the - usually - most crowded
place I know to drink beers, which was almost empty. Unusual things happened,
like strangers checking on strangers while crossing path in deserted streets.</p>

<p>But mostly, I've been through it untouched and unaffected. It's hard for me
to feel empathy and emotion those days, and when I'm not keeping them at
bay, I'm learning how to induce and emulates them, in a not that much
destructive way.</p>

<p>I'm getting good now at detecting thought patterns that lead to anxiety
crisis, I'm able to decide with feeling I wanna run in my brain - more or
less. It's an extremely artificial process, but not everyone can manage their
emotions as you do. Mine are tsunamis and typhoon destroying any bits of
rationality I can have, and it ends up with me boxing walls until I broke my
hands or drinking myself to the point I'm unable to feel.</p>

<p>So, I basically removed those feelings, and gone through the motion. Focusing
on people helping each other, closing myself into music and drawings, stuff
like that, because the anxiety provided by continuous access to information
is just the worst thing that could happens to me.</p>

<p>I rode through the horror with detachment and cynism. I was thinking about
all the work we - since I'm working at la quadrature du net right now - will
have to do on the coming days to check up freedom and civil liberties. But
besides that, I was okay.</p>

<p>And then, during the week-end, I've seen <em>fluctuat, nec mergitur</em> everywhere.
The Paris motto. People were defending their culture of getting out and drink
wine, and coffee, partying. People gathered around what has been - in their
perception of things - under assault: the parisian way of life (and, as <a href="https://www.youtube.com/watch?v=zUzNcu0fhJw">Jon
Oliver</a> said it - good luck with
that).</p>

<p>And people were already falling into the us VS them trap. Stating that we -
the one who party the one who get drunk, the one who don't respect anything -
are the good guys, and that anyone who would disagree with that are the bad
guys.</p>

<p>But people's heart is not at partying. Mine neither.</p>

<h2>Mergitur</h2>

<p>And then, there was the Congress. For the one not familiar with the French
political institution, the Congress is the gathering of the senate and of teh
parliament at the request of the President, and it is gathered essentially
for Constitutional patch and updates.</p>

<p>Before that, our President established the state of emergency. Basically, it
removes the Habbeas Corpus, and allow for administrative house searching -
warrantless house search - among other thing (it also grants prefect of
police the capacity of establishing a curfew, it stops the rights to
gathering, and close most of public space).</p>

<p>And the president then made a discourse before the Congress. He said mostly
three things. First that our freedom is partying and going to bars. Everyone
seems to forgot that my freedom is also resisting to injunctions, or asking
for respect. Second, that we must go in war against Daesh/ISIS. Which means
that we need to sit at a table with Poutin and Obama to found a solution for
the Syria crisis - meaning they will work with Assad. Third, he asked for a
two month prolongation of the state of emergency and a patch of the
constitution (especially the articles
<a href="http://www.conseil-constitutionnel.fr/conseil-constitutionnel/francais/la-constitution/la-constitution-du-4-octobre-1958/texte-integral-de-la-constitution-du-4-octobre-1958-en-vigueur.5074.html#article16">16</a>and <a href="http://www.conseil-constitutionnel.fr/conseil-constitutionnel/francais/la-constitution/la-constitution-du-4-octobre-1958/texte-integral-de-la-constitution-du-4-octobre-1958-en-vigueur.5074.html#article36">36</a>)</p>

<p>And then, everyone in the assistance applauded. And sang the national anthem.
In an extremely nationalist way. And no one was there to oppose that. Every
single parties represented as basically followed the president talks about
the state of emergency.</p>

<p>And everyne was happy, because we were told to party. We had to. To get drunk
is now a sign of resistance toward the horror. And no one cares that no ones
is actually trying to fix things. No one cares hat the state of emergency
will be updated to account for "new technologies", no one said a thing about
the Kurd and rebel in Syria that will get the heat from the French alliance
with Russia in Syria.</p>

<p>And I could not stand this. I hoped that, for once, things will indeed go in
the good way. But nope. Our freedom has been restrained to the freedom to
party. And I'm down. Really. The city that could take anything, that's proud
of its stoicism is drowning.</p>

<p>And I'm crying. I'm crying because I'll get used to it. In the end, you'll
get use to it. That's the horrific part. I'm used to the military in the
street, I'm used to the suspicion toward refugees and foreigners. I'm used to
the fact that politician just don't care. I'm used to be in pain. But I do
not see the point of living.</p>

<p>If it's just for the pain, then why should I? If there's nothing but more
pain incoming, what's the point to even bother at standing up in the morning?
I'm down the lane. I know how it's induced. I should eat, I should take some
rest. But I do not understand the point, I do not see it. The hope is a lie,
there's none.</p>


feed_id: http://about.okhin.fr//posts/Friend/
uri: This-is-for-friends-Because-without-them-I-probably-won-t-be-there-B
url: http://about.okhin.fr//posts/Friend/
title:
This is for friends. Because without them I probably won't be
there. But also because there's weird things going on.

content:
<h1>Remember, Remember, the 13th of November</h1>

<p>Hey Friend, been a long time. Usually this would be a conversation I have with
you over an instant messaging media. We would argue, because I need to confront
my views, and you'll help me to step back a little bit and try to force me to
take care of me.</p>

<p>This conversation would probably splitted across several media and people,
because this is how I function, in weird ways and without focus.</p>

<p>On the 13th of November, coming back from le Louvres to Saint Denis - where I
live - you sent me a SMS asking me if I was safe. I did heard a loud noise
from the Stade de France when I was heading out the subway to my home, but since
there was a match I just flagged it as "weird noise made by sports fan". I
didn't understood why I received this text.</p>

<p>Then, once home. I started a web browser. After receiving half a dozen a tweet
of various instance of you, I reassured you by posting that I was home and safe
on twitter. And then, with my room-mate and coworker we just thin about the huge
amount of work that we would have to do on Monday - and even before that.</p>

<p>I told you, I work in strange ways. I wasn't emotionally affected by the death
of 300 people. It's random and I knew no one there. The shooting happened in
places I can happen to go, but it's as random as a plane crash (and in fact
there's a higher probability to be killed in a plane crash than being hit in a
terrorist event).</p>

<p>I checked upon friends (or waited for news)(yeah, I suck at maintaining
friendship, I think you're kind of aware of that now) to be sure everyone was
mostly safe. And then I waited for the political disaster that will ensure.
Until the next Monday I really hoped that our politicians would do something clever,
like calling for respect and fraternity and unity.</p>

<p>You called me naïve, but if I'm not that naïve, then I turn cynical. I tried very
hard to shut down my inner voices warning me of what would come next. And since
you told me that being cynical might hurt you, I try to avoid that. Also it's
better for my moral and my depression.</p>

<p>And then our Beloved Socialist President of the Republican Democratic Palpatine
ordered the Senate to vote the martial law … Mmm, no, I'm on the wrong movie
here. It was the talk of Mr. Hollande in front of the congress - higher and lower
chamber gathered at Versailles - when he asserted that we were at war. And that
we need to form an alliance with Putin and Assad to fight ISIS. And that we need
to extend and modify the State of Emergency, and the Constitution.</p>

<p>This is where I broke up. Syria is still a hard political subject for me. You
know that since I talk a lot about it. You even asked me to get diagnosed
because I might have some sort of trauma. SO, yes, this is where my emotions
finally set me adrift.</p>

<p>What people call emotion wave or surge are - in my case - chaotic tsunamis
destroying anything that might be related to reason. That's my poison. That's
what will kill me in the end. You're important there, in the fact that you help
me resurface in those situation and kind of freeze the emotional disaster.</p>

<p>We talked about it. I see no hope in our current situation. Warrant-less search
and warrant-less house arrest; total stop of support of any kind toward the
refugees - who already had a hard time; suspension of the right to protest and,
more generally, confiscation of the political debate by the politicians - Mr.
Valls said that he won't accept any discussion about the incidence of social or
economic factor on terrorism; those are what we live on now.</p>

<p>I mean, I'm used to see army in the street of Paris. In fact, I never knew them
without troops - the bombing attack of 1995 happened at a time I wasn't that
much in Paris and since then troops are always in the street. But now, their in
battle suit, helmet and bullet proof vests, way to much weapon for my sanity,
etc.</p>

<p>Cops did change also. They weren't on a short leash before, but now they're out
for blood and revenge. Usually, even on the few forbidden protests I was at,
there's always a way to get out if you ask nicely, they will let you go without
hustle - they're basically filtering you to be sure you won't sucker punch them,
but in the end you can escape before they arrest everyone. But on the 28th of
November, there wasn't such a thing like a possible escape. They wanted to
fight.</p>

<p>There was a public announce that unemployment was on the raise just before the
COP21. And nothing in the government deemed important to say anything about it.
I mean, they're supposed to be socialists for fuck sake. They should at least
says that they will work on a new way to count unemployed people, or that they
will do something about it. But they only speaks about security. Mr Valls eve
stating that "Security if the first of liberty" which, ironically, is a quote
made by JM. Le Pen as a slogan for it's presidential elections back in the
eighties.</p>

<p>We have a socialist prime minister, defending a security only program, based on
pricniple established by the far right movement.</p>

<p>That's about the state of our politics in France. But don't get me wrong, The FN
is a bit worse than he PS in that he will actually do what they said they're
gonna do, and they plan to cut funding for planed parenthood (which depends
largely on regional funding), and other nice stuff.</p>

<p>Politicians wants me to vote to block the National Front, in a national movement
aganst fascism. But I won't. I do not see the point on voting for a lack of
response to social issues, just for the sake of protecting us against fascism.
Politicians who enabled the police state, who are asking for a republican merge,
who are saying that young people in teh suburb should cultivate themselves, who
plans to bomb people in collaboration with Turkish, Russian and Syrian - all
extremely democratic - governments, who reduce democratic life to vote, who
won't do a thing about the unemployment, wants my vote to oppose fascism?</p>

<p>You see my dearest friend, you asked me to look on the bright side. But it's
more than hard to do that. You told me that bitterness is like Beaujolais
Nouveau. You can drink a bit of it, it can even be good - and I disagree on
Beaujolais Nouveau being a good wine ever - but too much and it will kills you.
Or hurt you.</p>

<p>I don't know.</p>

<p>I work at La Quadrature du Net now. And I really try to avoid the repetitive
self destruct pattern that leads me to chain burn out. Me or other staffers. Or
you.</p>

<p>During the attacks on the 13th of November, I focused on the solidarity part of
it. That's what I'm trying to do. That's why I keep informed on the Syrian
situation by following the White Helmets.</p>

<p>But there's something that is absent of our political life in France. We have
traditional organisations who covers for themselves without caring about
anything else than their way to power: syndicates, political parties. We do have
old style NGO, advocating nd lobbying behind the scenes. We have radical groups
who are busy fighting cops. But we do not have orgs who works on party.
Militantism in France is a serious business. And if you're not working yourself
to death you're doing it wrong. ANd you end up without anyone willing to take up
the fight, to think on long term strategies, to federate smaller groups who
exhausts themselves beyond repair.</p>

<p>And I hear you. I need to focus on the positive sides. So that's what I'm trying
to do. There's some good stuff happening. LQDN is finally having a nice and more
inclusive community - there's a lot of effort to do, but it's in progress. I'm
working there to build tools to bother our deputies - piphone and similar
stuff, provide tools to flatten the democratic process. Or at least to help the
circulation of information.</p>

<p>And that's my target. You said me that we're in for a long fight. I'm not even
sure we can win this fight, and the nihilistic part of me keep thinking that it's
useless. But since I try to not killing myself, I need something. If I can
bother an intelligence officer, a head of office somewhere, deputies or
senators, ministers or head of state that's a win.</p>

<p>If, when they see us, in the press, or elsewhere, or when they hear about us
those people think "Oh no … not them again … my day is now ruined" then, it's a
win. It won't makes them stop doing shit, but at least, I'll smile when thinking
about all the pain they'll get.</p>

<p>And in the meantime, we should try harder working with other small organisation
specialised in other aspect of the fight. There's a lot to do with queers,
feminists, ant racist groups. And I really think that's where I can help - beyond
the purely technical point.</p>

<p>So, you see, I'm trying to stop sipping the bitterness part of things. It's hard
'cause I've turned cynical/realist. And because I love the bitterness. But
you're right. I should stop drinking it.</p>

<p>I'm happy you're here. Because at least I can talk to you. And there's here
also. This post is fucked up, and makes no sense. But I think it's a bit like
what's the political life looks like. Socialist calling voters to vote for
traditionalists.</p>

<p>It's fucked up. But I'm gonna ignore that, because it's useless and I can't
spend any more energy on that. I'll focus on building things.</p>

<p>Thanks for still being here.</p>


feed_id: http://about.okhin.fr//posts/Onionify/
title: Onionify
uri: Onionify
url: http://about.okhin.fr//posts/Onionify/
content:
<h1>Hidden services</h1>

<p>So, for those of you who never heard about it, there's some hidden services
in the wild. They're called .onion if you use Tor - and you should.</p>

<p>Facebook, for instance, also have a .onion. My blog to.</p>

<p>It's neat, it helps protect privacy of the user and escape mass surveillance
and censorship. Anyone should do it if they're even remotely interested in
protecting their users (I mean, even facebook did it. You can't be worse
thanthem on this bsasis, except if you're a bank).</p>

<p>But, users still need to know that the .onion exist, and they still need to
redirect there. And the onion adresses are anything but human friendly.
They're hard to remember, and a mistake in one character might land you on a
totally different website.</p>

<p>It would be nice that, the same way HTTPS Everywhere redirects you to https
enabled website when you go for the non-encrypted version, there would be
some way to redirect users who uses tor to the .onion version.</p>

<h1>Onionify all the things</h1>

<h2>The cloudflare way</h2>

<p>So, you can perfectly do the same thing that cloud flare is doing. Get a list
of exit nodes, and - on your web-server - when a queries go from one of them,
redirect to the hidden services.</p>

<p>It needs an updated list of exit node. Can probably be done, but then you
also need control of the webserver (which might not necessarily be the case)
and some cron jobs.</p>

<p>I need to do a bit more research on that anyway.</p>

<h2>HTTP Headers</h2>

<p>You can also probably add a header server side which would advertise the
.onion. Or advertise address in DNSSEC zones one way or another. But then,
you need the browser to be aware of that and to do those check before going
on the website.</p>

<p>I think it's probably the best way to do it. And it probably isn't a lot of
code (might need to do a plugin for that, to agree with everyone on a
standard, and write a RFC).</p>

<h2>Plain JS</h2>

<p>Or you can control the browser with something on your content whch is aware
of the onion. And which can check if the browser is able of using them.</p>

<p>That's what JS is for. A simple HEAD query sent by the client to the onion
will tell you if the client can connect to your .onion.</p>

<p>It's probably dirty, it's JS it does asks permission to do it, but the bit of
script I've write works fine.</p>

<p>It can be embedded on any page to redirect to a hidden service.</p>

<h1>Code</h1>

<p>The code is straightforward. No dependencies. You do not need jquery for
doing just a query, you need XMLHttpRequest.</p>

<p>It ca also be easily adaptable (just change the content of the onion
variable), and it works from anywhere your client lands.</p>

<p>Better privacy for the user in 15 lines of JS.</p>

<p>The code is <a href="https://git.laquadrature.net/snippets/1">here</a>, licenced under
WTFPL. There's probably way to do it in a cleaner way, and I said earier, I
think it would be better to have a .onion dectection feature in the browser,
but it's there now.</p>

<p>And the more you'll use it, the more people will land on your onions. WHich
will improve both Tor network - more casual surf is always good - and the
privacy of your users.</p>

<p>Have fun.</p>


feed_id: http://about.okhin.fr//posts/Redefining_Privacy/
title: Redefining privacy
uri: Redefining-privacy
url: http://about.okhin.fr//posts/Redefining_Privacy/
content:
<h1>Let's redefine Privacy, shall we?</h1>

<p>There's a lot of issue  with Privacy. I already wrote <a href="http://about.okhin.fr/posts/Fuckprivacy">about it</a>
some time ago, but I think that in fact the current definition of Privacy is
an issue. For starters, no one is able to provide me with a definition of
privacy.</p>

<h2>Is Privacy a secret?</h2>

<p>The definition I encounter the most can be summed up a bit like this, it's
everything that is "none of your concern". It's the version of Privacy I used
in my previous post and, I think, it's probably the one that's defended
mostly by people who basically are not discriminated against by system of
oppressions (states, but not only).</p>

<p>There's two main issue with that. First, there's thing that you cannot
"hide", such as your apparent gender, or the color of your skin, and those
will submit you to system of oppression - I won't spend time to expose them,
but please feel free to read some <a href="https://infokiosques.net/">useful
documentations</a>. Second there's the fact that
secret is used to hide things - that's the purpose of secret. You want to
keep others in the dark about what's happening. David Cameron just said that
his personal investment in Panama are <a href="http://www.ndtv.com/world-news/panama-papers-family-investments-are-private-matter-says-camerons-spokesperson-1338580">private
matters</a>.
Conjugal rape and other in-family sexual assault are always hidden under the
veil of the "private matters" that should be treated only inside the family.</p>

<p>I mean, clearly, secrecy is a bad thing. Not only for government, but for
people in position of power and control over other. I'm not advocating for a
full publicity of everything, but for a questioning of is privacy a synonym
to secrecy?</p>

<p>Do we really want to hide all of our lives to our society? If we want to
redistribute wealth, we need to know about the income of each person. If we
want to act upon the discrimination women faces, we need to know about those
discrimination, we need to know about who's identified as a woman and to act
upon the people who discriminate them.</p>

<p>If we want a world with a bit more fairness inside, we might need to be able
to be a little bit more public about our lives. Society is build on the
intersections and interactions we have with each other. The positive ones,
and the negatives ones. The society, the cultures we live in, is not - I
think - powered by the things we have in common, but by the differences we
have and the different experiences we've been through.</p>

<p>So, privacy a the thing you keep in the closet is bad - go talk to queers
about living in the closet to see why this kind of <a href="https://en.wikipedia.org/wiki/Closeted">privacy
sucks</a>.</p>

<p>Also, I do not think that the right to privacy - as described by the
article 12th of the <a href="http://www.un.org/en/documents/udhr/index.shtml#a12">UNDHR</a>
is defined by what we keep secret. This right is defined as protection
against <em>arbitrary interference</em>. It doesn't state that it has to be secret.
It protects interferences, meaning, influence, actions, perturbations. Not
about knowing about it.</p>

<p>The issue with mass surveillance - and why its so bad - is not because it
allow a passive global observer to exist, it is because it create an active
global discriminator that will sort people between good citizens and
terrorists, based on what data we create. Mass surveillance described as a
passive global observer is an issue. The mass surveillance complex is used by
power structure to maintain their power over people, by creating and
enforcing discrimination. This is clearly a violation of Privacy because it
is <em>arbitrary interfering</em> in life of people. But it's not because they
collect the data.</p>

<p>This is one of the thing about mass surveillance, it does not exist in void,
it exist as a political tool of social coercion. It'(s not the data
collection and gathering that's the real issue. With the amount of data
collected, we could have a real source of interesting data for sociologist to
help them describing our society, and gives us clue to change and improve it.</p>

<p>So, no. The fact that a passive global observer exist is not the issue. The
issue is that it is a fact an acting and active global discriminatory system.
And secrecy is only a way to protect against the passive global observer. It
does not enforce privacy. It does not defines privacy. It does not helps you
to protect yourself against discrimination.</p>

<h2>Is Privacy your identity?</h2>

<p>I'm not sure. Identity is a social concept (and a psychological one, it sucks
when you use one word for two different things). It's how you define
yourself at some point in time, and how you are recognised and defined by
others, based on their cultures and social cues and norms they have.</p>

<p>You decide how you want to define yourself, in regards with the current
social cultures you bathe in. You adopt, reject, create or appropriates part
of this culture to form your identity and to express to the society who you are,
and how you'd like the society to consider you.</p>

<p>Your identity is - at least partly - publicly displayed and used by the
society to interact with you. This is where discrimination will take place.
If you're identified as a woman - whether or not you define yourself as
<a href="https://en.wikipedia.org/wiki/Passing_%28sociology%29">one</a> - and the
society we live in discriminates women - and we live in such society - then
you'll be discriminated.</p>

<p>Which basically seemed to be a good match for <em>arbitral interfering</em> ad
specified earlier. It seems that the elements you use to define yourself,
the elements used by other to identify you and to relates to you seems a
better candidates for me than the one you keep secret.</p>

<p>What it means is that our privacy, what's private, is the core of how we see
ourselves. It's not what we want to substract to public scrutiny. It's how we
want to be identified. And our rights to have a privacy is basically our
rights to defined however we want - in a social context - without being
discriminated for it.</p>

<p>It does not means that if you want to define yourself as a patriarcal asshole
you'll be able to act onto people as you want. It just means that defining
yourself as a patriarcal asshole shouldn't means that you'll be treated in a
specific way. The thing you'll say, the thing you'll do are what will bring
your trouble, but not your identity.</p>

<p>Basically enforcing privacy is trying to find a way to end discrimination of
any kind. It's not providing tools - secrecy - to create more discrimination.
Fighting for privacy is understanding that the world is non-binary, that no
identity should be infeoded to another, it's fighting for sanctioning people
for what they do and not what they are.</p>

<h2>Yeah, OK, but where's the cryptography comes into play?</h2>

<p>Cryptography is needed because - in a world of oppression - you need to
organize yourself to change those. And to organize you need secrecy at least
temporary - until you act. It is not a right has protected by any of the
article of the UNHRD, but it is mentioned in the preamble:</p>

<p>  Whereas it is essential, if man is not to be compelled to have recourse, as
  a last resort, to rebellion against tyranny and oppression, that human rights
  should be protected by the rule of law,</p>

<p>Meaning that, if you're right to Privacy is not respected, then you need to
react and fight for it. And for that you need secrecy, you need to hide from
the spies and the forces that tries to remove your rights.</p>

<p>Because, in the end, the only rights you have are the one you fight for. And
this is where cryptography will helps you. Cryptography will allow you to
disobey, to organise dissent, to rebel, to have some time to breathe. But it
will not helps you to enforce Privacy and the right to self determination.</p>

<p>And I think we all need to rethink that privacy is not what is secret, but
it's what makes us individuals. It what gives us the right to coexist in the
same society. And this is why we all need to fight for it. Without privacy,
there's only bland human without identity. Without privacy there's no place
for non-mainstream person. Without privacy there's no way to evolve and
progress. Without privacy, there's no I or You. There's only us. Forced in an
identity we didn't choose, think, defined, accepted, created.</p>

<p>Those identities are the one created by the global active discriminator to
divides us. They are the nationalist ones, they are the Charlie's one.
They're the one of the dominant classes and we're stuck with them, without a
possibility to exist out of those scheme without being violently confronted.</p>

<p>We should fight for this privacy. For the possibility for anyone to
self-determine themselves. And stop believing that we currently have access
to it, or that cryptography will suffice.</p>


feed_id: http://about.okhin.fr//posts/And_Justice_For_All/
title: And Justice for all
uri: And-Justice-for-all
url: http://about.okhin.fr//posts/And_Justice_For_All/
content:
<p>[[!tags  justice politics]]</p>

<p>Trigger Warnings: Rape, Paedophilia</p>

<h2>Prison song</h2>

<p>I'm not really elaborate on the fact that the current prison system (either
in the US, or - basically - everywhere else) is broken and walk on its head.
If you want to contemplate the disaster, you can watch <a href="https://prisonvalley.arte.fr">Prison
Valley</a>, get facts from
<a href="https://www.oip.org">OIP</a> or read testimony made by, basically, every
inmates, their family, their friends about what the prison is doing to them.</p>

<p>I could tells you what the incarceration of my father for paedophilia
did to me, how I had to hide it, to lie every single days to basically
everyone, to pretend it did not happens for the sole purpose of surviving
through middle school, and that it didn't solve anything, Because he got
convicted a second time for similar crimes years later. You'll notice that
neither I, my sisters or my mother have been found guilty of anything, but
still, we paid a price. For justice.</p>

<p>I will not argue that prison is the worst solution to any problems. At best,
you put people on hold and free them, expecting them to behave when they'll
get out. At worst, it's a political tool used to criminalize populations and
build resentment upon some populations (yes, it's a tool used for power to
keep people in check) while creating more sociopaths, storing them away in
inhumane conditions, and forcing them to work - and so destroying jobs
outside of jail.</p>

<p>Prison should not exist. Even for serial rapists, paedophile, killers, abusers
of all sorts. If you're only answer as a society is to store them away, in a
dark room, and hopping they'll get better you're delusional. I do believe
people can change, but they need help, acceptance, and an possibility of
failure.</p>

<p>The thing is, prison is intricately mixed with the notion of justice. We tend
to think we deserve justice, but I'm not sure we really think about what it
means. The justice system, as its currently implemented in most part of the
world, is a punitive one. The principles behind it is that if you do a wrong
to someone, you should pay for it, one way or one another. You should not pay
to the victim, but to the society.</p>

<p>Basically, it's the biblical principle of the Talion's Law: an eye for an
eye, with interests. Those interests exist to dissuade further wrong to be
done and because the perceived loss might be above the material loss. When it
come to non material wrongs, it gets complicated.</p>

<p>The justice system tries to determine what is the impact of the wrongdoing,
what are the personalities of victims and perpetrators to find an appropriate
sanction. Basically the process of justice tries to evaluate the cost of a
human life, which is an extremely capitalist view. The life of a worker, or
of a woman worth less than the one of a CEO for instance. That's why
stealing and destruction of property is so harshly sanctioned, while rape or
harassment of the work place is rarely sanctioned.</p>

<h1>We deserve nothing</h1>

<p>But you probably all know that, I'm just writing down some ideas on a text
file. The thing I want to get too is that we deserve nothing. We do not
deserve justice. It sound harsh, I know, but when you look at it, all the
justice system is build around punishing.</p>

<p>And if you want to not act randomly, because you know, you're a
sophisticated society built on principle from the XVIII° centuries.
Principles formed by white people of the bourgeoisie, then you need to
defines what should be punished and what should not. You need to establish
what is the norm and to enforce it. You need to make sure everyone understand
what are the personal costs of transgressing this norm, and you need to know
who is behaving and who is not. You need to be Santa Claus, knowing all the
dirty secrets of every kids, and decides which on will get presents and which
one won't have anything.</p>

<p>You'll justify it with the Law. The Book Of The Law. We modernised the
process since the biblical times (where Moses got high on drugs in a mountain
and wrote stuff on marble tablets because he was afraid of losing he's grasp
on power). You'll enforce it with a dedicated group of people: cops.
And then you'll gave them the power to sort people between good and bad guys.
To do that you'll give them the power of mass and systemic surveillance.</p>

<p>This notion of justice most of people wants requires mass surveillance. And
prison. And a norm. And I'm still wondering: do we deserves justice? I tend
to believe that, as a member of a society, we deserves nothing. We do not
deserves to be happy, to have a good life, and the like. Deserving something
means that, inherently, the world in which you live, should give you
something.</p>

<p>I think the only thing we deserve, as individual, is the fulfilling of our
needs (physiological and/or mental). Not justice, not love, not a family. I
could insert here a reference to the Maslow's pyramid, but the model is a bit
simplistic and outdated. I don't think the notion of justice is a need. The
closest thing that would be associated to a need, is the need to be
recognised, to be esteemed by other. To live in dignity and respect. And
either everyone deserves that, or no one.</p>

<p>As stated before, prison strips individuals of their dignity, of their
respect, of their esteemed (by other or by themselves). And I think the notion
of justice cannot be dissociated of the notion of prison. As long as you ask
for people to be thrown in prison, you're losing your access to live in
dignity.</p>

<h1>Where do we go from here</h1>

<p>We do not deserve justice, and I think that, in our communities, we really
should work on that. Justice is an outdated system used to justify
incarceration, mass surveillance and therefor systemic discrimination.</p>

<p>What we need to think of is harm reduction, which is at the core of the
Transformative Justice theory. The idea behind harm reduction is to provide
communities with tools to help them avoiding harm in the first place, and
then reducing the impact of it.</p>

<p>That's the idea behind collective insurance for instance. A collective
effort can help reducing the burden of an accident. It requires to accept the
fact that some people might not want to behave, or are not able to. And that
you need to have structures to act before something happens. Calling out
rapist or aggressors helps to do that, but it deprives the aggressor of the
possibility of change. This is a community response to a traumatism. It does
not reduces the traumatism of the victim, but it tends to reduce the
potential harm that a person can do.</p>

<p>But I think we can go further. Paedophiles for instance are almost
universally perceived as monster that should rot in jail for ever because
they hurt children by kidnapping them and tying them in a closet making them
their sex slaves. Which is as accurate as the depiction of rapist being a
stranger that will jump women in the street to rape them and kill them.</p>

<p>In Berlin, a program has been started to help paedophile who did not commit
an aggression. You can read about it
<a href="https://www.theguardian.com/society/2015/oct/16/how-germany-treats-paedophiles-before-they-offend">here</a>
and it seems to be successful. They allow paedophile to talk about their
issue, to have access to treatment and t manage their life with dignity and
without hurting kids. This is not the only program, but a lot of them are
targeting offenders (you need to have molested a child to enter some of those
program)</p>

<p>Which is a better outcome than sending them to jail, with a so-called
obligation of treatment (it did work so well that my father did get back to
jail ten years after), or stacking them in prison cells, refusing to deal
with them don't you think?</p>

<p>I have to add that, on a community level, I think this can works well with
inside violence, not from harm done by the outside. You deserve dignity, so
you should protect yourself against aggression, especially as a community. A
neo-nazis entering a self-managed bar is an aggression, so you should gives
yourself ways to protect against these violence from outsiders.</p>

<p>I think that the idea of <a href="https://en.wikipedia.org/wiki/Transformative_justice">transformative justice</a>
is interesting. The idea is to change the society to reduce harm being done,
not trying to repair the victims (which is restorative justice) or trying to
avenge them and dissuade potential perpetrators (traditional justice).</p>

<p>To ease the way of harm reduction, we - as a society - needs to be able to
accept that perpetrators exists and are human being. And that they can
change. We need to accept that, most of the time, a victim will endure some
traumas that cannot ever be repaired fully - but they can learn to lives with
it. We need to accept that, as a society, we have a role to play in
aggressions and mitigating them.</p>

<p>One of the way of mitigation is to think of what enables aggressors. What
makes them act and why would they think it's OK to act this way. With the
traditional justice system it's often the perceived impunity. If a cop will
not accept the complaint made by a victim, then the aggressor will never ever
be confronted to the harm he did, so he will act and probably repeatedly.</p>

<p>Another enabler factor, is the social status of the perpetrator. A well
established person, with power over a community - because they're doing
important things - will enable perpetrator to do whatever they want, think
about R. Polanski, J. Depp, J. Applebaum for instance.</p>

<p>That is why it is important to avoid social structures which enables people
to do harm. Meaning, you should not have only one person in charge of this
important thing you need your social group to survive. Every structures which
have only one person in charge, will lead to harm. That is why I think it's
important to attributes success and failures on collectives, not on
individual among those collective.</p>

<p>We also needs to think about the friends of the perpetrators. Some of them
are enablers, some are afraid of consequences if they act against their
friends. I also tend to think that stripping a perpetrator of his friends by
punishing them for actions he did, will not help those person to come forward
and discuss an issue that bother them.</p>

<p>I think that most of the harm reduction process is about communication and
speech. Being able to talk about something, without being thrown out of a
group is something important. And you should be supported to come forward,
you should be accepted for that. If someone does not understand consent for
instance, or have trouble with it, this person should be able to talk about
it, at least to someone. Yes, it means that you need to keep those
discussions private.</p>

<p>Last point, you do not need for everyone to agree to that. But you need to
have people who wants to try it and to work on it You should also be careful
about not converting them o enabler, that's why it's something that needs to
be addressed by your communities.</p>

<p>I really think we have an issue with justice. We claim we deserve justice
while it's a tool made by and for the power. Or we tends to mix justice and
revenge. I think we should really works on those topics. Protection of
whistle blowers, privacy and other related issues cannot occur in a
traditional justice system since it is intertwined with mass surveillance,
systemic discrimination and the like.</p>

<p>I'm not advocating for vigilantes either, which is a protection from the
outside (and yes, you might need, at some point, to have people who can
physically resists to adversaries, but that's a different topic). But really,
if we want to reduces aggression made by member of our communities toward
other members of this communities, we cannot rely on the notion of justice,
we need to find a different way.</p>


feed_id: http://about.okhin.fr//posts/YouTubeSucks/
title: You Tube really sucks lately
uri: You-Tube-really-sucks-lately
url: http://about.okhin.fr//posts/YouTubeSucks/
content:
<h1>Being invisible</h1>

<p>Ohai.</p>

<p>I'm going to be personal for a little bit here. I'm not comfortable with it
because it's still a mess in my head. But I think I'm past overdue about it
and, also, it will probably help making some points later.</p>

<p>It took me thirty years to understand that I'm bisexual. That I'm not
straight. It took me that long because I didn't knew it was possible. I
didn't knew that the sexual attraction I had for boys was not something that
everyone else was going through and that no one spoke about.</p>

<p>I'm thirty seven years old now. And when I look back, I can only assume that
my current mental state of severe depression is more than probably linked to
the fact that I suppressed those impulse, to behave like everyone else.</p>

<p>Let's do the time warp and go back in time.</p>

<p>The first tie I was confronted to homosexuality, was in elementary school,
where faggots was used as a slur. Since I was there during the nineties, it
was also associated with AIDS. Still as a slur.</p>

<p>In high school, when my father got incarcerated for sexual assault on minor -
and some friends of mine - I closed myself to others. No internet yet, and so
my social input were made by the only representation available there :
heteronormativity (and no, there's no way I would have been able to spot and
understand it), I locked deep down inside me my attraction to boys. I was
also scared (and have been for almost twenty years now) that this attraction
to boys was in fact paedophilia, that I would have inherited from my father.</p>

<p>I landed on Internet in 1997. Mainly inside roll play communities, but since
I did not knew I was queer, there was no possibility to get access to those
communities.</p>

<p>Same for most of my studies. I've never been in contact with queers,
lesbians, gays, bis, trans*. I did not understood what the lyrics of Queen's
song meant, I will still fighting most of my feelings, learning to lie to
anyone about anything (because of course, I had to lie about my father, you
know, everyone keeps asking "what are you're parent doing for a living" and
you cannot really answer "he's locked in jail", so you lie. Constantly, to
anyone about anything, it doesn't help).</p>

<p>And even if I managed to get that they're was gays and lesbians somewhere,
bisexuality was kind of something limited to a sexual fetish in my world. And
I was trying to blend in, to disappear, to have everyone not asking
questions. I'm very good at it now, to not answer questions and to lie,
sometimes without thinking (yeah, I do have a good score on "Are you a
sociopath ?" tests).</p>

<p>The first time I encountered a non straight and out person was quite late in
my life. It was at Le Loop's Grand Opening, and
<a href="https://twitter.com/quota_atypique">quota_atypique</a> happened to be there
and, since she was doing an ethnology study of the hackerspaces - it was
around January 2011 all the hype didn't got there - and I think she told me
she was lesbian (she did come out as bi later) in probably less than 10s
after saying "Hi".</p>

<p>I'm not sure I've thanked you for that Quota, but meeting you did have an …
interesting … impact on my life. From there we met at the hackerspace, talks
about stuff (from the beauty of command line interfaces to being queer in
hackerspaces). It was at this time that I got involved in Telecomix too. A
lot of conference was happening in Paris, and I did some about inclusions of
people (not only women, but also trans* in the hackers communities. I build
up a political culture from the popular one.</p>

<p>I met my boyfriend later on (I did get through a tough breakup before that,
questioning my ability to manage a single dedicated relationship) at the
Congress, even if we started dating later. We were in 2013 or something like
that (or 2014, I suck at time frames). It took me a lot of time to accept it, to fight the
interiorized shame, and to admit it.</p>

<p>We're in 2017 now. I'm still not fully at ease with it, but it gets better.
And when I look at all this pain I've been through, that could have been
avoided if, like teenagers and kids today, I did have access to all this
queer material, online communities, accessible without especially looking for
it, at least we - the ones who grew up alone during the nineties - will be
the last ones suffering from invisibility.</p>

<p>The main reason it took me 32 fucking years and part of my depression is
because I didn't have access to the possibility of a positive alternative of
bisexuality. It was just invisible hidden. To know it wasn't a shame, that
you could be happy being bi and, it required to actively search for content.</p>

<p>And this is why I'm shaking with rage and anger while writing this (but Show
Must Go On is playing now and helps me keep t under control).</p>

<h1>YouTube sucks</h1>

<p>YouTube, for the one of you who lived in a cave for the last ten years, is a
media broadcasting company, which pays itself by selling targeting
advertisement to its customers. One of the side effect of their product is
that it happens they're quite good at hosting and promoting videos, clips,
documentaries, and whatever you can imagine doing with those cheap camera.</p>

<p>For years free software activists have advocated against the danger of this
kind of platform. I'm going to speak a lot about YouTube, but have a look at
the #FreeTheNipple campaign on Facebook or Twitter, the censorship of nudity
on most of the platform powered by Apple or Facebook.</p>

<p>So, YouTube create a Restricted mode. Before they did that, there was a flag
that - as an uploader - you could activate to hide explicit content (mostly
nudity) and which would have requires someone to log in to see the content.
And a way to report content that you think were offensive.</p>

<p>And there were copyright bots in charge of removing or monetizing content in
violation of Intellectual Property basically killing fair use, one example I
do like, is the <a href="https://www.forbes.com/sites/danielnyegriffiths/2013/01/15/copyright-in-the-twilight-zone-the-strange-case-of-buffy-versus-edward/#5bcfebcbc4aa">Edward VS
Buffy</a>
video.</p>

<p>But, in the end, uploaders and creators were able to post whatever contents
they wanted without too much intervention from YouTube Inc. or Alphabet or
whatever is the name of the thing that's supposed to manage the platform.</p>

<p>What they did with the Restricted Mode is one step toward nullification on
alternatives-cultures. Let's get a little into details about what this filter
exists, and speculation about the why, what are the impact and why it sucks.</p>

<h2>What is it ?</h2>

<p>From <a href="https://support.google.com/youtube/answer/174084?co=GENIE.Platform%3DDesktop&amp;hl=en">YouTube's
page</a>:</p>

<blockquote><p>Restricted Mode is an optional setting that you can use to help screen out
potentially mature content that you may prefer not to see or don’t want
others in your family to see.</p></blockquote>

<p>So, it looks like Parental filter for youtube. They'll defed themselves by
saying it's an optional features, but I bet it will be on by default until
you log in not s long in the future.</p>

<p>But what is 'potentially mature' content you'll ask ? Well, it's not defined.
But it appears that all LGBT content is considered as 'potentially mature'.
There's a lot of outrage about it, I'll just quote an article from <a href="https://www.independent.co.uk/life-style/gadgets-and-tech/news/youtube-lgbt-google-videos-restricted-mode-sensitive-issues-health-politics-sexuality-a7639036.html">The
Independent</a>
in which a Youtube spokesperson say that the potentially mature content is -
and I quote, in bold character, with emphasis :</p>

<blockquote><p>A YouTube spokesperson later clarified that those more sensitive issues
are particularly videos that cover subjects like "health, politics and
sexuality".</p></blockquote>

<p>Basically, if YouTube thinks that you might potentially talk about politics,
then you'll be hidden in Restricted Mode. One of the first collaterals is the
fact that, under Restricted mode, most of the queer produced content is
off-limits. Some tests were run, just having the word "gay" in a video title
is enough to have it blocked.</p>

<h2>Why ????</h2>

<p>My guess is that they did not specifically target a community. And we're
lucky that queers can be loud, other communities have probably been targeted
and e don't now which ones yet. Well, they didn't <em>intentionally</em> targeted
us.</p>

<p>Alphabet is currently having some issues with their customers (brands who
wants to rent advertisement space online). For instance, they placed ads on
extremists website, which raised concern with brands - no one really wants to
get associated with neo-nazis. <a href="http://europe.newsweek.com/google-apologises-brands-extremism-ads-570867?rm=eu">See
here</a>
for instance.</p>

<p>So, Alphabet made a promise to their customers. We will be able to display
your advertisement right next to the content that would improve your return on
investment. For that they need to be sure that no one will associate
neo-nazis with a brand of lipstick. That's why they need the Restricited
mode.</p>

<p>They need to create a consensual public space, which will suits their
customers. A space where you won't talk about politics, where you won't talk
about sexuality, where everything is about the mainstream culture.</p>

<p>The mainstream culture, for advertisement purposes. The culture of
heteronormativity, of whiteness, of sexism. The culture which has no issue
with anyone as long as they comply, hide their differences, and consume goods
targeted specifically for them on a large scale.</p>

<p>Assimilation or death is basically what the restricted mode is. It is the
removal from a public space of everything which does not match the cultural
consensus, and this cultural consensus has no room left for us.</p>

<h2>Impacts!</h2>

<p>Lots of them.</p>

<p>Beyond the invisibilisation which will makes life of all those teenager and
person questioning themselves a lot harder, which will lead to isolation (if
you know no one with whom you can share it gets harder to construct yourself)
and depression; there's also the end of anonymity for everyone who want to
access anything beyond the Restricted Mode.</p>

<p>You do not have to log in yet. But Google do not needs you to log in to know
who you are and what you're watching. It gets worse with restricted mode
because it states that you're explicitely calling for access to 'potentially
offensive' content when you disables it. Which in some country, might be
illegal or otherwise gets you in trouble. It also means that they're not
making any difference about a sex-ed video and pornography.</p>

<p>Or maybe you'll be in places where you do not know the restricted mode is
enable,d for instance on a high school of family computer. And you have
question about your personal health - like how to get an abortion. You just
won't be able to find any content, which is endangering people, not getting
them safe.</p>

<p>Yes, it's not n by default. But given the pace at which terms of uses change,
and the fact that Alphabet really needs this functionality to sustain their
business of analysing your comportment and selling it to advertisers, I do
not think it will takes long before it's getting on by default. At which
point, the only way would be to log in to disable it.</p>

<p>The impact on creator of those videos, some of them trying to earn some money
with it - using patreon or other similar platform for instance - is even
bigger. Making content online, maintaining a community, informing them,
entertaining them is, sometimes, one of the few recourse left to queers to
earn their life. Being Restricted will cut them from their community and from
getting new viewers.</p>

<p>And the beauty of it is, the more you have content flagged as restricted, the
more you'll be restricted in the future.</p>

<h1>Where do we go from here</h1>

<p>YouTube Restricted ban is a blatant statement that minorities are not a
priori concern of a multi billion company. It shouldn't be news to anyone,
but we were tolerated there, not warmly welcomed.</p>

<p>And even if YouTube says they will try to fix the issue, the fact that you
cannot talk about sex on a video without getting Restricted is a hell of an
issue.</p>

<p>The issue here is that we let a private interest to manage a public space of
expression. The only solution is to build other platforms. To create our own
medias, to fight assimilation.</p>

<p>Internet has always been about decentralisation getting your content online,
sharing information without filters but since the advertisement took over one
of the big chunk of it (heck, even getting into your phone and homes to gather
data), this decentralisation is dying.</p>

<p>It's never too late, there's a lot of alternatives a=out there. But we need
to accept that the road will not be easy. Storage and bandwidth are
expensive, architecture costs human time to be maintained and improved. Some
groups are working on it, they need our support.</p>

<p>I know that <a href="https://framasoft.org">Framasoft</a> is working on a tube-like platform
for instance. But we, as a community, need to accept that we're not welcome
anymore on YouTube. We also need to ensure who else has been left out the
Restricted mode.</p>

<p>And we need to move out of the advertisement business. I refuse to comply to
their terms of existence.</p>


