Moritz Bartl <[email protected]> writes: >On 17.06.2013 21:06, micah wrote: >> Do you have any suggestions for what Riseup can do to resolve that >> concern for you? I don't disagree with you, I'm just curious about >> solutions here. > >I am happy to repeat myself, since the issues I have with Riseup have >not been addressed so far. > >Tactical Tech should not be recommending Riseup, and Riseup only, >without stressing that you *always* have to trust the operators and the >systems behind them, and at least mention some alternatives to Riseup. A >longer article should also discuss that Gmail is probably better >security-wise than some random open source installation. In the end it >depends on your threat model, right? > >Anyway: > >#1 There was a point in time when Riseup purposely decided to stop >pushing decentralization. A lot of work was and is put into features >that are *not* documented properly and not easily available to replicate. > >#2 As an example, the website states "minimal logging". What the hell is >"minimum logging" other than marketing speech? Why don't you tell you're >users what you are logging, up to the last byte? Especially when you >provide a sensitive service like email, extra care should be put in the >documentation and specification of logging policies. And by that I mean >down to the config files of the syslog daemon.
Riseup makes a more specific promise than just "minimal logging". They say: "We do not log your IP address" and some other things, at https://help.riseup.net/en/about-us . It's not the "up to the last byte" you're asking for above, but it's more specific than just "minimal logging". >#3 How hard is it to be transparent about money and sponsors? There's >some big money behind Riseup now, and you guys should be very open about >the sources. Surprisingly hard. It's actually a fair bit of work to maintain up-to-date donor pages, especially when you have some donors who want to remain anonymous and other donors who want to be listed under a name slightly different from the one they donated under, etc... I'm not saying this is the reason Risup isn't showing that information. But the answer to your direct question is: "surprisingly hard". (Speaking from abundant personal experience, running one US non-profit organization and being on the board of another.) There's an opportunity cost to maintaining that information publicly. Whoever takes on the task gives up something else they could be doing -- something that might be more interesting and feel more productive to them. "Volunteers are surely standing by", and all that :-). -- Too many emails? Unsubscribe, change to digest, or change password by emailing moderator at [email protected] or changing your settings at https://mailman.stanford.edu/mailman/listinfo/liberationtech
