The main disadvantage I can think of would involve a situation where your email (and possibly also other personal data) was exposed without your name attached. It’d be possible for your DLN and/or SSN (or the equivalents for other countries) and email to be exposed without your name being exposed, for example. This wouldn’t have to be a breach - it could be that, for privacy purposes, certain people working with accounts simply don’t get visibility to names.

It’s also feasible that an employee might have access to your full name but only to partially masked email addresses. So if your email is site-firstname-lastname@example.com and they see site-firstname-****@domain.com, they can make an educated guess as to your full email address.

Also, if your email were exposed by itself and someone tried to phish you, it would be more effective if they knew your name.

Considering a password manager that also stores your second factor to be 2FA, assuming that it requires two factors to authenticate with on its own, is basically the same thing as considering logging into a site via SSO that itself requires two factors to be 2FA.

It’s also the same as considering a hardware security key with a PIN-protected Passkey to be 2FA.

For anyone who didn’t click into the original post and whose client didn’t include its text, here are the instructions for opting out:

Opt-out. You can decline this agreement to arbitrate by emailing an opt-out notice to arbitration-opt-out@discord.com within 30 days of April 15, 2024 or when you first register your Discord account, whichever is later; otherwise, you shall be bound to arbitrate disputes in accordance with the terms of these paragraphs. If you opt out of these arbitration provisions, Discord also will not be bound by them.

Note that the forced arbitration clause applies only to Discord users in the US. The class action waiver appears to apply regardless.

This is also not a new addition to their TOS, but it does appear to require opting out again even if you already did, and to grant an additional opt out opportunity if you didn’t.

Many people still use 4 digit PINs. This is a huge improvement in security for them.

Do you have any basis for your opinion other than “it feels like this other thing that I think should be fine but that is also illegal?”

Sure. On your side, you have your opinion. On my side I have legal precedent. You’re welcome to continue having your opinion, even though it’s unfounded and you’ve been told as much.

Thus why it’s prohibited in the future.

This is like going to a hotel and asking to see a list of people who stayed in the hotel last week because the suspect is probably staying nearby.

Going to the hotel and asking is fine. It’s up to the hotel to protect their guests’ privacy in such a case. It’d probably be more productive if they asked the hotel staff about particular suspicious behavior that they’d personally seen, especially if they could narrow down the time frame, though. “Did anyone smelling like smoke come through after 11 PM last night?”

But the issue wasn’t what the police did - it was what the judge did. This situation would be more like if a judge issued a warrant for such a request without any evidence linking the hotel itself to the crime.

Getting a warrant for the entire guest list would not be appropriate, though - at least, not without specific evidence linking a suspect to that specific hotel. “The crime was committed nearby” isn’t sufficient. They need evidence the suspect entered the hotel, at minimum.

Sounds like a pretty good way to get leads without asking for too much info.

Sounds like a pretty good way to trample over the privacy rights of the hotel guests who’ve done nothing wrong.

Oh cool! I’ll check those out.

Having looked at it a bit more, even if it doesn’t end up replacing Standard Notes for me, it still looks promising, particularly given the ease of self hosting it. Self hosted it looks like it could be useful for shared notes, too, even though that doesn’t seem to be its intended use case.

A big part of the appeal for me is that Standard Notes already had a bunch of editors and that it was easy to create my own - they provide a starter app and you can just use React and/or any web libraries of your choice. I’ve looked through the Trilium docs and while they’re not as good, they’re probably good enough.

Another big difference is that Standard Notes also sandboxes its editors, such that they only have access to the current note. It looks like Trilium’s executable JS code notes lack a similar feature. Then again, that also has a positive side effect of meaning plugin devs have a lot more power and flexibility in terms of what they build.

Good point. I’m not sure if IzzyOnDroid considers the CC license to be “free as in freedom” but even if they do, they allegedly have a 30 MB limit per application, and the most recent SN apk is just under 100 MB.

Signal’s approach is useful if the goal is to avoid being tracked by Google without losing out on the convenience of auto-upgrades, but it’s still bad in that they could theoretically introduce a client-side vulnerability that nobody external would have a chance to audit.

You can also use Standard Notes via the web app, which can be installed as a PWA. And even though it’s not FOSS anymore, the source is at least kept up to date.

Trilium looks pretty interesting but not like a great direct replacement. One major feature gap is the lack of custom editor plugins, which is essential for me.

Another app I’ve seen recommended as an alternative is Joplin. I don’t use it myself, but it does have custom plugins, including for custom editors. So for anyone who finds the lack of a mobile app or custom editors to be a deal-breaker, Joplin’s likely worth checking out.

Even if it were true (it is not: there are techniques like static analysis, intercepting client-server communication, etc., that can confirm application behavior), how is having “zero expectations of privacy with closed source apps as you cannot independently verify what they [sic] app is doing” relevant when the source is available?

Why do you say their actions were illegal? In every repository of theirs that I looked through (just app (formerly web), server, self-hosted, mobile, and desktop), the contributors on every single PR that had been merged was from someone in the org. Unless there are some other contributions that I’m unaware of, their license change was completely legal.

There are tons of community created plugins, e.g., for editors (heck, I created and maintain one) but the licenses on those haven’t been changed and aren’t impacted. For any plugin that’s bundled with SN, an AGPL license can be a problem, and I didn’t check the contributions on their plugins, so maybe there’s an issue there and that’s what you’re saying is illegal? If those are still licensed as AGPL my understanding is that’s still legally allowed when they’re doing it, so long as there are no community contributors.

Personally I don’t understand how moving away from AGPL could accomplish their goals - AGPL already prevents another company from forking their server, changing the code, and not distributing those changes to their users… is the concern that some major companies are doing that and charging for it or using it internally? But regardless, being source available instead of FOSS doesn’t impact privacy expectations.

In fact, the way SN handles this is much better than the way Signal does, even though Signal uses a FOSS license. With Signal, development takes place in a private repository and it is later (sometimes as much as a year later) merged to the public one. My point is, the license isn’t the only thing that matters.

In terms of impact on contributions from the community - well, given that there haven’t been any, there won’t be an impact to the server or app repos. But I could see this impacting the willingness of the community to continue to build and maintain plugins.

Standards compliance and interoperability is a lot more important than slightly more rounded message boxes in a walled-garden app

More important to whom? Not to the people I message, that’s for sure.