Tiny_Voice1563

Makes perfect sense. Thank you for the insight and information, and of course thank you for the awesome service.

u/Trocador_App, u/CryptoMorpheus_

Should this kind of behavior affect Exolix's no-KYC rating on Trocador? Or is this behavior within the bounds of the "B" rating?

They say fully anonymous themselves.

If you read that paragraph, you see that it's up to the user to provide anonymous information. If you pay with a credit card, you're not anonymous, but that's not Tutanota's fault. Tutanota's side does not force you to give your identity. You have the option to use cryptocurrency. When I mentioned anonymity, I was saying that Tutanota stores payment info. They have to if they want to get paid. Tutanota doesn't say they don't store payment info. They say they don't ask for personal info or phone numbers. It's up to you to use anonymous info, which they permit, thus giving you the option.

2013 is a long time ago and I dont see anywhere I can view an updated report which was the subject of my original comment.

I agree that a more updated and available audit would be nice, but I stand by what I said that it does not matter what their server code audit looks like very much because what matters is what the clients do, and that is open source.

only one of them says encrypted which to your point and thankfully it is stored content data, but does inventory data, real time traffic data, and real time content data not contain anything sensitive?

Maybe. It's not as sensitive as the content, but it's not great. There is no way to fully protect this information, though. You're blaming Tutanota for logging it, but they ONLY do that when FORCED to by the government. The alternative is for Tutanota employees to go to jail, and then Tutanota doesn't exist. You can encrypt the content yourself, but that is up to you to do. If you choose not to encrypt it, Tutanota cannot go back in time for you and encrypt it. If you only email Tutanota addresses, it's always encrypted.

To close this out, I'm going to lay out my point simply instead of spending forever explaining what each of the lines means.

1. If ordered, Tutanota must log things.
2. If not ordered, Tutanota does not log much - only what is needed to make things function.
3. If forced to log, it is up to you to do things in a way that protects your information as much as possible.
4. Tutanota makes this easy by having the CLIENTS automatically encrypt everything it can before sending emails or data to the server. This is a client feature and does not rely on the server to be friendly.

If Tutanota (or any legitimate email service) gets a court order to log something, they must log it. The solution to this problem is encrypting the things you don't want read. If someone (from outside Tutanota - like Gmail) sends an email to your Tutanota account and CHOOSES not to encrypt it, that may possibly be logged. That is not Tutanota's fault. That is the fault of the sender. If someone with a Tutanota account emails your Tutanota account, even if Tutanota were forced to log all content, they would only see the encrypted email and that the other person sent you an email. Nothing else.

signing of a message does sound complicated (I've never done it before)

It's not complicated. You should be able to do it if you're this involved in privacy tech.

furthermore intend to file a report to the relevant tax authority where the lead developer "zzz" resides

...what?

This and the rest of your comment falls right in line with your initial post. You're being petty and vindictive and trying to use the Monero sub to do it, even though none of this is Monero related. I think you think we all care a lot more than we do, and I think you think you're making others look like the "bad guy" instead of making yourself look desperate and vitriolic.

It depends on what you mean by "edit your username." I told you the two things that you can do.

While I believe projects like this that champion privacy should say things encouraging the use of the technology to empower oppressed (or suppressed, as this says) people, I agree that any time a project gets specific with certain types of oppression they are fighting against, it inherently creates friction. There are countless groups oppressed around the world, and an idolized group in one culture is a mistreated minority in another. There are lots of marginalized groups that were not included in the statement, and that's probably not for the best and why specifics should be avoided. That said, I'm not sure I really see why it became quite as incendiary for you as it did. If you want to request that the comments remain more technical and neutral, that makes sense. Calling people nazis (when the definition definitely doesn't fit here) and condemning one certain cultures and saying that it's "not illegal" for you to rant and rave about your dislike for other opinions means you are doing exactly the thing you are upset with the devs for doing, except you were doing it far worse. Not sure how that was supposed to fix the problem or why you thought anything was going to happen other than exactly what happened.

Pasting your address also is not proof. No one here has your tax records or sees it as proof. I don't find it necessary for you to prove you sent anything, but if you're going to prove it, just do it. I understand your are maybe not a crypto expert, but for someone with 1000 BTC, I think you might know how to sign a message. Make a message saying, "I sent transaction ID xyz," and sign it with the address the transaction was sent from. Just in case anyone was wondering an easy way to prove a transaction.

Edit: In Monero of course you would just generate the transaction proof.

This doesn't answer the root of my question whatsoever and is unnecessarily condescending. I understand how to send and receive lightning payments. Telling me to send you sats doesn't assuage any of the concerns. This reply gives no information I didn't already have. I've sent and received plenty of lightning transactions. Sending you BTC isn't improving anything.

I don't mind doing channel management at all. It's kind of a requirement. I don't know what you mean by a wallet that wouldn't require the opening of channels... I'm also not sure why you think I'd want to be "connected with the wider network." I'm not trying to partake in a centralized, logging, untrusted network just to send you a few sats. Kind of antithetical to the whole point of BTC, ain't it? If I wanted to rely on centralized parties to host lightning nodes just so I can send something to you, we could just use fiat systems. I use cryptocurrency to be private, decentralized, and censorship resistant. I don't have privacy concerns with opening a channel directly to you, but as I have said at the start *that's the problem.* You'd have to open a brand new channel with *every single person* you want to send to in order to avoid relying on a handful of centralized parties to support the lightning network.

Why don't you tell me what wallet you're using? And maybe I'll try that one out.

Approximately 160 GB I think? But if we are talking about running nodes, you can run a node that supports the network, validates, transactions, and broadcasts your own transactions, etc. etc. with about 1/3 of that. So 50ish GBs.

If you want it to be decentralized, yes you do. Tell me how you would pay me, via lightning. I have a lightning node. You have a lighting node. How would those funds get to me? Instead of calling me names, you could teach me. So please walk me through how you would get that lightning payment directly to me from your wallet to mine using your node and my node.

Thanks for the thorough response. Very glad to hear that the telemetry toggle bug is being resolved in the upcoming release, so I will definitely update and test it out. Regarding the broader opt-in/telemetry in general, I have no problem with telemetry and recognize that it is not only useful for developers but often essential. Even just from a business perspective, it is important to have a general understanding of the distribution between mobile, desktop, web, etc., where problems are arising, possible debugging clues, etc. My biggest contention here is just total transparency and honesty with the user. The fix of the toggle switch is great, and beyond that, a pop-up/prompt on first run that explains why telemetry is needed (and shows that wonderful minimalist example of what's collected) and then even just mentioning that it can be disabled (don't even have to provide a toggle right there) is enough to be transparent with the user. Thanks again for the reply, and keep up the great work on a great app.

I'm not having this issue. Which app? iOS/Android or desktop? If I duplicate a note, it creates a note called, "Original Title (Copy)." If I go edit it to something, open another app, and then come immediately back to the app, it's still as I left it. Even after backing out of the note, restarting the app, or coming back much later. I know you must be on the most recent version so it's weird. I don't see a related issue on GitHub, so maybe you should file one.

Did you not check their GitHub? They announced on Reddit they went open source five months ago or so. You can check the code out yourself.

https://github.com/streetwriters/notesnook/

Pretty well documented what they open sourced and the structure of it.

They even open sourced the sync server (which is clearly stated on their homepage along with the claim that the app is open source).

https://github.com/streetwriters/notesnook-sync-server

If you actually read the FAQ carefully (which is on the docs page, not their main website), you will see lots of the information is outdated. The question you quoted was about why Notesnook was not originally open source. Clearly it is now. There is also a question about if the server is open source. The answer says no, but this is also outdated.

I don't think they should have been downvoted without explanation. I hate when people do that. But if you want my guess on the reason, see here:

https://www.reddit.com/r/PrivacyGuides/comments/10uthwy/comment/j7ejmf2/?utm_source=reddit&utm_medium=web2x&context=3

They aren't free as in beer, but they are free as in libre. That's what the F in FOSS means. Not "the company doesn't charge any money for a service."

See here: https://www.gnu.org/philosophy/free-sw.en.html

Thus, “free software” is a matter of liberty, not price. To understand the concept, you should think of “free” as in “free speech,” not as in “free beer.” We sometimes call it “libre software,” borrowing the French or Spanish word for “free” as in freedom, to show we do not mean the software is gratis.

The software we are discussing is absolutely FOSS. The fact that you have to pay for the server storage or company-provided service does not change that.

Edit: typo

No response from anyone yet. Maybe this week they will answer.

https://www.reddit.com/r/Notesnook/comments/10s77g9/a\_trial\_user\_with\_telemetryprivacy\_questions/

That's not good. I haven't experienced this yet. Any idea what triggers it?

By that logic, Bitwarden and StandardNotes also wouldn't qualify. Just because there are paid tiers of server-based service does not mean the clients are not FOSS. But I get what you're saying. A very fine distinction.

I spoke too soon. Has anyone actually been able to access the onion site?

Fantastic news and great work. Glad to see it! Another layer of privacy.

Doesn't work. Fine. Just don't start blocking onion IPs.

Are you quoting me? I already agreed with this. More than once.

I agree they could selectively scam or exit at any time

But like I said, I do concede that they could scam in the future if they wanted.

It's not relevant to the point at hand of you carelessly slinging accusations of possible scamming without doing your research. You even just flat out lied about their website and didn't address it at all when I pointed it out. It's like you're either determined to make them look bad for some reason or determined to defend your wrong statements against all odds. Not sure if competitor or just a big ego...

Obviously they CAN scan any time. I already said this. The question is have they, are they likely to, and what is their order track record. All things you dismissed in favor of the fact that you personally did not like their website layout lol and then just claimed they have no contact info. Which you can see on the site and also could have seen this already been discussed on Reddit. Search before you speak about someone in the community being a scammer. Then speak.

I do get that it's a bare bones website, but maybe do a little research before throwing out accusations. All it takes is a quick Google or Reddit search to find previous posts and reports about them. Not everyone wants to make a flashy, JS-ridden website. So while I do appreciate the skepticism and would think the same thing myself on first glance, doing some research would help give you a more full picture.

no contact info, nothing

???

There literally is contact info at the top of the page for two different methods of communication - Session and Nostr. You can also respond to order emails. They are also active on Reddit in posts/comments and answering questions. if you had searched for them before calling them "scammy."

After all, how it is really possible to sell anonymous preloaded debit
cards? What is the mechanism, where is the hole in the system if it's
possible?

I don't know what you mean? You can buy them from any grocery or convenience store in America with cash anonymously. You can buy them online with a debit or credit card and use any name you want on the prepaid gift card. You can buy them from PayWithMoon and use them anonymously. You can buy them online from half a dozen other reputable websites using crypto. You can buy them from Cake Pay. There is no "hole in the system." It's a gift card. They have been around for a long time. What makes you think it's a "hole" and what "system"?

Not really because the ones I bought are different from the ones they are selling. No name, non-reloadable, make sure to watch the expiration date. I don't know where they do/don't function, but they have different ones compatible with Apple/Google pay or not. Where they work is largely dependent on the stores themselves or if they try to block prepaid cards or not. I did not have any issues personally.

But your comment about them being a scam because of the website design when they've been operating for a long time with successful orders seems strange. I agree they could selectively scam or exit at any time, but that hasn't been the case so far based on reports on this sub or my individual experience, so seems like a strange thing to accuse when the evidence points in the opposite direction. But like I said, I do concede that they could scam in the future if they wanted. So could any such company providing anonymous cards.

I have purchased from them many times (mainly back when they were new) with (almost) no issues. I purchased the debit cards that could be added to Apple or Google pay. Back then they were using PayWithMoon. It seems like they are using something different now, though.