Security is Desirable, But Not When the Term Security is Misused to Imply Centralisation of "Trust" (Whose?)
'Security' is not an excuse for vendor lock-in or kick-starting kill switches
The "man in the middle" does not protect you.
Earlier today in Daily Links we shared an article that said "Secure Hosting Alliance (SHA) is introducing the SHA Trust Seal. The seal sets a clear bar for providers by demanding transparency, accountability, and resilience."
Who gets to decide? How will my own home fare for "transparency, accountability, and resilience"?
What if it handles E-mail?
What if it handles Web hosting/Gemini hosting?
Do I need to register somewhere for "transparency, accountability, and resilience" like many need to solve all sorts of technical puzzles and riddles for their self-hosted mail systems not to be universally flagged as SPAM? Over time more and more such obstacles are set up. The "small person" cannot keep up. GMX can handle it in one fell swoop for millions of people, whereas for your home setup with 1 or 2 users it's a considerable barrier to cross, time and time again.
As an associate has framed it, the above is a "war on self-hosting as a stage in war against general-purpose computing" (remember what Google does to Android 'apps' that Google does not know about, or whose developers are not known to Google).
We wrote about this in relation to UEFI, centralised CAs, self-hosting for E-mail, and Linux Foundation fantasies of remotely controlling what software you can or cannot install/execute on your own system (2021). Google and IBM (Red Hat) led that effect, which never quite got off the ground (thankfully).
Passing trust to some other entities isn't making it "someone else's problem" if misplaced trust can become a problem to you (maybe not immediately).
In Free software and in the federated world, we have "No Kings". Not Microsoft, not Google, not IBM; not even consortia that falsely or shamelessly disguise themselves as neutral. If you want freedom, reject masters. █