Your residential address is not private. Even if you do not vote.

Of course your residential address is private. It’s sensitive information because it can be used against you in countless ways. Do you mean to say that you personally don’t care if your residential address is published? Anyone who is street-wise treats it as private. Note that this is different from mailing address. Residential address is where you can physically be found… where you sleep at night.

Your political party is self reported. I don’t believe the primaries have anything to do with actual government protection and are run by each party. Therefore they can make the rules on who can and cannot vote. As it’s self reported, you can always lie.

By “self-reported”, do you mean that registrants are entering it on the voter reg. form themselves? Yes they have a choice whether or not to provide that, but it depends on the state whether it’s a precondition to participation in primaries. (see the earlier discussion below).

Voting activity is a strange one. I have never gotten those postcards.

I haven’t either. Just heard about it going on. The bigger issue is that the information to do that is /available publicly/. The postcards aren’t coming from the gov. The fact that people are exploiting the info is expected. The non-voter shaming is a bit eye opening but then again so are so many abusive tactics we encounter in the election run-up you could fill a book with all the ways voters are manipulated and exploited. AI of course supercharges it. Cambridge Analytica is merely the beginning.

Cloudflare, is well, cloudflare. Because of how they do their ddos protection they do have the ability to decrypt traffic, but it’s highly unlikely that they do.

That’s not true. The ability is used inherently in how they operate. Of course they decrypt the traffic; that’s a precondition to the DDoS protection. How do you think CF offloads the user’s server workload without directly processing payloads? Any packets they don’t decrypt cannot be treated and must be passed through to the customer who cannot afford the bandwidth to handle all the traffic which is why they use CF to begin with.

To give you a concrete example, you use #lemmyWorld, a Cloudflare instance. Your username and password is revealed to Cloudflare every time you login, along with all your actions including actions that do not manifest in a public way. Cloudflare inherently sees that all in the clear (to them). Whether they abuse it is guesswork. But it’s obviously not a wise move to choose a centralized CF’d instance when there are non-CF instances to choose from. You compromise privacy and support an anti-netneutrality tech giant for nothing.

The option to allow the customer to have their own key is a premium option (non-gratis), which makes it rare, not to mention it defeats the DDoS protection. The use of that is obviously quite niche.

Anything done along the wire would destroy their reputation.

If they are caught abusing that data, it may or may not matter considering what they’ve gotten away with so far. One would be a fool to not assume CF is feeding 3 letter orgs just like the other tech giants. Of course they are. There just hasn’t been a specific leak in that regard yet.

CF’s reputation should be in the shitter because they doxxed a CSAM whistle blower to a CSAM host they were protecting, who then published the identity of the whistle blower so users could retaliate. If that’s not startling enough evidence of Cloudflare’s untrustworthyness, consider as well that the (manchild) CEO said the whistle blower “should have used a fake name” when reporting the CSAM to CF. Effectively, the CEO admitted that CF cannot be trusted with people’s real identities. That should have been a PR nightmare for them but most people don’t give a shit or don’t even know enough to understand it, which enables CF to grow. They’ve taken ~25-30% of all the world’s websites so far and it’s rapidly increasing. Cloudbleed should have been an alarming disaster for them but people shrugged it off and a couple weeks later it was back to business as usual.

Find me a PRISM corp whose reputation was destroyed by the Snowden leaks. Microsoft… Google… Facebook… Apple… They are all doing well.

It is a big issue regarding consolidation of Internet resources into the hands of a few large companies, but just because traffic goes through them doesn’t mean that privacy is violated.

That’s not how wise infosec works. You do not wait until your data gets exploited before deciding not to do a reckless disclosure. That would be like leaving the keys in your car on the basis that your car has never been stolen. Not to mention Cloudflare has proven to be untrustworthy anyway. Just like Facebook. It doesn’t stop people using them. And the nature of the beast is the admin is putting other unwitting people at risk. Mallory solves her problems by transferring risk onto Alice.

I’m curious, can you expand on what demographics they block?

By default, Cloudflare blocks access to the following groups of people:

• users whose ISP uses CGNAT to distribute a limited range of IPv4 addresses (this generally impacts poor people in impoverished regions)
• the Tor community
• VPN users
• users of public libraries (consequently people who can’t afford a PC and internet subscription), and generally networks where IP addresses are shared
• privacy enthusiasts who will not disclose ~25% of their web traffic to one single corporation in a country without privacy safeguards
• blind people who disable images in their browsers (which triggers false positives for robots, as scripts are generally not interested in images either)
• environmentalists and the permacomputing community and people on limited internet connections, who also disable browser images to reduce bandwidth which consequently makes them appear as bots
• people who actually run bots – Cloudflare is outspokenly anti-robot and treats beneficial bots the same as malicious bots

… and that’s just what has been noticed and complained about. It’s likely a bigger list but they are non-transparent. Cloudflare does not publicize who they marginalize. They just say they block the baddies, and then proceed to assume all those they block are baddies in a circular logic fashion. Marketing works wonders on people.

I didn’t know about VAN specifically but I know the analytics works out what issues an individual cares about (or is likely to care about) as well as your degree of swingyness. So e.g. if there is a moderate/swing voter (tagged as a “persuadable”) in a region that matters and the machine determines that individual has an interest in immigration, the campaign workers will bring up that issue early in their pitch after you open the door.

I think Obama was the first to exploit these marketing tactics effectively (not that he needed to; it was overkill in his case). Then Peter Thiel brought it to a more extreme level with Cambridge Analytica on the Russia-financed Trump campaign. I think it’s widely accepted that Trump never would have taken power without Thiel & Cambridge Analytica (and Facebook who sold the data to C/A).

I don’t know enough about the Canadian system to understand your 2nd paragraph, but I can answer this:

Do you have anything similar, where you might deliberately register with the “wrong” party in an attempt to control who your real party runs against?

There are republicans in the US who will register as democrats in order to vote for the “weaker” candidate in the democratic primary. By weaker, they select the opponent who they think is less likely to win against whoever the republican turns out to be. It’s hard to imagine that enough of them would be able to do that in enough numbers to influence who wins the primary, but it is yet another sneaky tactic that the republicans try.

Correction: Many states have open primaries, meaning you don’t need to register with a party to vote in primaries (but you can only vote in one). Illinois has open primaries, for example.

Is there any reason to register a party affiliation in the case of open primaries? The more important question: if you vote in a democratic primary, is it public that you did so? If yes, then the privacy factor would be mostly the same.

(edit) I just noticed there is a national voter reg form (paper format) and for Illinois the instructions say:

“7. Choice of Party. Leave Blank. Exception: for primary elections, unless a voter only wishes to vote on public questions, a party preference should be indicated.”

Seems a bit counter-intuitive considering the open primary. The instructions for Ohio seem more intuitive for an open primary than any other state in those instructions:

“7.Choice of Party. You do not register with a party if you want to take part in that party’s primary election. Party afliation is established by voting at a primary election.”

Illinois also requires two-party consent for voice recording, meaning you can only be filmed in public without sound.

That has some interesting relevance to my other thread. I wonder if you call Discovercard customer support from Illinois whether they can take your voice print without your express consent.

You can also file taxes here for general delivery, meaning you don’t need to have a mailing address, you just get your documents sent to the post office for pickup, no PO box needed.

That’s surprising because you would need to know that you have something waiting there. If I send you some correspondence via general delivery (“poste restante” in French which is internationally recognized), you would know about it unless I told you in some way. General delivery sits for 2 weeks and if not collected it gets returned. So you would have to visit the post office every 2 weeks and ask if the IRS has sent you anything, correct?

W.r.t to the topic at hand, it’s interesting to note that homeless people can register to vote if instead of an address they unambiguously write their usual hang-out where they can often be found; e.g. “park bench near Main St. and Broad St.”, “under the yada yada bridge” or use the address of a homeless shelter.