site banner

Culture War Roundup for the week of August 24, 2026

This weekly roundup thread is intended for all culture war posts. 'Culture war' is vaguely defined, but it basically means controversial issues that fall along set tribal lines. Arguments over culture war issues generate a lot of heat and little light, and few deeply entrenched people ever change their minds. This thread is for voicing opinions and analyzing the state of the discussion while trying to optimize for light over heat.

Optimistically, we think that engaging with people you disagree with is worth your time, and so is being nice! Pessimistically, there are many dynamics that can lead discussions on Culture War topics to become unproductive. There's a human tendency to divide along tribal lines, praising your ingroup and vilifying your outgroup - and if you think you find it easy to criticize your ingroup, then it may be that your outgroup is not who you think it is. Extremists with opposing positions can feed off each other, highlighting each other's worst points to justify their own angry rhetoric, which becomes in turn a new example of bad behavior for the other side to highlight.

We would like to avoid these negative dynamics. Accordingly, we ask that you do not use this thread for waging the Culture War. Examples of waging the Culture War:

  • Shaming.

  • Attempting to 'build consensus' or enforce ideological conformity.

  • Making sweeping generalizations to vilify a group you dislike.

  • Recruiting for a cause.

  • Posting links that could be summarized as 'Boo outgroup!' Basically, if your content is 'Can you believe what Those People did this week?' then you should either refrain from posting, or do some very patient work to contextualize and/or steel-man the relevant viewpoint.

In general, you should argue to understand, not to win. This thread is not territory to be claimed by one group or another; indeed, the aim is to have many different viewpoints represented here. Thus, we also ask that you follow some guidelines:

  • Speak plainly. Avoid sarcasm and mockery. When disagreeing with someone, state your objections explicitly.

  • Be as precise and charitable as you can. Don't paraphrase unflatteringly.

  • Don't imply that someone said something they did not say, even if you think it follows from what they said.

  • Write like everyone is reading and you want them to be included in the discussion.

On an ad hoc basis, the mods will try to compile a list of the best posts/comments from the previous week, posted in Quality Contribution threads and archived at /r/TheThread. You may nominate a comment for this list by clicking on 'report' at the bottom of the post and typing 'Actually a quality contribution' as the report reason.

2
Jump in the discussion.

No email address required.

All I need to do is confirm the counterparty is the owner of the domain, which they are on the blockchain under this scheme. It doesn't say whether they are good people or not.

How do you trust your counterparty to keep your conversation private without knowing they are who you think they are, and not a leaky proxy?

How could they be a leaky proxy? I don't get it. Say I get 1 HTTPS-coin from a wallet and in exchange I transfer my unique ownership of themotte.org to the wallet that sent the coin. Now that wallet is the only wallet on the blockchain the owns themotte.org. There is one and only one. If they transfer it, there will still be one and only one. That wallet can now use its own keys to publish on the blockchain under its own signature the DNS config for themotte.org and the TLS certificate for themotte.org. There is one and only one under this wallet. That is the right one. How do I know themotte.org isn't owned by a racist? I don't, I have to query safetyandcensorship.org to get the reputation, if I'm in to that. But I know that themotte.org is not a «leaky proxy».

How do you know the NSA SPLC didn't pre-register themotte.org, and the pass all your queries on to what you think is the real site while logging all your traffic? Or that the block chain you see is the real one and not swapped out by your ISP with fake certs?

The PKI system we have is flawed, but you generally start with certificates delivered out-of-band (even if you use Chrome, you downloaded that with TLS in Edge, for example) that would loudly fail if your ISP tries this. Doing everything in-band is a "turtles all the way down" problem.

How do you know the NSA SPLC didn't pre-register themotte.org, and the pass all your queries on to what you think is the real site while logging all your traffic? Or that the block chain you see is the real one and not swapped out by your ISP with fake certs?

The same way I know the bitcoin blockchain is the real one and not one swapped out with fake balances?

The SPLC would have to own themotte.org in this case? This site could be operated by the SPLC right now, has anyone talked to Zorba lately? Do we know who he's working for? This problem is orthogonal to the blockchain idea.

I'm not going to say your approach is crazy, but it isn't quite the same threat model the typical PKI infrastructure was intended to secure. You probably have more network connections at hand than was envisioned 30 years ago.

But how do you know you got the "real" bitcoin chain? Is each party resolving it separately, or are you keeping DNS servers (those have been difficult-to-authenticate, but proposed solutions rely on those darn CAs again)? Because you know the time and expect a rough block number? Secure time transfer is one of the classic difficult cryptographic problems. There are solutions, but the classical ones rely on pre-trusted servers (CAs!) and local trusted randomness. Using the cell network or GPS wasn't an option at the time, and even today there are real concerns about those (fake base stations!). And injecting bad notions of time is also a classic attack vector for using broken or revoked credentials.

In practice, I'm not sure you'd be wrong to trust a consensus time from multiple mechanisms, but that sort of thing is a very different model than the classical PKI exists to secure.

This is much simpler than you're trying to make it. A site cert needs to only tell me it has not been MITMd. So if your domain's cert hash appears in your dns and that cert for that domain is verifiable to have existed N number of days/months ago then that's fine for me.