"SMTP has outlived its usefulness" (was: Forwarding services)

Posted Jan 17, 2026 15:00 UTC (Sat) by kleptog (subscriber, #1183)
In reply to: "SMTP has outlived its usefulness" (was: Forwarding services) by pizza
Parent article: A note for MXroute users

> Where's the profit/control in that?

Yet that is precisely what is being implemented in the EU.

* The site only gets that you are over 18, but not who you are
* The verifier knows who asked for verification, but doesn't know the site that wants to know.

The whole area of Zero-Knowledges Proofs is a fascinating one. Just because you don't think someone can profit, doesn't mean it won't happen.

And personally, this is all a *vast* improvement over the current process of sending photos your your passport over the ether to god-knows which data store. Why people think the new system could be any worse I don't know.

I look forward to the day I can prove my nationality over the internet without photocopying my passport. Bring it on!

to post comments

"SMTP has outlived its usefulness" (was: Forwarding services)

Posted Jan 17, 2026 15:41 UTC (Sat) by paulj (subscriber, #341) [Link] (4 responses)

There are people talking about ZK proofs for age verification for EU Chat Control. However, none of this is agreed on yet. And we are dealing with a number of governments who are notoriously incompetent at tech. Further, even if it's done via ZK proofs, this still doesn't address the fundamental problem here:

You have no anonymity anymore in online speech. Your identity is verifiably linked to everything.

(Again, the threat model here is state actors and increasing illiberalism - which may one day lead to troubling overreach; indeed, there already are examples of troubling over-reach in previously-liberal democracies where people have been locked out of digital services by government because of political speech).

"SMTP has outlived its usefulness" (was: Forwarding services)

Posted Jan 17, 2026 18:43 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link] (3 responses)

> a number of governments who are notoriously incompetent at tech.

Have you seen the actual EU regulations? They are awesome. For example, I suggest checking the repairability regulations. CRA and DMA are also great.

The EU is exceedingly bureaucratic, but it's a very competent bureaucracy.

"SMTP has outlived its usefulness" (was: Forwarding services)

Posted Jan 17, 2026 19:51 UTC (Sat) by paulj (subscriber, #341) [Link] (2 responses)

The EU is not a monolith, and there are a number of different institutions with differing interests, in different groupings.

I don't know, and I can't find, the history of the CRA and which groups pushed for it - before the European Commission formally introduced it as a proposal (the commission being the one and only body able to do that) - but if it's sensible and pro-consumer, there's a good chance it originated from or at least drew much of its early support from MEPs (prior to formal proposal).

The Chat Control thing is the wet dream of a number of governments and (I assume) their security services. There are regular top-down (i.e., governmental) attempts to push in ID cards and ID checks in various contexts (to *long before* the EU!), and they usually fail because of bottom-up push-back - which MEPs are pretty good at listening to most times. But the securocrats keep pushing for it, keep bringing it back.

"SMTP has outlived its usefulness" (was: Forwarding services)

Posted Jan 18, 2026 15:37 UTC (Sun) by kleptog (subscriber, #1183) [Link] (1 responses)

> I don't know, and I can't find, the history of the CRA and which groups pushed for it - before the European Commission formally introduced it as a proposal (the commission being the one and only body able to do that) - but if it's sensible and pro-consumer, there's a good chance it originated from or at least drew much of its early support from MEPs (prior to formal proposal).

Well sure. The process of lawmaking prior to the Commission publishing its proposal is nebulous, but there is structure there. The 2020 Cybersecurity strategy [1] already pointed out this was going to happen. The Cybersecurity Act (CSA) in 2019 already established an EU-wide cybersecurity framework focused largely on ICT and hardware products, making it clear that software would eventually be addressed as well.

In 2022 there was a public consultation [2] with 108 responses. And looking through those responses (they are all public), not a single Free Software/Open Source organisation (AFAICT) made a submission. So it's not entirely surprising that initial draft did not have much in that direction (only 3 mention the term "open source"). Free software 5 times, and Linux mentioned not once.

It's good that in the process we could get MEPs on our side to improve the legislation, but we need to get a lot better at adding to the process earlier. Limited early participation leads to limited early consideration.

[1] https://digital-strategy.ec.europa.eu/en/library/eus-cybe...
[2] https://ec.europa.eu/info/law/better-regulation/have-your...

"SMTP has outlived its usefulness" (was: Forwarding services)

Posted Jan 21, 2026 13:07 UTC (Wed) by paulj (subscriber, #341) [Link]

My experience is that MEPs are pretty good at listening. The more authoritarian proposals I know of always originated with governments. My assumptions, maybe biased by my experience, is that:

- The "good" pro-consumer, pro-individual rights stuff tends to have originated from MEPs (and their EP workings groups, via whatever other groups went to the trouble of lobbying them)

- The "bad", authoritarian, illiberal, anti-individual-rights stuff (mandatory IDs, criminal weight behind "DRM" copyright laws, etc.) tends to come from the governments (i.e., the council). Often these are laws they /desired/ previously to implement nationally, but could not get done because of national push-back. So they then go and push it through at a European level, and then later when they have to pass a law (if they even have to do that) to implement the directive they can counter any local opposition with "Oh, but it's not our fault, Europe passed it".

No doubt there are exceptions, but that's the pattern I've noticed, when there's been sufficiently "good" or "bad" European "law" or regulations for me to notice.