I volunteer with them here in the UK after being a youth member most of the way through. I know our respective organisations differ in some ways and I don't know a great deal about USA Scouts.

I think we do legitimately help young people gain life skills and care for others. If I had kids, they'd be on the waiting list well in advance of joining age.

I'm proud that we're an LGBT+ and neurodivergence inclusive space, by national policy as well as practical local example in many places. I have seen variations between groups though and I don't think we get enough training on that. I would also say we're pretty bad at race and class inclusion.

The biggest downside I feel is organisationally. We suffer from all the usual issues of a big organisation including internal politicking, shitty managers, disconnect between different teams, and putting the organisation's interests above its professed values.

I don't think it's fair to call someone dealing with mental health issues "an idiot" and I don't think it's fair to lay the blame on a grieving family.

Bruce!

In case you missed it, the article's not about the government but about the Lib Dem party's internal conference. The Lib Dems do indeed seem sympathetic but lack the power to change anything at the moment.

The Labour government, as you say, could change the legislation, so the fact that they haven't says quite a lot about how sympathetic they really are (i.e. very little).

Resilient to these kinds of problems? Apparently not

I feel like dadjokes would also appreciate it

I'm glad we have the BBC and I follow its news, but it has its problems and deserves criticism on some fronts.

Not an exhaustive list by any means but it's very prone to legitimising harmful attitudes by false equivalence, and it's very TERFy/transphobic.

Or for the hell of it, write your web client with its encryption code in plain js rather than minifying it or using a framework. Then someone can view source on the web page and literally see the client source which is running.

Not the most maintainable solution of course, but highly transparent.

It's not the server code which is the question though, it's the client side, which either way is downloaded from somewhere you control (whether in minified js to run in the browser, or binary blob of a desktop app). A malicious developer can quite easily insert different code rather than the published source in either situation.

I guess if you have a traceable build pipeline which is entirely under control of a trusted cloud provider, that might do it.

But if so then there's no reason you can't make the web client "binary" available in the same way, as say a webroot zip or a container image. People can run it themselves against your backend api, or audit the frontend code your server is serving against the trusted version.

Something along these lines is a good idea, but be aware you need extra considerations to keep the e2ee intact. If like most websites you would send the password to the server to login, and if you derive the private key from the password, suddenly the server would have your private key.

There's probably something you can do with hashing before sending to the server on login, but I don't have enough confidence to be definitive on that.

The user's going to have to trust your code one way or another. Making it a separately downloaded extension/application, rather than some js in the browser page, doesn't change that.

Yep. Had to go find the history in settings to actually read it.