3 ms·

Privacy is a poor angle to pursue. It's old, and so we know, as you said, that people don't care. They have a real chance if they ride the social justice and p

Privacy is a poor angle to pursue. It's old, and so we know, as you said, that people don't care. They have a real chance if they ride the social justice and progressivism train, though. It's hot and unlike privacy, people care about it a lot. They've already set the precedent with the Eich controversy. They just need to double down and start promoting it better. Take initiative instead of being reactive. Not too hard when the organizations you're up against are gigantic multi-billion-dollar companies who can't afford to fire every conservative employee, not comply with government regulations their audience views negatively, or kowtow too hard to diversity for fear of angering the technolibertarians.

bobajeff 11y ago
I'm pretty sure people do still care about privacy. It just might not be readily obvious how to profit from such people.
- caskance 11y ago
  And some people are "pretty sure" the hyper advanced alien Xenu used hydrogen bombs to detonate all volcanoes on earth simultaneously and capture everyone's thetans. Unless you have any evidence, you're just going to have to resign yourself to the idea that most people won't believe you.
- nickpsecurity 11y ago
  It's obvious: you sell them the tools that enhance their privacy with solid reviews and advertisements in right places. If people don't buy, they either didn't care enough about privacy or were poor. There's security companies selling hardened phone OS's, browsers, desktops... you name it. Most individuals or businesses, even with the money, just don't buy them or even research them much.
  - bobajeff 11y ago
    I bet they just don't deliver on their promise or do so at the expense of some fundamental use case. Security and privacy are very hard issues to address. So any solution will be temporary, very restrictive or fall short of it's promise. For instance you can't have total privacy even if you never use Google and use tracker blockers, erase your browser's fingerprint etc. you are still sharing information with servers you're visiting.
    - nickpsecurity 11y ago
      Many server appliances or hardened distros did exactly what their counterparts could but with much less risk. Either went nowhere or made small amounts of money. Meanwhile, insecure garbage and spyware prevails at multi-billion dollar amounts. I think people have made their preferences clear in practice even if in theory they want it more private.
  - zobzu 11y ago
    all of these take terrible trade offs. people want a good product AND privacy AND security. Not fucking OR. OR will NEVER win. A secure and/or private thing that you can't use simply CANNOT win vs something that actually works. If it doesn't work well being secure or anything missing the point why people even get the tool. Sadly many companies totally miss that and think they'll get lucky. That's sort of sad.
    - nickpsecurity 11y ago
      "people want a good product AND privacy AND security. Not fucking OR." That's true. The problem is: what is a good product? Good is relative to what the insecure garbage on the market is offering. You can move fast, drastically add complexity, keep it extra cheap, and so on if quality or security aren't on the table. So, a good product that meets one's needs can look like a bad one if it's secure and makes right tradeoffs vs the "good product" that sells its users out. One simple example is how several companies did high assurance VPN's whose trusted computing base was very difficult to hack. Yet, to get there, they had to eliminate most features competition was adding to their all-in-one appliances. I pointed out one could just chain them together with the high assurance solution being the interface to untrusted network. Rest of functionality can be in next device. Even such a simple scenario was almost always rejected as it was cheaper or simpler to have one do-it-all(-like-crap) device. Apply such logic throughout entire industry and we have whole, insecure stacks that can't be made better without sacrifice. Nonetheless, companies keep trying with medium-assurance, full-featured appliances that are easy to configure. They sell very few and most go out of business. Enough said.
  - danieldk 11y ago
    It's obvious: you sell them the tools that enhance their privacy with solid reviews and advertisements in right places. If people don't buy, they either didn't care enough about privacy or were poor. I think this differs highly per region. In some European countries, people are very privacy-aware. I know quite a number of people who refuse to use Google's services or Dropbox, because of privacy reasons. As for security companies selling hardened phones, etc. They are typically very expensive and/or inconvenient.
    - nickpsecurity 11y ago
      Re privacy-aware Guess I need to try to market stuff in Europe instead. ;) Re expensive or inconvenient They're often perceived as expensive. Truth is most COTS is too cheap: corners cut everywhere to get it at that price point which gives unrealistic expectations on price. So, key firewall or server is five digits instead of three to four. Don't need many of them but good luck selling even one. Always will be an uphill battle. Far as convenience, that can be improved on and some apps are very convenient. The users' cut-off point is the real issue. Do they want one thoughtless step for everything? Can't do secure comms that was as verification requires extra step somewhere. Same with trust or key mgmt in other things. Im with us eliminating unnecessary complexity & technical stuff but users need to meet us halfway on convenience angle.

bobajeff 11y ago

I'm pretty sure people do still care about privacy. It just might not be readily obvious how to profit from such people.

caskance 11y ago
And some people are "pretty sure" the hyper advanced alien Xenu used hydrogen bombs to detonate all volcanoes on earth simultaneously and capture everyone's thetans. Unless you have any evidence, you're just going to have to resign yourself to the idea that most people won't believe you.
nickpsecurity 11y ago
It's obvious: you sell them the tools that enhance their privacy with solid reviews and advertisements in right places. If people don't buy, they either didn't care enough about privacy or were poor. There's security companies selling hardened phone OS's, browsers, desktops... you name it. Most individuals or businesses, even with the money, just don't buy them or even research them much.
- bobajeff 11y ago
  I bet they just don't deliver on their promise or do so at the expense of some fundamental use case. Security and privacy are very hard issues to address. So any solution will be temporary, very restrictive or fall short of it's promise. For instance you can't have total privacy even if you never use Google and use tracker blockers, erase your browser's fingerprint etc. you are still sharing information with servers you're visiting.
  - nickpsecurity 11y ago
    Many server appliances or hardened distros did exactly what their counterparts could but with much less risk. Either went nowhere or made small amounts of money. Meanwhile, insecure garbage and spyware prevails at multi-billion dollar amounts. I think people have made their preferences clear in practice even if in theory they want it more private.
- zobzu 11y ago
  all of these take terrible trade offs. people want a good product AND privacy AND security. Not fucking OR. OR will NEVER win. A secure and/or private thing that you can't use simply CANNOT win vs something that actually works. If it doesn't work well being secure or anything missing the point why people even get the tool. Sadly many companies totally miss that and think they'll get lucky. That's sort of sad.
  - nickpsecurity 11y ago
    "people want a good product AND privacy AND security. Not fucking OR." That's true. The problem is: what is a good product? Good is relative to what the insecure garbage on the market is offering. You can move fast, drastically add complexity, keep it extra cheap, and so on if quality or security aren't on the table. So, a good product that meets one's needs can look like a bad one if it's secure and makes right tradeoffs vs the "good product" that sells its users out. One simple example is how several companies did high assurance VPN's whose trusted computing base was very difficult to hack. Yet, to get there, they had to eliminate most features competition was adding to their all-in-one appliances. I pointed out one could just chain them together with the high assurance solution being the interface to untrusted network. Rest of functionality can be in next device. Even such a simple scenario was almost always rejected as it was cheaper or simpler to have one do-it-all(-like-crap) device. Apply such logic throughout entire industry and we have whole, insecure stacks that can't be made better without sacrifice. Nonetheless, companies keep trying with medium-assurance, full-featured appliances that are easy to configure. They sell very few and most go out of business. Enough said.
- danieldk 11y ago
  It's obvious: you sell them the tools that enhance their privacy with solid reviews and advertisements in right places. If people don't buy, they either didn't care enough about privacy or were poor. I think this differs highly per region. In some European countries, people are very privacy-aware. I know quite a number of people who refuse to use Google's services or Dropbox, because of privacy reasons. As for security companies selling hardened phones, etc. They are typically very expensive and/or inconvenient.
  - nickpsecurity 11y ago
    Re privacy-aware Guess I need to try to market stuff in Europe instead. ;) Re expensive or inconvenient They're often perceived as expensive. Truth is most COTS is too cheap: corners cut everywhere to get it at that price point which gives unrealistic expectations on price. So, key firewall or server is five digits instead of three to four. Don't need many of them but good luck selling even one. Always will be an uphill battle. Far as convenience, that can be improved on and some apps are very convenient. The users' cut-off point is the real issue. Do they want one thoughtless step for everything? Can't do secure comms that was as verification requires extra step somewhere. Same with trust or key mgmt in other things. Im with us eliminating unnecessary complexity & technical stuff but users need to meet us halfway on convenience angle.