6 ms·

This feels a bit like blaming unsafe working conditions and 12-hour work days at the beginning of the industrial revolution on workers, because they signed the

This feels a bit like blaming unsafe working conditions and 12-hour work days at the beginning of the industrial revolution on workers, because they signed the contracts (this was the prevailing narrative from factory owners at the time too). At some point, society came to the conclusion that the workers and factory owners were not on equal footing, and so rules were instated, despite strong protests from the factory owners that contract law was sacrosanct and workers should be free to agree to anything. Perhaps it's time for regulation to solve this dilemma?

cmdrfred 10y ago
Also remember that the factory owners at the time screamed that they could not afford any changes and it would bankrupt them and destroy the economy.
- lostlogin 10y ago
  I dont defend the creepy advertisers but banning their crap would bankrupt and destroy them.
  - nickpsecurity 10y ago
    And imagine the online world loosing both Google and Mozilla. Or development of Firefox, Chrome, and Android slowing to a crawl as they went paid or donation-only. Big companies would win in browser and mobile market by default.
    - dredmorbius 10y ago
      Red Herring. Fixing the funding model is an independent problem. I'm not saying that advertising and software development aren't prresently linked through funding. But the process is _fundamentally_ unbundled, through the vehicle of Free Software development and licensing. The costs for advertising are approximately $500 per year per capita in the developed world (~1 billion persons), plus all the associated privacy, surveillance, security, and chilling-effects risks. A shift of that basis from advertising to a syndicated content-and-development support tax would cut the cord between both advertising and content, and advertising and software development. Treating both writing of content (fiction, nonfiction, journalism, research) and software development as public goods could achieve some very strong social benefits (or at least present a different set of problems for us to jaw over on HN, though the concept of a technology startup incubator might also see some ground shifts). Bust out of that box a bit, Nick. Detachable headphones and mics.
      - nickpsecurity 10y ago
        "Fixing the funding model is an independent problem." Oh no, it's a very, intertwined problem. One is only likely to succeed in business using models that are shown to work. A browser, secure platform, and so on is usually tens to hundreds of millions in labor. The only companies that have pulled that off either used premium, licensed software (eg Microsoft) or advertising (the rest). There's scores of attempts at alternative, business models to break into all these ad-dominated markets. Almost none of them work. So, this is important. "through the vehicle of Free Software development and licensing." It's possible but few have been built that way. There's a bunch of small players trying in the secure collaboration space. Making almost no money. Used iMessage, Facebook Messenger, WhatApp, and SMS instead. The ones making it, almost none in privacy, seem to be outliers that have lasted quite a while or VC-funded ones that we shouldn't trust due to sell-out risks. "The costs for advertising are approximately $500 per year per capita in the developed world (~1 billion persons), plus all the associated privacy, surveillance, security, and chilling-effects risks." Better to look at what it costs to develop top-notch products vs what they make on advertising, proprietary licensing, and FOSS licensing/support. What they make and if it justifies continuing the offering matter more than the $500/yr they probably haven't heard of. It's new to me, too. "Treating both writing of content (fiction, nonfiction, journalism, research) and software development as public goods could achieve some very strong social benefits (or at least present a different set of problems for us to jaw over on HN, though the concept of a technology startup incubator might also see some ground shifts)." I agree. It's just that 90-99% of buyers don't consistently for a decade or so. "Detachable headphones and mics." Mine and some others' designs call for simple switches that cut power or connection to mic, camera, and so on. That's doable if people want it. I'm also for jumper- and/or crypto-enabled updates of firmware that are tamper-evidence. Also doable. "Bust out of that box a bit, Nick." The model I've been considering is to get proprietary vendors to each contribute a bit of their revenue to the development of OSS dependencies. These might even be new proprietary vendors that are starting for the purpose of pushing better, paid software plus new models. The idea is that each of them contribute to say a mobile OS, a SSL library, a Linux/BSD, disk encryption, secure backup, and so on. As they improve and succeed, so do the critical components they are sponsoring. They can include it in the marketing material for customers along with examples like Heartbleed that came from supporting competition that didn't invest in critical infrastructure. So, there's immediate benefit, long-term maintenance, and public good all in one package. Selling the participants is the hard part here. Note: I also thought getting CompSci people developing bug hunting or code generation tools to use them on these projects with their grant money would be nice, too. Note 2: We haven't even gotten to the risk of patent suits on these companies whose business models have nowhere near as much money for lawyers or buying patents as those suing. That makes situation more dire at least in U.S..
nickpsecurity 10y ago
"This feels a bit like blaming unsafe working conditions and 12-hour work days at the beginning of the industrial revolution on workers, because they signed the contracts (this was the prevailing narrative from factory owners at the time too)." That would make more sense if various companies didn't sink $1+ billion into more robust systems and software over the decades that most users & developers intentionally avoided in favor of what was faster, cheaper, supported buzzword/feature X, and/or was known unreliable/insecure. They make the same tradeoffs today. Look at use & tradeoffs of Facebook Messenger vs WhatApp vs Signal vs Threema [1]. Even when cheap/free and easy, vast majority will not make slightest effort for increased security and privacy. [1] Not endorsing Threema so much as to say it was quite marketable & good example of what should get more adoption if users aren't to blame. Itanium got posted here recently, too. It had enhanced reliability, stack protection, read/write/execute per page, and memory key isolation if one wanted it. Most server software that was mission critical continued to run on Xeon x86 instead of leveraging improvements in Itanium even when portable source was available for mere re-compile to Itanium. Why? Xeon was cheaper and took no extra effort. Rinse, repeat for all kinds of software and tooling. There's often supply but little demand that pays. Which sucks extra here given high reliability or security costs more not less for producers. There has to be sustained demand that will pay at least 30-50% premium to develop each component or app. Since there's not, the companies are entirely justified in producing unreliable, insecure or surveillance-oriented garbage for people that exclusively use or buy such things. And the buyers are to blame wherever there were clear alternatives that were inexpensive given their choices collectively decide the issue. "Perhaps it's time for regulation to solve this dilemma?" I supported that on Schneier's blog with specific points showing where market consistently fails (even for itself) and how regulation would help: https://www.schneier.com/blog/archives/2011/09/an_interesting.html#c595111 https://www.schneier.com/blog/archives/2011/09/an_interestin... Despite low demand, I also actually write a counterpoint justifying continued focus on niche that cares about quality/security with recommendations for "low-cost but high-value" practices to deliver that profitably as a differentiator. What's in this post is an example of how my software liability argument in other one might play out. Regulations would enforce stuff known to knock out problems consistently to form a better baseline without driving up cost or having vague stuff prone to frivilous lawsuits. https://www.schneier.com/blog/archives/2013/03/is_software_sec.html#c1208941 https://www.schneier.com/blog/archives/2013/03/is_software_s...
Torgo 10y ago
People LOVE their phones and the functionality it provides, this is not analogous to being forced into shitty miserable manufacturing jobs to buy food for your kids. You can buy a dumbphone with a contact list that makes calls, but people don't.
- deleted 10y ago
  [deleted]
- nickpsecurity 10y ago
  That's actually a good example. Many honest people and criminals alike who value privacy are buying feature phones with no background apps, GPS turned off, and sometimes battery out. Been going on a long time. Great improvement in privacy or odds someone (outside nation-state) is going to remotely snatch your secrets. There's also regular press releases showing smartphones have lots of hackers targeting them. Yet, people buy iPhones and Androids instead. They wanted those features over privacy or security. Next step was people posting hardening guides plus making private apps for these. Most people still didn't use them. Next step, given that and low sales of "crypto phones," was to make new crypto phones & mobile solutions that pre-hardened Android, pre-supplied key apps we needed, and provided things like remote wipe. Most people and businesses don't buy those even if the price gets down to a normal smartphone. I mean, what else is even left to do to appeal to majority who won't buy a fully-featured, privacy-enabled, Android phone for Android prices? At this point, I feel comfortable saying the buyers are the problem or (said differently) they have a clear preference against any private phone companies produce. They're for existing UX, tons of apps, more tracking for app's features, cloud backups providers can read, faster, prettier, and so on. Everything that enables hackers. So, I suggest companies just say "Screw it! I'm just going to do a marginal improvement on whatever customers want while making excuses when problems happen." Since telling them it's their own choice doing it or offering them a secure phone will both lead to financial losses.
  - pdimitar 10y ago
    This is a very good reply. My hat off to you. That being said, could you give us a good example for these privacy-enabled phones and apps? I am willing to make a collection out of these and write a guide on hardening Android. And I am not just talking apps that are incredibly hard to use; I mean the better generation of them who are actually mass-audience-friendly. Of course we must not forget that Android phones could have a backdoor at the kernel or even at the hardware level. But I still think we should do the best that we can. As many security researches say, you aren't absolutely breach-proof, but if you work hard enough you're not a target that's worth the effort, especially having in mind you're not a legitimate threat to any government. I view this sort of like the people who got away from the Matrix in the movies; as the Architect and the Oracle implied, as long as these people aren't an escalating threat for the entire system, they're allowed to live however they choose. What's your opinion on the Turing Phone and Sailfish OS in general, by the way? Do you think that it gives us a fair progress in the direction of the more snoop-proof end-user tech?

cmdrfred 10y ago

Also remember that the factory owners at the time screamed that they could not afford any changes and it would bankrupt them and destroy the economy.

lostlogin 10y ago
I dont defend the creepy advertisers but banning their crap would bankrupt and destroy them.
- nickpsecurity 10y ago
  And imagine the online world loosing both Google and Mozilla. Or development of Firefox, Chrome, and Android slowing to a crawl as they went paid or donation-only. Big companies would win in browser and mobile market by default.
  - dredmorbius 10y ago
    Red Herring. Fixing the funding model is an independent problem. I'm not saying that advertising and software development aren't prresently linked through funding. But the process is _fundamentally_ unbundled, through the vehicle of Free Software development and licensing. The costs for advertising are approximately $500 per year per capita in the developed world (~1 billion persons), plus all the associated privacy, surveillance, security, and chilling-effects risks. A shift of that basis from advertising to a syndicated content-and-development support tax would cut the cord between both advertising and content, and advertising and software development. Treating both writing of content (fiction, nonfiction, journalism, research) and software development as public goods could achieve some very strong social benefits (or at least present a different set of problems for us to jaw over on HN, though the concept of a technology startup incubator might also see some ground shifts). Bust out of that box a bit, Nick. Detachable headphones and mics.
    - nickpsecurity 10y ago
      "Fixing the funding model is an independent problem." Oh no, it's a very, intertwined problem. One is only likely to succeed in business using models that are shown to work. A browser, secure platform, and so on is usually tens to hundreds of millions in labor. The only companies that have pulled that off either used premium, licensed software (eg Microsoft) or advertising (the rest). There's scores of attempts at alternative, business models to break into all these ad-dominated markets. Almost none of them work. So, this is important. "through the vehicle of Free Software development and licensing." It's possible but few have been built that way. There's a bunch of small players trying in the secure collaboration space. Making almost no money. Used iMessage, Facebook Messenger, WhatApp, and SMS instead. The ones making it, almost none in privacy, seem to be outliers that have lasted quite a while or VC-funded ones that we shouldn't trust due to sell-out risks. "The costs for advertising are approximately $500 per year per capita in the developed world (~1 billion persons), plus all the associated privacy, surveillance, security, and chilling-effects risks." Better to look at what it costs to develop top-notch products vs what they make on advertising, proprietary licensing, and FOSS licensing/support. What they make and if it justifies continuing the offering matter more than the $500/yr they probably haven't heard of. It's new to me, too. "Treating both writing of content (fiction, nonfiction, journalism, research) and software development as public goods could achieve some very strong social benefits (or at least present a different set of problems for us to jaw over on HN, though the concept of a technology startup incubator might also see some ground shifts)." I agree. It's just that 90-99% of buyers don't consistently for a decade or so. "Detachable headphones and mics." Mine and some others' designs call for simple switches that cut power or connection to mic, camera, and so on. That's doable if people want it. I'm also for jumper- and/or crypto-enabled updates of firmware that are tamper-evidence. Also doable. "Bust out of that box a bit, Nick." The model I've been considering is to get proprietary vendors to each contribute a bit of their revenue to the development of OSS dependencies. These might even be new proprietary vendors that are starting for the purpose of pushing better, paid software plus new models. The idea is that each of them contribute to say a mobile OS, a SSL library, a Linux/BSD, disk encryption, secure backup, and so on. As they improve and succeed, so do the critical components they are sponsoring. They can include it in the marketing material for customers along with examples like Heartbleed that came from supporting competition that didn't invest in critical infrastructure. So, there's immediate benefit, long-term maintenance, and public good all in one package. Selling the participants is the hard part here. Note: I also thought getting CompSci people developing bug hunting or code generation tools to use them on these projects with their grant money would be nice, too. Note 2: We haven't even gotten to the risk of patent suits on these companies whose business models have nowhere near as much money for lawyers or buying patents as those suing. That makes situation more dire at least in U.S..

nickpsecurity 10y ago

"This feels a bit like blaming unsafe working conditions and 12-hour work days at the beginning of the industrial revolution on workers, because they signed the contracts (this was the prevailing narrative from factory owners at the time too)." That would make more sense if various companies didn't sink $1+ billion into more robust systems and software over the decades that most users & developers intentionally avoided in favor of what was faster, cheaper, supported buzzword/feature X, and/or was known unreliable/insecure. They make the same tradeoffs today. Look at use & tradeoffs of Facebook Messenger vs WhatApp vs Signal vs Threema [1]. Even when cheap/free and easy, vast majority will not make slightest effort for increased security and privacy. [1] Not endorsing Threema so much as to say it was quite marketable & good example of what should get more adoption if users aren't to blame. Itanium got posted here recently, too. It had enhanced reliability, stack protection, read/write/execute per page, and memory key isolation if one wanted it. Most server software that was mission critical continued to run on Xeon x86 instead of leveraging improvements in Itanium even when portable source was available for mere re-compile to Itanium. Why? Xeon was cheaper and took no extra effort. Rinse, repeat for all kinds of software and tooling. There's often supply but little demand that pays. Which sucks extra here given high reliability or security costs more not less for producers. There has to be sustained demand that will pay at least 30-50% premium to develop each component or app. Since there's not, the companies are entirely justified in producing unreliable, insecure or surveillance-oriented garbage for people that exclusively use or buy such things. And the buyers are to blame wherever there were clear alternatives that were inexpensive given their choices collectively decide the issue. "Perhaps it's time for regulation to solve this dilemma?" I supported that on Schneier's blog with specific points showing where market consistently fails (even for itself) and how regulation would help: https://www.schneier.com/blog/archives/2011/09/an_interesting.html#c595111 https://www.schneier.com/blog/archives/2011/09/an_interestin... Despite low demand, I also actually write a counterpoint justifying continued focus on niche that cares about quality/security with recommendations for "low-cost but high-value" practices to deliver that profitably as a differentiator. What's in this post is an example of how my software liability argument in other one might play out. Regulations would enforce stuff known to knock out problems consistently to form a better baseline without driving up cost or having vague stuff prone to frivilous lawsuits. https://www.schneier.com/blog/archives/2013/03/is_software_sec.html#c1208941 https://www.schneier.com/blog/archives/2013/03/is_software_s...

Torgo 10y ago

People LOVE their phones and the functionality it provides, this is not analogous to being forced into shitty miserable manufacturing jobs to buy food for your kids. You can buy a dumbphone with a contact list that makes calls, but people don't.

deleted 10y ago
[deleted]
nickpsecurity 10y ago
That's actually a good example. Many honest people and criminals alike who value privacy are buying feature phones with no background apps, GPS turned off, and sometimes battery out. Been going on a long time. Great improvement in privacy or odds someone (outside nation-state) is going to remotely snatch your secrets. There's also regular press releases showing smartphones have lots of hackers targeting them. Yet, people buy iPhones and Androids instead. They wanted those features over privacy or security. Next step was people posting hardening guides plus making private apps for these. Most people still didn't use them. Next step, given that and low sales of "crypto phones," was to make new crypto phones & mobile solutions that pre-hardened Android, pre-supplied key apps we needed, and provided things like remote wipe. Most people and businesses don't buy those even if the price gets down to a normal smartphone. I mean, what else is even left to do to appeal to majority who won't buy a fully-featured, privacy-enabled, Android phone for Android prices? At this point, I feel comfortable saying the buyers are the problem or (said differently) they have a clear preference against any private phone companies produce. They're for existing UX, tons of apps, more tracking for app's features, cloud backups providers can read, faster, prettier, and so on. Everything that enables hackers. So, I suggest companies just say "Screw it! I'm just going to do a marginal improvement on whatever customers want while making excuses when problems happen." Since telling them it's their own choice doing it or offering them a secure phone will both lead to financial losses.
- pdimitar 10y ago
  This is a very good reply. My hat off to you. That being said, could you give us a good example for these privacy-enabled phones and apps? I am willing to make a collection out of these and write a guide on hardening Android. And I am not just talking apps that are incredibly hard to use; I mean the better generation of them who are actually mass-audience-friendly. Of course we must not forget that Android phones could have a backdoor at the kernel or even at the hardware level. But I still think we should do the best that we can. As many security researches say, you aren't absolutely breach-proof, but if you work hard enough you're not a target that's worth the effort, especially having in mind you're not a legitimate threat to any government. I view this sort of like the people who got away from the Matrix in the movies; as the Architect and the Oracle implied, as long as these people aren't an escalating threat for the entire system, they're allowed to live however they choose. What's your opinion on the Turing Phone and Sailfish OS in general, by the way? Do you think that it gives us a fair progress in the direction of the more snoop-proof end-user tech?