5 ms·

I'm in the camp that this anger at Facebook is largely misdirected, even though I'm very privacy-oriented. It's very interesting seeing nontechnical reactions t

by bo1024 8y ago

I'm in the camp that this anger at Facebook is largely misdirected, even though I'm very privacy-oriented. It's very interesting seeing nontechnical reactions to this news. As technical users, we all know that every layer of software down to the hardware potentially has access to the data flowing on top of it. If you're running X browser on Y operating system on Z device and you log in to Facebook, you've just trusted X, Y, and Z with your FB username, password, and data. (An API works the same.) But nontechnical users are just now realizing this as privacy and data security become hot. They're lashing out at Facebook, but I think the scrutiny absolutely should be leveled at the software and hardware vendors. People should be asking phone companies: why can I trust your phone enough to type my facebook username/password into it? An ideal outcome would be a huge push toward open source (and also toward free software), but that's probably too optimistic.

TeMPOraL 8y ago
> An ideal outcome would be a huge push toward open source (and also toward free software), but that's probably too optimistic. Realistic outcome will be, unfortunately, companies playing all kinds of tricks to manage the perceived safety of their brand, combined with further locking down hardware and software stacks to reduce the attack surface.
forapurpose 8y ago
This argument is repeated so often today that it seems like the latest FB talking point. It's whataboutism yet again - who cares if someone else is doing wrong? 'There are other rapists too' is not an accepted plea in court. The argument also is disingenuous for several other reasons: First, [EDIT: this point has many flaws and is too complex to state succinctly, so I'm pulling it] Much more importantly: The problem isn't who I need to trust, it's that Facebook is deliberately capturing and distributing large quantities of user data, and in addition they are giving it to some exceptionally unsavory people that are doing great harm to the world, including damaging the foundations of democracy and civil society. Finally, it's disingenuous because few other companies have the power and data of Facebook. Why does Facebook get more attention than other violators? Is that a serious question? EDIT: And finally finally, the argument overlooks the fact that security is defense in depth. Just because some other component isn't secure doesn't mean you shouldn't secure this one.
- ForHackernews 8y ago
  > First, if my application encrypts something, such as if my browser encrypts traffic, then the layers beneath it cannot access the data (without intentionally hacking the application). If your browser is running on an operating system when it applies the encryption, then yes, you are indeed trusting that OS.
  - inlined 8y ago
    This. Many security systems protect you laterally and from layers above you. Layers below can still be vulnerable (e.g. non-standard openSSL library in the exception case, keyloggers in kernel space, etc)
    - greenleafjacob 8y ago
      https://en.wikipedia.org/wiki/Protection_ring https://en.wikipedia.org/wiki/Protection_ring
- TheForumTroll 8y ago
  Who do you refer to with this? >and in addition they are giving it to some exceptionally unsavory people that are doing great harm to the world, including damaging the foundations of democracy and civil society. The US government? NSA? Big Business? China? All of them?
- syrrim 8y ago
  >security is defense in depth You misunderstand what this means. This refers to the need to have multiple layers of security, such that if one fails, the others will continue to protect you. If you have two doors to your house, there is little point in putting more locks on the front door when everyone knows you leave your back door unlocked.
  - forapurpose 8y ago
    > If you have two doors to your house, there is little point in putting more locks on the front door when everyone knows you leave your back door unlocked. I'm familiar with this reasoning and formerly used it myself, but now I see it differently. You need to secure both doors; if you're the front door designer, 'the back door isn't secure either' is a poor excuse for not doing your job and it's counterproductive in securing the house.
dorgo 8y ago
>An ideal outcome would be a huge push toward open source (and also toward free software) how much does open source improve security? (And does it at all?) In my experience nobody reads the source code before executing it. Maybe the situation is different for big project with many users. On the other hand for example smart contracts (which are open source) had security issues several times in the past which were discovered too late.
- matheusmoreira 8y ago
  I read the source code of programs I use often, mostly for learning purposes. The first thing I do when I want to evaluate the security of a program I don't trust is look at the system calls it performs, especially those related to I/O. Since I don't need to reverse engineer binaries, open source code allows me to spot malicious code much faster. More importantly, it allows me to more easily remove that code from the program. The rate of vulnerabilities caused by honest mistakes is probably the same.
  - jf22 8y ago
    Yeah, everybody is going to start reading the entire source code of the apps they use.
    - Djvacto 8y ago
      There's still a benefit even if only a small amount of people read it, because they can call it out. You don't go to the production areas of packaged food you buy to make sure you know they're not making any mistakes/pumping sawdust into the food, but you trust that because everyone else is buying it and no one is getting sick that there's a fair chance you won't either.
      - dTal 8y ago
        You broke your analogy a bit there. You don't go to the production areas of packaged food companies because you assume that others are doing so - specifically, state regulators. It's not that no one is obviously getting sick - they might be getting sick in subtle ways they can't pin on the food, like long term heavy metal poisoning, in the same way that malicious software can be very quiet about it.
forgottenpass 8y ago
>As technical users, we all know that every layer of software down to the hardware potentially has access to the data flowing on top of it. Yeah, but that's a double sided sword. We're the only ones that have had to internalize the idea that incidental access to data will trying to monetize it as much as possible. In the real world, there are huge expectation that incidental access to something _isn't_ license to do whatever you want with it. The standards of behavior everyone adheres to are almost always narrower than what the law allows. Regular people don't expect others to suddenly become the must ruthless motherfuckers possible just "because computers."
zaroth 8y ago
Non-technical users read the hitjob published by the NYT yesterday and just assume Facebook lies and continue on their lives with absolutely zero understanding of the OSI model.

by bo1024 8y ago

TeMPOraL 8y ago

> An ideal outcome would be a huge push toward open source (and also toward free software), but that's probably too optimistic. Realistic outcome will be, unfortunately, companies playing all kinds of tricks to manage the perceived safety of their brand, combined with further locking down hardware and software stacks to reduce the attack surface.

forapurpose 8y ago

This argument is repeated so often today that it seems like the latest FB talking point. It's whataboutism yet again - who cares if someone else is doing wrong? 'There are other rapists too' is not an accepted plea in court. The argument also is disingenuous for several other reasons: First, [EDIT: this point has many flaws and is too complex to state succinctly, so I'm pulling it] Much more importantly: The problem isn't who I need to trust, it's that Facebook is deliberately capturing and distributing large quantities of user data, and in addition they are giving it to some exceptionally unsavory people that are doing great harm to the world, including damaging the foundations of democracy and civil society. Finally, it's disingenuous because few other companies have the power and data of Facebook. Why does Facebook get more attention than other violators? Is that a serious question? EDIT: And finally finally, the argument overlooks the fact that security is defense in depth. Just because some other component isn't secure doesn't mean you shouldn't secure this one.

ForHackernews 8y ago
> First, if my application encrypts something, such as if my browser encrypts traffic, then the layers beneath it cannot access the data (without intentionally hacking the application). If your browser is running on an operating system when it applies the encryption, then yes, you are indeed trusting that OS.
- inlined 8y ago
  This. Many security systems protect you laterally and from layers above you. Layers below can still be vulnerable (e.g. non-standard openSSL library in the exception case, keyloggers in kernel space, etc)
  - greenleafjacob 8y ago
    https://en.wikipedia.org/wiki/Protection_ring https://en.wikipedia.org/wiki/Protection_ring
TheForumTroll 8y ago
Who do you refer to with this? >and in addition they are giving it to some exceptionally unsavory people that are doing great harm to the world, including damaging the foundations of democracy and civil society. The US government? NSA? Big Business? China? All of them?
syrrim 8y ago
>security is defense in depth You misunderstand what this means. This refers to the need to have multiple layers of security, such that if one fails, the others will continue to protect you. If you have two doors to your house, there is little point in putting more locks on the front door when everyone knows you leave your back door unlocked.
- forapurpose 8y ago
  > If you have two doors to your house, there is little point in putting more locks on the front door when everyone knows you leave your back door unlocked. I'm familiar with this reasoning and formerly used it myself, but now I see it differently. You need to secure both doors; if you're the front door designer, 'the back door isn't secure either' is a poor excuse for not doing your job and it's counterproductive in securing the house.

dorgo 8y ago

>An ideal outcome would be a huge push toward open source (and also toward free software) how much does open source improve security? (And does it at all?) In my experience nobody reads the source code before executing it. Maybe the situation is different for big project with many users. On the other hand for example smart contracts (which are open source) had security issues several times in the past which were discovered too late.

matheusmoreira 8y ago
I read the source code of programs I use often, mostly for learning purposes. The first thing I do when I want to evaluate the security of a program I don't trust is look at the system calls it performs, especially those related to I/O. Since I don't need to reverse engineer binaries, open source code allows me to spot malicious code much faster. More importantly, it allows me to more easily remove that code from the program. The rate of vulnerabilities caused by honest mistakes is probably the same.
- jf22 8y ago
  Yeah, everybody is going to start reading the entire source code of the apps they use.
  - Djvacto 8y ago
    There's still a benefit even if only a small amount of people read it, because they can call it out. You don't go to the production areas of packaged food you buy to make sure you know they're not making any mistakes/pumping sawdust into the food, but you trust that because everyone else is buying it and no one is getting sick that there's a fair chance you won't either.
    - dTal 8y ago
      You broke your analogy a bit there. You don't go to the production areas of packaged food companies because you assume that others are doing so - specifically, state regulators. It's not that no one is obviously getting sick - they might be getting sick in subtle ways they can't pin on the food, like long term heavy metal poisoning, in the same way that malicious software can be very quiet about it.

forgottenpass 8y ago

>As technical users, we all know that every layer of software down to the hardware potentially has access to the data flowing on top of it. Yeah, but that's a double sided sword. We're the only ones that have had to internalize the idea that incidental access to data will trying to monetize it as much as possible. In the real world, there are huge expectation that incidental access to something _isn't_ license to do whatever you want with it. The standards of behavior everyone adheres to are almost always narrower than what the law allows. Regular people don't expect others to suddenly become the must ruthless motherfuckers possible just "because computers."

zaroth 8y ago

Non-technical users read the hitjob published by the NYT yesterday and just assume Facebook lies and continue on their lives with absolutely zero understanding of the OSI model.