4 ms·

> So in short: this bill is a backdoor way to allow the government to ban encryption on commercial services. I'm all for this. Suddenly people in tech would h

• danShumway 7y ago
  We want decentralized systems so that people will be more free. Giving up freedom in order to get them is completely counterproductive. Decentralized systems aren't nothing; they're more resilient against these types of attacks than the alternatives. However, decentralized systems don't welcome these attacks any more than anybody else does. These attacks still hurt us, and they still make our life harder -- China isn't more free because its centralized services are all back-doored. There's a (thankfully fringe) group of people who keep saying that if Section 230 goes away everyone will just switch to more Open protocols and it'll be fine. But this is painfully naive; a pseudo-requirement to backdoor communications will make it harder to build Open platforms and onboard users, because no commercial host will want to touch a platform that exposes them to liability. Getting rid of Internet freedom turns the people using these systems into criminals, which will make Open platforms much more dangerous to use, much more risky to sponsor, and much harder to advertise or develop. What happens when you go to host your private encrypted email on Linode, and Linode says, "no, because then we can't scan your server for CSAM"? What happens when the Matrix org tries to set up a free server to onboard new users and the government prosecutes them? What happens when every user running a Tor exit node becomes liable for content traced back to that IP? What on earth makes you think the DOJ won't prosecute hosts of Open services? There are so many ways this law can go wrong, and so many ways it can be expanded from here to shut down the projects you think it's helping.
  • clarry 7y ago
    > There are so many ways this law can go wrong, and so many ways it can be expanded from here to shut down the projects you think it's helping. It'd have to be expanded by a ridiculous amount. To the point where it's practically speaking illegal for anyone to run non-approved software on their computers, if it can send messages over the internet. I'm not saying they wouldn't try that, but in practice it's completely unrealistic. Which means, at best, it'll be a law that criminalizes everyone and nobody really cares. Hilariously, the same tech behemoths that people give up their freedom to are doing everything they can to push us into the same exact situation, with their walled gardens and power asymmetry that allows them to squeeze out competition. > But this is painfully naive; a pseudo-requirement to backdoor communications will make it harder to build Open platforms and onboard users, because no commercial host will want to touch a platform that exposes them to liability. If you play your cards right, these "platforms" are more like internet routers and load balancers that facilitate message exchange between computers. You build your platform on top of this technology. Banning the technology would be akin to banning TCP/IP+TLS or UDP+DTLS. I don't see hosting providers having a case for banning encrypted transport protocols. And the law in question doesn't go that far; again, for it to go there we'd need a law that virtually bans all encrypted message exchange on the internet. > What happens when the Matrix org tries to set up a free server to onboard new users and the government prosecutes them? Once decentralization becomes a thing techies care about because they need it, I'm sure we can spread software by word of mouth just like we did back in the early days of Kazaa, DC++, Torrents, etcetra. In fact that's pretty much how software gets adopted today. You only need faddy & flashy onboarding when you're trying to growth hack a product that has no intrinsic demand for it. We'd be way past that point. > What happens when every user running a Tor exit node becomes liable for content traced back to that IP? That's already something you should worry about if you're about to run a Tor exit node. I don't recommend it. Exit nodes are just bowing down to the centralized clearnet. A proper decentralized network is one where the exchange stays within, and doesn't rely on a single point source as a hosting node that can be taken down. If a message is in the network, it can be anywhere, and it can and will replicate itself if requested. > What on earth makes you think the DOJ won't prosecute hosts of Open services? The easy way out for them is that everyone uses the same handful of services provided by a handful of tech behemoths. Then they only need to prosecute those, if they don't play along. That's largely where we've been headed, and I think it really sucks, because I lose my freedom and privacy both to these tech companies as well as their government. If individual people started participating in a network and hosting their own nodes, the situation becomes much harder. If they seriously tried to prosecute everyone, it'd end up being much like the neverending war on drugs (or piracy or similar). Except that in this case, you wouldn't be up against just potheads and kids downloading movies, you'd also be up against professionals (and not only in tech) keeping their comms confidential. But everyone, individually, is a small fry, so fighting a legal battle against everyone is very nonproductive, unlike slapping one megacorp with millions in fines they can actually pay. The status quo is terrifying, and it is not getting better because even technical users are too lazy to care if they don't have to. If I move to decentralized services that try to provide freedom and anonymity, I'm just isolating myself from everything else and simultaneously painting a target on my back. That's because these things do not have enough mindshare, and they will never have enough mindshare when techies just encourage everyone to keep using google & fb & co.
    • danShumway 7y ago
      > It'd have to be expanded by a ridiculous amount. > If you play your cards right, these "platforms" are more like internet routers and load balancers that facilitate message exchange between computers. I think it's important to point out that your model of how a decentralized world should work isn't the current reality or even direction that most projects in this area are going. In the Fediverse we heavily rely on homeservers/instances that coordinate with each other. Tor is the only completely blind system that springs to my mind right now, because it turns out that for a lot of stuff (Peertube, Matrix, Mastodon, Email, PixelFed, etc...) instances are a really good, scalable solution. What that means is that if you run a popular Peertube/Mastodon/Matrix instance, you're in the same legal position as YouTube/Twitter/Slack. This law will apply to you in its current form without any exansion. If a public Mastodon server has E2E encrypted messages, they're in the exact same situation as Twitter. If a PeerTube instance isn't doing whatever scanning the DOJ decides is the standard, then they're in the same situation as Youtube. The only hope you have is that these instances will be small enough that the DOJ won't care. But of course the DOJ will care. This law is an effort to block encryption. The only reason the DOJ doesn't currently care about these systems is because nobody uses them. If everyone migrated to Matrix today, the DOJ would absolutely start prosecuting individual servers just to make an example of them. Because the entire point is to scare people away from using encryption. The DOJ will care about wherever people go. ---- > You only need faddy & flashy onboarding when you're trying to growth hack a product that has no intrinsic demand for it. And on the subject of popular homeservers, my Matrix example wasn't theoretical. Matrix's current free homeserver is doing a ton of really valuable work in this space to onboard new users right now, because setting up servers is stinking hard. See also Mastodon, which got a huge amount of early traction because there was a way for ordinary people to quickly join. I run my own Peertube instance, I'm working on setting up Matrix servers for communities that I host. But in the meantime, I'm coordinating my family on Matrix's "official-ish" homeserver. This stuff is genuinely useful if you want to get ordinary people interested in decentralized systems -- it's not just marketing fluff. Nobody's going to install a server to try out Matrix. They're going to create an account on an existing service, sign up for an existing community, and then once they get used to the protocol they might migrate their identity/communities to a new self-hosted homeserver. ---- > It'd have to be expanded by a ridiculous amount. > Once decentralization becomes a thing techies care about because they need it All the stuff I said above is kind of a side discussion. Here's the main problem with your philosophy: If you really want to argue purely on the merits of this bill in isolation, and you want to argue that we can take away a few freedoms and it won't quickly become a slippery slope, and that the DOJ won't make the exact same arguments about hosts like Linode, fine. But in the world you describe, E2E encryption is not something that most techies will care about. It's something that privacy advocates will care about, but privacy advocates are a minority. If Facebook got rid of E2E encryption in WhatsApp, and none Facebook's competitors like Signal were able to roll it out either, people would not migrate off of Facebook onto distributed alternatives. They'd shrug their shoulders and go on with their lives. It would not trigger the mass exodus you want. So if you genuinely believe that the DOJ isn't going to go farther than this bill and they're not going to use it as a springboard to lock down encryption in general, then it's still a bad bill -- because it's not currently restrictive enough to get ordinary people (or even technical people) off of Instagram or Twitter. If you're a techy, and you can't get your friends to switch from Twitter to Mastodon right now, even when Mastodon has objectively better user-freedom guarantees, better privacy, better data export tools, better moderation tools, better APIs, a more responsive development team, and more focused communities -- do you really think Mastodon rolling out E2E encrypted DMs would be enough to make those friends switch? ---- > If they seriously tried to prosecute everyone, it'd end up being much like the neverending war on drugs (or piracy or similar). Quick side note, these are really bad examples. The war on drugs has been awful. The war on piracy has been awful. I don't think it's reasonable to look at the war on piracy and say, "this has actually helped Internet freedom when you think about it." The war on piracy has been used to clamp down on ordinary people's speech, it's killed entire businesses, it's greatly reduced adoption of torrent technology for ordinary people. Sure, torrents have still survived, for some people. Yes, people still break the law and pirate media. But the situation we're in today has not been improved by making piracy into a felony; the Digital Millennium Copyright Act isn't something that Open Source advocates like. The current laws you allude to have real, negative consequences, and they are aggressively wielded against advocates. Ordinary people have had their lives ruined as an example to the rest of us, and that has a chilling effect on the Internet as a whole. Think about people like Aaron Schwartz, effectively killed by the Computer Fraud and Abuse Act. Selectively enforced laws that can be easily brought down on specific targets are far more terrifying than anything Facebook is doing today. For whatever it's worth, I am pretty optimistic about the future of decentralization and federation; I am realistic and pragmatic about the work required, but I don't share your cynicism. I think that for people paying attention to this space, the status quo is currently getting better (slowly but surely). We don't need to slide towards totalitarianism to speed things up. Always remember that the goal isn't decentralization; it's user freedom. Decentralization is a means to an end. So again, it is counterproductive to take away user freedom in the pursuit of decentralization.