14 ms·

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't se

by nullc 6y ago

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometimes they do, sometimes they don't. Parts of the US Governments unlawful massive domestic surveillance apparatus were described in the open in IETF drafs and patent documents for years. But people largely didn't notice and regarded reports as conspiracy theories for a long time. Information being available doesn't necessarily make any difference and making a difference is what matters.

simias 6y ago
> The market can't act against what it can't see. Privacy loss is often irreversible. You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware. Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching for profiling, that's been known for a while now. The market seems fine with it. And I mean, at this point I could just gesture broadly at all of Facebook.
- oarsinsync 6y ago
  > has "the market" shown any serious signal that it cares about privacy? Depends on what you consider a serious signal of care. If 'voting with you wallet' is the measure, increasing levels of income inequality, stagnant wages, weakening employee rights through the gig-economy, etc. are effectively taking away that choice, as most market participants cannot afford to make the choice. Also, what is the paid alternative to Apple or Google photos that allows me to have the same end user experience, without giving up my privacy? "the market" doesn't even have such an offer that I can see. The closest I can find (and that's through here) is photostructure.com, and even that's lacking all the local-ML-foo that makes Apple/Google photos a compelling option over anything else. > Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching for profiling, that's been known for a while now. Known by who? I'd wager a year's salary that >50% of Samsung TV owners (and bump that number up to >75% of Samsung TV users) do not know this is happening.
  - deleted 6y ago
    [deleted]
  - zepto 6y ago
    Income inequality and stagnant wages etc are not the consequences of Apple and Google.
    - sudosysgen 6y ago
      No one suggested they are. But they still make it much less likely for the average Joe to put money and effort to protect their privacy, and this is known to those that make major pricing decisions.
      - kortilla 6y ago
        We’re talking about Apple here. People who can afford a Mac over a cheap pc/chrome book already have disposable income and are making trade-offs with it.
        sudosysgen 6y ago
        That is not really true. Many people of lower income will buy a Mac after their cheap laptops break because they perceive them, correctly or not, to be the most reliable and thus less expensive on the long term laptops. Sometimes even second hand. Also, Chromebooks are not viable alternatives for many people especially of lower income. Having to rely on being always online is an issue when you can't always guarantee having internet. Been there, done that.
        kortilla 6y ago
        > That is not really true. Many people of lower income will buy a Mac after their cheap laptops break because they perceive them, correctly or not, to be the most reliable and thus less expensive on the long term laptops. This is not true. The tiny user-base of OSX compared to Windows is already evidence that most people are not buying MacBooks.
- ethbr0 6y ago
  > From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware I'd argue that's more of what parent was talking about with regards to visibility. "Privacy" isn't something anyone can see. What you see are the effects of a lack of privacy. Given the dark market around personal data (albeit less in the EU), how are consumers to attribute effects to specific privacy breaches? If Apple sells my app history privately to a credit score bureau, and I'm denied a credit card despite having a stellar FICO, how am I supposed to connect those dots?
- tinkertamper 6y ago
  I hear this argument a lot but I think it is exactly OPs point when he says, “The market can’t act against what it can’t see”. Your average consumer doesn’t know the extent of what they’re trading. Take Facebook, even with high profile stories and documentaries it’s reasonable for your average consumer to assume that what Facebook tracks about them is what they actively give to Facebook themselves. I’ve had conversations with people that say, “I rarely even post on Facebook” and “If they want to monitor pictures of my food/dog/etc whatever who cares”, without any solid understanding of what even having the app installed alone is giving Facebook.
  - deleted 6y ago
    [deleted]
  - oblio 6y ago
    It's ok, if they will be educated they will care. Just like they care now about not using single use plastics, buying the biggest and most gas guzzling SUV or flying on holidays across the globe. They won't care even when they'll know. And they might not ever know.
    - gpanders 6y ago
      Yes exactly. I don't think an abstract understanding of the costs is enough. If the cost isn't physically or viscerally felt, it just doesn't factor into people's decision making. This is where the pricing system really comes into great effect. People buy and drive fewer SUVs when gas is more expensive. If we want people to buy fewer SUVs, increase the fuel tax. Education is not enough, and in fact might not even be necessary at all. Just introduce real costs to capture the "abstract" costs (externalities) and the problem will likely correct itself.
- andrepd 6y ago
  >that's been known for a while now Ask a representative sample and I wager only a very small percentage of people are actually aware of (1) the breaches of privacy that are happening (e.g. your TV sending mic dumps and screenshots of what you're watching), and (2) the hard consequences of those invasions (that is, beyond the immediate fact that you're being snooped upon), like higher insurance premiums on auto and health, being targeted by your opinions, etc.
  - mehrdadn 6y ago
    To be honest I would expect if you told people "your TV will report what you're watching" they will think "wait, doesn't my cable company already know what I'm watching???" If you tell them it's the manufacturer this time in addition to the cable company, I'm not sure how many would freak out over the extra entity.
    - moduspol 6y ago
      Very few. I'm not sure how you'd measure it, but there seems to be a huge disconnect between techie privacy advocates and the rest of the world. The former keeps claiming the latter just doesn't understand, or needs to be informed, but I just don't think that's realistic. I think it's pretty common knowledge that these companies are harvesting all imaginable data to serve users more / better advertisements and to keep them on the site, yet usage continues to grow despite all the scandals. I think advocates need to make more convincing claims to everyone else that they're being harmed.
      - andrepd 6y ago
        In my anecdotical experience, that's not remotely true. Yes there is a disconnect between techies and regular people, in that for us it's obvious that these companies are harvesting all this data and processing it in all this ways and sharing it with all these people, but for the majority of people it's not. Even for you, do you think you fully understand how your data is being utilised and what the consequences are?
- eternalban 6y ago
  > You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? Is there a pro-privacy Google out there whose products languished while Google's succeeded? The Silicon Valley VC network did not fund nor support companies that promoted privacy. I can not think of a single example. Not a single major venture from SV VC network even attempted to innovate the "business model". We can make machines reason now but, alas, a business model that does not depend on eradicating privacy is beyond the reach of the geniuses involved. It is "Impossible"? I think, "undesirable" is more likely. No one is even seriously trying. Point: money behind SV tech giants is not motivated at all to fund the anti-panopticon. The salient, sobering, facts are that all these companies are sitting on a SV foundation that was and remains solidly "national security", "military", and "intelligence". The euphemism used is to mention SV's "old boy network". https://steveblank.com/secret-history/ https://steveblank.com/secret-history/
- ardy42 6y ago
  > You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware. Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching for profiling, that's been known for a while now. The market seems fine with it. I'd guess that most of that's due to information asymmetry. Privacy losses aren't advertised(and often hidden) and are more difficult to understand, but price is and is understood by everyone. Take that Samsung example: it's not like they had a bullet point on the feature list saying "Our Smart TVs will let us spy one what you're watching, so we can monetize that information."
absolutelyrad 6y ago
The market only acts fairly when the product is a commodity. The time for the market to react for a product with the complexity of a mac is decades. As the ecosystem grows, the cost of switching increases. Therefore market starts acting more and more inefficiently. This is why countries have state intervention in such cases. And anti trust exists. If the option was a mac with privacy vs a mac without privacy but $10 cheaper, I'd think the market would pick the mac with privacy. No such choice within the budget exists, and if a company has a monopoly on the ecosystem, then the market cannot react when held hostage. The cost to transition to a different ecosystem is thousands of $'s when you've been using a mac your entire life. It's not like you'd want to relearn many things when you get older, perhaps the sunk cost fallacy as many would define it. It's a bundled deal, it's not like you can pick the parts you like and throw away the ones you don't like it would be in an efficient market. If even someone like me cannot be bothered to move to more privacy friendly platforms, then I don't have hope for other people. It's just not worth it. Until the majority face the consequences of their apathy, any action you take is fruitless. Let them taste the pain, then offer the solution. I know I can be tracked. So what? I can't verify the silicon in my device, can I? Gotta trust someone, maybe blockchain will solve the problem of trust among humans, in a verifiable way.
- _puk 6y ago
  Whilst I agree with the sentiment, it does occur to me just how many kindles I see with ads. Is there any data released on ads Vs no ads versions? That's the closest comparator I can think of.
  - ClumsyPilot 6y ago
    I think its worthwhile trying to test the hypothesys, but i dont think anyone takes privacy on a book reader with the same passion as they do on a mobile phone.
  - paublyrne 6y ago
    > Whilst I agree with the sentiment, it does occur to me just how many kindles I see with ads. True, although the price difference for the Kindle is about 20%. If the discount on a Macbook Air was similar, I'm sure it would be well subscribed.
internet_user 6y ago
which IETF drafts and patents? Can you point me to some links? tia
- nullc 6y ago
  Sure, lemme give you an example: https://tools.ietf.org/html/draft-cavuto-dtcp-00 https://tools.ietf.org/html/draft-cavuto-dtcp-00 This protocol was created so that monitoring infrastructure could reprogram asic-based packet filters on collection routers (optical taps feed routers with half-duplex-mode interfaces), which grab sampled netflow plus specific targets selected by downstream analysis in realtime. It has to be extremely fast so that it can race TCP handshakes. I don't think it's much of an exaggeration to say that the technical components of almost all the mass surveillance infrastructure is described in open sources. Yes, they don't put "THIS IS FOR SPYING ON ALL THE PEOPLE" on it, but they also don't even bother reliably scrubbing sigint terms like "tasking". Sometimes the functionality is described under the color of "lawful intercept", though not always. One of the arguments that people made against the existence of widescale internet surveillance -- back before it was proved to exist-- was that it would require so much technology that it would be impossible to keep secret: the conspiracy would have to be too big. But it wasn't kept secret, not really-- we just weren't paying attention to the evidence around us. For a related patent example: https://patents.google.com/patent/US8031715B1 https://patents.google.com/patent/US8031715B1 which has fairly explicit language on the applications: > The techniques are described herein by way of example to dynamic flow capture (DFC) service cards that can monitor and distribute targeted network communications to content destinations under high traffic rates, even core traffic rates of the Internet, including OC-3, OC-12, OC-48, OC-192, and higher rates. Moreover, the techniques described herein allow control sources (such as Internet service providers, customers, or law enforcement agencies) to tap new or current packet flows within an extremely small period of time after specifying flow capture information, e.g., within 50 milliseconds, even under high-volume networks. > Further, the techniques can readily be applied in large networks that may have one or more million of concurrent packet flows, and where control sources may define hundreds of thousands of filter criteria entries in order to target specific communications.
polote 6y ago
> A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it Seriously, who has ever been successful at defending that idea ?
- lucideer 6y ago
  Many lobbyists and lawmakers, unfortunately.
  - AshWolfy 6y ago
    It doesnt count as winning the argument if you paid them to agree with you
    - lucideer 6y ago
      It does if you convince people to vote for you though
amelius 6y ago
So, we should take away the market's incentive to infringe upon our privacy: by making user-tracking illegal.
blub 6y ago
The laws are already there. If you care about this and have some free time you may try to make a complain to the Irish data protection commission. I'm not sure if it's infringing though. If Apple says that they do not collect personal data and that the information is thrown away and this is done for a legitimate business purpose or for the customers (i.e. protecting customers), it may well be fine according to the GDPR.
ClumsyPilot 6y ago
Lying to the customer about what your product does, or having secret functionality, should be a criminal offence in the same way as breaking and entering or stalking are. Then, we would find out very quickly what people value. I firmly believe this ecosystem (as in privacy violating ad and data selling business model) is only dominant because companies are able to mislead with impunity, so it's basically a form of fraud
- ethbr0 6y ago
  The act of breaching privacy is technically difficult to prohibit in a way many of us would find palatable. What should be targeted is the product of said breaches. Something like the blood diamond approach. If your company has PII, then you by law must be able to produce a consented attestation chain all the way back to the source. If you do not, then you're charged a fine for every piece of unattested PII on every individual.
  - zepto 6y ago
    By the time someone is charged with a crime, the damage is already done. And, there will be many scammers who are simply out of reach of meaningful legal remedies.
    - ben509 6y ago
      That's true of virtually all criminal laws, though. If you're beat up and your assailant is charged with assault, you've already been beat up.
      - zepto 6y ago
        Yes, which is why you need both laws, and prevention methods.
  - ClumsyPilot 6y ago
    I thonk we are both arguing that clear consent must be present, and the customer must have clearly agreed to whatever you are doing with the data - that appears similar to GDPR. However, how do you prove John Doe has actually agreed to this? What if John says he did not click accept button? Do we require digital signature with certificates, given that most people don't have them or know how to use them? I think the problem is more tractable for physical products running firmware - there you have real proof of purchase, and, at present, firmware that does whatever it wants.
chrisweekly 6y ago
Great points. Related tangent: for those interested in this topic of "unlawful massive domestic surveillance", I heartily recommend Cory Doctorow's "Little Brother" novels -- esp the most recent, "Attack Surface". They get the technical details right while remaining accessible and engaging regardless of the reader's geek acumen.
jaredklewis 6y ago
Yes, unfortunately there is no safe harbor. Companies can make mistakes or add backdoors and we won't know. See this clusterfuck. Open Source, likewise, can make mistakes and (much more rarely) add backdoors, and we could know, but few have the resources to so. See heartbleed.
pibechorro 6y ago
Ya no thanks. Top down regulation will just make startups less likely to enter new disruptive tech. The solution is choice, stop using Apple products and all their shadyness stops being an issue.
- eganist 6y ago
  > Ya no thanks. Top down regulation will just make startups less likely to enter new disruptive tech. The solution is choice, stop using Apple products and all their shadyness stops being an issue. And since people have demonstrated that they're not appropriately incentivized to stop, that's where the regulations snap in, which brings us back to where we started: there's a need for it. Solution could just be to regulate based on a tightly managed definition of age. Enable younger companies to have a bit more flexibility in determining their business model as controls slowly snap in as the company ages. There are some pretty clear loopholes that immediately come to mind (e.g. re-chartering the company every few years and transferring assets) that'll need to somehow be managed, but it should be enough to give companies runway to figure out how to disrupt and monetize while coming into compliance with consumer protections.
- diffeomorphism 6y ago
  > The solution is choice Correct. Among apple, MS and google you have no choice. That is why regulation is necessary.
- oblio 6y ago
  How do you provide choice? How do you commoditize an entire hardware and software ecosystem, vertically integrated? Just like Standard Oil or AT & T were displaced, right? By customers going to their competitors? I'm being sarcastic, obviously :-)
- lawnchair_larry 6y ago
  Nothing shady about this. It isn’t logged and it protects customers from malware. That was the purpose. Most customers want that.
- AshWolfy 6y ago
  > Top down regulation will just make startups less likely to enter new disruptive tech Im ok with this
valuearb 6y ago
Probably no one cares because Apple’s OCSP checks don’t reduce your privacy.
- grupthink 6y ago
  They should care. The checks are sent unencrypted over HTTP to Apple's OCSP.
  - valuearb 6y ago
    Since they don’t identify specific apps you use, so what’s your point?
    - throwaway525142 6y ago
      As far as I understand it, most vendors ship a single digit amount of apps. If you start the Tor browser, everyone on your network will know. If you start Firefox, everyone on your network will know you started a Mozilla product, most likely Firefox. If you start the Zoom client, everyone on your network knows you started the Zoom client. I don't think the "it's only the vendor" defense of Apple is any good.
      - athms 6y ago
        On MacOS, developer certificate requests are NOT done for every application launch. Responses are cached for a period of time before a new check is done. FYI -- Both Firefox and Safari use OCSP to check server certificates. Anybody sniffing your network could figure out which websites you visit. Chrome still uses CRL; it trades precision for performance.
        pseudalopex 6y ago
        That period of time was 5 minutes.
  - athms 6y ago
nerbert 6y ago
On argument to make is that the market only cares about the majority of their customers, not all of them. If 0.5% of their customers has their privacy busted by a backdoor, or that 0.01% of google users have their account arbitrarily deleted, this percentage of users is screwed like no one and the company doesn't suffer any damage.
ardy42 6y ago
> A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometimes they do, sometimes they don't. And there are cases where it's not practical for "people to notice." For instance: a privacy leak that only uses the cell network connection of a phone, which would avoid easily-sniffed connections.
- iso1631 6y ago
  Even with traffic monitoring, how do you distinguish bad TLS traffic from a machine you don't control to a cloudflare IP to good TLS traffic?
api 6y ago
> The market can't act against what it can't see. Privacy loss is often irreversible. I would add that the market can't act to prevent risks that are outside the market and not taken into account by the market. The big risks from widespread privacy loss are the exploitation of private data by criminals, foreign unconventional warfare by terrorists or hostile states, and the rise of a totalitarian government here in the USA. Criminal action can to some extent be priced into a market, but the other two really can't be.
Spooky23 6y ago
This isn’t that. I’ve been aware of this for some time, pretty sure it was in the security white paper and talked about as a feature. People forget about CRLs because browsers mostly ignore them. People just go crazy for any Apple story because it attracts attention. People have been paying to send all sorts of app launch analytics to AV companies for example since the 90s.
- kelnos 6y ago
  > I’ve been aware of this for some time, pretty sure it was in the security white paper and talked about as a feature. That doesn't invalidate what the parent said. The only way awareness helps is if it's general knowledge. I don't believe it was, and you personally having known about it doesn't make it so.
ogre_codes 6y ago
> A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. Stronger privacy laws hurt Google, Facebook, and Amazon far more than Apple. Most of Apple's privacy gaffs are just bonehead moves like this one which shouldn't happen, but also don't drive revenue.
- tonyedgecombe 6y ago
  I've always thought Apple's focus on privacy (putting aside the current incident) is rather clever as Google have no way to respond. Any improvements to privacy undermine their business model.
  - refulgentis 6y ago
    You'd think that'd be how it worked out, but funnily enough, it's net negative even when Google actively tries to enhance privacy! Using Apple's privacy-sensitive ad blocker standard made people protest the limitations of a fixed count of sites, and competitors spun it into a way for Google to advantage themselves (details on that somewhat murky, i.e. nonexistent) We have a long way to go as an industry on keeping users _well_ informed on their privacy, and I'm afraid Apple's set us back years by morphing it into an advertising one-liner over actually helping users along.
- kelnos 6y ago
  I don't look at it that way. I think privacy is secondary to Apple, and that they use privacy as a selling point when it suits them. Their overall goal is tight control over the entire computing experience, and in places where that degrades privacy, so be it.
  - ogre_codes 6y ago
    Their goal is making money. On the iPhone, that means keeping the system's reputation for security and ease of use trumps more or less everything else. On the Mac? Not so much. For Apple, privacy is a cheap giveaway because unlike Google or Facebook, the way Apple makes money doesn't require they know when my last BM was.
1vuio0pswjnm7 6y ago
Perhaps this is why Apple did not ask for permission from the user to add some delay every time the user launches an application. If the user were presented with the choice what would she choose. If we look at the example of OCSP in the website certificate context, the notion of the delay added by OCSP (not to mention privacy concerns) being objectionable has already been acknowledged. As a result we have OCSP stapling. For some reason, in the Apple developer certificate context, OCSP is deemed acceptable by default.
8bitsrule 6y ago
> arguments that we don't need laws to protect privacy is that the market will take care of it. Since discussion of Apple's behavior in particular has, somehow, been completely de-railed anyway (a frequent happening on HN) ... Can't help but observe that the market takes the best care of those who control it. Freely.
matheusmoreira 6y ago
> Parts of the US Governments unlawful massive domestic surveillance apparatus were described in the open in IETF drafs and patent documents for years. References?

by nullc 6y ago

simias 6y ago

> The market can't act against what it can't see. Privacy loss is often irreversible. You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware. Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching for profiling, that's been known for a while now. The market seems fine with it. And I mean, at this point I could just gesture broadly at all of Facebook.

oarsinsync 6y ago
> has "the market" shown any serious signal that it cares about privacy? Depends on what you consider a serious signal of care. If 'voting with you wallet' is the measure, increasing levels of income inequality, stagnant wages, weakening employee rights through the gig-economy, etc. are effectively taking away that choice, as most market participants cannot afford to make the choice. Also, what is the paid alternative to Apple or Google photos that allows me to have the same end user experience, without giving up my privacy? "the market" doesn't even have such an offer that I can see. The closest I can find (and that's through here) is photostructure.com, and even that's lacking all the local-ML-foo that makes Apple/Google photos a compelling option over anything else. > Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching for profiling, that's been known for a while now. Known by who? I'd wager a year's salary that >50% of Samsung TV owners (and bump that number up to >75% of Samsung TV users) do not know this is happening.
- deleted 6y ago
  [deleted]
- zepto 6y ago
  Income inequality and stagnant wages etc are not the consequences of Apple and Google.
  - sudosysgen 6y ago
    No one suggested they are. But they still make it much less likely for the average Joe to put money and effort to protect their privacy, and this is known to those that make major pricing decisions.
    - kortilla 6y ago
      We’re talking about Apple here. People who can afford a Mac over a cheap pc/chrome book already have disposable income and are making trade-offs with it.
      - sudosysgen 6y ago
        That is not really true. Many people of lower income will buy a Mac after their cheap laptops break because they perceive them, correctly or not, to be the most reliable and thus less expensive on the long term laptops. Sometimes even second hand. Also, Chromebooks are not viable alternatives for many people especially of lower income. Having to rely on being always online is an issue when you can't always guarantee having internet. Been there, done that.
        kortilla 6y ago
        > That is not really true. Many people of lower income will buy a Mac after their cheap laptops break because they perceive them, correctly or not, to be the most reliable and thus less expensive on the long term laptops. This is not true. The tiny user-base of OSX compared to Windows is already evidence that most people are not buying MacBooks.
ethbr0 6y ago
> From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware I'd argue that's more of what parent was talking about with regards to visibility. "Privacy" isn't something anyone can see. What you see are the effects of a lack of privacy. Given the dark market around personal data (albeit less in the EU), how are consumers to attribute effects to specific privacy breaches? If Apple sells my app history privately to a credit score bureau, and I'm denied a credit card despite having a stellar FICO, how am I supposed to connect those dots?
tinkertamper 6y ago
I hear this argument a lot but I think it is exactly OPs point when he says, “The market can’t act against what it can’t see”. Your average consumer doesn’t know the extent of what they’re trading. Take Facebook, even with high profile stories and documentaries it’s reasonable for your average consumer to assume that what Facebook tracks about them is what they actively give to Facebook themselves. I’ve had conversations with people that say, “I rarely even post on Facebook” and “If they want to monitor pictures of my food/dog/etc whatever who cares”, without any solid understanding of what even having the app installed alone is giving Facebook.
- deleted 6y ago
  [deleted]
- oblio 6y ago
  It's ok, if they will be educated they will care. Just like they care now about not using single use plastics, buying the biggest and most gas guzzling SUV or flying on holidays across the globe. They won't care even when they'll know. And they might not ever know.
  - gpanders 6y ago
    Yes exactly. I don't think an abstract understanding of the costs is enough. If the cost isn't physically or viscerally felt, it just doesn't factor into people's decision making. This is where the pricing system really comes into great effect. People buy and drive fewer SUVs when gas is more expensive. If we want people to buy fewer SUVs, increase the fuel tax. Education is not enough, and in fact might not even be necessary at all. Just introduce real costs to capture the "abstract" costs (externalities) and the problem will likely correct itself.
andrepd 6y ago
>that's been known for a while now Ask a representative sample and I wager only a very small percentage of people are actually aware of (1) the breaches of privacy that are happening (e.g. your TV sending mic dumps and screenshots of what you're watching), and (2) the hard consequences of those invasions (that is, beyond the immediate fact that you're being snooped upon), like higher insurance premiums on auto and health, being targeted by your opinions, etc.
- mehrdadn 6y ago
  To be honest I would expect if you told people "your TV will report what you're watching" they will think "wait, doesn't my cable company already know what I'm watching???" If you tell them it's the manufacturer this time in addition to the cable company, I'm not sure how many would freak out over the extra entity.
  - moduspol 6y ago
    Very few. I'm not sure how you'd measure it, but there seems to be a huge disconnect between techie privacy advocates and the rest of the world. The former keeps claiming the latter just doesn't understand, or needs to be informed, but I just don't think that's realistic. I think it's pretty common knowledge that these companies are harvesting all imaginable data to serve users more / better advertisements and to keep them on the site, yet usage continues to grow despite all the scandals. I think advocates need to make more convincing claims to everyone else that they're being harmed.
    - andrepd 6y ago
      In my anecdotical experience, that's not remotely true. Yes there is a disconnect between techies and regular people, in that for us it's obvious that these companies are harvesting all this data and processing it in all this ways and sharing it with all these people, but for the majority of people it's not. Even for you, do you think you fully understand how your data is being utilised and what the consequences are?
eternalban 6y ago
> You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? Is there a pro-privacy Google out there whose products languished while Google's succeeded? The Silicon Valley VC network did not fund nor support companies that promoted privacy. I can not think of a single example. Not a single major venture from SV VC network even attempted to innovate the "business model". We can make machines reason now but, alas, a business model that does not depend on eradicating privacy is beyond the reach of the geniuses involved. It is "Impossible"? I think, "undesirable" is more likely. No one is even seriously trying. Point: money behind SV tech giants is not motivated at all to fund the anti-panopticon. The salient, sobering, facts are that all these companies are sitting on a SV foundation that was and remains solidly "national security", "military", and "intelligence". The euphemism used is to mention SV's "old boy network". https://steveblank.com/secret-history/ https://steveblank.com/secret-history/
ardy42 6y ago
> You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware. Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching for profiling, that's been known for a while now. The market seems fine with it. I'd guess that most of that's due to information asymmetry. Privacy losses aren't advertised(and often hidden) and are more difficult to understand, but price is and is understood by everyone. Take that Samsung example: it's not like they had a bullet point on the feature list saying "Our Smart TVs will let us spy one what you're watching, so we can monetize that information."

absolutelyrad 6y ago

The market only acts fairly when the product is a commodity. The time for the market to react for a product with the complexity of a mac is decades. As the ecosystem grows, the cost of switching increases. Therefore market starts acting more and more inefficiently. This is why countries have state intervention in such cases. And anti trust exists. If the option was a mac with privacy vs a mac without privacy but $10 cheaper, I'd think the market would pick the mac with privacy. No such choice within the budget exists, and if a company has a monopoly on the ecosystem, then the market cannot react when held hostage. The cost to transition to a different ecosystem is thousands of $'s when you've been using a mac your entire life. It's not like you'd want to relearn many things when you get older, perhaps the sunk cost fallacy as many would define it. It's a bundled deal, it's not like you can pick the parts you like and throw away the ones you don't like it would be in an efficient market. If even someone like me cannot be bothered to move to more privacy friendly platforms, then I don't have hope for other people. It's just not worth it. Until the majority face the consequences of their apathy, any action you take is fruitless. Let them taste the pain, then offer the solution. I know I can be tracked. So what? I can't verify the silicon in my device, can I? Gotta trust someone, maybe blockchain will solve the problem of trust among humans, in a verifiable way.

_puk 6y ago
Whilst I agree with the sentiment, it does occur to me just how many kindles I see with ads. Is there any data released on ads Vs no ads versions? That's the closest comparator I can think of.
- ClumsyPilot 6y ago
  I think its worthwhile trying to test the hypothesys, but i dont think anyone takes privacy on a book reader with the same passion as they do on a mobile phone.
- paublyrne 6y ago
  > Whilst I agree with the sentiment, it does occur to me just how many kindles I see with ads. True, although the price difference for the Kindle is about 20%. If the discount on a Macbook Air was similar, I'm sure it would be well subscribed.

internet_user 6y ago

which IETF drafts and patents? Can you point me to some links? tia

nullc 6y ago
Sure, lemme give you an example: https://tools.ietf.org/html/draft-cavuto-dtcp-00 https://tools.ietf.org/html/draft-cavuto-dtcp-00 This protocol was created so that monitoring infrastructure could reprogram asic-based packet filters on collection routers (optical taps feed routers with half-duplex-mode interfaces), which grab sampled netflow plus specific targets selected by downstream analysis in realtime. It has to be extremely fast so that it can race TCP handshakes. I don't think it's much of an exaggeration to say that the technical components of almost all the mass surveillance infrastructure is described in open sources. Yes, they don't put "THIS IS FOR SPYING ON ALL THE PEOPLE" on it, but they also don't even bother reliably scrubbing sigint terms like "tasking". Sometimes the functionality is described under the color of "lawful intercept", though not always. One of the arguments that people made against the existence of widescale internet surveillance -- back before it was proved to exist-- was that it would require so much technology that it would be impossible to keep secret: the conspiracy would have to be too big. But it wasn't kept secret, not really-- we just weren't paying attention to the evidence around us. For a related patent example: https://patents.google.com/patent/US8031715B1 https://patents.google.com/patent/US8031715B1 which has fairly explicit language on the applications: > The techniques are described herein by way of example to dynamic flow capture (DFC) service cards that can monitor and distribute targeted network communications to content destinations under high traffic rates, even core traffic rates of the Internet, including OC-3, OC-12, OC-48, OC-192, and higher rates. Moreover, the techniques described herein allow control sources (such as Internet service providers, customers, or law enforcement agencies) to tap new or current packet flows within an extremely small period of time after specifying flow capture information, e.g., within 50 milliseconds, even under high-volume networks. > Further, the techniques can readily be applied in large networks that may have one or more million of concurrent packet flows, and where control sources may define hundreds of thousands of filter criteria entries in order to target specific communications.

polote 6y ago

> A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it Seriously, who has ever been successful at defending that idea ?

lucideer 6y ago
Many lobbyists and lawmakers, unfortunately.
- AshWolfy 6y ago
  It doesnt count as winning the argument if you paid them to agree with you
  - lucideer 6y ago
    It does if you convince people to vote for you though

amelius 6y ago

So, we should take away the market's incentive to infringe upon our privacy: by making user-tracking illegal.

blub 6y ago

The laws are already there. If you care about this and have some free time you may try to make a complain to the Irish data protection commission. I'm not sure if it's infringing though. If Apple says that they do not collect personal data and that the information is thrown away and this is done for a legitimate business purpose or for the customers (i.e. protecting customers), it may well be fine according to the GDPR.

ClumsyPilot 6y ago

Lying to the customer about what your product does, or having secret functionality, should be a criminal offence in the same way as breaking and entering or stalking are. Then, we would find out very quickly what people value. I firmly believe this ecosystem (as in privacy violating ad and data selling business model) is only dominant because companies are able to mislead with impunity, so it's basically a form of fraud

ethbr0 6y ago
The act of breaching privacy is technically difficult to prohibit in a way many of us would find palatable. What should be targeted is the product of said breaches. Something like the blood diamond approach. If your company has PII, then you by law must be able to produce a consented attestation chain all the way back to the source. If you do not, then you're charged a fine for every piece of unattested PII on every individual.
- zepto 6y ago
  By the time someone is charged with a crime, the damage is already done. And, there will be many scammers who are simply out of reach of meaningful legal remedies.
  - ben509 6y ago
    That's true of virtually all criminal laws, though. If you're beat up and your assailant is charged with assault, you've already been beat up.
    - zepto 6y ago
      Yes, which is why you need both laws, and prevention methods.
- ClumsyPilot 6y ago
  I thonk we are both arguing that clear consent must be present, and the customer must have clearly agreed to whatever you are doing with the data - that appears similar to GDPR. However, how do you prove John Doe has actually agreed to this? What if John says he did not click accept button? Do we require digital signature with certificates, given that most people don't have them or know how to use them? I think the problem is more tractable for physical products running firmware - there you have real proof of purchase, and, at present, firmware that does whatever it wants.

chrisweekly 6y ago

Great points. Related tangent: for those interested in this topic of "unlawful massive domestic surveillance", I heartily recommend Cory Doctorow's "Little Brother" novels -- esp the most recent, "Attack Surface". They get the technical details right while remaining accessible and engaging regardless of the reader's geek acumen.

jaredklewis 6y ago

Yes, unfortunately there is no safe harbor. Companies can make mistakes or add backdoors and we won't know. See this clusterfuck. Open Source, likewise, can make mistakes and (much more rarely) add backdoors, and we could know, but few have the resources to so. See heartbleed.

pibechorro 6y ago

Ya no thanks. Top down regulation will just make startups less likely to enter new disruptive tech. The solution is choice, stop using Apple products and all their shadyness stops being an issue.

eganist 6y ago
> Ya no thanks. Top down regulation will just make startups less likely to enter new disruptive tech. The solution is choice, stop using Apple products and all their shadyness stops being an issue. And since people have demonstrated that they're not appropriately incentivized to stop, that's where the regulations snap in, which brings us back to where we started: there's a need for it. Solution could just be to regulate based on a tightly managed definition of age. Enable younger companies to have a bit more flexibility in determining their business model as controls slowly snap in as the company ages. There are some pretty clear loopholes that immediately come to mind (e.g. re-chartering the company every few years and transferring assets) that'll need to somehow be managed, but it should be enough to give companies runway to figure out how to disrupt and monetize while coming into compliance with consumer protections.
diffeomorphism 6y ago
> The solution is choice Correct. Among apple, MS and google you have no choice. That is why regulation is necessary.
oblio 6y ago
How do you provide choice? How do you commoditize an entire hardware and software ecosystem, vertically integrated? Just like Standard Oil or AT & T were displaced, right? By customers going to their competitors? I'm being sarcastic, obviously :-)
lawnchair_larry 6y ago
Nothing shady about this. It isn’t logged and it protects customers from malware. That was the purpose. Most customers want that.
AshWolfy 6y ago
> Top down regulation will just make startups less likely to enter new disruptive tech Im ok with this

valuearb 6y ago

Probably no one cares because Apple’s OCSP checks don’t reduce your privacy.

grupthink 6y ago
They should care. The checks are sent unencrypted over HTTP to Apple's OCSP.
- valuearb 6y ago
  Since they don’t identify specific apps you use, so what’s your point?
  - throwaway525142 6y ago
    As far as I understand it, most vendors ship a single digit amount of apps. If you start the Tor browser, everyone on your network will know. If you start Firefox, everyone on your network will know you started a Mozilla product, most likely Firefox. If you start the Zoom client, everyone on your network knows you started the Zoom client. I don't think the "it's only the vendor" defense of Apple is any good.
    - athms 6y ago
      On MacOS, developer certificate requests are NOT done for every application launch. Responses are cached for a period of time before a new check is done. FYI -- Both Firefox and Safari use OCSP to check server certificates. Anybody sniffing your network could figure out which websites you visit. Chrome still uses CRL; it trades precision for performance.
      - pseudalopex 6y ago
        That period of time was 5 minutes.
- athms 6y ago

nerbert 6y ago

On argument to make is that the market only cares about the majority of their customers, not all of them. If 0.5% of their customers has their privacy busted by a backdoor, or that 0.01% of google users have their account arbitrarily deleted, this percentage of users is screwed like no one and the company doesn't suffer any damage.

ardy42 6y ago

> A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometimes they do, sometimes they don't. And there are cases where it's not practical for "people to notice." For instance: a privacy leak that only uses the cell network connection of a phone, which would avoid easily-sniffed connections.

iso1631 6y ago
Even with traffic monitoring, how do you distinguish bad TLS traffic from a machine you don't control to a cloudflare IP to good TLS traffic?

api 6y ago

> The market can't act against what it can't see. Privacy loss is often irreversible. I would add that the market can't act to prevent risks that are outside the market and not taken into account by the market. The big risks from widespread privacy loss are the exploitation of private data by criminals, foreign unconventional warfare by terrorists or hostile states, and the rise of a totalitarian government here in the USA. Criminal action can to some extent be priced into a market, but the other two really can't be.

Spooky23 6y ago

This isn’t that. I’ve been aware of this for some time, pretty sure it was in the security white paper and talked about as a feature. People forget about CRLs because browsers mostly ignore them. People just go crazy for any Apple story because it attracts attention. People have been paying to send all sorts of app launch analytics to AV companies for example since the 90s.

kelnos 6y ago
> I’ve been aware of this for some time, pretty sure it was in the security white paper and talked about as a feature. That doesn't invalidate what the parent said. The only way awareness helps is if it's general knowledge. I don't believe it was, and you personally having known about it doesn't make it so.

ogre_codes 6y ago

> A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. Stronger privacy laws hurt Google, Facebook, and Amazon far more than Apple. Most of Apple's privacy gaffs are just bonehead moves like this one which shouldn't happen, but also don't drive revenue.

tonyedgecombe 6y ago
I've always thought Apple's focus on privacy (putting aside the current incident) is rather clever as Google have no way to respond. Any improvements to privacy undermine their business model.
- refulgentis 6y ago
  You'd think that'd be how it worked out, but funnily enough, it's net negative even when Google actively tries to enhance privacy! Using Apple's privacy-sensitive ad blocker standard made people protest the limitations of a fixed count of sites, and competitors spun it into a way for Google to advantage themselves (details on that somewhat murky, i.e. nonexistent) We have a long way to go as an industry on keeping users _well_ informed on their privacy, and I'm afraid Apple's set us back years by morphing it into an advertising one-liner over actually helping users along.
kelnos 6y ago
I don't look at it that way. I think privacy is secondary to Apple, and that they use privacy as a selling point when it suits them. Their overall goal is tight control over the entire computing experience, and in places where that degrades privacy, so be it.
- ogre_codes 6y ago
  Their goal is making money. On the iPhone, that means keeping the system's reputation for security and ease of use trumps more or less everything else. On the Mac? Not so much. For Apple, privacy is a cheap giveaway because unlike Google or Facebook, the way Apple makes money doesn't require they know when my last BM was.

1vuio0pswjnm7 6y ago

Perhaps this is why Apple did not ask for permission from the user to add some delay every time the user launches an application. If the user were presented with the choice what would she choose. If we look at the example of OCSP in the website certificate context, the notion of the delay added by OCSP (not to mention privacy concerns) being objectionable has already been acknowledged. As a result we have OCSP stapling. For some reason, in the Apple developer certificate context, OCSP is deemed acceptable by default.

8bitsrule 6y ago

> arguments that we don't need laws to protect privacy is that the market will take care of it. Since discussion of Apple's behavior in particular has, somehow, been completely de-railed anyway (a frequent happening on HN) ... Can't help but observe that the market takes the best care of those who control it. Freely.

matheusmoreira 6y ago

> Parts of the US Governments unlawful massive domestic surveillance apparatus were described in the open in IETF drafs and patent documents for years. References?