6 ms·

General purpose computing is one possible safeguard, it also has pretty big and clear downsides for many consumers and isn't obviously the right choice for most

General purpose computing is one possible safeguard, it also has pretty big and clear downsides for many consumers and isn't obviously the right choice for most. And again, the proof is in the pudding. If closed-down markets degrade and become awful over time, the market will eventually reflect and account for that in the future. Long-term consequences eventually materialize into immediate consequences after all. In fact, the market exists to validate lofty claims like yours because history is filled with failed attempts to dictate what people should produce, by minorities like you who believe they know better than the people who buy them. > I do think it's slightly problematic to assume that users are conscious enough of security to make an educated decision to opt into a locked-down platform, but are not educated enough to avoid flipping a switch in the settings that turns that environment off and on. This seems pretty obviously true to me. It's quite easy to realize you suck at security, all you need to do is suffer a security breach or know of one. For example, the Windows era taught many users just how insecure they could be, the lessons were pretty simple. Knowing when to disable security guardrails, however, requires actual security knowledge that most users don't have. We know users usually don't have them because Windows tested this with UAC, which users happily and quickly disabled to allow malicious programs that they didn't really evaluate at all; A long and painful case study in "how to let your users choose to fuck themselves". Of course users don't think about a tradeoff between open access and security, the choice is obvious to them. Security matters and open access doesn't. On the one hand you have the tangible risk of getting your stuff or info stolen, and on the other you have danShumway's nebulous & unproven prophecies of a day that will soon(tm) come where the lack of open access causes stuff to degrade and become awful. I don't personally make the same tradeoff because open access matters more to me personally, but I think the majority of consumers have made legitimate choices for themselves. They know what they want and have made choices to support their desires, same as you or I, and frankly no one should be able to violate their choices.

danShumway 6y ago
> the market will eventually reflect and account for that in the future. Which won't help unless we're willing to break apart duopolies and enforce government antitrust. The point I'm making is that when you get rid of consumers' ability to solve their own problems, they lose the ability to solve their own problems. They don't magically get that ability back when the market starts being terrible. Take a look at Amazon's DRM -- it doesn't matter if you as a consumer wake up one day and realize that there are negative consequences to being unable to port your library to any other devices. You still can't do it. Market capture is not a problem that can be solved by the market on its own, which we've seen repeatedly throughout the history of US markets, including in the computing market. This is why we have regulations around some of the most egregious anti-free-market activities companies can take. For example, it's illegal to use warranties to block unrelated consumer repairs. Car makers are legally required to use some universal interfaces that allow non-manufacturers to repair and alter the vehicle. And we're currently campaigning to get rid of DMCA restrictions on breaking DRM for legal purposes like porting Kindle books to other platforms. None of that is stuff that consumers on their own would prioritize, but they're market conditions that benefit everyone tremendously. These are instances where the free market can't solve the problem on its own, there have to be legislative changes that allow the market to compete. And unless you're currently buying stock in Purism or Windows Phone, I think we both know that the current smartphone market is not set up to allow competition. > which users happily and quickly disabled to allow malicious programs that they didn't really evaluate at all So what makes you think they didn't? You're assuming that consumers are making a rational choice when they purchase a phone, but not when they use the phone. I don't think people's brains stop working when they turn their devices on, I think that we should apply a consistent framework to understand both people's computing usage and their purchasing decisions. > Knowing when to disable security guardrails, however, requires actual security knowledge No, it really doesn't. You can have a big warning that says "this makes your phone insecure" and people don't need to know the details to trust you. Of course, in practice, people ignore those warnings. But there's two ways to interpret that -- either people don't understand security/access at all and we shouldn't treat any of their purchasing decisions on this with reverence, or people are making a security decision not to trust phone manufactures when they uncheck that box, and we shouldn't shame them for having a different risk model than us. I object to any attempt to try and characterize them as somehow being both conscious/unconscious of the risks at the same time, there has to be some consistency in how we talk about those people. How do you know that normal users don't just have a separate threat model than you and that they're willing to uncheck that box because they're consciously deciding to tolerate a greater rate of infection/malware than you find acceptable?
- anderspitman 6y ago
  > And unless you're currently buying stock in Purism or Windows Phone OT but if Microsoft released a reasonably-open Linux phone, all would be forgiven as far as I'm concerned. They've always made fantastic hardware, and they're one of the few companies who could potentially break into the market in a real way.
- themacguffinman 6y ago
  > Take a look at Amazon's DRM -- it doesn't matter if you as a consumer wake up one day and realize that there are negative consequences to being unable to port your library to any other devices. You still can't do it. Because almost no one actually cares that you can't port your library to any other devices, Amazon's DRM is well known by now and they certainly don't mislead customers into thinking their books are DRM-free nor do they advertise library portability as a feature. The mechanism by which consumers "get that ability back" is by buying DRM free books if they're sick of DRM, but that hasn't and doesn't happen for most consumers even though they're completely free to do so. Most people are content with Amazon DRM, and when they aren't, any company that sells DRM-free books will make a killing. But no one makes a lot of money from DRM-free books because there is no widespread demand for it. It's ridiculous to suggest that consumers have been robbed of their ability to influence the market, they have always held all the cards. Companies only make money if consumers want what they make, and boy do they want it. If you have reason to believe Amazon is somehow preventing consumers from buying DRM-free books, I'd be happy to hear it. The kind of failures that markets can't solve themselves are typically ones of deception and coercion, show me that. > None of that is stuff that consumers on their own would prioritize, but they're market conditions that benefit everyone tremendously. Says you. I'll let consumers decide what's important and what market conditions are beneficial to them, thank you. > either people don't understand security/access at all and we shouldn't treat any of their purchasing decisions on this with reverence, or people are making a security decision not to trust phone manufactures when they uncheck that box, and we shouldn't shame them for having a different risk model than us. People don't need to understand security/access at all for their purchasing decisions to be legitimate. Do you need to be an expert in plumbing to know that you need a plumber? Do you need plumber skills to figure out that the wet & broken mess you've made by yourself suggests you need expert help? You can't conflate a consumer's knowledge of security risk with a consumer's knowledge of security itself. Security risks & benefits are really obvious: consumers notice when they or people they know get hacked & phished. They notice when their computer slows down to a crawl and starts injecting garbage into their screen. They especially notice when iPhones & Chromebooks have none of these problems. Knowing if a non-vetted program is safe to bypass regular security checkpoints? Consumers consistently and repeatedly fail that test almost every time they're given the opportunity. > How do you know that normal users don't just have a separate threat model than you and that they're willing to uncheck that box because they're consciously deciding to tolerate a greater rate of infection/malware than you find acceptable? I know because they switch to a more secure & locked down platform wherever they can. I know because they loudly complain that Android is full of malware and unvetted trash and then proceed to buy an iPhone. I know because the anger& confusion they lash out with when they fuck up their own security clearly indicate that they'd rather never deal with that ever again. The idea that most consumers were happy with the previously awful state of security is totally absurd when they fled those platforms en masse the first chance they could get.
amelius 6y ago
> General purpose computing is one possible safeguard, it also has pretty big and clear downsides for many consumers and isn't obviously the right choice for most. Yes, but isn't it sad if (say) mom and dad have better hardware at their disposal than people who need general purpose computing for their jobs (e.g. scientists, hackers, ...). Optimizing for the majority is not always a good thing as it can result in bad outcomes for minorities.
- themacguffinman 6y ago
  I think it would be sadder if mom and dad had terrible security and lost their savings or treasured memories as a result. Optimizing for one group is always going to cause some problems for a different group, and if I had to choose I'd optimize for the majority every time.
  - amelius 6y ago
    But you're sailing along with a false dichotomy. We can have hardware that is safe for mom and dad, and open for professionals.
    - themacguffinman 6y ago
      I'll just have to disagree that it's a false dichotomy. System openness is diametrically opposed to security; the more open a system is, the more insecure it becomes. This is especially true for mainstream consumers who have little knowledge or skill to administrate open systems securely. It's one of the classic engineering trade-offs, thinking you can have your cake and eat it to seems pretty ignorant to me.

danShumway 6y ago

> the market will eventually reflect and account for that in the future. Which won't help unless we're willing to break apart duopolies and enforce government antitrust. The point I'm making is that when you get rid of consumers' ability to solve their own problems, they lose the ability to solve their own problems. They don't magically get that ability back when the market starts being terrible. Take a look at Amazon's DRM -- it doesn't matter if you as a consumer wake up one day and realize that there are negative consequences to being unable to port your library to any other devices. You still can't do it. Market capture is not a problem that can be solved by the market on its own, which we've seen repeatedly throughout the history of US markets, including in the computing market. This is why we have regulations around some of the most egregious anti-free-market activities companies can take. For example, it's illegal to use warranties to block unrelated consumer repairs. Car makers are legally required to use some universal interfaces that allow non-manufacturers to repair and alter the vehicle. And we're currently campaigning to get rid of DMCA restrictions on breaking DRM for legal purposes like porting Kindle books to other platforms. None of that is stuff that consumers on their own would prioritize, but they're market conditions that benefit everyone tremendously. These are instances where the free market can't solve the problem on its own, there have to be legislative changes that allow the market to compete. And unless you're currently buying stock in Purism or Windows Phone, I think we both know that the current smartphone market is not set up to allow competition. > which users happily and quickly disabled to allow malicious programs that they didn't really evaluate at all So what makes you think they didn't? You're assuming that consumers are making a rational choice when they purchase a phone, but not when they use the phone. I don't think people's brains stop working when they turn their devices on, I think that we should apply a consistent framework to understand both people's computing usage and their purchasing decisions. > Knowing when to disable security guardrails, however, requires actual security knowledge No, it really doesn't. You can have a big warning that says "this makes your phone insecure" and people don't need to know the details to trust you. Of course, in practice, people ignore those warnings. But there's two ways to interpret that -- either people don't understand security/access at all and we shouldn't treat any of their purchasing decisions on this with reverence, or people are making a security decision not to trust phone manufactures when they uncheck that box, and we shouldn't shame them for having a different risk model than us. I object to any attempt to try and characterize them as somehow being both conscious/unconscious of the risks at the same time, there has to be some consistency in how we talk about those people. How do you know that normal users don't just have a separate threat model than you and that they're willing to uncheck that box because they're consciously deciding to tolerate a greater rate of infection/malware than you find acceptable?

anderspitman 6y ago
> And unless you're currently buying stock in Purism or Windows Phone OT but if Microsoft released a reasonably-open Linux phone, all would be forgiven as far as I'm concerned. They've always made fantastic hardware, and they're one of the few companies who could potentially break into the market in a real way.
themacguffinman 6y ago
> Take a look at Amazon's DRM -- it doesn't matter if you as a consumer wake up one day and realize that there are negative consequences to being unable to port your library to any other devices. You still can't do it. Because almost no one actually cares that you can't port your library to any other devices, Amazon's DRM is well known by now and they certainly don't mislead customers into thinking their books are DRM-free nor do they advertise library portability as a feature. The mechanism by which consumers "get that ability back" is by buying DRM free books if they're sick of DRM, but that hasn't and doesn't happen for most consumers even though they're completely free to do so. Most people are content with Amazon DRM, and when they aren't, any company that sells DRM-free books will make a killing. But no one makes a lot of money from DRM-free books because there is no widespread demand for it. It's ridiculous to suggest that consumers have been robbed of their ability to influence the market, they have always held all the cards. Companies only make money if consumers want what they make, and boy do they want it. If you have reason to believe Amazon is somehow preventing consumers from buying DRM-free books, I'd be happy to hear it. The kind of failures that markets can't solve themselves are typically ones of deception and coercion, show me that. > None of that is stuff that consumers on their own would prioritize, but they're market conditions that benefit everyone tremendously. Says you. I'll let consumers decide what's important and what market conditions are beneficial to them, thank you. > either people don't understand security/access at all and we shouldn't treat any of their purchasing decisions on this with reverence, or people are making a security decision not to trust phone manufactures when they uncheck that box, and we shouldn't shame them for having a different risk model than us. People don't need to understand security/access at all for their purchasing decisions to be legitimate. Do you need to be an expert in plumbing to know that you need a plumber? Do you need plumber skills to figure out that the wet & broken mess you've made by yourself suggests you need expert help? You can't conflate a consumer's knowledge of security risk with a consumer's knowledge of security itself. Security risks & benefits are really obvious: consumers notice when they or people they know get hacked & phished. They notice when their computer slows down to a crawl and starts injecting garbage into their screen. They especially notice when iPhones & Chromebooks have none of these problems. Knowing if a non-vetted program is safe to bypass regular security checkpoints? Consumers consistently and repeatedly fail that test almost every time they're given the opportunity. > How do you know that normal users don't just have a separate threat model than you and that they're willing to uncheck that box because they're consciously deciding to tolerate a greater rate of infection/malware than you find acceptable? I know because they switch to a more secure & locked down platform wherever they can. I know because they loudly complain that Android is full of malware and unvetted trash and then proceed to buy an iPhone. I know because the anger& confusion they lash out with when they fuck up their own security clearly indicate that they'd rather never deal with that ever again. The idea that most consumers were happy with the previously awful state of security is totally absurd when they fled those platforms en masse the first chance they could get.

amelius 6y ago

> General purpose computing is one possible safeguard, it also has pretty big and clear downsides for many consumers and isn't obviously the right choice for most. Yes, but isn't it sad if (say) mom and dad have better hardware at their disposal than people who need general purpose computing for their jobs (e.g. scientists, hackers, ...). Optimizing for the majority is not always a good thing as it can result in bad outcomes for minorities.

themacguffinman 6y ago
I think it would be sadder if mom and dad had terrible security and lost their savings or treasured memories as a result. Optimizing for one group is always going to cause some problems for a different group, and if I had to choose I'd optimize for the majority every time.
- amelius 6y ago
  But you're sailing along with a false dichotomy. We can have hardware that is safe for mom and dad, and open for professionals.
  - themacguffinman 6y ago
    I'll just have to disagree that it's a false dichotomy. System openness is diametrically opposed to security; the more open a system is, the more insecure it becomes. This is especially true for mainstream consumers who have little knowledge or skill to administrate open systems securely. It's one of the classic engineering trade-offs, thinking you can have your cake and eat it to seems pretty ignorant to me.