3 ms·

>But again, note there's nothing fundamental about this problem. People routinely download and run arbitrary code on their desktops, laptops and smartphones...

>But again, note there's nothing fundamental about this problem. People routinely download and run arbitrary code on their desktops, laptops and smartphones... But isn't that in fact the fundamental problem we're talking about? You get security without knowledge exactly if you give up all control over the device. What's the point of "running" your own server if all control you have left is that you can physically smash it to pieces? Yes you can take control, but only to the degree to which you acquire the knowledge to keep it secure. I think this is a very fundamental trade-off.

mike_hearn 5y ago
I don't think giving up control is necessary to achieve security. Modern web browsers are pretty secure (even if web apps themselves aren't) and yet I can browse to whatever websites I want. There's a competitive marketplace of browsers to ensure that if one provider goes nuts I can switch to another. There are lots of different angles through which to make progress here. I don't think we should be defeatist about it.
- dmitriid 5y ago
  > There's a competitive marketplace of browsers There isn't. There are exactly three independent browser vendors: - Google with Chrome. Chrome dominates the market to such an extent that Google pushes through its internal APIs as "standards" - Apple with Safari. They flat out refuse to implement many of Chrome's shenanigans, and also have issues with priorities and funding - Mozilla with Firefox. Much like Safari, they are increasingly refusing to implement Chrome's shenanigans. But Firefox is rapidly declining in relevance, and will be on the brink of extinction within a few years (it already has at best ~150-199 million users)
  - mike_hearn 5y ago
    Chrome, Safari, Edge, Firefox, Brave. At least 5. Also, whipping together a simple browser is quite easy given the embedding APIs available. It's good enough to make the point.
    - dmitriid 5y ago
      > Chrome, Safari, Edge, Firefox, Brave. At least 5. Chrome, Edge and Brave are the same engine > whipping together a simple browser is quite easy Slapping lipstick on a pig doesn't make it a different animal. Yes, there are superficial differences like watching ads in Brave to earn their "coin", but it doesn't make them a truly different/competitive browser.
      - mike_hearn 5y ago
        Similarity of the code base doesn't matter, because we're talking about what sort of things a browser maker who "goes nuts" might do, like trying to switch off SSL or upload everything you type to their servers. In which case it's easy to patch that stuff out and/or just build a new shell around the underlying (fixed) rendering engine. That's the reason browser makers open sourced their renderers in the first place - exactly to help the web be more decentralized. And it works. If tomorrow Chrome blocks a website because it mis-gendered someone, OK, I'll switch to Safari. And if they do the same thing I'll switch to Edge. Etc. In extremis, I'll make my own browser based on the open code and sell it to people who really hate censorship. There are lots of ways to respond to this type of 'attack' but they don't rely on cryptography (I can't think of a cryptographic algorithm that could stop such a thing). Instead it's decentralization that fixes it. That's my point.
        dmitriid 5y ago
        Ah. Now I got you. Agreed
        hiq 5y ago
        > Instead it's decentralization that fixes it. That's FOSS. You can have FOSS using centralized, federated or decentralized protocols, I don't see a direct connection between the two. To go back a little, Moxie's main point has always been about the advantages of centralized protocols vs decentralized ones, not about FOSS vs proprietary software. In practice, he seems to favor (at least for Signal) centralized protocols and FOSS.
  - hkalbasi 5y ago
    Browsers based on chromium like brave also refuse to enable chrome shenanigans.

mike_hearn 5y ago

I don't think giving up control is necessary to achieve security. Modern web browsers are pretty secure (even if web apps themselves aren't) and yet I can browse to whatever websites I want. There's a competitive marketplace of browsers to ensure that if one provider goes nuts I can switch to another. There are lots of different angles through which to make progress here. I don't think we should be defeatist about it.

dmitriid 5y ago
> There's a competitive marketplace of browsers There isn't. There are exactly three independent browser vendors: - Google with Chrome. Chrome dominates the market to such an extent that Google pushes through its internal APIs as "standards" - Apple with Safari. They flat out refuse to implement many of Chrome's shenanigans, and also have issues with priorities and funding - Mozilla with Firefox. Much like Safari, they are increasingly refusing to implement Chrome's shenanigans. But Firefox is rapidly declining in relevance, and will be on the brink of extinction within a few years (it already has at best ~150-199 million users)
- mike_hearn 5y ago
  Chrome, Safari, Edge, Firefox, Brave. At least 5. Also, whipping together a simple browser is quite easy given the embedding APIs available. It's good enough to make the point.
  - dmitriid 5y ago
    > Chrome, Safari, Edge, Firefox, Brave. At least 5. Chrome, Edge and Brave are the same engine > whipping together a simple browser is quite easy Slapping lipstick on a pig doesn't make it a different animal. Yes, there are superficial differences like watching ads in Brave to earn their "coin", but it doesn't make them a truly different/competitive browser.
    - mike_hearn 5y ago
      Similarity of the code base doesn't matter, because we're talking about what sort of things a browser maker who "goes nuts" might do, like trying to switch off SSL or upload everything you type to their servers. In which case it's easy to patch that stuff out and/or just build a new shell around the underlying (fixed) rendering engine. That's the reason browser makers open sourced their renderers in the first place - exactly to help the web be more decentralized. And it works. If tomorrow Chrome blocks a website because it mis-gendered someone, OK, I'll switch to Safari. And if they do the same thing I'll switch to Edge. Etc. In extremis, I'll make my own browser based on the open code and sell it to people who really hate censorship. There are lots of ways to respond to this type of 'attack' but they don't rely on cryptography (I can't think of a cryptographic algorithm that could stop such a thing). Instead it's decentralization that fixes it. That's my point.
      - dmitriid 5y ago
        Ah. Now I got you. Agreed
      - hiq 5y ago
        > Instead it's decentralization that fixes it. That's FOSS. You can have FOSS using centralized, federated or decentralized protocols, I don't see a direct connection between the two. To go back a little, Moxie's main point has always been about the advantages of centralized protocols vs decentralized ones, not about FOSS vs proprietary software. In practice, he seems to favor (at least for Signal) centralized protocols and FOSS.
- hkalbasi 5y ago
  Browsers based on chromium like brave also refuse to enable chrome shenanigans.