4 ms·

Doctorow is arguing for adversarial interop but also observes that companies shut down APIs due to them becoming data leak vectors and then use that concern to

by pfraze 5y ago

Doctorow is arguing for adversarial interop but also observes that companies shut down APIs due to them becoming data leak vectors and then use that concern to make circumvention illegal. The dilemma is real. You end up with a sense that fair access and security are meaningfully in conflict. Perhaps a bit like the anti-cheating DRM conversation in the RMS state of FOSS thread. I’m also reminded of the free speech vs moderation debate, where the common retort to decentralization by Twitter employees is “you don’t know how impossible moderation will become.” Im inclined to think the system has to be rearchitected to solve the dilemma such that interop is the default easier option. (And, ideally, makes data security default easier.) Nobody has succeeded at it yet but it’s always the theory I’ve chosen to pursue.

cryptonector 5y ago
> the system has to be rearchitected to solve If it was obvious how to, we'd be talking about that, but it's not even obvious how to. A process to solve a problem no one knows how to solve can get co-opted and yield something awful, so I am not inclined to start one yet. Moreover, there must be plenty of room for innovation. We're all using TCP/IP, which is a great win for interoperability, but also an enabler of proprietary application protocols above it because it didn't try to preclude them. We've missed out on some things though, in the CNLP/OSI side of things, but I'm not familiar enough with them to know just how tragic, if at all, that is -- we're pretty happy with TCP/IP anyways. Do note that no one forced TCP/IP on anyone. The best interop is that which arises w/o the use of force.
- pfraze 5y ago
  >> the system has to be rearchitected to solve > If it was obvious how to, we'd be talking about that, but it's not even obvious how to We're in agreement, both on that and on your points on how innovation does happen. Basically all of the decentralization projects in the past ten years, from federation to p2p to blockchains, have been taking a stab at the greenfield approach. None of them have worked in the sense that they displace existing approaches, but I remain hopeful that something useful can come out of it all. As a fun aside, one of the more interesting semi-adversarial approaches I've seen was Delta Chat [1] which basically put a chat interface on top of email. 1. https://delta.chat/en/ https://delta.chat/en/
AtlasBarfed 5y ago
"The dilemma is real." Um, authentication? The issue with API mass data leaks is unauthenticated access to the data. Facebook HAS a web-wide authentication service, to heap the irony. Which of course would be sabotaged, but there are of course other means to do basic authentication. The users presumably know their passwords. That is a fake issue, IMO.
- pfraze 5y ago
  Is it fake? The relationship isn't just between the user and facebook (thus, auth) it's between the user, facebook, and the third-party app. The concern is that the 3rd-parties act maliciously; see the challenges with browser extensions. I'm not making excuses for the big companies -- I'm just trying to evaluate the challenges properly. If the core of the problem really is the behaviors of 3p apps, the security model for them is what a solution needs to address.
  - AtlasBarfed 5y ago
    Then you get into... authorization. Yes, facebook and other social platforms have issues with people snagging account access, usually by shared password vectors, but come on. This is still basic meat and potatoes auth for a more open social "pan-platform".
    - pfraze 5y ago
      Well I'm more thinking of the problem that browser extensions had, where people would make something handy or fun, be granted perms by the user, then get sold to people looking to mine user data. Extension authors get solicitations for these sales constantly, and the sale prices can be really tempting for devs. A friend of mine just made a silly "cursor sparkles" extension and he's mentioned multiple of these emails. Regardless of how you feel about it, the Cambridge Analytica ordeal was entirely about using benign quiz apps to mine user data, and the pressure that Facebook received was to fix their security. That's a huge incentive to lock down fair access. So if this is the situation, we need to address it if we're going to fix the technical pressures that create monopolies.
drewcoo 5y ago
The only thing missing in the "dilemma" is someone, teary, begging us to "think of the children."

by pfraze 5y ago

cryptonector 5y ago

> the system has to be rearchitected to solve If it was obvious how to, we'd be talking about that, but it's not even obvious how to. A process to solve a problem no one knows how to solve can get co-opted and yield something awful, so I am not inclined to start one yet. Moreover, there must be plenty of room for innovation. We're all using TCP/IP, which is a great win for interoperability, but also an enabler of proprietary application protocols above it because it didn't try to preclude them. We've missed out on some things though, in the CNLP/OSI side of things, but I'm not familiar enough with them to know just how tragic, if at all, that is -- we're pretty happy with TCP/IP anyways. Do note that no one forced TCP/IP on anyone. The best interop is that which arises w/o the use of force.

pfraze 5y ago
>> the system has to be rearchitected to solve > If it was obvious how to, we'd be talking about that, but it's not even obvious how to We're in agreement, both on that and on your points on how innovation does happen. Basically all of the decentralization projects in the past ten years, from federation to p2p to blockchains, have been taking a stab at the greenfield approach. None of them have worked in the sense that they displace existing approaches, but I remain hopeful that something useful can come out of it all. As a fun aside, one of the more interesting semi-adversarial approaches I've seen was Delta Chat [1] which basically put a chat interface on top of email. 1. https://delta.chat/en/ https://delta.chat/en/

AtlasBarfed 5y ago

"The dilemma is real." Um, authentication? The issue with API mass data leaks is unauthenticated access to the data. Facebook HAS a web-wide authentication service, to heap the irony. Which of course would be sabotaged, but there are of course other means to do basic authentication. The users presumably know their passwords. That is a fake issue, IMO.

pfraze 5y ago
Is it fake? The relationship isn't just between the user and facebook (thus, auth) it's between the user, facebook, and the third-party app. The concern is that the 3rd-parties act maliciously; see the challenges with browser extensions. I'm not making excuses for the big companies -- I'm just trying to evaluate the challenges properly. If the core of the problem really is the behaviors of 3p apps, the security model for them is what a solution needs to address.
- AtlasBarfed 5y ago
  Then you get into... authorization. Yes, facebook and other social platforms have issues with people snagging account access, usually by shared password vectors, but come on. This is still basic meat and potatoes auth for a more open social "pan-platform".
  - pfraze 5y ago
    Well I'm more thinking of the problem that browser extensions had, where people would make something handy or fun, be granted perms by the user, then get sold to people looking to mine user data. Extension authors get solicitations for these sales constantly, and the sale prices can be really tempting for devs. A friend of mine just made a silly "cursor sparkles" extension and he's mentioned multiple of these emails. Regardless of how you feel about it, the Cambridge Analytica ordeal was entirely about using benign quiz apps to mine user data, and the pressure that Facebook received was to fix their security. That's a huge incentive to lock down fair access. So if this is the situation, we need to address it if we're going to fix the technical pressures that create monopolies.

drewcoo 5y ago

The only thing missing in the "dilemma" is someone, teary, begging us to "think of the children."