11 ms·

I wrote up a quick analysis last night here: https://ioc.exchange/@invisv/110387246627189198 https://ioc.exchange/@invisv/110387246627189198 Here are the takea

I wrote up a quick analysis last night here: https://ioc.exchange/@invisv/110387246627189198 https://ioc.exchange/@invisv/110387246627189198 Here are the takeaways: * It'd be easy for Apple and Google to prevent downloads of TikTok for most users, which would also include app updates, as they have a significant amount of knowledge of users' locations and could prevent most users in Montana -- even those using a VPN -- from downloading the app or updating it. * It'd be very difficult for Montana to enforce the other piece of the TikTok ban -- if "entity" in the bill means any company, they're stuck: the state has little ability to prevent side-loading of apps on Android and users who want TikTok can access app repositories hosted out of state. There's virtually no way for ISPs inside Montana to surveil all user usage to find out if they're trying to download TikTok from a third-party repository, and even if they could there would be legal issues with the state mandating this. Fundamentally, this makes user privacy and security much worse. * Apple, Google, and ByteDance could be aggressive and use the data they have -- all three have GPS data for most or all relevant users here (i.e. TikTok users on an iPhone or Android) -- and block requests to download or use TikTok from within Montana. And they probably will, unless they get a court to block the bill. The one thing the bill banning TikTok doesn't do is the one thing that is desperately needed: actually protect user privacy, by banning the collection, aggregation, sale, and use of fine-grained user data -- by ByteDance, Meta, Google, Apple, Microsoft, Amazon, or any other.

mrighele 3y ago
> It'd be very difficult for Montana to enforce the other piece of the TikTok ban I don't know if it is technically and legally feasible in Montana, but you "just" need to block the endpoints that the app uses to fetch the data. It is not foolproof, but given that ByteDance probably has interest in keeping doing business in the rest of the USA, at least for now, it would be fineable in case it was trying to avoid the block.
- threeseed 3y ago
  Technically and legally it's trivial and common. They just ask any ISPs and telcos operating in the state to ban the URL.
  - dudus 3y ago
    But then TikTok can still detect your location. Unless you spoof that, remove the permission or patch the apk. Then you still need to update almost daily to keep using it.
  - nerdbert 3y ago
    I doubt that e.g. mobile carriers have the infrastructure in place to do state-by-state website blocking. Of course we can conceive of the mechanism very simply in the abstract, but that doesn't necessarily mean that implementing it will be simple for them.
- hippich 3y ago
  Blocked in my house with few rules in pi.hole. so definitely not a technical problem.
  - hiatus 3y ago
    What happens if the kids use mobile data and not the house wifi?
    - hippich 3y ago
      They don't have it
screye 3y ago
> side-loading of apps on Android 90%+ users are never going to use apks. If this ban kills the network effect (the R0 of the viral infection), then the last 10% aren't going to last long either.
- twelve40 3y ago
  but of this keeps trending (more future bans) it will nudge more people to sideload to get around stupid middlemen who get in their way countries who engage in these bans have conditioned many non-tech people to learn to use vpns and other tools "sideloading" is the norm on desktop too, btw, and always has been
  - tracker1 3y ago
    Doubt it... I seriously doubt even 1% of android users has even heard of FDroid or knows that Amazon has it's own android market you can load on your phone. That will really limit network effect overall.
    - hiatus 3y ago
      If you download an apk off of a website you can install it just like that, no f-droid needed.
    - kelnos 3y ago
      All it takes is one kid in class to sideload the app and show off to their friends that they have the app again, and others will follow.
    - powersnail 3y ago
      Downloading from a website is simple enough. That’s what Windows users do for a long time. A mildly motivated teenager definitely can figure it out.
    - nerdbert 3y ago
      You may doubt it, but installing VPNs and getting software from alternate sources is a basic life skill in a country like Iran where the government tries hard to control what people see online. The old and young alike are doing this.
jasmer 3y ago
This is not a user privacy vs. megacorp story, it's a national security story. I wish there was a megacorp privacy story to run here, sadly, I'm not sure Congress will go for it. There is only one solution and that is for TT to be 'forked' from ByteDance/Doyin. It would literally cost almost nothing, there are almost zero synergies between Doyin and TT at this point, they will do just fine separately, and it won't cost anything but a few bankers/accountants to do the split. TT will have to be based in Singapore or US and be completely independent from BD/Doyin but that's fine. Nothing will skip a beat, everyone can be happy, kids can have their app but CCP won't have any control visibility at all. Funny enough, ByteDance could probably retain maybe even majority control, although that might not work in practices. And then we can get on with trying to get Congress to protect consumers from Meta ...
threeseed 3y ago
Almost everyone that uses the App Store has a credit card and billing address on file. And they have mechanisms to require it for certain app downloads e.g. adult content. So they won't need to rely on GPS or VPN data.
knaik94 3y ago
Part of the issue is that the government itself takes part in that marketplace as a seller and buyer. There's no resonable way to make laws for corporations while giving a pass to government agencies, it might be proposed but it would never pass. One of the biggest clients of Cambridge Analytica was the Trump campaign. I became disillusioned about hoping laws pass that protect user data after watching the TikTok hearing. The congressman questioning whether TikTok tracks eye dialation as a signal for "the algorithm", and the CEO having to explain that it's used for funny face filters, gave me second hand embarrasment. It reminds me of the Facebook hearing where a congressman ask whether it was possible to ban "finsta" and the Head of Global Safety at FB reponding that it's not a product. It's people having a secondary personal account limited to specific friends. An explanation the congressman was having a hard time understanding. https://www.youtube.com/watch?v=gPZA98whQGI https://www.youtube.com/watch?v=gPZA98whQGI https://www.youtube.com/watch?v=TGt1Ukg7q4Y https://www.youtube.com/watch?v=TGt1Ukg7q4Y
- quantum_state 3y ago
  In one word, you are saying we have stupid folks in the legislature messing up the country. It is true and they have been doing that for a while …
  - knaik94 3y ago
    I think I would use the word misinformed or misguided. I feel it's hard to get a clear understanding because there's a lot of performative politics. There isn't enough push back to obstructionism. There are people doing good work in legislature, but mainstream and social media tend to highlight the bad. Regarding opinions about things like banning TikTok or protecting section 230, the divide is caused by bad technology literacy. I don't think it's fair to say it's been happening for a while, because the pace of tech development has been so much faster than legislature. The median age of the 118th congress is ~58 years old, broadband internet has only been around for the last ~20.
- Gollapalli 3y ago
  If they are actually just using eye dilation for funny faces, I would be shocked. It's one of those things that's pretty telling physically. Whichever congressman asked that question was NOT dumb.
mikrotikker 3y ago
> The one thing the bill banning TikTok doesn't do is the one thing that is desperately needed: actually protect user privacy, by banning the collection, aggregation, sale, and use of fine-grained user data -- by ByteDance, Meta, Google, Apple, Microsoft, Amazon, or any other. I totally agree it doesn't do that and I want that, but at this point that is a major battle esp with how big tech have embedded themselves into govt. This is a smaller battle won, and I hope it spreads. There's nothing bad about a multi-pronged approach.
deleted 3y ago
[deleted]
opmelogy 3y ago
> * It'd be easy for Apple and Google to prevent downloads of TikTok for most users, which would also include app updates, as they have a significant amount of knowledge of users' locations and could prevent most users in Montana -- even those using a VPN -- from downloading the app or updating it. I find this statement odd. It's one thing to have the data and another thing to assert that it's either readily available or easy to insert into legacy systems. Do you know this to be true? Or is this just a guess on your end? Because it sounds like a guess. And with guessing becomes weakened trust in what people "report" or "analyze".
- barathr 3y ago
  Of course it's a guess. Nobody knows what will happen.
worrycue 3y ago
Users will still need to connect to TikTok’s servers right? Can’t they implement an IP block or something on those servers - this way even if you have the app it’s useless unless you use a VPN.
ninefathom 3y ago
This comes back to something I mentioned elsewhere: What's good enough for an advertiser trying to sell concert tickets is not necessarily good enough for enforcing legal prohibitions. The location collection mechanisms built by Apple and Google that would be effective at a state or regional level within the US have been built for advertising, with secondary purposes of opt-in anti-theft. They weren't built for continuous, rigorous enforcement of legal prohibitions within a given sub-region of the USA. I think you're asserting that e.g. 90% of TikTok users in Montana would be impacted by the ban, and 10% would find a way around. For advertisers, that's fine. For enforcement of a law? Bzzzzzz! That's gonna be arbitrary-and-capricious'ed right out of the courtroom doors.

mrighele 3y ago

> It'd be very difficult for Montana to enforce the other piece of the TikTok ban I don't know if it is technically and legally feasible in Montana, but you "just" need to block the endpoints that the app uses to fetch the data. It is not foolproof, but given that ByteDance probably has interest in keeping doing business in the rest of the USA, at least for now, it would be fineable in case it was trying to avoid the block.

threeseed 3y ago
Technically and legally it's trivial and common. They just ask any ISPs and telcos operating in the state to ban the URL.
- dudus 3y ago
  But then TikTok can still detect your location. Unless you spoof that, remove the permission or patch the apk. Then you still need to update almost daily to keep using it.
- nerdbert 3y ago
  I doubt that e.g. mobile carriers have the infrastructure in place to do state-by-state website blocking. Of course we can conceive of the mechanism very simply in the abstract, but that doesn't necessarily mean that implementing it will be simple for them.
hippich 3y ago
Blocked in my house with few rules in pi.hole. so definitely not a technical problem.
- hiatus 3y ago
  What happens if the kids use mobile data and not the house wifi?
  - hippich 3y ago
    They don't have it

screye 3y ago

> side-loading of apps on Android 90%+ users are never going to use apks. If this ban kills the network effect (the R0 of the viral infection), then the last 10% aren't going to last long either.

twelve40 3y ago
but of this keeps trending (more future bans) it will nudge more people to sideload to get around stupid middlemen who get in their way countries who engage in these bans have conditioned many non-tech people to learn to use vpns and other tools "sideloading" is the norm on desktop too, btw, and always has been
- tracker1 3y ago
  Doubt it... I seriously doubt even 1% of android users has even heard of FDroid or knows that Amazon has it's own android market you can load on your phone. That will really limit network effect overall.
  - hiatus 3y ago
    If you download an apk off of a website you can install it just like that, no f-droid needed.
  - kelnos 3y ago
    All it takes is one kid in class to sideload the app and show off to their friends that they have the app again, and others will follow.
  - powersnail 3y ago
    Downloading from a website is simple enough. That’s what Windows users do for a long time. A mildly motivated teenager definitely can figure it out.
  - nerdbert 3y ago
    You may doubt it, but installing VPNs and getting software from alternate sources is a basic life skill in a country like Iran where the government tries hard to control what people see online. The old and young alike are doing this.

jasmer 3y ago

This is not a user privacy vs. megacorp story, it's a national security story. I wish there was a megacorp privacy story to run here, sadly, I'm not sure Congress will go for it. There is only one solution and that is for TT to be 'forked' from ByteDance/Doyin. It would literally cost almost nothing, there are almost zero synergies between Doyin and TT at this point, they will do just fine separately, and it won't cost anything but a few bankers/accountants to do the split. TT will have to be based in Singapore or US and be completely independent from BD/Doyin but that's fine. Nothing will skip a beat, everyone can be happy, kids can have their app but CCP won't have any control visibility at all. Funny enough, ByteDance could probably retain maybe even majority control, although that might not work in practices. And then we can get on with trying to get Congress to protect consumers from Meta ...

threeseed 3y ago

Almost everyone that uses the App Store has a credit card and billing address on file. And they have mechanisms to require it for certain app downloads e.g. adult content. So they won't need to rely on GPS or VPN data.

knaik94 3y ago

Part of the issue is that the government itself takes part in that marketplace as a seller and buyer. There's no resonable way to make laws for corporations while giving a pass to government agencies, it might be proposed but it would never pass. One of the biggest clients of Cambridge Analytica was the Trump campaign. I became disillusioned about hoping laws pass that protect user data after watching the TikTok hearing. The congressman questioning whether TikTok tracks eye dialation as a signal for "the algorithm", and the CEO having to explain that it's used for funny face filters, gave me second hand embarrasment. It reminds me of the Facebook hearing where a congressman ask whether it was possible to ban "finsta" and the Head of Global Safety at FB reponding that it's not a product. It's people having a secondary personal account limited to specific friends. An explanation the congressman was having a hard time understanding. https://www.youtube.com/watch?v=gPZA98whQGI https://www.youtube.com/watch?v=gPZA98whQGI https://www.youtube.com/watch?v=TGt1Ukg7q4Y https://www.youtube.com/watch?v=TGt1Ukg7q4Y

quantum_state 3y ago
In one word, you are saying we have stupid folks in the legislature messing up the country. It is true and they have been doing that for a while …
- knaik94 3y ago
  I think I would use the word misinformed or misguided. I feel it's hard to get a clear understanding because there's a lot of performative politics. There isn't enough push back to obstructionism. There are people doing good work in legislature, but mainstream and social media tend to highlight the bad. Regarding opinions about things like banning TikTok or protecting section 230, the divide is caused by bad technology literacy. I don't think it's fair to say it's been happening for a while, because the pace of tech development has been so much faster than legislature. The median age of the 118th congress is ~58 years old, broadband internet has only been around for the last ~20.
Gollapalli 3y ago
If they are actually just using eye dilation for funny faces, I would be shocked. It's one of those things that's pretty telling physically. Whichever congressman asked that question was NOT dumb.

mikrotikker 3y ago

> The one thing the bill banning TikTok doesn't do is the one thing that is desperately needed: actually protect user privacy, by banning the collection, aggregation, sale, and use of fine-grained user data -- by ByteDance, Meta, Google, Apple, Microsoft, Amazon, or any other. I totally agree it doesn't do that and I want that, but at this point that is a major battle esp with how big tech have embedded themselves into govt. This is a smaller battle won, and I hope it spreads. There's nothing bad about a multi-pronged approach.

deleted 3y ago

[deleted]

opmelogy 3y ago

> * It'd be easy for Apple and Google to prevent downloads of TikTok for most users, which would also include app updates, as they have a significant amount of knowledge of users' locations and could prevent most users in Montana -- even those using a VPN -- from downloading the app or updating it. I find this statement odd. It's one thing to have the data and another thing to assert that it's either readily available or easy to insert into legacy systems. Do you know this to be true? Or is this just a guess on your end? Because it sounds like a guess. And with guessing becomes weakened trust in what people "report" or "analyze".

barathr 3y ago
Of course it's a guess. Nobody knows what will happen.

worrycue 3y ago

Users will still need to connect to TikTok’s servers right? Can’t they implement an IP block or something on those servers - this way even if you have the app it’s useless unless you use a VPN.

ninefathom 3y ago

This comes back to something I mentioned elsewhere: What's good enough for an advertiser trying to sell concert tickets is not necessarily good enough for enforcing legal prohibitions. The location collection mechanisms built by Apple and Google that would be effective at a state or regional level within the US have been built for advertising, with secondary purposes of opt-in anti-theft. They weren't built for continuous, rigorous enforcement of legal prohibitions within a given sub-region of the USA. I think you're asserting that e.g. 90% of TikTok users in Montana would be impacted by the ban, and 10% would find a way around. For advertisers, that's fine. For enforcement of a law? Bzzzzzz! That's gonna be arbitrary-and-capricious'ed right out of the courtroom doors.