7 ms·

The problem here is that most people don't give a crap. I was explaining this situation to my girlfriend last night over a drink. She's a high level academic wi

by baz00 3y ago

The problem here is that most people don't give a crap. I was explaining this situation to my girlfriend last night over a drink. She's a high level academic with a strong mathematical and logical background in a different field but she didn't really formulate an opinion on it past "if my stuff keeps working, why is it a problem?". Which is fair, because it's a hypothetical risk, but the side effects are a net negative and the open nature of the web is at risk. As always people see the happy path down the middle of the forest, not the creatures waiting to leap out and eat them two steps down the line.

genocidicbunny 3y ago
> "if my stuff keeps working, why is it a problem?" "Is your stuff going to keep working? There's literally a website dedicated to the products Google has killed. What makes you think you're so special that they won't do that to something you use?" Of course, you're probably sleeping on the couch that evening...
- baz00 3y ago
  Well that's exactly it. Her entire professional life is also tied to a free Gmail account she refuses to pay for too.
  - genocidicbunny 3y ago
    I will preface this with the agreement that I am kind of an asshole on some things. With that out of the way... I would find quite a bit of value in getting that person locked out of their google accounts and forcing them to deal with the consequences; Especially if the lock-out was just me getting in and changing their password so that their access can still be recovered. A little controlled scare would be far better than getting locked out at some unknown/unprepared-for point in the future. So perhaps in your case, the wise thing to do would be to ask your gf to try to pretend she was locked out of her google accounts for a week. Force her to see how much she relies on it, and how bad it is when that spf actually fails. You could probably accomplish it by allowing her to change the password to something she doesn't know for a week.
    - baz00 3y ago
      I would agree but it's best to boil the frog slowly I find. One divorce was enough here ;). I've just got her to back up her stuff onto OneDrive and an external disk so if she's hacked or the house burns down then she's covered. Next is MFA. Then a custom email address which will feed into your point. I'm selling it on taking control of her identity.
- tzs 3y ago
  Here's how that argument would go: GF: "If my stuff keeps working, why is it a problem?" BF: "Is your stuff going to keep working? There's literally a website dedicated to the products Google has killed. What makes you think you're so special that they won't do that to something you use?" GF: "If Google deploys this and then kills it, my stuff will keep working. So why is it a problem?" ...and she would be right. If it doesn't break her stuff when some websites start relying on it for user device attestation, then if Google kills it making it so sites can no longer use it for user device attestation those sites aren't going to just say "Oh no! User device attestation no longer works! Let's shut down the site!". They will go back to whatever they were doing before it became available.
KnobbleMcKnees 3y ago
Sounds like a variant of the "nothing to hide" argument which, IMO, isn't particularly logical.
- baz00 3y ago
  I don't think it's the same. It's more the assumption that stuff is going to keep working forever. A lot of us have been around long enough to see the change. Many haven't. Their first email address may have been a gmail.com one for example and they still have it. I mean a friend of mine still has a hotmail address from the late 1990s that works.
- lozenge 3y ago
  It's closer to explaining Coca-Cola anti-union murders in Colombia or the use of child labor and forced labor in P&G palm oil products. "I can keep buying this stuff, and can't practically avoid it, therefore it doesn't affect me." Most people don't want to dedicate hours a day to a "vote with your feet" attempt that will not even register on corporations' balance sheets.
  - KnobbleMcKnees 3y ago
    There's a difference between active boycott and explicitly stating you don't really care. You can be against something and not have the resource to fight it. The person in question said they don't see the problem which is the former.
geocar 3y ago
> she didn't really formulate an opinion on it past "if my stuff keeps working, why is it a problem?". Once upon a time, I was a homeless teenager running from a cult. If not for software I wouldn't have gotten out of that. WEI (and other such things) are mainly about regulating who is allowed to write software, and so the way I think about it is this: If WEI existed when I was a homeless teenager, I might be dead. I do not think I would like your girlfriend very much if she said keeping "her" stuff working was more important than my life, although I could understand her not understanding how big of a deal it is when you talk abstractly about the "open nature of the web" without putting it into human terms; The "open" part is really important to get across because it means anyone who has the ability to can contribute: Does such a high level academic with a strong mathematical and logical background understand what can be lost not just to industry, but to science itself when a church wants to name itself the arbiter of who can work?
- charcircuit 3y ago
  >WEI (and other such things) are mainly about regulating who is allowed to write software No, it's about being able to prove that your device is secure. Attestation doesn't stop you from writing software for your device. >if she said keeping "her" stuff working was more important than my life Arguing that you would be dead if your viewpoint isn't correct is a bad argument. >what can be lost not just to industry, but to science itself when a church wants to name itself the arbiter of who can work? It would be a better analogy to say that "employers can run background checks on people who want to work for them." Because it is up to each website to choose which attestors they trust and the websites have the choice of doing whatever they want with information or not requiring attestation at all.
  - Pannoniae 3y ago
    It doesn't prove that your device is secure at all. It just "secures" it from the user, not from malware. Even if it's signed and approved, malware can still hijack it....
    - charcircuit 3y ago
a_c 3y ago
Many things have a "if my stuff keeps working, why is it a problem?" vibe. On personal level we have health - why can't I have fries and ice cream all day, everyday. That's what any sensible children would choose. Education - why can't I play video games and watch tik tok attention grabbing videos all day. In fact many do. On country level, why would we want to help Ukraine or Taiwan. Why would we want to reduce carbon footprint. Stuff just keeps working. Lead pipe worked just fine. Asbestos worked just fine. Smoking was just fine. Until they aren't. Secondary effects require experience and education. We are not so good at grasping causal relationship when the results aren't immediate.
nologic01 3y ago
> The problem here is that most people don't give a crap Most people are not qualified to give a crap. We don't adopt medicines on the basis of "most people's" opinion, we don't adopt anything technological with potentially harmful impact on the basis of the opinion of large uninformed masses. Thats why we have regulators and other institutions that should be informed and give an informed crap. On a ongoing basis and not only a result of popular outrage. Which brings us to regulatory capture and said institutions actually failing their mandate to serve the interests of the people that fund them. But now we have something that most people should give a crap about. This is not technical, it goes to the foundation of democracy and governance. Otherwise we might as well stop voting and accept we live in a corporate oligarchy.
- flagrant_taco 3y ago
  This can be a really dangerous approach though. Appeals to authority can easily turn dark if the wrong authority is in charge, and by then the people have been conditioned to blindly follow them. People should never be expected to make meaningful decisions in their life only because someone with degrees said it's best for them, or even worse make no decision because the leader already made it for them. People need to be able to think for themselves and make their own decisions, even if the few experts may disagree with the decisions made. In my opinion, this should have been the most important lesson from three years of pandemic response. We had a small group of experts getting out over their skis and speaking with certainty about the virus and what everyone must do. In reality these experts had much less research-based data to support this level of confidence, and in some cases the data even contradicted them. In the meantime we were all forced or coerced into various decisions and protocols that didn't seem to pan out, for a virus that we once got kicked off social media platforms for comparing to the cold or flu while that's precisely how said experts discuss it today. Experts should absolutely weigh in and attempt to educate people on what's at stake and why they should make one decision of another. But a system in which a few at the top decide for and control the rest of the population is extremely dangerous and should be reserved for only the absolutely most important situations.
  - nologic01 3y ago
63stack 3y ago
>"if my stuff keeps working, why is it a problem?" I find the easiest way to make these people think, is to attack it from a money angle. Disregard all the ideological, practical, security, surveillance related issues. Ask them how would they feel if from tomorrow, they would need to shell out money, a $100 equivalent of their local currency when buying any kind of computer (ipads, mobile phones, pcs, macs) for a stamp of approval, and then having to fork over $10 every month for renewing an "attestation license". You are not forced to get this stamp. There will be some websites restricted that you can't access, but your computer will keep working fine. First it will be your bank website, then streaming sites, then food ordering services, and so on, until eventually all the major services will be walled off until you pay. Because that's what will happen (among other things). All this infrastructure will need setup, maintenance, and it will not be free, and you can bet your ass that FAANG (or whoever will be running the attestation services) will be charging whoever is using their services, and they will be forwarding the bill to you, the end user.
- hahn-kev 3y ago
  It sounds like you are describing an internet that could run without ads and by paying instead. Interesting.
  - 63stack 3y ago
    Right? Instead we will get surveillance, walled gardens, locked out devices, centralized control, pay for all this, and still have ads.
  - danShumway 3y ago
    > describing an internet that could run without ads and by paying instead How are you drawing this conclusion? What about paying Apple for verification would imply that any of that money would go to the websites you're visiting, or would make it any easier for those websites to collect payments from you?
  - rolph 3y ago
    internet with ads, that you have to pay for, seems to be the endgame
deleted 3y ago
[deleted]

by baz00 3y ago

genocidicbunny 3y ago

> "if my stuff keeps working, why is it a problem?" "Is your stuff going to keep working? There's literally a website dedicated to the products Google has killed. What makes you think you're so special that they won't do that to something you use?" Of course, you're probably sleeping on the couch that evening...

baz00 3y ago
Well that's exactly it. Her entire professional life is also tied to a free Gmail account she refuses to pay for too.
- genocidicbunny 3y ago
  I will preface this with the agreement that I am kind of an asshole on some things. With that out of the way... I would find quite a bit of value in getting that person locked out of their google accounts and forcing them to deal with the consequences; Especially if the lock-out was just me getting in and changing their password so that their access can still be recovered. A little controlled scare would be far better than getting locked out at some unknown/unprepared-for point in the future. So perhaps in your case, the wise thing to do would be to ask your gf to try to pretend she was locked out of her google accounts for a week. Force her to see how much she relies on it, and how bad it is when that spf actually fails. You could probably accomplish it by allowing her to change the password to something she doesn't know for a week.
  - baz00 3y ago
    I would agree but it's best to boil the frog slowly I find. One divorce was enough here ;). I've just got her to back up her stuff onto OneDrive and an external disk so if she's hacked or the house burns down then she's covered. Next is MFA. Then a custom email address which will feed into your point. I'm selling it on taking control of her identity.
tzs 3y ago
Here's how that argument would go: GF: "If my stuff keeps working, why is it a problem?" BF: "Is your stuff going to keep working? There's literally a website dedicated to the products Google has killed. What makes you think you're so special that they won't do that to something you use?" GF: "If Google deploys this and then kills it, my stuff will keep working. So why is it a problem?" ...and she would be right. If it doesn't break her stuff when some websites start relying on it for user device attestation, then if Google kills it making it so sites can no longer use it for user device attestation those sites aren't going to just say "Oh no! User device attestation no longer works! Let's shut down the site!". They will go back to whatever they were doing before it became available.

KnobbleMcKnees 3y ago

Sounds like a variant of the "nothing to hide" argument which, IMO, isn't particularly logical.

baz00 3y ago
I don't think it's the same. It's more the assumption that stuff is going to keep working forever. A lot of us have been around long enough to see the change. Many haven't. Their first email address may have been a gmail.com one for example and they still have it. I mean a friend of mine still has a hotmail address from the late 1990s that works.
lozenge 3y ago
It's closer to explaining Coca-Cola anti-union murders in Colombia or the use of child labor and forced labor in P&G palm oil products. "I can keep buying this stuff, and can't practically avoid it, therefore it doesn't affect me." Most people don't want to dedicate hours a day to a "vote with your feet" attempt that will not even register on corporations' balance sheets.
- KnobbleMcKnees 3y ago
  There's a difference between active boycott and explicitly stating you don't really care. You can be against something and not have the resource to fight it. The person in question said they don't see the problem which is the former.

geocar 3y ago

> she didn't really formulate an opinion on it past "if my stuff keeps working, why is it a problem?". Once upon a time, I was a homeless teenager running from a cult. If not for software I wouldn't have gotten out of that. WEI (and other such things) are mainly about regulating who is allowed to write software, and so the way I think about it is this: If WEI existed when I was a homeless teenager, I might be dead. I do not think I would like your girlfriend very much if she said keeping "her" stuff working was more important than my life, although I could understand her not understanding how big of a deal it is when you talk abstractly about the "open nature of the web" without putting it into human terms; The "open" part is really important to get across because it means anyone who has the ability to can contribute: Does such a high level academic with a strong mathematical and logical background understand what can be lost not just to industry, but to science itself when a church wants to name itself the arbiter of who can work?

charcircuit 3y ago
>WEI (and other such things) are mainly about regulating who is allowed to write software No, it's about being able to prove that your device is secure. Attestation doesn't stop you from writing software for your device. >if she said keeping "her" stuff working was more important than my life Arguing that you would be dead if your viewpoint isn't correct is a bad argument. >what can be lost not just to industry, but to science itself when a church wants to name itself the arbiter of who can work? It would be a better analogy to say that "employers can run background checks on people who want to work for them." Because it is up to each website to choose which attestors they trust and the websites have the choice of doing whatever they want with information or not requiring attestation at all.
- Pannoniae 3y ago
  It doesn't prove that your device is secure at all. It just "secures" it from the user, not from malware. Even if it's signed and approved, malware can still hijack it....
  - charcircuit 3y ago

a_c 3y ago

Many things have a "if my stuff keeps working, why is it a problem?" vibe. On personal level we have health - why can't I have fries and ice cream all day, everyday. That's what any sensible children would choose. Education - why can't I play video games and watch tik tok attention grabbing videos all day. In fact many do. On country level, why would we want to help Ukraine or Taiwan. Why would we want to reduce carbon footprint. Stuff just keeps working. Lead pipe worked just fine. Asbestos worked just fine. Smoking was just fine. Until they aren't. Secondary effects require experience and education. We are not so good at grasping causal relationship when the results aren't immediate.

nologic01 3y ago

> The problem here is that most people don't give a crap Most people are not qualified to give a crap. We don't adopt medicines on the basis of "most people's" opinion, we don't adopt anything technological with potentially harmful impact on the basis of the opinion of large uninformed masses. Thats why we have regulators and other institutions that should be informed and give an informed crap. On a ongoing basis and not only a result of popular outrage. Which brings us to regulatory capture and said institutions actually failing their mandate to serve the interests of the people that fund them. But now we have something that most people should give a crap about. This is not technical, it goes to the foundation of democracy and governance. Otherwise we might as well stop voting and accept we live in a corporate oligarchy.

flagrant_taco 3y ago
This can be a really dangerous approach though. Appeals to authority can easily turn dark if the wrong authority is in charge, and by then the people have been conditioned to blindly follow them. People should never be expected to make meaningful decisions in their life only because someone with degrees said it's best for them, or even worse make no decision because the leader already made it for them. People need to be able to think for themselves and make their own decisions, even if the few experts may disagree with the decisions made. In my opinion, this should have been the most important lesson from three years of pandemic response. We had a small group of experts getting out over their skis and speaking with certainty about the virus and what everyone must do. In reality these experts had much less research-based data to support this level of confidence, and in some cases the data even contradicted them. In the meantime we were all forced or coerced into various decisions and protocols that didn't seem to pan out, for a virus that we once got kicked off social media platforms for comparing to the cold or flu while that's precisely how said experts discuss it today. Experts should absolutely weigh in and attempt to educate people on what's at stake and why they should make one decision of another. But a system in which a few at the top decide for and control the rest of the population is extremely dangerous and should be reserved for only the absolutely most important situations.
- nologic01 3y ago

63stack 3y ago

>"if my stuff keeps working, why is it a problem?" I find the easiest way to make these people think, is to attack it from a money angle. Disregard all the ideological, practical, security, surveillance related issues. Ask them how would they feel if from tomorrow, they would need to shell out money, a $100 equivalent of their local currency when buying any kind of computer (ipads, mobile phones, pcs, macs) for a stamp of approval, and then having to fork over $10 every month for renewing an "attestation license". You are not forced to get this stamp. There will be some websites restricted that you can't access, but your computer will keep working fine. First it will be your bank website, then streaming sites, then food ordering services, and so on, until eventually all the major services will be walled off until you pay. Because that's what will happen (among other things). All this infrastructure will need setup, maintenance, and it will not be free, and you can bet your ass that FAANG (or whoever will be running the attestation services) will be charging whoever is using their services, and they will be forwarding the bill to you, the end user.

hahn-kev 3y ago
It sounds like you are describing an internet that could run without ads and by paying instead. Interesting.
- 63stack 3y ago
  Right? Instead we will get surveillance, walled gardens, locked out devices, centralized control, pay for all this, and still have ads.
- danShumway 3y ago
  > describing an internet that could run without ads and by paying instead How are you drawing this conclusion? What about paying Apple for verification would imply that any of that money would go to the websites you're visiting, or would make it any easier for those websites to collect payments from you?
- rolph 3y ago
  internet with ads, that you have to pay for, seems to be the endgame

deleted 3y ago

[deleted]