5 ms·

> We look forward to discussing the future of telco network security with our ecosystem and industry partners and standardization bodies. We will also continue

• esafak 3y ago
  Google is a large company. One part can do good while another part does bad. It's not as if anybody thinks Pichai is directing it all with any success :)
  • coldtea 3y ago
    Google is a profit-seeking machine who has long shed any "startup" stage principles ("don't be evil" and such) as luxuries. Even the parts that do good feed the parts that do bad.
    • szundi 3y ago
      Agreed
    • surajrmal 3y ago
      Companies have many incentives and they play out in different ways. It's possible to have that result in some things that you think are good and some which you don't. At a certain size, there is no longer a unified set of values holding everything together and inevitably, some values will clash with yours. Lumping everything into one pile is dramatic.
      • coldtea 3y ago
        >Lumping everything into one pile is dramatic. In the end there's a net result. Doesn't matter if it "put out a good backup app", if they also got to own the web or build Skynet.
        • fauigerzigerk 3y ago
          >In the end there's a net result There is, but the financial net result is only known with hindsight. Exactly which actions boost the net result in a particular time frame always remains uncertain. Also, the people who work for corporations have their own goals and net results, such as promoting their own careers or self esteem. Shareholders may wish for a single minded, deterministic, profit seeking machine but that is not a possibility. Capitalism just provides vague, incomplete and even contradictory incentives.
          • coldtea 3y ago
            >There is, but the financial net result is only known with hindsight. I mean a net result regarding the impact it has on society. >Shareholders may wish for a single minded, deterministic, profit seeking machine but that is not a possibility. Yes, but my point is not based on some total purity of absolute profit seeking. It's enough that we can observe for 20 plus years now actions with harmful intentions and harmful effects, primarily motivated and explained by profit seeking. It doesn't have to be Google's (or any companys or organizations) absolute and only priority, nor everybody has to be single-mindedly going for it all of the time, Google doesn't even have to be totally effective in this goal for them to perform profit-increase-oriented harmful actions. I mean, it's such a pedantic point! What you wrote is common sense, and it wasn't contended. I didn't paint them as pure-profit-seeking-pure-evil-nothing-else. Just as an actor that causes harm in pursuit of its profit-seeking.
    • kaba0 3y ago
      Unless you believe Google is controlled on the micro-level by some all-knowing AI with the single goal of profit seeking, and it can ultimately align every one of their goals to profit, that is just an overly naive take. People/bureaucracy is faulty, even at being evil.
      • coldtea 3y ago
        >Unless you believe Google is controlled on the micro-level by some all-knowing AI with the single goal of profit seeking, and it can ultimately align every one of their goals to profit, that is just an overly naive take. Yes, because a company can be a negative actor driven by profit-seeking only if it is "controlled on the micro-level by some all-knowing AI with the single goal of profit seeking, and it can ultimately align every one of their goals to profit". To think otherwise would be naive /s Thanks for the nuance!
  • 2OEH8eoCRo0 3y ago
    That's one way of looking at it. My way of looking at it lately is: Why would a trillion dollar company pay obscene salaries to work on this?
  • jchw 3y ago
    That's, of course, not the point. For example, I believe the Chromium team has done plenty of good, too, but the C-suite, directors and shareholders are at best, completely complicit in a lot of the sketchy, corrupt activity that Google is endeavoring in with standards, Android, etc. So it's difficult to trust them with anything. There are plenty of great people at Google, but they're not able to stop the awful things Google does, so why does it matter?
• Kiro 3y ago
  Out of all the bad things Google has done, WEI was what made you feel that? I don't even think WEI is unanimously bad.
  • surajrmal 3y ago
    It feels like folks reacting to WEI are just riding a wave of publicity and outlash. There are many reasons that WEI sounds like a good idea, but a reasonable debate can't even occur in the current climate. I would like the ability to improve websites' trust in me, and use services that are free of bots, but apparently giving me the ability to do that might somehow endanger folks rights to not do that so I am not going to be allowed to? What's next, people will be outraged that I show my state issued id before entering age restricted stores?
    • adambatkin 3y ago
      I believe that the concern is that it will infringe on some people's ability to use their computers to interact with some websites (something which is vital to living in our modern society). My computers all run Linux and I use Firefox so this is a personal issue for a lot of people. As someone who is only able to use sites like Netflix on my computer through the continued generosity of a bunch of large corporations (honestly it's really good fortune) this makes me extremely uncomfortable. Especially since the whole point of EME was to prevent privacy and it hasn't done that (100% of Netflix content is trivially available to anyone via a multitude of pirate sites) so...
    • michaelmrose 3y ago
      How can parties which have no power have any kind of dialogue with a megacorp with billions of dollars. From a thousand miles up the only level of dissatisfaction that is even noticeable is the kind where people throw their androids in a lake and switch to Apple and Bing. Exactly zero folks are liable to notice that you have a subtle nuanced analysis regarding their strategic direction with a feature. It would be like you telling a star about how you feel about how they wore their hair at a show 3 weeks ago. Your opinion is either invisible or irrelevant.
    • 3y ago
• magicalist 3y ago
  > Ever since Google dropped WEI into our lives, I feel like they should not be allowed to be a part of any security efforts in any standards body or ecosystem. How long until carriers try to limit devices that don't support Google Play or Apple remote attestation of some kind? Wait, so no Google or Apple employees involved in any standards body security efforts. What about TPM? Better ban employees from Intel, AMD, Qualcomm, Microsoft...who's left? I mean, that's a take, but it seems like really the take away is that we should be skeptical of company motivations and security issues in standards bodies should be dealt with transparently, which all seems like a good take?
  • jchw 3y ago
    Until some kind of regulatory action occurs, I especially do not believe Google should be allowed. Intel definitely has its misgivings and conflicts of interest, but Intel doesn't have the same conflicts of interest that Google has. I truly believe Google is off on their own island of being impossible to trust in their current state. Especially not in a world where W3C gleefully standardizes literal DRM.
    • Dah00n 3y ago
      How is it worse when Google wants to implement something that Apple already did? I mean it's bad but being number two to implement it seems like the regulators should look at Apple first, not Google.
      • daurentius523 3y ago
        >I mean it's bad but being number two to implement it Number is irrelevant - power is. >seems like the regulators should look at Apple first, not Google. If some one person company proposed this instead, would you want regulators to look at them first? To put it simply - Apple does not provide OS to smartphones and PCs, it manufactures them. So as long as they do not produce 50% of PCs or 50% of phones or have Microsoft agreeing with their proposal then they are lesser threat (for now). It's like with Monopolies and Cartels - power over market should bring relative response from regulators over company - especially if that company tries to create proposal which invades users privacy.
• notatoad 3y ago
  The WEI discourse is just getting comical. it may be bad for the open internet, or for the browser ecosystem. but it's not a security flaw. to say you don't trust google to be part of any security efforts because they tried to put security in a place you don't want it is silly. you're arguing the slippery slope fallacy here, there's no reason to think that carriers would even want any sort of device attestation, or be legally allowed to do that under the terms of their spectrum licenses.
  • LightHugger 3y ago
    Of course it's a security flaw, but it's a security flaw for the end user, not google. It's google's security, like them putting their own lock on your door that they can a remotely activate on a whim. This is what most humans would call a security flaw, but it's a non traditional one for sure.
    • fauigerzigerk 3y ago
      I guess security is only ever defined with respect to specific security threats. There are quite a few of those "dual use" features where you have a primary purpose of protecting some oligopolist's business model but the incidental side-effects range from beneficial to catastrophic in terms of security for users. Take Apple's side-loading ban for instance. It makes obvious sense for Apple's own interests. Beyond this primary purpose, it protects people against getting tricked into installing malware but it also poses a threat to human rights and freedom of speech as it gives whoever is in power central control over the software people can use to protect themselves. Google's WEI is another such dual use technology that can be portrayed in many different ways, because it really does have different consequences for different people at different times.
  • jchw 3y ago
    ? I didn't say it's a security flaw. The problem is that it's a terrible, user-hostile, open-web-hostile approach to security that shouldn't have even been proposed. >there's no reason to think that carriers would even want any sort of device attestation With the bargaining power that Google has in the mobile space, I strongly suspect they could find a way to entice carriers into moving towards enforcing device attestation. And I don't just mean forcing devices to attest; I mean things like, Hmmm, are you sure you want these untrusted Android devices on your RCS services? > or be legally allowed to do that under the terms of their spectrum licenses. I don't really like relying on hoping the laws will help, but it would be nice to know for sure if they do. Unfortunately, I am assuming you aren't actually positive. Google Fi definitely favors Google devices heavily and there is no supported way to use a non-data-only device without an Android phone with GMS.
• summerlight 3y ago
  > Ever since Google dropped WEI into our lives, I feel like they should not be allowed to be a part of any security efforts in any standards body or ecosystem. Excluding Apple and Google, the remaining bodies are MS, Amazon and Facebook which presence is close to non-existent in the mobile OS market. Good luck with them?
• mindslight 3y ago
  I don't think the stuff in the article is really that great. Google is basically shoring up a few possible avenues of man in the middle attacks. Meanwhile, the mobile ecosystem is still rife with many other avenues - your MVNO, fractured Ma Bell, Play Services still has outsized privileges on standard Android, most apps aren't E2EE (despite the article's bastardized use of the term), etc. It's just this boring corporate security narrative where we're supposed to continue ignoring the 800lb gorillas selling our personal information into countless surveillance databases and focus on how they're closing down possible independent attackers. What would be newsworthy is if they were even talking about real security - libre baseband, mitigating protocol identifiers (eg IMEI) that allow for pervasive location tracking, etc.
• ldehaan 3y ago
  [dead]