4 ms·

I think it is worthwhile to understand and steelman Stallman [lolz]: Stallman is not anti-security and is indeed pro-privacy[1], i.e. you should be able to dep

by tgma 2y ago

I think it is worthwhile to understand and steelman Stallman [lolz]: Stallman is not anti-security and is indeed pro-privacy[1], i.e. you should be able to deploy security systems to keep your data secure from adversaries. However, a security system should be deployed to protect the user from adversaries, not protect admins from the users and give admins power over the user. It's the power asymmetry that is used to oppress the users that bugs him. (In fact, time and time again, the actual security of the system is a joke, as was in his particular story, but nevertheless the boogeyman is there and is set up by the admins to restrict the users.) Note that we are talking about a different era and deployment of computer systems. I have seen firsthand university systems that are effectively run by students as peers for the most part, but some power-hungry clueless hired admin inevitably comes up and wants to deploy spyware and overprotective policies on the students. [1]: another example of this is Secure Boot. He has no problem with Secure Boot in principle as long as the keys are under the control of the user, not the manufacturer.

hulitu 2y ago
> However, a security system should be deployed to protect the user from adversaries They all (Google, Microsoft and Apple) say that . The problem is that they do the exact opposite. All your user data belongs to Google, Microsoft and Apple because they protect the root user. But all data is in your user account.
- delusional 2y ago
  Notice how that dovetails into stallman's main ideological point. The reason they can want "security" for the user, while actually only protecting themselves, is that they've already perpetrated the original sin of proprietary software. The "user account" isn't an abstraction used to help you, it's an abstraction that serves the companies.
- kalleboo 2y ago
  Huh, but it's Google and Apple operating systems that are the only ones that actually protect user data by sandboxing apps from each other so they can only access their own data? It's the open source operating systems (and MS) that only protect the root account, because they're designed for servers or academic/corporate campuses and not personal computers. If I install a program from a package manager on Linux, it has access to my whole home directory. If I install an app from the Apple App Store, it only has access to the files I specifically tell the OS to open with it.
  - tgma 2y ago
    SELinux is a couple decades old. https://docs.fedoraproject.org/en-US/quick-docs/selinux-getting-started/ https://docs.fedoraproject.org/en-US/quick-docs/selinux-gett...
    - kalleboo 2y ago
      And we get back to "open source operating systems are only designed for servers": "Why doesn't SELinux confine desktop applications" https://access.redhat.com/solutions/1578673 https://access.redhat.com/solutions/1578673 If your text editor can own your account, it doesn't count.
      - DEADMINCE 2y ago
        SELinux can confine desktop applications perfectly fine.
- Andrew_nenakhov 2y ago
  Thing is, Google, Microsoft and Apple are the adversaries.
tgma 2y ago
P.S. Struck me as quite sad to see "Hacker" News crowd who presumably should know better sometime mock RMS, an actual, proven, hacker, without having an understanding of his principles, even if they are not in agreement with them. Rarely people understand what he stands for, that his not the poster child of "Open Source", and all they know is that he ate something off his foot in a video. I sometimes worry most have no idea he wrote an Emacs and he was the one who conceived of much of the operating system they call "Linux."
- mandmandam 2y ago
  He has made some very powerful enemies keen to smear him by any means possible. The quickest and most common way to do this is by labelling someone crazy or a sex offender, both of which are constantly tried against RMS, to the point where there's a whole website to counter the most common misinformation: https://stallmansupport.org/ https://stallmansupport.org/
  - kleiba 2y ago
    I'm sure you didn't mean to imply it but the way your post is worded could be misunderstood as if you were saying that some powerful entity is trying to mute rms through defamation. However, the website you cite points out that the beginning of the whole sex offender thing was a single MIT alumna who wrote a blog post. It seems unlikely that this was part of a greater conspiracy (by big business) to cancel Stallman.
    - lukan 2y ago
      Hm, I do recall many people calling that girl a hired gun from the big proprietary evil bigcorp alliance. And that really put me off, because reading a bit about her with an open mind showed quickly, she was genuinly enraged and a real simple student. She was maybe not right, but her anger was for real. And dismissing this as hired defamination prevents seeing why the outside world has no idea about what RMS want to tell the world.
    - mandmandam 2y ago
efitz 2y ago
Infosec guy here. When you work for a company, the computer issued for your use is not your computer. It belongs to the company. Modern threats often target the user, and often through the web or email. The user is the target. Of course no one who reads hacker news would ever have the same browser logged in with root/admin rights to a company system, and in the same session also be downloading and installing stuff, and browsing to sketchy web sites, and clicking on legit-looking phishing mails. Not to mention that they wouldn’t be doing local development but have a shared component with the production system because it’s not practical to make a staging version of the production service that acts like production. And certainly no one here would ever disable monitoring software, or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value. But believe it or not we see that sort of stuff Every. Single. Day. in infosec. If you can’t stand not having full control over every aspect of your computing environment; if your ego doesn’t allow it- then corporate IT work is probably not for you. But the company has to protect its interests as well, and often that includes setting stuff that makes your life less convenient or violates your ideas that you should be master of your computer. And sometimes there are reasons that you cannot know (like regulatory requirements or consent decrees) and you place the company at significant financial risk if you try to evade those policies. That said, there do exist business that act like big brother - installing essentially managed spyware on your computer. The best thing to do there is resign. But most businesses are just trying to do due diligence in protecting their systems and data (and users), and most users don’t need root access, and many users who think they need root access really don’t, even though it’s convenient.
- tgma 2y ago
  > or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value. You write as if those are things one should feel guilty for. I proudly admit that I have done such things. In my experience, whenever this happens, whenever the user goes above and beyond to do such things, the security team should revisit their values rather than the other way around. Never ever it happens. Feedback is given. Stupid policies remain. At best you get some acknowledgement that they also realize it is stupid but it is what it is. As the tone of your post shows, the security guy thinks they are bestowed a divine power to restrict without fully understanding the trade-offs. That puts the user in an adversarial position with the security team. Stallman's philosophy ultimately sides with the user.
ekidd 2y ago
> Note that we are talking about a different era and deployment of computer systems. Yeah, this is really important to understand. The machines of this era required some degree of physical access, they were shared by entire departments, and in some cases even the CPU instruction set might get changed overnight by students with soldering irons. The student ethos around these machines at the MIT AI Lab was that they were essentially run as anarchist collectives. University management didn't always agree. But frequently the OS, the applications and even some of the hardware had been built by the "anarchist collective." This worked because of the small community size, because of the limited physical access, and because of the high knowledge barrier new users needed to climb to do anything. By the time you'd figured things out (or your peers had taught you), you'd become part of the culture. Communities like this can be fantastic, while they last. But they don't scale. When Stallman talks about security, don't imagine a modern world full of millions of computers connected by networks. Imagine instead someone arguing about the right way to run a local non-profit "hacker space". Should it be run by the membership under tacit social rules, or should they elect someone to enforce lots of strict rules? Or imagine Wikipedia, and how it has evolved. Once, you could just fix articles. Now it's often harder. The original offense that set Stallman on his journey involved a new printer. The AI Lab had a printer with a clever feature: When the paper ran out, it sent a message to everyone in the print queue, and someone would come add paper. The AI Lab bought a printer which couldn't do this. So Stallman tried to get the source code and fix the printer, but he was told he couldn't have the code. This fundamentally annoyed him, so he decided to rebuild literally the entire computer industry so that everyone would always have the code. Stallman has a lot of faults. Some of them deserve serious criticism. And his brain does not work like that of most people. But he's essentially a left-libertarian anarchist who prefers self-organizing communities over centralized authority. His opinions on stuff like security are essentially arguments about a very specific world that was disappearing even in the 80s, one where people would think, "Hey, the OS on the shared machine could be better, so let's fix it tonight." His goal was always to keep some version of that alive.
1vuio0pswjnm7 2y ago
https://www.gnu.org/gnu/thegnuproject.html https://www.gnu.org/gnu/thegnuproject.html

by tgma 2y ago

hulitu 2y ago

> However, a security system should be deployed to protect the user from adversaries They all (Google, Microsoft and Apple) say that . The problem is that they do the exact opposite. All your user data belongs to Google, Microsoft and Apple because they protect the root user. But all data is in your user account.

delusional 2y ago
Notice how that dovetails into stallman's main ideological point. The reason they can want "security" for the user, while actually only protecting themselves, is that they've already perpetrated the original sin of proprietary software. The "user account" isn't an abstraction used to help you, it's an abstraction that serves the companies.
kalleboo 2y ago
Huh, but it's Google and Apple operating systems that are the only ones that actually protect user data by sandboxing apps from each other so they can only access their own data? It's the open source operating systems (and MS) that only protect the root account, because they're designed for servers or academic/corporate campuses and not personal computers. If I install a program from a package manager on Linux, it has access to my whole home directory. If I install an app from the Apple App Store, it only has access to the files I specifically tell the OS to open with it.
- tgma 2y ago
  SELinux is a couple decades old. https://docs.fedoraproject.org/en-US/quick-docs/selinux-getting-started/ https://docs.fedoraproject.org/en-US/quick-docs/selinux-gett...
  - kalleboo 2y ago
    And we get back to "open source operating systems are only designed for servers": "Why doesn't SELinux confine desktop applications" https://access.redhat.com/solutions/1578673 https://access.redhat.com/solutions/1578673 If your text editor can own your account, it doesn't count.
    - DEADMINCE 2y ago
      SELinux can confine desktop applications perfectly fine.
Andrew_nenakhov 2y ago
Thing is, Google, Microsoft and Apple are the adversaries.

tgma 2y ago

P.S. Struck me as quite sad to see "Hacker" News crowd who presumably should know better sometime mock RMS, an actual, proven, hacker, without having an understanding of his principles, even if they are not in agreement with them. Rarely people understand what he stands for, that his not the poster child of "Open Source", and all they know is that he ate something off his foot in a video. I sometimes worry most have no idea he wrote an Emacs and he was the one who conceived of much of the operating system they call "Linux."

mandmandam 2y ago
He has made some very powerful enemies keen to smear him by any means possible. The quickest and most common way to do this is by labelling someone crazy or a sex offender, both of which are constantly tried against RMS, to the point where there's a whole website to counter the most common misinformation: https://stallmansupport.org/ https://stallmansupport.org/
- kleiba 2y ago
  I'm sure you didn't mean to imply it but the way your post is worded could be misunderstood as if you were saying that some powerful entity is trying to mute rms through defamation. However, the website you cite points out that the beginning of the whole sex offender thing was a single MIT alumna who wrote a blog post. It seems unlikely that this was part of a greater conspiracy (by big business) to cancel Stallman.
  - lukan 2y ago
    Hm, I do recall many people calling that girl a hired gun from the big proprietary evil bigcorp alliance. And that really put me off, because reading a bit about her with an open mind showed quickly, she was genuinly enraged and a real simple student. She was maybe not right, but her anger was for real. And dismissing this as hired defamination prevents seeing why the outside world has no idea about what RMS want to tell the world.
  - mandmandam 2y ago

efitz 2y ago

Infosec guy here. When you work for a company, the computer issued for your use is not your computer. It belongs to the company. Modern threats often target the user, and often through the web or email. The user is the target. Of course no one who reads hacker news would ever have the same browser logged in with root/admin rights to a company system, and in the same session also be downloading and installing stuff, and browsing to sketchy web sites, and clicking on legit-looking phishing mails. Not to mention that they wouldn’t be doing local development but have a shared component with the production system because it’s not practical to make a staging version of the production service that acts like production. And certainly no one here would ever disable monitoring software, or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value. But believe it or not we see that sort of stuff Every. Single. Day. in infosec. If you can’t stand not having full control over every aspect of your computing environment; if your ego doesn’t allow it- then corporate IT work is probably not for you. But the company has to protect its interests as well, and often that includes setting stuff that makes your life less convenient or violates your ideas that you should be master of your computer. And sometimes there are reasons that you cannot know (like regulatory requirements or consent decrees) and you place the company at significant financial risk if you try to evade those policies. That said, there do exist business that act like big brother - installing essentially managed spyware on your computer. The best thing to do there is resign. But most businesses are just trying to do due diligence in protecting their systems and data (and users), and most users don’t need root access, and many users who think they need root access really don’t, even though it’s convenient.

tgma 2y ago
> or write a cron job that resets a managed setting to a more palatable one every time the corporate security team enforces a value. You write as if those are things one should feel guilty for. I proudly admit that I have done such things. In my experience, whenever this happens, whenever the user goes above and beyond to do such things, the security team should revisit their values rather than the other way around. Never ever it happens. Feedback is given. Stupid policies remain. At best you get some acknowledgement that they also realize it is stupid but it is what it is. As the tone of your post shows, the security guy thinks they are bestowed a divine power to restrict without fully understanding the trade-offs. That puts the user in an adversarial position with the security team. Stallman's philosophy ultimately sides with the user.

ekidd 2y ago

> Note that we are talking about a different era and deployment of computer systems. Yeah, this is really important to understand. The machines of this era required some degree of physical access, they were shared by entire departments, and in some cases even the CPU instruction set might get changed overnight by students with soldering irons. The student ethos around these machines at the MIT AI Lab was that they were essentially run as anarchist collectives. University management didn't always agree. But frequently the OS, the applications and even some of the hardware had been built by the "anarchist collective." This worked because of the small community size, because of the limited physical access, and because of the high knowledge barrier new users needed to climb to do anything. By the time you'd figured things out (or your peers had taught you), you'd become part of the culture. Communities like this can be fantastic, while they last. But they don't scale. When Stallman talks about security, don't imagine a modern world full of millions of computers connected by networks. Imagine instead someone arguing about the right way to run a local non-profit "hacker space". Should it be run by the membership under tacit social rules, or should they elect someone to enforce lots of strict rules? Or imagine Wikipedia, and how it has evolved. Once, you could just fix articles. Now it's often harder. The original offense that set Stallman on his journey involved a new printer. The AI Lab had a printer with a clever feature: When the paper ran out, it sent a message to everyone in the print queue, and someone would come add paper. The AI Lab bought a printer which couldn't do this. So Stallman tried to get the source code and fix the printer, but he was told he couldn't have the code. This fundamentally annoyed him, so he decided to rebuild literally the entire computer industry so that everyone would always have the code. Stallman has a lot of faults. Some of them deserve serious criticism. And his brain does not work like that of most people. But he's essentially a left-libertarian anarchist who prefers self-organizing communities over centralized authority. His opinions on stuff like security are essentially arguments about a very specific world that was disappearing even in the 80s, one where people would think, "Hey, the OS on the shared machine could be better, so let's fix it tonight." His goal was always to keep some version of that alive.

1vuio0pswjnm7 2y ago

https://www.gnu.org/gnu/thegnuproject.html https://www.gnu.org/gnu/thegnuproject.html