4 ms·

Ehm... A long time developer do think data sent on someone else machine can still be "private"? Ehm... Mh... I have some issue to find a politically correct way

• tsimionescu 2y ago
  On the contrary, laws are the only thing that can protect you form this. Other than simply not using dating apps, there is nothing you can do as an individual to protect yourself from the service. Now, laws in this area are woefully inadequate, even in the best places like Europe's GDPR or California's regulaitons, so in practice I do agree that at the moment shared with a third party == shared with the whole world, to some extent. But this just means we need harsher laws, explicit controls, probably agencies that conduct periodic inspections like the FDA for restaurants etc.
  • kkfx 2y ago
    Well, a simple example: essentially all banks at least inside a nation have some standard open APIs, typically signed XML or JSON, to exchange transactions. In the EU/SEPA for instance is OpenBank API. All banks by laws support it and use it for transfers and so on. No one offer it to their customers. If something happen to your money APPARENTLY licit good luck proving it's not you. You are slave of a service and no law except mandating aforementioned APIs open for all, not just between banks, can really protect you because you can't prove it's not you but someone else who have done something with your money. If your car crash onto a school group on a trip you might state "I've try braking and steering but the car does not respond" (for the rare all-by-wire models who start to appear) beside car logs and third party cam you have nothing to prove you are right. That's because the car it's not really yours but under the control of the OEM at a much deeper access than the limited you have. No laws can protect you except mandating FLOSS cars in their owner hands as he/she wish. Modern cars are services on wheels, you are a slave not knowing of your position. If your emails are on GMail GDPR/HIPAA etc state you have some right, but gives no means to materially verify if Alphabet do not do something from training LLMs to analyses you messages for ads and so on. You are not on their servers and you have no right to inspection their infra. Even if you suspect something and file a complaint a Judge might command Google to share with a third party technician a certain set of infos, but no one can be sure they are true. Even an USA Judge inside USA, so in the same country of Alphabet can't do much to really know what happen on their servers, as you can't know what happen in your CPU, it's a closed source black box. You can be "sure enough" only in technical terms "hey, my computer is not connected, It's composed of hw from different manufactures, running a FLOSS OS I know, ... maybe my files on it's storage are just mine", "the drive in my pocket it's mine, it can't leak data around being not connected with the rest of the world", but not more. If you give some data to a third party no one can really tell you what happen to your data.
    • tsimionescu 2y ago
      You're not at the mercy of any of those things, because we live in a state of law. If these companies mishandle data, they know they are liable for quite a lot of money. For some cases, individual employees are liable personally, potentially even risking prison time. You're speaking from an absurdly low level of trust in instituions. The fact is that banks work, they shield their clients from mass amounts of fraud, and do so reliably over decades. The vast majority of people have never lost a single cent to a bank mistake. Google employees don't have routine access to your emails, and if some group do and use that power and Google gets sued, it will very likely be found out at trial, because most ordinary employees don't perjure themselves to protect colleagues for obvious ilegalities (outside the police, but that's a different discussion). Of course, the chance of actually successfully pursuing a suit against Google is small for a mere mortal, but that's a different issue that has to do with corruption in the system and not a fundamental inability to achieve this.
      • kkfx 2y ago
        It's not a matter of trust in institutions, but a matter of ability to know, not the company but you, that your data are mishandled. How can I know that an Alphabet sysadmin do not use my mails? I can only know because Alphabet state it respect the laws. I have NO PROOF that's true, nor I can't have one. Since I can't prove unlawful handling of "my" data, I can't complaint because I can't even prove such unlawful use exists. Sometimes, here and there we read some scandals about "this coming out of an LLM", "this coming out from a leak" etc, but there is no real proof. One of my past banks at a certain point in time have chosen to suppress the RSA OTP for a mobile crapplication that do soft-token and many more, I've sent a classic GDPR Nightmare Letter to them with many detailed complaint, they answer politely: - we need speaker permissions because you can call customer service from the app, so you can see and act on the screen while talking - we need camera permissions because there are many QR-based payments systems we support - we need precise location and location history because with them we can try to prevent potential misuse of the app - we demand contacts reading and writing to allow you easy transfers, quickly call the right number if you lost your card, .... Essentially 100% is formally justified BUT the app does not run on an emulator or on rooted phones, there is no source code and formally reverse engineer it is forbidden. So essentially I can't prove they access some sensors and data ONLY for the purpose they declare or not. If I can't prove illicit use I can't use my country laws about my privacy.
• perching_aix 2y ago
  > I have some issue to find a politically correct way to state the fact that no damn laws can "protect" people who send anything to a third party The article is exclusively(!) about the technological enforcement of that, not legal, so there really wasn't any need to exercise those apparently weak political correctness muscles of yours in the first place.