4 ms·

I am also doing my part on fighting that, but it is an uphill battle. I will not stop fighting, and I am actively trying to bring my point into the public disco

I am also doing my part on fighting that, but it is an uphill battle. I will not stop fighting, and I am actively trying to bring my point into the public discourse in my country and organize myself in organizations that fight this. Until we have laws that guarantee that I won't be forced to be a Google customer, I will demand freedom over my device if I am practically prevented from running an alternative OS because I risk getting my access to the rest of society limited. If it means that some people will be more vulnerable to scams in the mean time, that is not my fault, but the fault of politicians who have failed to secure our right to digital autonomy and our right to remain analog. I also think there should be other technical measures that could mitigate these scams that would not be as draconic, but I don't know enough about what scams you have in mind that I can offer concrete alternatives. I do not think that is tyranny, but I think Google is definitely being a tyrant and misuse their market position.

notepad0x90 1y ago
I think two things can be true. I agree with most of what you said. I think Google is doing the right thing with the right intent, but they shouldn't be the sole arbiter of who can write apps. It should be similar to the PKI/CA ecosystem, or better yet, governments can directly issue permits of some sort and they could be the CA's.
- ulrikrasmussen 1y ago
  Agreed. What Google is doing is practically inserting themselves as the only CA in this domain. They, a private company, effectively take on the role of policing the digital infrastructure of many countries, but without being a democratically controlled agency. That makes me very very uneasy.
  - notepad0x90 1y ago
    But to be fair, they are doing that with browsers as part of the CA/B forum/group. If google doesn't like your CA, you can't be a CA.
    - ulrikrasmussen 1y ago
      Also a problem, but at least the power is decentralized for now. Also, browsers are not operating systems, and it is easier to switch to another browser if you don't agree with its list of trusted CAs.
      - notepad0x90 1y ago
        All valid points, except no CA can survive when Chrome isn't supporting them. Most users won't switch browsers because one site isn't compatible with Chrome, they're more likely to just use another site. So using that CA costs site owners customers and they in turn will move away from the CA. My point sort of being, there is a deeper problem where industries self-police. People complain about oligarchies, ruling classes and corporations running America but at the same time they don't push for or support governments regulating things like this. Governments should be the arbiters of which CA is legitimate, just as which appstore and which app developer. If you want to treat patients, sell drugs, build bridges, sell cars,etc.. you give your id to the government and validate your credentials. App development as well as all other public safety impacting credential validation should be the same way. If you're in europe, your local government does the validation and OSes like Android will respect the CA's of the country they're operating under. Software should obey laws. And if governments can't be trusted, that isn't a software problem but a political one.

notepad0x90 1y ago

I think two things can be true. I agree with most of what you said. I think Google is doing the right thing with the right intent, but they shouldn't be the sole arbiter of who can write apps. It should be similar to the PKI/CA ecosystem, or better yet, governments can directly issue permits of some sort and they could be the CA's.

ulrikrasmussen 1y ago
Agreed. What Google is doing is practically inserting themselves as the only CA in this domain. They, a private company, effectively take on the role of policing the digital infrastructure of many countries, but without being a democratically controlled agency. That makes me very very uneasy.
- notepad0x90 1y ago
  But to be fair, they are doing that with browsers as part of the CA/B forum/group. If google doesn't like your CA, you can't be a CA.
  - ulrikrasmussen 1y ago
    Also a problem, but at least the power is decentralized for now. Also, browsers are not operating systems, and it is easier to switch to another browser if you don't agree with its list of trusted CAs.
    - notepad0x90 1y ago
      All valid points, except no CA can survive when Chrome isn't supporting them. Most users won't switch browsers because one site isn't compatible with Chrome, they're more likely to just use another site. So using that CA costs site owners customers and they in turn will move away from the CA. My point sort of being, there is a deeper problem where industries self-police. People complain about oligarchies, ruling classes and corporations running America but at the same time they don't push for or support governments regulating things like this. Governments should be the arbiters of which CA is legitimate, just as which appstore and which app developer. If you want to treat patients, sell drugs, build bridges, sell cars,etc.. you give your id to the government and validate your credentials. App development as well as all other public safety impacting credential validation should be the same way. If you're in europe, your local government does the validation and OSes like Android will respect the CA's of the country they're operating under. Software should obey laws. And if governments can't be trusted, that isn't a software problem but a political one.