7 ms·

I think us software people tend to think in absolutes. Yes, completely banning VPNs is very difficult. But for a totalitarian government, reducing VPN usage by

by cedws 11mo ago

I think us software people tend to think in absolutes. Yes, completely banning VPNs is very difficult. But for a totalitarian government, reducing VPN usage by say 60% is a win. You only have to make it difficult enough for the layman.

gjsman-1000 11mo ago
I keep citing, as an example of this, speed limits. You can literally break the law by just pushing your foot down harder. It's that easy! Therefore they're pointless. Or, the TSA. They might have taken away my knife, but putting a rock in a sock and hitting someone in the head is an easy workaround. Therefore it's pointless. (Arguing that the law is easy to break has no effect on whether the law is a good idea, should exist, or is effective.)
- thaumasiotes 11mo ago
  Your examples are unlike each other. What stops people from speeding more than they already do is enforcement. The law isn't doing anything. But the TSA isn't a law. The TSA is, notionally, the enforcement. And it doesn't do anything either. So the TSA really is pointless. If you drive around at 30 mph over the limit, you're going to get a ticket, and this traffic cop presence stops people from speeding "too much". If you smuggle explosives onto an airplane, you may die in the crash, but that would have happened regardless of the TSA. The TSA hasn't added any value.
  - brookst 11mo ago
    The examples are similar in that they demonstrate that reducing probability is a reasonable goal, and it is a mistake to say anything imperfect is useless. Your take on TSA seems to be in the imperfect=useless camp. There are good ROI, efficiency, and philosophical reasons to want to abolish TSA, but it seems naive to say there is zero value and their mere existence has not deterred anyone.
    - maxbond 11mo ago
      I think the problem with these examples is that they conflate instrumental goals with terminal goals. People speed to get to a destination faster or to relieve their frustration on the road (street racers notwithstanding). If the cost of speeding increases they'll speed much less, because they're more interested in their terminal goal. There's a lot of elasticity here. Attacking a plane is a terminal goal for terrorists. If it gets harder, they'll do it somewhat less or pursue softer targets. But there's much less elasticity here. So it's less clear that more security measures will result in fewer deaths. That doesn't imply the TSA is useless but I think it might be clarifying to the discussion.
    - adgjlsfhk1 11mo ago
      the problem with TSA is that their effectiveness is near 0. every time there have been tests, ~3/4ths of bombs/guns go straight through. you'd get better accuracy out of a monkey pointing at whoever happens to have a banana in their bag
    - thaumasiotes 11mo ago
      > There are good ROI, efficiency, and philosophical reasons to want to abolish TSA, but it seems naive to say there is zero value and their mere existence has not deterred anyone. Are you familiar with the TSA's measured efficiency? It's not naive at all to say that, below a certain detection threshold, the deterrence value is zero. Compare https://www.loweringthebar.net/2015/06/tsa-successfully-passes-three-security-tests.html https://www.loweringthebar.net/2015/06/tsa-successfully-pass... . You'll notice that what I actually said was "[the TSA doesn't] do anything", which is accurate in a context of accident prevention. I didn't call them imperfect. I called them useless directly. It isn't the case that they do some good work and some bad work. They don't do anything that is useful in any degree.
- ACCount37 11mo ago
  TSA really is pointless, and airport "security" in general is an example of what you get when you keep sacrificing real freedom to fight imaginary threats. If Trump administration was ever serious about reducing government waste, they should have dismantled the TSA.
  - JustExAWS 11mo ago
    Are you really unaware of how often plane hijackings use to occur?
    - fn-mote 11mo ago
      Eyeballing the data [1], it looks like total fatalities in the low 1000s, and roughly 20 hijackings per year 1980-2000. Let's value each human fatality at $1M, and - lacking any knowledge about the subject - cargo also at $1M/incident. That's about $1B in human life loss and $20M/year in cargo. The 2025 budget for ths TSA was over $10B, so we're spending 10x the loss to prevent it. Value each human life at $10M? Then the total value of lives lost over a 20 year span is about one year of TSA spending. [1]: https://ourworldindata.org/data-insights/airline-hijackings-once-relatively-common-are-rare-today https://ourworldindata.org/data-insights/airline-hijackings-...
      - JustExAWS 11mo ago
        You’re completely ignoring the knock on economic effects of lower confidence in flight safety, liability and the not so hypothetical ability of someone to take over a plane and use it to attack ground targets. AirTran for instance went out of business because of one crash. If someone blew up a United plane, I can guarantee you that Delta would increase the security before you got on their flights to instill confidence on passengers. And people act as if airport security and the TSA measures are unique to the US. My wife and I just got into a position where the stars aligned for us to fly a lot post Covid. But during that time the three countries that we have flown out of - London, Costa Rica and Mexico all have the basic same security measure with the slight difference that you can bring liquids on board from LHR because they have newer scanners that supposedly detect explosives. And it’s not just airlines. We also had to go through the same type of security to get on the “Chunnel” from London to France. The only thing that is really theatre is taking off your shoes in the US.
- AnthonyMouse 11mo ago
  > You can literally break the law by just pushing your foot down harder. It's that easy! How are you distinguishing that from any other law? You can literally break the law against theft by just picking someone's pocket. It's that easy! But that was never the argument to begin with. They're proposing a law requiring websites to ban users who visit via a VPN. So to begin with we already have a major difference. The people subject to the law (websites) are different than the people who would be trying to circumvent it (users and VPN services). Meanwhile websites have no actual means to know if someone is using a VPN. There are a zillion VPN services and anyone with an IP address can start one. There is no way for them to comprehensively ban them all. So now what happens? The website bans some VPNs -- they would be doing an incredibly painstaking job if they managed to get three out of every four -- and then the user just tries three or four random VPNs or VPN-equivalents until they find one that works and keeps using that. At this point you could try to prosecute the website for failing, but then you'd be prosecuting everybody because nobody would actually be able to do it. Whereas if making an attempt is sufficient for compliance then they check their compliance box meanwhile everybody is still bypassing it. Which is why it's useless.
AnthonyMouse 11mo ago
> I think us software people tend to think in absolutes. "Software people" have an above-average understanding of probabilities overall. It's politicians who tend to think in absolutes. If you tell them that the effectiveness of something is poor and vastly exceeded by its costs, they say "so you admit that its effectiveness is more than zero". And then people will instead have to say that something doesn't work when they mean it has low effectiveness or an underwater cost-benefit ratio. Moreover, a lot of things with computers actually are absolutes. You can't backdoor encryption without a massive systemic risk to national security and personal privacy of someone bad getting the keys to everything. You can't allow people to send arbitrary data to each other while preventing them from communicating something you don't want them to -- the same string of bits can have arbitrarily many semantic meanings and that's proven with math, and software can do the math without the user needing to understand it. And the most important one is this: > But for a totalitarian government... A totalitarian government is trying to do something different and illegitimate. Banning VPNs etc. has higher effectiveness as a means for censoring the general population than it does as a means to prevent crimes or limit contraband in a democracy, because criminals will take the required countermeasures when the alternative is being arrested or not getting their fix whereas laymen are less likely to when the alternative is "only" that they don't get to read criticism of the government. "It works better for totalitarian regimes" is an argument for not doing it.
- coldtea 11mo ago
  >"Software people" have an above-average understanding of probabilities overall. It's politicians who tend to think in absolutes. If I had a penny for everytime a software person / nerd on HN and elsewhere made an argument that shows little understanding of probabilities and statistics, or perhaps only a theoritical understand that's context dependent (meaning they know the math, but magically forget them when discussing some specific topic), I'd be rich. >"It works better for totalitarian regimes" is the argument for not doing it Parent is not justyfing them doing it. They are explaining how little exhaustive their implementation can be, while still being effective for their goals.
  - AnthonyMouse 11mo ago

by cedws 11mo ago

gjsman-1000 11mo ago

I keep citing, as an example of this, speed limits. You can literally break the law by just pushing your foot down harder. It's that easy! Therefore they're pointless. Or, the TSA. They might have taken away my knife, but putting a rock in a sock and hitting someone in the head is an easy workaround. Therefore it's pointless. (Arguing that the law is easy to break has no effect on whether the law is a good idea, should exist, or is effective.)

thaumasiotes 11mo ago
Your examples are unlike each other. What stops people from speeding more than they already do is enforcement. The law isn't doing anything. But the TSA isn't a law. The TSA is, notionally, the enforcement. And it doesn't do anything either. So the TSA really is pointless. If you drive around at 30 mph over the limit, you're going to get a ticket, and this traffic cop presence stops people from speeding "too much". If you smuggle explosives onto an airplane, you may die in the crash, but that would have happened regardless of the TSA. The TSA hasn't added any value.
- brookst 11mo ago
  The examples are similar in that they demonstrate that reducing probability is a reasonable goal, and it is a mistake to say anything imperfect is useless. Your take on TSA seems to be in the imperfect=useless camp. There are good ROI, efficiency, and philosophical reasons to want to abolish TSA, but it seems naive to say there is zero value and their mere existence has not deterred anyone.
  - maxbond 11mo ago
    I think the problem with these examples is that they conflate instrumental goals with terminal goals. People speed to get to a destination faster or to relieve their frustration on the road (street racers notwithstanding). If the cost of speeding increases they'll speed much less, because they're more interested in their terminal goal. There's a lot of elasticity here. Attacking a plane is a terminal goal for terrorists. If it gets harder, they'll do it somewhat less or pursue softer targets. But there's much less elasticity here. So it's less clear that more security measures will result in fewer deaths. That doesn't imply the TSA is useless but I think it might be clarifying to the discussion.
  - adgjlsfhk1 11mo ago
    the problem with TSA is that their effectiveness is near 0. every time there have been tests, ~3/4ths of bombs/guns go straight through. you'd get better accuracy out of a monkey pointing at whoever happens to have a banana in their bag
  - thaumasiotes 11mo ago
    > There are good ROI, efficiency, and philosophical reasons to want to abolish TSA, but it seems naive to say there is zero value and their mere existence has not deterred anyone. Are you familiar with the TSA's measured efficiency? It's not naive at all to say that, below a certain detection threshold, the deterrence value is zero. Compare https://www.loweringthebar.net/2015/06/tsa-successfully-passes-three-security-tests.html https://www.loweringthebar.net/2015/06/tsa-successfully-pass... . You'll notice that what I actually said was "[the TSA doesn't] do anything", which is accurate in a context of accident prevention. I didn't call them imperfect. I called them useless directly. It isn't the case that they do some good work and some bad work. They don't do anything that is useful in any degree.
ACCount37 11mo ago
TSA really is pointless, and airport "security" in general is an example of what you get when you keep sacrificing real freedom to fight imaginary threats. If Trump administration was ever serious about reducing government waste, they should have dismantled the TSA.
- JustExAWS 11mo ago
  Are you really unaware of how often plane hijackings use to occur?
  - fn-mote 11mo ago
    Eyeballing the data [1], it looks like total fatalities in the low 1000s, and roughly 20 hijackings per year 1980-2000. Let's value each human fatality at $1M, and - lacking any knowledge about the subject - cargo also at $1M/incident. That's about $1B in human life loss and $20M/year in cargo. The 2025 budget for ths TSA was over $10B, so we're spending 10x the loss to prevent it. Value each human life at $10M? Then the total value of lives lost over a 20 year span is about one year of TSA spending. [1]: https://ourworldindata.org/data-insights/airline-hijackings-once-relatively-common-are-rare-today https://ourworldindata.org/data-insights/airline-hijackings-...
    - JustExAWS 11mo ago
      You’re completely ignoring the knock on economic effects of lower confidence in flight safety, liability and the not so hypothetical ability of someone to take over a plane and use it to attack ground targets. AirTran for instance went out of business because of one crash. If someone blew up a United plane, I can guarantee you that Delta would increase the security before you got on their flights to instill confidence on passengers. And people act as if airport security and the TSA measures are unique to the US. My wife and I just got into a position where the stars aligned for us to fly a lot post Covid. But during that time the three countries that we have flown out of - London, Costa Rica and Mexico all have the basic same security measure with the slight difference that you can bring liquids on board from LHR because they have newer scanners that supposedly detect explosives. And it’s not just airlines. We also had to go through the same type of security to get on the “Chunnel” from London to France. The only thing that is really theatre is taking off your shoes in the US.
AnthonyMouse 11mo ago
> You can literally break the law by just pushing your foot down harder. It's that easy! How are you distinguishing that from any other law? You can literally break the law against theft by just picking someone's pocket. It's that easy! But that was never the argument to begin with. They're proposing a law requiring websites to ban users who visit via a VPN. So to begin with we already have a major difference. The people subject to the law (websites) are different than the people who would be trying to circumvent it (users and VPN services). Meanwhile websites have no actual means to know if someone is using a VPN. There are a zillion VPN services and anyone with an IP address can start one. There is no way for them to comprehensively ban them all. So now what happens? The website bans some VPNs -- they would be doing an incredibly painstaking job if they managed to get three out of every four -- and then the user just tries three or four random VPNs or VPN-equivalents until they find one that works and keeps using that. At this point you could try to prosecute the website for failing, but then you'd be prosecuting everybody because nobody would actually be able to do it. Whereas if making an attempt is sufficient for compliance then they check their compliance box meanwhile everybody is still bypassing it. Which is why it's useless.

AnthonyMouse 11mo ago

> I think us software people tend to think in absolutes. "Software people" have an above-average understanding of probabilities overall. It's politicians who tend to think in absolutes. If you tell them that the effectiveness of something is poor and vastly exceeded by its costs, they say "so you admit that its effectiveness is more than zero". And then people will instead have to say that something doesn't work when they mean it has low effectiveness or an underwater cost-benefit ratio. Moreover, a lot of things with computers actually are absolutes. You can't backdoor encryption without a massive systemic risk to national security and personal privacy of someone bad getting the keys to everything. You can't allow people to send arbitrary data to each other while preventing them from communicating something you don't want them to -- the same string of bits can have arbitrarily many semantic meanings and that's proven with math, and software can do the math without the user needing to understand it. And the most important one is this: > But for a totalitarian government... A totalitarian government is trying to do something different and illegitimate. Banning VPNs etc. has higher effectiveness as a means for censoring the general population than it does as a means to prevent crimes or limit contraband in a democracy, because criminals will take the required countermeasures when the alternative is being arrested or not getting their fix whereas laymen are less likely to when the alternative is "only" that they don't get to read criticism of the government. "It works better for totalitarian regimes" is an argument for not doing it.

coldtea 11mo ago
>"Software people" have an above-average understanding of probabilities overall. It's politicians who tend to think in absolutes. If I had a penny for everytime a software person / nerd on HN and elsewhere made an argument that shows little understanding of probabilities and statistics, or perhaps only a theoritical understand that's context dependent (meaning they know the math, but magically forget them when discussing some specific topic), I'd be rich. >"It works better for totalitarian regimes" is the argument for not doing it Parent is not justyfing them doing it. They are explaining how little exhaustive their implementation can be, while still being effective for their goals.
- AnthonyMouse 11mo ago