5 ms·

The people in the industry that I know were/are trying to stop fraudsters, script kiddies, nasty people, and governments from trying to exploit weaknesses and t

The people in the industry that I know were/are trying to stop fraudsters, script kiddies, nasty people, and governments from trying to exploit weaknesses and take unauthorised control of devices and services. The problem with that is it generally requires a central point of trust. Sure you can allow multiple points of trust, but for the unskilled user, that means that the little lock symbol becomes unreliable (or whatever) Without commenting on the UK governments stuff (It is probably full of shit, but then thats what lobbying does) We as technologists need to engage with wider society and understand on their terms, the worries they have. For this particular "proposal" it strikes at the core worry of today's kids. They are sadder, more insular, more dependent on mobile comms and exposed to much nastier stuff than millennials were at the same age. AT my school in the very late 90s, a group of 14 year old girls went to the beach and took a disposable camera. Standard photos apart from one, which was a group of them topless. One of them brought them back from the developers into school. Somehow the topless photo was stolen and passed around various classes. It ruined her month, even though she got the photo back. I suspect it left scars longer than that. Now imagine not being able to get that photo back. Thats the problem for todays kids. One moment of stupidity and a lifetime of consequences. (under a certain age, if they took photos or videos of other kids, that makes them liable to be on a list, for life.) You could say "oh education" but did you listen at that age? Whats worse now is that there are no gates on what photos can be developed by the normal person. If you took any photo that was explicit, it almost certainly wouldn't be printed (hence why there were very little dick pics from that era). Is what the UK government proposing workable? well looking at the OSA, almost certainly not. However unless we, as a tech community engage with society, with useable answers that are understandable to the normal person, then we are going to be crushed by the weight of "something must be done". Absolutism is not our friend here. We need to engage and choose compromises, or lose wider freedom for ever.

jpfromlondon 4mo ago
>We as technologists need to engage with wider society and understand on their terms, the worries they have. We were the vanguard blocking this to the public's benefit, now they've voted for it our only duty is to ourselves; to make sure the rules don't apply to us.
- KaiserPro 4mo ago
  I mean I get that, but don't you also see thats dangerous? I think its perfectly winnable argument. For example we already _had_ age gating in the UK, its just it was at the network level on mobile internet. It worked and was unobtrusive. The antidote to the OSA was to just extend that to domestic internet. That argument was lost, and lost hard. mainly because we didn't engage properly with a believable solution. > to make sure the rules don't apply to us. The point is, they don't really apply to the determined. the same argument could be made for painkiller blister packs. The level of friction that the packs provide reduce drug based impulse suicide by 40% (depending on which study you reference) The argument against it is "I can't be arsed with pressing the little shits out, I just want it easy". The Populist approach is making it prescription only. Unless we engage properly, on the right level, then we are going to be worse off.
AnthonyMouse 4mo ago
> The problem with that is it generally requires a central point of trust. The problem with it is that the people who want to use a central point of trust as a chokepoint for censorship, surveillance and monopolization keep claiming that this is required when it isn't. > Sure you can allow multiple points of trust, but for the unskilled user, that means that the little lock symbol becomes unreliable (or whatever) The premise being that if you have a monopoly then ordinary people can trust it. Only that isn't the case. A monopolist not only can be just as malicious or incompetent as any of the multiple players in a competitive landscape, they're more likely to be because the lack of competitive pressure allows them to be more abusive and complacent and more capable of capturing the government. > under a certain age, if they took photos or videos of other kids, that makes them liable to be on a list, for life That seems like a problem caused by the law. Why is it possible for any actions taken as a minor to cause someone to be put on a permanent list when we recognize that minors aren't mature enough to be held responsible for that? > Now imagine not being able to get that photo back. Now imagine what would be necessary to get it back. It's on some other person's private device. Either you invade everyone's privacy and private communications to check if they might have it or be privately sharing it, or they could be. The cure is worse than the disease.
- KaiserPro 4mo ago
  > That seems like a problem caused by the law. Why is it possible for any actions taken as a minor to cause someone to be put on a permanent list when we recognize that minors aren't mature enough to be held responsible for that? Its a second order effect. The problem is predators get children to take pictures and distribute them. To stop them escaping justice it requires a certain level of absolutism. In Common law, there are exceptions. However people exploit the system. > Now imagine what would be necessary to get it back. It's on some other person's private device. Either you invade everyone's privacy and private communications to check if they might have it or be privately sharing it, or they could be. The cure is worse than the disease. I mean there are loads of ways to look at this. But if we want to have strong controls over your data, then sharing should be controlled by the owner, not the platform. Currently there are no trusted environments that allow people to share securely and privately data without it being copied. My understanding of what is being proposed is that cameras will have basic nudity detection on them, and they will refuse to take the pictures if the device is registered to a person under the age of 18. That, more or less is not privacy invading, depending on how its done. The central point that you are missing here is that something which was quite hard to happen in 1999 was destructive to a child life. Now its much easier to do, and there is an actual economy in sourcing, exploiting and trading these pictures/videos.
trumpdong 4mo ago
In today's world the 14-year-old girl who took a topless beach photo of herself would likely be criminally charged as an adult for production, possession and distribution of child pornography. So there's something about how our legal attitudes have changed too.
cogman10 4mo ago
> were/are trying to stop fraudsters, script kiddies, nasty people, and governments from trying to exploit weaknesses and take unauthorised control of devices and services. While I don't doubt that's a motivation, the problem I have is it's really a question of likelihood. I feel that in terms of security focus it's very common for people to put on blinders and ignore the likelihood of an exploit in favor of "Ooooh look at this thing that COULD be exploited!" It's fundamentally the problem I have with how CVEs are reported and handled in general. In terms of secure boot stopping problems. Yes, it does stop someone from rooting a device which is great. However, someone that has access to root a device almost certainly also has the ability to just install a virus in the OS startup scripts. Or to modify a user executable. Or to modify the user's PATH environment variable to inject a malicious app in front of a commonly used one. That's what I wish security focused people would weigh more heavily when they evaluate these sorts of threats. "What other damage could a malicious individual do if they had the same permissions to pull off this exploit."
- KaiserPro 4mo ago
  > It's fundamentally the problem I have with how CVEs are reported and handled in general. Yes, its more like a popularity contest. But secure boot stopped(or stops) a whole bunch of driver/rootkit exploits, which was a big thing in the late 2000s. It means that a random driver that is inserted by some script kiddie raises a whole bunch of warnings, which it wouldnt have done before. We have come a long way since windows 2000

jpfromlondon 4mo ago

>We as technologists need to engage with wider society and understand on their terms, the worries they have. We were the vanguard blocking this to the public's benefit, now they've voted for it our only duty is to ourselves; to make sure the rules don't apply to us.

KaiserPro 4mo ago
I mean I get that, but don't you also see thats dangerous? I think its perfectly winnable argument. For example we already _had_ age gating in the UK, its just it was at the network level on mobile internet. It worked and was unobtrusive. The antidote to the OSA was to just extend that to domestic internet. That argument was lost, and lost hard. mainly because we didn't engage properly with a believable solution. > to make sure the rules don't apply to us. The point is, they don't really apply to the determined. the same argument could be made for painkiller blister packs. The level of friction that the packs provide reduce drug based impulse suicide by 40% (depending on which study you reference) The argument against it is "I can't be arsed with pressing the little shits out, I just want it easy". The Populist approach is making it prescription only. Unless we engage properly, on the right level, then we are going to be worse off.

AnthonyMouse 4mo ago

> The problem with that is it generally requires a central point of trust. The problem with it is that the people who want to use a central point of trust as a chokepoint for censorship, surveillance and monopolization keep claiming that this is required when it isn't. > Sure you can allow multiple points of trust, but for the unskilled user, that means that the little lock symbol becomes unreliable (or whatever) The premise being that if you have a monopoly then ordinary people can trust it. Only that isn't the case. A monopolist not only can be just as malicious or incompetent as any of the multiple players in a competitive landscape, they're more likely to be because the lack of competitive pressure allows them to be more abusive and complacent and more capable of capturing the government. > under a certain age, if they took photos or videos of other kids, that makes them liable to be on a list, for life That seems like a problem caused by the law. Why is it possible for any actions taken as a minor to cause someone to be put on a permanent list when we recognize that minors aren't mature enough to be held responsible for that? > Now imagine not being able to get that photo back. Now imagine what would be necessary to get it back. It's on some other person's private device. Either you invade everyone's privacy and private communications to check if they might have it or be privately sharing it, or they could be. The cure is worse than the disease.

KaiserPro 4mo ago
> That seems like a problem caused by the law. Why is it possible for any actions taken as a minor to cause someone to be put on a permanent list when we recognize that minors aren't mature enough to be held responsible for that? Its a second order effect. The problem is predators get children to take pictures and distribute them. To stop them escaping justice it requires a certain level of absolutism. In Common law, there are exceptions. However people exploit the system. > Now imagine what would be necessary to get it back. It's on some other person's private device. Either you invade everyone's privacy and private communications to check if they might have it or be privately sharing it, or they could be. The cure is worse than the disease. I mean there are loads of ways to look at this. But if we want to have strong controls over your data, then sharing should be controlled by the owner, not the platform. Currently there are no trusted environments that allow people to share securely and privately data without it being copied. My understanding of what is being proposed is that cameras will have basic nudity detection on them, and they will refuse to take the pictures if the device is registered to a person under the age of 18. That, more or less is not privacy invading, depending on how its done. The central point that you are missing here is that something which was quite hard to happen in 1999 was destructive to a child life. Now its much easier to do, and there is an actual economy in sourcing, exploiting and trading these pictures/videos.

trumpdong 4mo ago

In today's world the 14-year-old girl who took a topless beach photo of herself would likely be criminally charged as an adult for production, possession and distribution of child pornography. So there's something about how our legal attitudes have changed too.

cogman10 4mo ago

> were/are trying to stop fraudsters, script kiddies, nasty people, and governments from trying to exploit weaknesses and take unauthorised control of devices and services. While I don't doubt that's a motivation, the problem I have is it's really a question of likelihood. I feel that in terms of security focus it's very common for people to put on blinders and ignore the likelihood of an exploit in favor of "Ooooh look at this thing that COULD be exploited!" It's fundamentally the problem I have with how CVEs are reported and handled in general. In terms of secure boot stopping problems. Yes, it does stop someone from rooting a device which is great. However, someone that has access to root a device almost certainly also has the ability to just install a virus in the OS startup scripts. Or to modify a user executable. Or to modify the user's PATH environment variable to inject a malicious app in front of a commonly used one. That's what I wish security focused people would weigh more heavily when they evaluate these sorts of threats. "What other damage could a malicious individual do if they had the same permissions to pull off this exploit."

KaiserPro 4mo ago
> It's fundamentally the problem I have with how CVEs are reported and handled in general. Yes, its more like a popularity contest. But secure boot stopped(or stops) a whole bunch of driver/rootkit exploits, which was a big thing in the late 2000s. It means that a random driver that is inserted by some script kiddie raises a whole bunch of warnings, which it wouldnt have done before. We have come a long way since windows 2000