6 ms·

Feudal Security

132 points by skeltoac 14y ago

debacle 14y ago
Nothing is going to happen with digital security rights so long as the NSA wants to be able to store everything indefinitely and we have a Congress that can't even agree on more critical issues like the budget. It wont be an issue unless people make it, and for most people security isn't even a consideration.
dsr_ 14y ago
People tend to infer two-way bargains that have some degree of fairness; they are upset when those expectations are violated. The general bargain is "You provide some services, I agree to let you see the data that I put in and either show me some advertising or charge me a small fee." This holds true for Facebook, Google, Apple... The problem is that many people assume that their data will be kept reasonably (not perfectly) private. Advertisers get to specify the attributes of people who will see their ads (age, large geographical area, expressed interests) and not, say, phone number, name, birthday and address. But that bargain has not actually been struck. And if you do read the pages and pages of legalese, and manage to comprehend it all, it can still all be changed out from under you. People who realize this generally aren't happy about it.
jiggy2011 14y ago
My guess is we get far less cases of minor security breaches "my computer has a virus and I lost some files" but occasionally suffer massive scale data breaches. For example "somebody got into my facebook, bank and dropbox and has stolen my identity". The amount of software that is being automatically downloaded , installed and executed every day on millions of devices from a handful of "trusted" servers is really quite frightening. You just know that someone out there is busy trying to work out how to forge Apple certificates.
olalonde 14y ago
I'd rather trust cloud provider X then have the government regulate the Internet. Please, let's not go down that slippery slope!
- xmpir 14y ago
  I don't agree. The cloud provider is a company only existing for the sake of generating revenue for the share-holders of this company. The government is a (usually) democratically elected institution. That is why I prefer to trust governments.
  - charonn0 14y ago
    The advantage of a cloud provider is that you can unilaterally sever the relationship without serious penalty.
    - xmpir 14y ago
      Only if the government provides the right law...
    - xmpir 14y ago
      What I tried to say is: we need the government to regulate the internet in terms of providing the right laws so users actually can take action against providers misusing their data. Just turning away from the provider is not the solution (from my point of view).
    - B-Con 14y ago
      You can? Migrate everything from Google to Apple. Then check back in 5 years and see if it's as painless. That was one of the author's points. We're becoming a culture where you pretty much buy into one provider or another provider. One of his assumptions was that it's only going to get more locked in and more difficult to switch. His conclusions were thinking about the future based on those assumptions.
      - charonn0 14y ago
        I never said painless. However Apple doesn't have (yet) the power to imprison or execute anti-Apple subversives. Vive la résistance!
- davegauer 14y ago
spindritf 14y ago
I'd rather have the freedom of choosing a feudal e-lord than trust governmental regulations. Maybe there's a reporting bias but the ones I hear about are always god-awful. From seizing domains[1], blocking fairly random sites[2] to threatening ISPs over content[3], governments make Google, Canonical and the like look very attractive in comparison. Especially considering you can dump them with only moderate effort and cost. [1] http://arstechnica.com/tech-policy/2012/11/feds-seize-101-domains-for-counterfeiting-in-cyber-monday-operation/ http://arstechnica.com/tech-policy/2012/11/feds-seize-101-do... [2] https://torrentfreak.com/uk-isps-block-pirate-bays-artist-promotions-121202/ https://torrentfreak.com/uk-isps-block-pirate-bays-artist-pr... [3] http://olgierd.bblog.pl/wpis,jak;urzad;celny;bogu;ducha;winny;portal;odcinal;od;internetu,86592.html http://olgierd.bblog.pl/wpis,jak;urzad;celny;bogu;ducha;winn...
- jff 14y ago
  Is the government offering to provide Internet services to you? You're comparing apples and oranges. A government still can, and will, seize domains, block sites, and issue takedowns and warrants on content to Google. Suppose I own xyzzy.com, set up to use Google Apps to handle mail and serve some web pages. Just like if I was hosting at home or in a colo somewhere, the government can still come in and demand the data. In fact, the biggest difference is that companies like Google are more likely to just roll over--see the stories about cell carriers just handing over tons of information just because law enforcement said please.
  - spindritf 14y ago
    And did the actions governments have taken inspire your trust to give them even more control? > companies like Google are more likely to just roll over More likely than who?
    - jff 14y ago
      If I self-host, for example, then I can hold on to my stuff until either I get a subpoena or the cops show up with a warrant. In the meantime, I can decide if I want to risk charges for destroying any evidence, I can call for lawyers, all these various actions I can take before my data gets handed over. Beats the hell out of getting an email to your backup account: "Your domain has been taken down at the request of law enforcement. Please have a nice day. Do not reply to this message."
saturdaysaint 14y ago
repost - http://news.ycombinator.com/item?id=4831842 http://news.ycombinator.com/item?id=4831842
deleted 14y ago
[deleted]
uvdiv 14y ago
...it's time we step in in our role as governments (both national and international) to create the regulatory environments that protect us... Or putting on other imaginary hats: ...it's time we step in in our role as technology corporations to circumvent and mitigate broken government regulations which harm our customers... ...it's time we step in in our role as malevolent crackers to cease-and-desist thieving things which do not belong to us... ...it's time we as terrorists, child pornographers, and film pirates stop doing naughty things, so that people stop asking for digital surveillance... How is the counterfactual, "we the governments", any more sensible than the "we the corporations", or the sillier ones? Schneier isn't a government. Inference along the aligns of "If I were the government I would...", in a democracy where you and everyone who kind-of agrees with you are an insignificant fringe, is barely more rational than pretending to be any other third party. The main effect of this reasoning flaw is to accede more powers to the biggest digital-rights threat of all, national governments, out of the fatal illusion that they will be used to protect you, as imagined in your "If I were government" fantasy. The evidence strongly suggests that the government--which you are not--would much rather use new powers against you, to the benefit of established, paying clients (MPAA). ...we, as private citizens, should oppose regulation of our networks, because governments have been very bad at it, and we do not control them well enough to expect better.
- nhaehnle 14y ago
  How is the counterfactual, "we the governments", any more sensible than the "we the corporations", or the sillier ones? For the obvious reason that governments, at least in democratic countries, are supposed to be about the people governing themselves. Governments are a means to solve cooperation problems. Sure, this theory does not perfectly translate into practice. But it is the normative ideal of democracy. Hence your comment just comes off as snarky without really adding much to the discussion other than the point that yes, government power also must be restricted when it comes to information, just like it must be restricted in other areas of life. This is a useful point, but one that you might have made using much fewer words.
  - sophacles 14y ago
    You need to understand the mindset of people like him. Basically the idea is that government is a single, monolithic entity that behaves stricly as an incompetent buffoon in all circumstances. Any good that comes from any subset of it is strictly accidental and must have been because others shepherded them to OKness, while any subset that does bad is proof the the whole is corrupt and incompetent. Further, any attempts at fixing it are obviously flawed because the government monolith is by definition unfixable. Further, the cognitive dissonance in this viewpoint is strong, in that they can see how treating any other composite entity, e.g. corporations, or a single corporation, or whatever as a monolith will be ridiculed as "you can't judge this composite entity as a whole based on a subset of it's components". Similarly when the effects of the entities they like look like the results the fear from the government, it is all OK, because some magical thinking results in not understanding what a choice really is (namely that somehow being forced to do something because it is the only choice that minimizes harm when the mechanism is not government is freedom, but when it is government it is tyranny).
deleted 14y ago
[deleted]

132 points by skeltoac 14y ago

Nothing is going to happen with digital security rights so long as the NSA wants to be able to store everything indefinitely and we have a Congress that can't even agree on more critical issues like the budget. It wont be an issue unless people make it, and for most people security isn't even a consideration.

dsr_ 14y ago

People tend to infer two-way bargains that have some degree of fairness; they are upset when those expectations are violated. The general bargain is "You provide some services, I agree to let you see the data that I put in and either show me some advertising or charge me a small fee." This holds true for Facebook, Google, Apple... The problem is that many people assume that their data will be kept reasonably (not perfectly) private. Advertisers get to specify the attributes of people who will see their ads (age, large geographical area, expressed interests) and not, say, phone number, name, birthday and address. But that bargain has not actually been struck. And if you do read the pages and pages of legalese, and manage to comprehend it all, it can still all be changed out from under you. People who realize this generally aren't happy about it.

jiggy2011 14y ago

My guess is we get far less cases of minor security breaches "my computer has a virus and I lost some files" but occasionally suffer massive scale data breaches. For example "somebody got into my facebook, bank and dropbox and has stolen my identity". The amount of software that is being automatically downloaded , installed and executed every day on millions of devices from a handful of "trusted" servers is really quite frightening. You just know that someone out there is busy trying to work out how to forge Apple certificates.

olalonde 14y ago

I'd rather trust cloud provider X then have the government regulate the Internet. Please, let's not go down that slippery slope!

xmpir 14y ago
I don't agree. The cloud provider is a company only existing for the sake of generating revenue for the share-holders of this company. The government is a (usually) democratically elected institution. That is why I prefer to trust governments.
- charonn0 14y ago
  The advantage of a cloud provider is that you can unilaterally sever the relationship without serious penalty.
  - xmpir 14y ago
    Only if the government provides the right law...
  - xmpir 14y ago
    What I tried to say is: we need the government to regulate the internet in terms of providing the right laws so users actually can take action against providers misusing their data. Just turning away from the provider is not the solution (from my point of view).
  - B-Con 14y ago
    You can? Migrate everything from Google to Apple. Then check back in 5 years and see if it's as painless. That was one of the author's points. We're becoming a culture where you pretty much buy into one provider or another provider. One of his assumptions was that it's only going to get more locked in and more difficult to switch. His conclusions were thinking about the future based on those assumptions.
    - charonn0 14y ago
      I never said painless. However Apple doesn't have (yet) the power to imprison or execute anti-Apple subversives. Vive la résistance!
davegauer 14y ago

spindritf 14y ago

I'd rather have the freedom of choosing a feudal e-lord than trust governmental regulations. Maybe there's a reporting bias but the ones I hear about are always god-awful. From seizing domains[1], blocking fairly random sites[2] to threatening ISPs over content[3], governments make Google, Canonical and the like look very attractive in comparison. Especially considering you can dump them with only moderate effort and cost. [1] http://arstechnica.com/tech-policy/2012/11/feds-seize-101-domains-for-counterfeiting-in-cyber-monday-operation/ http://arstechnica.com/tech-policy/2012/11/feds-seize-101-do... [2] https://torrentfreak.com/uk-isps-block-pirate-bays-artist-promotions-121202/ https://torrentfreak.com/uk-isps-block-pirate-bays-artist-pr... [3] http://olgierd.bblog.pl/wpis,jak;urzad;celny;bogu;ducha;winny;portal;odcinal;od;internetu,86592.html http://olgierd.bblog.pl/wpis,jak;urzad;celny;bogu;ducha;winn...

jff 14y ago
Is the government offering to provide Internet services to you? You're comparing apples and oranges. A government still can, and will, seize domains, block sites, and issue takedowns and warrants on content to Google. Suppose I own xyzzy.com, set up to use Google Apps to handle mail and serve some web pages. Just like if I was hosting at home or in a colo somewhere, the government can still come in and demand the data. In fact, the biggest difference is that companies like Google are more likely to just roll over--see the stories about cell carriers just handing over tons of information just because law enforcement said please.
- spindritf 14y ago
  And did the actions governments have taken inspire your trust to give them even more control? > companies like Google are more likely to just roll over More likely than who?
  - jff 14y ago
    If I self-host, for example, then I can hold on to my stuff until either I get a subpoena or the cops show up with a warrant. In the meantime, I can decide if I want to risk charges for destroying any evidence, I can call for lawyers, all these various actions I can take before my data gets handed over. Beats the hell out of getting an email to your backup account: "Your domain has been taken down at the request of law enforcement. Please have a nice day. Do not reply to this message."

saturdaysaint 14y ago

repost - http://news.ycombinator.com/item?id=4831842 http://news.ycombinator.com/item?id=4831842

deleted 14y ago

[deleted]

uvdiv 14y ago

...it's time we step in in our role as governments (both national and international) to create the regulatory environments that protect us... Or putting on other imaginary hats: ...it's time we step in in our role as technology corporations to circumvent and mitigate broken government regulations which harm our customers... ...it's time we step in in our role as malevolent crackers to cease-and-desist thieving things which do not belong to us... ...it's time we as terrorists, child pornographers, and film pirates stop doing naughty things, so that people stop asking for digital surveillance... How is the counterfactual, "we the governments", any more sensible than the "we the corporations", or the sillier ones? Schneier isn't a government. Inference along the aligns of "If I were the government I would...", in a democracy where you and everyone who kind-of agrees with you are an insignificant fringe, is barely more rational than pretending to be any other third party. The main effect of this reasoning flaw is to accede more powers to the biggest digital-rights threat of all, national governments, out of the fatal illusion that they will be used to protect you, as imagined in your "If I were government" fantasy. The evidence strongly suggests that the government--which you are not--would much rather use new powers against you, to the benefit of established, paying clients (MPAA). ...we, as private citizens, should oppose regulation of our networks, because governments have been very bad at it, and we do not control them well enough to expect better.

nhaehnle 14y ago
How is the counterfactual, "we the governments", any more sensible than the "we the corporations", or the sillier ones? For the obvious reason that governments, at least in democratic countries, are supposed to be about the people governing themselves. Governments are a means to solve cooperation problems. Sure, this theory does not perfectly translate into practice. But it is the normative ideal of democracy. Hence your comment just comes off as snarky without really adding much to the discussion other than the point that yes, government power also must be restricted when it comes to information, just like it must be restricted in other areas of life. This is a useful point, but one that you might have made using much fewer words.
- sophacles 14y ago
  You need to understand the mindset of people like him. Basically the idea is that government is a single, monolithic entity that behaves stricly as an incompetent buffoon in all circumstances. Any good that comes from any subset of it is strictly accidental and must have been because others shepherded them to OKness, while any subset that does bad is proof the the whole is corrupt and incompetent. Further, any attempts at fixing it are obviously flawed because the government monolith is by definition unfixable. Further, the cognitive dissonance in this viewpoint is strong, in that they can see how treating any other composite entity, e.g. corporations, or a single corporation, or whatever as a monolith will be ridiculed as "you can't judge this composite entity as a whole based on a subset of it's components". Similarly when the effects of the entities they like look like the results the fear from the government, it is all OK, because some magical thinking results in not understanding what a choice really is (namely that somehow being forced to do something because it is the only choice that minimizes harm when the mechanism is not government is freedom, but when it is government it is tyranny).

deleted 14y ago

[deleted]