5 ms·

We've gone in a security model that Bruce Schneier calls Digital Feudalism. We give up rights to have large centralized organizations take care of our security

We've gone in a security model that Bruce Schneier calls Digital Feudalism. We give up rights to have large centralized organizations take care of our security for us. In exchange we give them data that they are allowed to sell. This is both for devices and for services (notably Web 2.0). There are arguably benefits to this arrangement. Prostitutes have pimps, even though they cut into profits without taking much personal risk or providing much labor, because pimps do provide a safety mechanism. Likewise, vassals gave up large portions of what they produced for security from their lords and kings. We've returned to this arrangement because: 1.) Paying is painful and copying software is easy. Instead of making money from you, Web 2.0 have monetized you as a target for advertisers. Web services are 'in' because that's the only way software can't be pirated. Much of our software today displays GUIs on a screen but runs on other computers because of this reason. The new Office products all run in the cloud, MMOs offer the same deal, and games like Diablo III can only run when in constant connection to the internet, even though there's no technical reason why that should be the case. XBox One tried to (and backpedaled from) make the xBox always on always connected. Other streaming video game and content services try the same. Essentially, the internet has become glorified TV (minimally interactive), with more channels. 2.) The internet is the Wild Wild West. Security professionals have been yelling for ages that the rush to release and the need to compete together with closed source development was making the world an insecure place. Essentially every layer of our computing stack is insecure. Attestation of computer intrusion is ridiculously hard. And there's money (and geopolitical power) to be had. We designed things insecure from the start, and continue to do so. Individuals can't stay secure on their own. It's not possible. So up with the lords and vassals - we know it sort of works from history. I do think the average user cares. I don't think the average user is informed.

api 12y ago
Piracy is a really huge part of it. Nothing is free. Pay for it or it finds someone who will pay for you. ... And If neither occurs, you won't get it at all. I've started to become increasingly convinced that huge scale piracy really did harm the quality of popular music. You can find some good obscure music today, but the average quality seems to have hugely declined in some objective way. Art is no more free than code, and good art really does cost more than bad art for all kinds of reasons... Fewer can make it, and quality takes time and sustained focus. Having some talentless tart squall into an auto tuner to a cliched catchy melody is cheap. Finding an Elizabeth Fraser and paying them to practice for 40 hours a week under the supervision of a professional choral voice instructor while you coach the band on composition in a recording studio is not. Why invest in a product nobody will pay for? Funny how when I bring up the issue in the context of software everyone agrees. Of course people have to get paid somehow and of course polished products cost money. But on every forum including this one, nobody gets how there could be any relationship whatsoever between the quality of art and its ability to be financed. I think this comes down to one of the greatest myths about art: that it comes from some automatic and magical place and people either have it or they don't, and that artists make art solely out of duty to the muse. Like anything else art is a skill and doing it well requires practice, research, focus, coaching, even peer review, and all of that takes time during which many people including the artist must be supported. There is a component of inspiration but raw inspiration without the rest of it results in rough draft quality work that is only of value to the artist themselves. Piracy undermines the ability to finance art just like it does in software. What's one of the first questions a VC asks about? Defensibility. In other words how will you protect your ability to monetize the value you create. You think investors only ask that question in software?
- debaserab2 12y ago
  Art is subjective, code is not. Good code is testable. Good art is not testable. Top40 music is palatable to many and is the exact result of what you describe: practice, research, focus, coaching, and peer review on a massive financed scale that "startup" bands could never afford. Yet despite that, the indie music scene has never been more vibrant and alive than it is today. Instead of a small number of bands/groups producing music that all indie fans like, there's a huge pool of artists each producing their unique sound based on their own personal values of how music should be produced (including things like practice, focus, peer review, and other things not mentioned like experience, personality, and culture). That, to me, is art -- not a rehearsed manufactured production but an embedded experience unique to the artist you are listening to. That's what you heard in popular music until the mid nineties. The lack of quality popular music is not due to lack of craftsmanship.
  - gglitch 12y ago
    The financial costs a young artist or group incurs to bring one or a few albums into the world are slim, but the cost in time is great, especially if they're also trying to keep food in their bellies by touring. But here's the thing - who can afford to do that for their whole careers? I think part of the costs parent is describing have to do with making art as a viable lifetime career, meaning, providing for healthcare and retirement. Sure, it's easier than ever for college-age people to put out some records, but if anyone is to make art a viable profession, money has to come from somewhere, and enough of it to make it viable as a living.
    - api 12y ago
      That's exactly what I meant: a viable profession. I also disagree with the OP about cost vs. quality. The key difference comes later when you're managing the artist. If the artist has talent then they also have a certain amount of leverage in the relationship. If you make them feel like a slave then they have an ultimate trump card: turning off the juice. (The "Atlas Shrugged" maneuver?) A talentless piece of meat plus auto tune gives you total leverage, which means risk mitigation and a more controllable product. Right now the environment in the music industry is one of extreme risk aversion, which is something you see when the bottom falls out of an industry. You've arguably seen a much more risk-averse tech industry since the 2001 crash. I think my points about piracy fit into a broader critique of the concept of "free" that I've been thinking about and that I've heard others talking about. Unlike previous critiques it's more of a liberal/progressive critique.
AnthonyMouse 12y ago
> Web services are 'in' because that's the only way software can't be pirated. That is cognitive dissonance. If your revenue is derived from advertising then users installing ad blocking software is revenue-equivalent to users pirating your software. The fact that it's legal for users to do when piracy is not provides no support for argument that ad-supported services are on stronger financial footing. The reason ad-supported services are winning is much simpler. Users prefer them to paying. So if one competitor is "free" (with ads) while another is charging money, the market picks the free one. But ad-supported services don't inherently require centralization or feudalism anyway. > The internet is the Wild Wild West. The internet has never been the wild west. Modern computing devices are dramatically more secure than physical things like your house or your car. The internet is so far away from the wild west that we consider even the possibility of a security breach under rare circumstances to be a serious vulnerability and work quickly to close it. And the feudal lords are the ones making it worse -- is it even possible to patch a vulnerability on an un-rooted iPhone which is too old for Apple to patch it officially? Having said that, I don't disagree that the reasons you're listing are the ones used to justify feudalism, they just happen to be factually incorrect.
- xnull2guest 12y ago
  Interesting perspectives, so here's another volley. I think "users prefer ads to paying" is not a full explanation: I did include "paying is painful". If that's all there were - just upfront cost, how do we deal with the trend of connected software (Diablo III, etc) and devices whose primary developer feature is DRM? The internet totally is the WWW. Well, it's an analogy. So no, it's not. But the analogy is useful in its most spirited form. There is no truly enforceable law and criminal and conspiratorial enterprises run abound. It's questionable whether the Feudal lords are making it better or worse. (One way they make it better is by having direct accountability.)
  - AnthonyMouse 12y ago
    > I think "users prefer ads to paying" is not a full explanation: I did include "paying is painful". If that's all there were - just upfront cost, how do we deal with the trend of connected software (Diablo III, etc) and devices whose primary developer feature is DRM? Connected software is a different business model. It has certain advantages for the developer (like collecting a monthly fee rather than a one time payment), but how is that supposed to be providing any security or other benefit to the user? > There is no truly enforceable law and criminal and conspiratorial enterprises run abound. There are lots of enforceable laws -- probably too many. And the threat is vastly overhyped. Actual criminals and criminal organizations are the likes of Ted Bundy and the Zetas Cartel. The internet version of that is supposed to be weev and Anonymous? They're not even on the same planet. Moreover, what is the feudal lord supposed to do any better than anyone else to prevent some jerk from cracking into a webserver and stealing private data? If anything the centralization makes it worse by creating juicer targets. If the bad guys compromise Apple or Google you're roasted, toasted and burnt to a crisp. > It's questionable whether the Feudal lords are making it better or worse. I have a hard time thinking of any way they could legitimately make it better that wouldn't work just as well without a locked boot loader. > (One way they make it better is by having direct accountability.) The fact that they aren't accountable is half the problem. At best the user can throw away their device and buy one from a different vendor, but that's hardly much consolation when you can't get your money back. And the app developers have even less leverage. The only way to opt out is to abandon hundreds of millions of prospective customers.
rayiner 12y ago
Glad to hear someone air these thoughts out loud. I vastly preferred back when I could simply trade money for software. I don't like this new world in which I have to enter into a vaguely abusive intimate relationship with Google or whoever to pay for their product.
- kbenson 12y ago
  I find that my stance on this topic has changed as I have more money to pay for services. I used to vastly prefer free services. Now I would happily pay a few dollars. Unfortunately, a large portion of my privacy and anonymity has already been given up from past use of these free services, and I most likely will never be able to reclaim that. I can at any point choose to use a less invasive service, but the choice is not the same now that I view much of my anonymity already gone.

api 12y ago

Piracy is a really huge part of it. Nothing is free. Pay for it or it finds someone who will pay for you. ... And If neither occurs, you won't get it at all. I've started to become increasingly convinced that huge scale piracy really did harm the quality of popular music. You can find some good obscure music today, but the average quality seems to have hugely declined in some objective way. Art is no more free than code, and good art really does cost more than bad art for all kinds of reasons... Fewer can make it, and quality takes time and sustained focus. Having some talentless tart squall into an auto tuner to a cliched catchy melody is cheap. Finding an Elizabeth Fraser and paying them to practice for 40 hours a week under the supervision of a professional choral voice instructor while you coach the band on composition in a recording studio is not. Why invest in a product nobody will pay for? Funny how when I bring up the issue in the context of software everyone agrees. Of course people have to get paid somehow and of course polished products cost money. But on every forum including this one, nobody gets how there could be any relationship whatsoever between the quality of art and its ability to be financed. I think this comes down to one of the greatest myths about art: that it comes from some automatic and magical place and people either have it or they don't, and that artists make art solely out of duty to the muse. Like anything else art is a skill and doing it well requires practice, research, focus, coaching, even peer review, and all of that takes time during which many people including the artist must be supported. There is a component of inspiration but raw inspiration without the rest of it results in rough draft quality work that is only of value to the artist themselves. Piracy undermines the ability to finance art just like it does in software. What's one of the first questions a VC asks about? Defensibility. In other words how will you protect your ability to monetize the value you create. You think investors only ask that question in software?

debaserab2 12y ago
Art is subjective, code is not. Good code is testable. Good art is not testable. Top40 music is palatable to many and is the exact result of what you describe: practice, research, focus, coaching, and peer review on a massive financed scale that "startup" bands could never afford. Yet despite that, the indie music scene has never been more vibrant and alive than it is today. Instead of a small number of bands/groups producing music that all indie fans like, there's a huge pool of artists each producing their unique sound based on their own personal values of how music should be produced (including things like practice, focus, peer review, and other things not mentioned like experience, personality, and culture). That, to me, is art -- not a rehearsed manufactured production but an embedded experience unique to the artist you are listening to. That's what you heard in popular music until the mid nineties. The lack of quality popular music is not due to lack of craftsmanship.
- gglitch 12y ago
  The financial costs a young artist or group incurs to bring one or a few albums into the world are slim, but the cost in time is great, especially if they're also trying to keep food in their bellies by touring. But here's the thing - who can afford to do that for their whole careers? I think part of the costs parent is describing have to do with making art as a viable lifetime career, meaning, providing for healthcare and retirement. Sure, it's easier than ever for college-age people to put out some records, but if anyone is to make art a viable profession, money has to come from somewhere, and enough of it to make it viable as a living.
  - api 12y ago
    That's exactly what I meant: a viable profession. I also disagree with the OP about cost vs. quality. The key difference comes later when you're managing the artist. If the artist has talent then they also have a certain amount of leverage in the relationship. If you make them feel like a slave then they have an ultimate trump card: turning off the juice. (The "Atlas Shrugged" maneuver?) A talentless piece of meat plus auto tune gives you total leverage, which means risk mitigation and a more controllable product. Right now the environment in the music industry is one of extreme risk aversion, which is something you see when the bottom falls out of an industry. You've arguably seen a much more risk-averse tech industry since the 2001 crash. I think my points about piracy fit into a broader critique of the concept of "free" that I've been thinking about and that I've heard others talking about. Unlike previous critiques it's more of a liberal/progressive critique.

AnthonyMouse 12y ago

> Web services are 'in' because that's the only way software can't be pirated. That is cognitive dissonance. If your revenue is derived from advertising then users installing ad blocking software is revenue-equivalent to users pirating your software. The fact that it's legal for users to do when piracy is not provides no support for argument that ad-supported services are on stronger financial footing. The reason ad-supported services are winning is much simpler. Users prefer them to paying. So if one competitor is "free" (with ads) while another is charging money, the market picks the free one. But ad-supported services don't inherently require centralization or feudalism anyway. > The internet is the Wild Wild West. The internet has never been the wild west. Modern computing devices are dramatically more secure than physical things like your house or your car. The internet is so far away from the wild west that we consider even the possibility of a security breach under rare circumstances to be a serious vulnerability and work quickly to close it. And the feudal lords are the ones making it worse -- is it even possible to patch a vulnerability on an un-rooted iPhone which is too old for Apple to patch it officially? Having said that, I don't disagree that the reasons you're listing are the ones used to justify feudalism, they just happen to be factually incorrect.

xnull2guest 12y ago
Interesting perspectives, so here's another volley. I think "users prefer ads to paying" is not a full explanation: I did include "paying is painful". If that's all there were - just upfront cost, how do we deal with the trend of connected software (Diablo III, etc) and devices whose primary developer feature is DRM? The internet totally is the WWW. Well, it's an analogy. So no, it's not. But the analogy is useful in its most spirited form. There is no truly enforceable law and criminal and conspiratorial enterprises run abound. It's questionable whether the Feudal lords are making it better or worse. (One way they make it better is by having direct accountability.)
- AnthonyMouse 12y ago
  > I think "users prefer ads to paying" is not a full explanation: I did include "paying is painful". If that's all there were - just upfront cost, how do we deal with the trend of connected software (Diablo III, etc) and devices whose primary developer feature is DRM? Connected software is a different business model. It has certain advantages for the developer (like collecting a monthly fee rather than a one time payment), but how is that supposed to be providing any security or other benefit to the user? > There is no truly enforceable law and criminal and conspiratorial enterprises run abound. There are lots of enforceable laws -- probably too many. And the threat is vastly overhyped. Actual criminals and criminal organizations are the likes of Ted Bundy and the Zetas Cartel. The internet version of that is supposed to be weev and Anonymous? They're not even on the same planet. Moreover, what is the feudal lord supposed to do any better than anyone else to prevent some jerk from cracking into a webserver and stealing private data? If anything the centralization makes it worse by creating juicer targets. If the bad guys compromise Apple or Google you're roasted, toasted and burnt to a crisp. > It's questionable whether the Feudal lords are making it better or worse. I have a hard time thinking of any way they could legitimately make it better that wouldn't work just as well without a locked boot loader. > (One way they make it better is by having direct accountability.) The fact that they aren't accountable is half the problem. At best the user can throw away their device and buy one from a different vendor, but that's hardly much consolation when you can't get your money back. And the app developers have even less leverage. The only way to opt out is to abandon hundreds of millions of prospective customers.

rayiner 12y ago

Glad to hear someone air these thoughts out loud. I vastly preferred back when I could simply trade money for software. I don't like this new world in which I have to enter into a vaguely abusive intimate relationship with Google or whoever to pay for their product.

kbenson 12y ago
I find that my stance on this topic has changed as I have more money to pay for services. I used to vastly prefer free services. Now I would happily pay a few dollars. Unfortunately, a large portion of my privacy and anonymity has already been given up from past use of these free services, and I most likely will never be able to reclaim that. I can at any point choose to use a less invasive service, but the choice is not the same now that I view much of my anonymity already gone.