Hacker News Reader

Comment by M_Grey | Hacker News Reader

Honestly at this point you just have to assume this is a nearly constant reality.

This is sadly true, but I think we also need to reject that this is the new normal. We need to continue to push back firmly on secret government request without oversight.

I agree, although I suspect that the time for that was a couple of decades ago, not now. Still, we have to fight.

You can't put the genie back into the bottle. It has already escaped. In our days, surveillance is being performed by all governments and many private companies. For US to be the only country that doesn't do it, it would be uncompetitive. We have to accept the new reality - ever since digital cameras became popular (year 2000) and ever since cell phones became packed with sensors and always on connectivity (and continuous auto-updates), hard drives cheap and large, face recognition software efficient - there has been no way to stop surveillance. It is an emergent situation based on a confluence of technologies.

We need AI to protect privacy, capable of detecting information leaks and unintended exposures right in the browser and OS, similar to an antivirus that is always scanning the data flowing in the system. We need to have software educating people about consequences and making it really easy to remain private. It won't solve the problem fully, it's impossible to do that today.

In our days, surveillance is being performed by all governments and many private companies. For US to be the only country that doesn't do it, it would be uncompetitive.

How does surveillance improve competitiveness?

Governments spy on other nations businesses, then pass the information back to their companies who process to undercut the competition (because they have all the information)

Here's China doing it to America http://www.telegraph.co.uk/finance/china-business/10842339/A...

'According to the indictment, five hackers “stole trade secrets” which allowed Chinese companies to undercut their American competitors, or gave them “insight into [their] strategy and vulnerabilities”. '

And here's America doing it to everyone else (including allies both domestic and foreign) https://theintercept.com/2014/09/05/us-governments-plans-use...

Except that passing the information back never actually happened in The Intercept article.

Don't forget Windows 10 NSA Edition. Auto updates you can't disable, constant resetting of privacy settings, insane new levels of telemetry...

The scary thing about auto updates is you can never be sure what is being installed on your device.

I'd be shocked if there wasn't some chilling effect from this already.

It's a false equivalence to say that "everyone does it".

1. It's unclear how surveillance does anything for a countries competitiveness. If we're talking security, the US's competitive edge in technology should have enabled them to completely reshape world affairs to their liking long ago. If they can be duped bit some sadistic middle-eastern ophthalmologist in the way they have, it shows how useless those skills are.

Economically, the benefits of surveillance are especially limiting. You may be able to support a few "national heroes" like Boeing here and there, or win a few tenders with your knowledge of some interior ministers passion for really strange pornography, but the economic effects are negligible.

2. "Everyone does it" is a really really bad excuse for something morally repugnant. When did we start measuring morality on scale relative to others?

3. Not everyone does. In fact, barely anyone does it, and even fewer use it for economic competitiveness. Even discounting places like Luxemburg or Qatar because they use non-replicable features for their success, I'd point at the Netherlands, Austria, Canada or Denmark as countries that are successful even though they almost certainly lack the ability to play that game on any level comparable to the US.

4. Even you think it's naive to expect moral leadership in a world of race-to-the-bottom competition, there are long-established processes to avoid playing the prisoner's dilemma with the rights of everyone on earth: cooperation, embodied in the WTO, the ICC, the Oxford Manual of Style, START 1-3, RFC 2616, or actually anything else that is collectively called "international law". I know americans hate the concept because they really don't get a foreigner, of all people, could disagree with them but just underneath the surface these systems have worked extremely well for everyone.

5. It may be right to try to solve these issues technologically. Such solutions may even be preferable because they don't require trust, or the expectation of mora; behavior from everyone. But I'd still prefer a political solution because there is a universe of problems that cannot be solved technologically and I fear a world where we've given up on expecting people's behavior to be limited by anything but feasibility.

So yes, if you can create a protocol or an AI that gives people power over their data do publish it, if you can teach people to use technology, do so. But don't join the cynical masses that don't expect anything from their leaders, or declare ruthless competition as the only "rational" choice, or deny humanity's ability to give shape to their fate in the face of the downward pressure of game theory.

You're absolutely correct.

The word "new" is entirely out of place.

Well, new in the sense that, post Snowden, there was an immense increase in the number of mostly-facsimile files documenting the mass surveillance. I don't remember earlier programs like Carnivore getting the same level of public documentation and confirmation.

So that's new in the sense that now we know about it?

I think at this point you have to assume that chinese, american and russian intelligence if not organized crime have their fingers in all the major email providers.

I'm starting to think that these giant email providers are too much of a juicy target and we need to start moving towards a more decentralized model, or even move away from email entirely.

Or move into heavy, future-proofed encryption as the norm.

Initiated on endpoint by open protocol and implementation, too.

Agree with all but the last suggestion.

Email is great, and there is no reason to give it up

If you want full control, just publish an MX record in DNS, and run you own email server. The TCP session will be established directly between you and the sender. Encryption options are available and evolving, thanks to IETF and other bodies. All you have to pay is just a couple of hours of your time for setting it all up, and $15/yr for the DNS.

Are there good spam filters these days?

SpamAssassin works well enough for me.

Yes there are, and many of them will block all of your email if you run your own server...

Or did you mean "good for independent email operators"?

I started running my own mail server recently and spam hasn't been much of a problem with postscreen + spamassassin (with pyzor and razor).

Also, if you are worried about deliverability of your own e-mail: worry less. I am running my mail server on a VPS and the only place I've had any trouble delivering mail to so far is hotmail. They were blocking my IP, so I requested that they investigate the block and it was removed within hours.

It's really been a very pleasant experience.

Hotmail is doing the same with my server's IP because apparently someone else with a similar IP is a spammer. Could you tell me who you contacted?

Fill out and submit this form: https://support.microsoft.com/en-us/getsupport?oaspworkflow=...

First I got this strange and confusing response:

    Dear x
    Please note that your ticket number is in the subject line of this mail.
    x.x.x.x
    Note: Errors are unlikely, however, if an error is indicated, please resubmit the specific IP or IP range.
    Thank you,
    Outlook.com Deliverability Support
    Please do not reply to this message as it is from an unattended mailbox.
    Any replies to this email will not be responded to or forwarded.
    This service is used for outgoing emails only and cannot respond to inquiries.

About an hour later I got another e-mail from them informing me that my IP address had been "conditionally mitigated", and I was then able to send e-mails to Hotmail.

No, the TCP session will be established between your mail server and the sender's. And since the other party's mail server often happens to belong to Google, Yahoo or <insert big mail provider>, this doesn't increase security at all. (As long as you don't use end-to-end encryption but even then they still see your social network.)

_not_ running your own mail server because other people won't is a fallacy.

If everyone thinks like you do, sure, not much changes- but if 10% of people think like me! Then we chat with each other without snoops or middlemen.

I totally agree. That's why I'm running my own mail server, as well. That doesn't change the fact, though, that email is fundamentally broken these days.

Reply on news.ycombinator.com