Hacker News Reader

Comment by ajeet_dhaliwal | Hacker News Reader

This is an honest answer that I think many people who are outraged about privacy and advertising would begrudgingly have to admit if forced to really answer. The only way to know whether the price of something is too high or not is to put up two options. A free version where privacy is lost, and a paid version where it's not. See how many people opt for the paid version. Now unfortunately many services that go the advertising route do not offer a paid version. I happen to be in the camp that does pay for several services I use online, and I run a service that charges customers too. Where I can I like to pay and be free of advertising.

View on HN

Here's the thing though, would we ever get privacy? Even if we were to pay?

I know that there are several defendants [drugs etc] even in my small area who have had deleted snapchat posts, deleted texts, deleted emails, "anonymous" forum posts etc etc etc show up as evidence in court. Now I'm obviously unfamiliar with the legal and technical means by which police investigators made things like that happen, but the fact that they happen means that we can assume that at LEAST the government has access to a record of most everything we do online. Free or otherwise.

Even ignoring the question of the government surveillance net, once your data is on that company's server, how would you even be able to reliably validate what's being done with it? By which I mean, they say they don't share it, but how do you KNOW?

So maybe we would get some pretty compelling new features in a lot of our services if we were to pay for them, but I'm not at all certain that ironclad privacy would be one of them.

In fact, I'm fair certain that it wouldn't be.

It works through preservation orders, which LE can issue to companies and mandate they preserve records of something.

"Bad money pushes out good money." Since you can't prove privacy, customers have to assume no-privacy and vendors must exploit that or else get outcompeted by someone who does. Same for any quality that customers want but can't verify, such as quickly long-life or organic ingredients or treatment of workers and animals.

I wonder if it's possible for a watchdog organization to automate trap street accounts.

I don't think paid-for services are going to solve anything. We pay up and out the ass for television, which obviously has ads, but I'm sure they're tracking as much as possible too.

Unless you've been extremely diligent, there's no way you're going to escape a targeted invasion of privacy when someone, or some group, government or not, wants it bad enough. Trying to stop that would be exhausting and futile.

Right now, we're allowing highly coordinated, highly detailed, nearly invisible, for-profit, stalking to take place legally. There's no doubt that's bad for society. We have anti-stalking laws for good reason. It's worth doing something about the current state of things, even if it doesn't bring the tracking down to nothing. The free market and tech has failed to fix it so far. They don't have forever to keep trying. Laws are the next line of defense. Laws might not stop criminals from crimin' but I'm sure the Tim Cooks of the world aren't going to risk their company profits (or personal freedoms, if the laws are strict enough) to get a little extra info on everyone.

Couldn't agree more though I got downvoted for saying more or less the same thing earlier today (still don't understand that but, um, internet).

I'm not going to dig up your earlier post, but discussing up- and down votes like you're doing here is an anti pattern on HN. I think that if you look objectively at your comment, you'll find that it doesn't contribute anything to the discussion, and has the potential to distract from it. Most likely that's why you've been down voted here.

What if there were paid services that promised no ads? Ever? Make it part of their policy?

Naive: instead of serving ads directly, the service would just eagerly sell your data to someone else for possibly worse purposes than ads (e.g. denying you health insurance, mortgages, a job, etc.)

Why? Why wouldn't the income from subscriptions be enough?

There is no such thing as "enough" when corporations seek perpetual growth.

Originally, this was the promise of cable television. Eventually they figured out they could charge you and deliver ads.

Exactly. I'm doing this with the company I've been building [0] and it works. While it's taken a while being completely bootstrapped, we make enough money to grow and focus on our users. No one is obligated to track and stalk everyone online; that's just the prevailing business model (unfortunately).

[0] https://write.as/principles

Yes, and when you cash out to enjoy life in the tropics, whoever you sell to will then use any and all information you may have as they see fit, and load up your service with the usual. I won't even blame you for it, this is just how things work. I believe the sincerity of your statement of principles, just as I believe that Sergei and Larry were sincere when they told Google "Don't Be Evil". Everything ultimately has a price, even your principles, and even if it is very high, there is someone out there that will meet it if they can make a profit on it. The guys like Richard Stallman that are religiously committed to their beliefs is vanishingly small, and the odds that a founder such as yourself is one of those people is correspondingly low.

That doesn't mean I wouldn't use your service (which looks cool). It just means that I would have a plan in place for what I'll do when you sell out ;)

Haha well they certainly don't make the covers of magazines very often, but I don't know that they're as rare as you think. The people behind Basecamp, Balsamiq, and tons of other smaller companies are able to build "old-fashioned" businesses that stick to their principles and only answer to their customers. You need a little fortitude on the founder's part of course, but also the right financial incentives -- a key aspect the GP post missed.

As for Write.as, I spend copious time talking about why I built it [0] and making sure people know me personally, to address your exact point. Personally, I'm a simple dude who relishes putting more value on principles than a number in a bank account. And I'd rather have a tent in the woods than Mai Thais on the beach.

But we do have an open API [1] and one-click export to get your data out, so you can be sure :)

[0] https://write.as/matt/who-is-this

[1] https://developers.write.as/docs/api/

Well, if you pay for a service that promises certain privacy protections, then they are legally obligated to fulfill those promises. That’s one mechanism, although obviously you still need watchdogs and a solid legal and court system to protect the promises.

It's possible that the prosecutors in a local drug case got Snapchat data by subpoena, but much more likely is that it was given to them by an informant. Here's the real thing. Anything you do online is not private. If you want to keep something private, don't do it online.

> Here's the thing though, would we ever get privacy? Even if we were to pay?

The issue is that the services have to be funded somehow. If they're funded through data mining, you lose your privacy. So if you want privacy, some other funding source is necessary but not sufficient.

> once your data is on that company's server, how would you even be able to reliably validate what's being done with it?

The answer is for it not to be on their server at all. Have it be on your server. Operating a server should be as simple as operating any other home appliance.

> The issue is that the services have to be funded somehow. If they're funded through data mining, you lose your privacy. So if you want privacy, some other funding source is necessary but not sufficient.

That, and there has to be a legal or technical way to prevent them from datamining you anyway. Because seriously, almost no company is going to voluntarily leave money on the table. Why drop old profit source for the new one, when you can have both?

> The answer is for it not to be on their server at all. Have it be on your server. Operating a server should be as simple as operating any other home appliance.

That's an important part of the solution, I believe. Personally, what I'd love to see is the move towards making service providers stop trying to own data. The way SaaS currently works is: I send my data to the service for processing, they basically own it, and I'm lucky if I can even get the data back out and untangled from the service. The way this should be working is that I own and control the data, and I rent their code to be run on it.

Come to think of it, that's how desktop software works, and that's why the abstraction of a file - the one the cloud is desperately trying to kill - is so awesome.

>The answer is for it not to be on their server at all. Have it be on your server. Operating a server should be as simple as operating any other home appliance.

But... operating non-computerized home appliances is difficult, too. Remember all the jokes about the VCR blinking 12:00? This was because every damn thing had it's own completely non-standard, unique interface.

I mean, we've got fewer and fewer clocks we've gotta set, but back in the day, I remember I was the sort of person who would have to jimmy with a friend's car until their in-dash clock was right... and almost nobody I knew had a clock that was right year round, just 'cause they couldn't be bothered to look up or figure out how to set it.

Now, with connected appliances? (as any of your 'social network' appliances would have to be) if you didn't apply the security updates (and maybe if you did) the data would be even more public than it is now.

> But... operating non-computerized home appliances is difficult, too. Remember all the jokes about the VCR blinking 12:00? This was because every damn thing had it's own completely non-standard, unique interface.

Not really. It was because the device is a VCR (or a car) that happens to contain a clock and people didn't care enough about the clock feature to bother with setting it. Even the people whose clocks weren't set could still play a video tape or drive to work.

What it points to is the need for good defaults. The default shouldn't be to blink 12:00, nobody actually wants that. It should be to get the time from a GPS receiver or NTP server or something like that. It's a problem caused by no external connectivity, which is no longer an issue today.

> Now, with connected appliances? (as any of your 'social network' appliances would have to be) if you didn't apply the security updates (and maybe if you did) the data would be even more public than it is now.

Security is an issue but it's a separate issue. Huge organizations get pwned all the time. Yahoo, Target, Equifax, OPM, it's a very long list. If the thing holding your data gets hacked, you lose. That doesn't really depend on if it's in your home or not.

>Security is an issue but it's a separate issue. Huge organizations get pwned all the time. Yahoo, Target, Equifax, OPM, it's a very long list. If the thing holding your data gets hacked, you lose. That doesn't really depend on if it's in your home or not.

For your thing to not get hacked, someone needs go proactively defend that thing, even if defending that thing just means 'install the dang updates' (of course, there's more to it than that, but for most of us, if installing the updates isn't enough, we are compromised and deal with the consequences)

I'm comparing leaving the clock blinking 12:00 to the phone that hasn't been updated in two years. If your data is on devices you control... you need to control the security of said devices, and that's easier said than done.

My point here is that not paying attention to the security of your home appliances has very different and sometimes not obvious consequences to not paying attention to other aspects of home appliance setup.

Websites were "free" from the start when people were hosting them on their own machines. At this point we have the internet access and cheap hardware that would allow us to take control and build distributed solutions that are "free" in the sense that they only cost our contribution of hosting power or something.

Look at the Tor network, for example, the next time you assume that nobody would run a service for free without collecting data or ads.

EDIT: I used Tor as an example because of the contrast with data collection companies like Facebook but there are a lot of people who run Tor relays for free that push quite a bit of traffic around. Things like IPFS, blockchains, Mastodon Project, SETI@Home, etc, are examples of free approaches given our modern hardware proliferation.

> Look at the Tor network, for example, the next time you assume that nobody would run a service for free without collecting data or ads.

Oh an exit node certainly has the capability to collect data. Have enough of them and you can de-anonymize an user.

But not everyone is running exit nodes. And even if they are they get random requests that can't easily be correlated to a source.

My point is that most people run those services for free without the expectation of collecting personal data.

But I think the expectation of free internet services sort of originates in that kind of attitude. Because originally the internet was a bunch of hackers using their spare bandwidth and their spare cpu cycles to host web sites. Perhaps they enjoyed it enough to volunteer the extra cash for dedicated servers and dedicated internet connections.

It's only after that in the second step that people try to monetise. Nowadays of course it's money from the getgo, but things have changed.

There's still plenty of free today. Lots of people run websites with highly interesting information and then distributed it without benefiting from the ads that run on the site (e.g. a Wordpress blog, where the privacy invasion and ad revenue profits go to Wordpress not the blogger).

There are also still plenty of ways to host content that is free to a reasonable point of usage.

See Firebase Hosting [a sister team of mine]: 1GB hosting and 10GB xfer monthly without even dropping a credit card.

Right, you can't just take a free-to-the-user (paid by advertising) product, slap a fee on it, and expect people to pay for it. Instead products need to be user-centric from the start, with business models that align users and the company making the products. It's just rare to see companies thinking critically about this.

Once they've said "let's monetize our free users" they've already lost. What people miss is that free users are incredibly valuable with a digital product -- whether it's seeing how real people use it or the free marketing they give you. Sure, a freemium product will generally have >95% of its users not paying a cent. That doesn't mean you need to sell of their data to generate value from them.

And as a consumer "outraged about privacy and advertising," frankly we're faced with many products that are overpriced for the value they deliver. More companies need to find the middle ground between surveillance business models and gouging consumers.

How would you know if the paid version is privacy respecting or not? If for example FB had a 5$/mo subscription that was ad free, how would you know that access to your database wasn't still being sold?

For me that kind of problem is the blocker, and "oh look nobody paid for for the premium version, therefore people don't value privacy" is a bit disingenuous.

If you are buying a product/service and it says it won't do something (like sell your data) and does anyway, that's clearly wrong. They agreed to protect your privacy. With services that state they will use your data to run targeted ads you are immediately accepting the loss of privacy.

Being ad free is not the same as not tracking though. They are just saying, you get the version with no ads.

"clearly wrong" means nothing if you can't win a law suit against megacorp's carefully worded legalese. "We use this information to improve the Service" means game over.

I don't think that will hold up against GDPR.

It won't, but despite the complaints that the GDPR reaches too far, it still only protects a minority of worldwide users.

What if there were a trusted third-party that periodically audited the business to see if they were protecting your privacy of not. Would people value or trust that? And who would people trust to do the audit?

And the problem too is that even paid products like my NYT subscriptions have ads. If the point is privacy, I don't have an option to buy it.

The newspapers and magazines have had advertisements for at least the last two centuries to help subsidize the cost of the subscription. If you had to pay full price for a subscription, you probably wouldn't have it because the publisher couldn't afford it.

And likely even if you paid for a subscription to a magazine, your name and address was sold to marketers to sell you direct mail. And this ended up in someone's database, who resold it to advertisers time and time again.

Cook's Illustrated is an example of a magazine that doesn't sell ads. But the cost per issue is higher and the number of pages is lower. Also most of the magazine is usually printed in black and white to save publishing costs.

The question I ask myself constantly, is do I want to end up being advertised to (Google, Facebook), or do I want to end up being part of someone's brand (Apple, Nike)?

One model, in the UK at least, is to use an agent for purchasing of subscription publications.

This newsagent delivered the papers and magazines to your door before you left for work in the morning, didn't send your data to organisations and allowed flexible purchasing options (monthly, weekly, etc). Many people still use news agents for their subscription delivery mechanisms.

Perhaps we can see an online agent, where we pay a trusted third party that negotiates transactions on all our online activites on our behalf, and protects our privacy, location, when else we buy, etc. That digital agent would collect a small (1% of transaction cost) as fee, to continue it's operations.

> The only way to know whether the price of something is too high or not is to put up two options. A free version where privacy is lost, and a paid version where it's not.

This test doesn't seem to work in practice due to, I imagine, human psychology. When looking at a free vs not free service, most people are just comparing the cost of the service. The implied privacy costs are too diffuse and complex for the brain to properly comprehend them at that moment.

The individual-based solution is to develop a feeling of ickiness towards such services, but I'm not sure how that could be implemented on a mass scale.

Reply on news.ycombinator.com