I Tried to Live Without the Tech Giants. It Was Impossible
nytimes.com
nytimes.com
> I came to think of Amazon and Google as the providers of the very infrastructure of the internet, so embedded in the architecture of the digital world that even their competitors had to rely on their services.
This is the right take. I disagree with the disappointment around this article.
It’s about the fact that tech giants are running the infrastructure of the internet. Its the federal highway program of the 21st century. It’s a critical piece of public infrastructure. I can’t even begin to wrap my head around the death and mayhem that would ensue if AWS and Google simply packed up and turned off the data centers.
When we consider the future and safety of our country we should keep these things in mind.
Imagine an unusually well-attended AWS all-hands was hit by a freak meteor. What do you even do? Take enough engineers off the oncall rotation and things will eventually fall over. I think the government would actually need to take emergency action at a level we don’t understand to prevent the collapse of our financial system beyond god knows what else. It would be utter mayhem. Globally.
That said, no one takes this more seriously than AWS. I really believe this. I sat in meetings regarding how to recover if we lost entire states, like literally what if we lose the Virginia to a catastrophe. (I worked on the Key Management Service or KMS which underlies much of the rest of the infrastructure.) But it is good and correct that our representatives are questioning our tech giants about their role in the future of our civilization. They’re playing perhaps the most critical role, and that should scare you.
I actually believe in the benevolence of AWS; I spent nearly a decade there. Do you?
I'm eternally grateful to Google for HTTP/2, Chrome, Web Vitals, Angular and so many other puzzle pieces without which the whole Internet wouldn't be what it is today. It showed foresight, wisdom, excellence, responsibility and stewardship.
The problem starts where growth ends, and all growth needs to end somewhere. There are only so many people on the planet with 24h a day to spend.
When that problem starts, a corporation still has to maximize shareholder value, and that's where the formally great stewardship gets endangered.
And then Google used its web browser, standards and search monopoly in order to
- shove the open-but-really-not-open AMP "standard" down everybody's throat
- eat up any kinds of comparison competitors by stealing their content into the featured snippets
- ...
So going back to your question, I'd still mostly trust in the benevolence of AWS — but I have zero doubts this benevolence will go away as soon as there is an opportunity to crush a competitor by ignoring that benevolence.
To quote Jeff Bezos here: "Your margin is my opportunity".
That is a very creative way to describe forcing one-side standards via monopolies. By your logic, you also love IE4, HTTPxml, flashcookies, etc.
And you call microsoft business tactics in the 90s as "foresight, wisdom, excellence, responsibility and stewardship" because that is the text book those companies are following to push those "technologies" that are completely self-serving to show rich ads to you and control which video your browser can play or not.
Monopolies have agency to remake the world; ecosystems have competition over a relatively fixed landscape. Each has their pros and cons, but to build a radically new social structure, nothing beats a monopoly.
Emphasis on this part.
Which is why a market that is completely "free", where actors are not beholden to any laws or regulations, is not a good idea.
So what? What does that have to do with anything? I would disagree with this statement wholeheartedly. Private enterprise did not save the midwest from the dust storms, government did. Private enterprise did not save the world from the Nazi's, government did. Private enterprise will not save us from global warming, government will. Indeed, all of these problems are generally started by private monied interest.
Without the government, those companies can't even operate, so your entire premise is totally backwards.
There's lots of companies out there that would cause mayhem if they simply closed up shop. But there's plenty of alternatives out there and self hosting is still an option. We can do without AWS. It would take more than a day to migrate but we could do it.
Self hosting our company infrastructure would require hundreds of physical servers. That's the easy part. Put those servers into a room, where they can work, they have power, network etc. Yes, we could move to self hosting. Yes, the company is dead before the servers are shipped, if amazon goes down everywhere and not recover. If they lose a region we are fine.
And we are a medium company.
I don't understand why you would allow this situation to arise, though. What are you waiting for ordering those servers right now, while Amazon is still working?
If you require hundreds of physical servers, it's basically guaranteed that on the long term it would be cheaper to host them yourself than let Amazon do the job, with the risks that that entails.
It's fine to take this kind of risk while you're not sure if you're going to operate long term at all, but once that's established and if you're not a small shop, depending absolutely on one company is unforgivable.
The startup costs, ongoing maintenance, and organizational costs of mitigating this kind of risk have to be considered with an evaluation of the likelihood of the event occurring. And other things the company could do with those same resources.
Do you have a fully equipped backup home somewhere far away you keep stocked with consumables and perishables in case where you live is destroyed by a meteorite one day? If not, why not?
Yes. I have some friends and family members who live anywhere between 1 mile and 10,000 miles away, in both same country and other countries, that I can turn to provide me with food and shelter if my home is no longer available for some reason.
Regardless of them, I can take shelter short term in a hotel or other rental facility, as I have sufficient savings that I'll continue to be warm and fed.
The comparison doesn't hold up. A business cannot just reform overnight if critical dependencies disappear. A person can.
This is equivalent to knowing you could get a hotel room or crash with a friend, instead of maintaining a whole second home yourself.
But my company does everything we can in order not to have a single point of failure, however unlikely it is to fail. Because low probabilities of something still mean it can happen, and you don't want to allow that if you can avoid it.
I'm not sure why the hostility or what exactly you disagree with. I said that we could migrate off of AWS but it'd take more than a day. You say that your company can migrate off AWS but it would take more than a day. Where's the disagreement?
Sure, you could _migrate_ off of AWS if AWS was still alive. Could you restore your data and start your business from scratch if you lost everything? I suspect many rather large businesses could not.
Ask yourself why Enterprise isn't in the cloud yet. There are significant reasons.
What if there's an error and Amazon bans your account, do you just shut down and give up? There's no contingency plan whatsoever?
Yes, that is what I believe. I see a path where after Amazon creates something that becomes a de facto public good they hand it over to a highly competent government agency full of the world's best operational engineers. Those people turn it into a public works project, and it has legendary 25-nines uptime.
Amazon engineers are excited to see their work become part of the fabric of the Galactic Alliance of Good and Kind Beings and no one does oncall like a Quarkian, am I right, 700-hour sleep/wake cycles how cool is that, love working with them.
Do I see a path to get there from here? Uh, not at the moment. We're still working on "hitting each other is bad" so I'm feeling pretty depressed about our outlook.
Perhaps you would argue that "if we never plan for public energy infrastructure we're screaming towards some kind of Gibsonian cyberpunk future where energy is privately controlled".
Do you know any Americans who are completely self-sufficient in food production? Should we plan for public infrastructure there? Or is it ok that our food production is privately controlled?
I personally think it is foolish to move a company's data entirely outside the company and place it wholly at the mercy of a single third party outside your control. But I don't see it as needing some plan to put it into the hands of "public digital infrastructure".
The problem is that we're so busy arguing about whether we should even HAVE a government it's incredibly difficult to do anything smart with ours.
Do you know who own the Hoover dam? Have you ever heard of this thing called National Grid?
Lets adress food production - ever heard of farming subsidies?
Did you never read anything about how these markets function? Because if you do, you will realise that government absolutely does have a hand inevery indutry that's essential to survival of organised civilisation.
The zeal to nationalize has gone from."theorerical improvement" to dogma to outright mental sickness. At this point just accept that partnerships where entities specialize in what they are good it can exist already instead of going full paranoid improbable worst case scenario. Amazon would not do well if they tried to occupy a small nation-state. It would be trivial to the US government. (Whether it would be wise for either to do is another question.)
The treatment of "nationalizing being a bad idea" as a threat is a black and white insanity like equating being "unable to be murder someone without consequences" equates to the target automatically becoming the immortal god king eternal tyrant over all.
Amazon is a baby, it's a new-ish company in the grand scheme of things. It's a huge, huge baby, it has accumulated power incredibly quickly. Where is it gonna be in 200 years? Will the federal government still be more powerful?
No one is saying nationalize Amazon tomorrow. But we haven't even managed to give our citizens good internet service yet, we're way behind here, and we do not appear to be catching up.
AWS isn’t the highway system. It’s the railroad. Now, railroads aren’t all good. Farmers were once relieved that the railroad would buy all of their produce but ultimately grew resentful that the railroad had become the only cost-effective buyer and shipper and could dictate prices to them—this is the etymology of the term “railroaded”. And eventually with the interstate highway system, the railroads had to compete with trucking.
And from that perspective, AWS isn’t even the railroad. It’s a trucking company. The railroad owns the tracks. AWS doesn’t own the tracks; they operate on the same highway that Azure and GCP use. If someone invents something better than AWS, people will invest in migrating to it; that’s how they ended up on AWS in the first place.
Does that mean that the network connectivity should be a public utility? Maybe at the last mile (municipal broadband?) but the backbones seem to work fine as a competitive market, too.
Did you know that the US was one of the only countries where radio was privatized when it was first invented? Most countries nationalized their radio airwaves and had the government control all the broadcasting. We do have the FCC to allocate spectrum but we also had a remarkably free market in broadcasting and, as a result, led the world in radio technology well into the 20th century. Even Britain was so committed to controlling the radio that as late as the 1960’s, the unmet demand for listening to rock music on the radio could only be met by pirate radio stations broadcasting from ships at sea.
Why do you think the U.S. government is one of them? They previously have shown no organizational aptitude for developing software far less complicated than AWS.
I genuinely believe in Amazon and its humans. But at some point in the distant future internet infrastructure will be so ingrained in our lives that it IS our society, and I want to live in a Democracy.
I want our representatives to continue asking powerful companies how they're handling our data, and if they're becoming too big, and all of these things. I see this as a fundamentally good thing.
I don't believe that AWS should be handed to the government, that would kill AWS. I believe that when something becomes critical to the public we should talk about what that means, and how we stay safe.
Amazon holds themselves to an incredibly high bar, and I really applaud them for that. It made me proud to work there when we talked about how critical the work was, and I was awed to see how far we would go to recover from disaster.
But Amazon has this saying about relying on mechanisms and not best intentions, and relying on Amazon's best intentions is foolish as a citizenry; we should continue to question them. And if at some point in the future we realize that AWS is more important than the self-governing society that we live in we should ask whether that is okay.
Tech companies have become some of the most powerful entities in the world in short decades. In generations they could become the world. We shouldn't rely on their best intentions.
Fantasyland. As soon as the profit motive disappears, you’ll have the DMV.
As an example, the “world’s best operational engineers” — what happens when one of those engineers isn’t world’s best anymore? Can you fire him/her? Because in government, it’s extremely hard to fire mediocrity. It’s hard to even fire for incompetence. You’ll have unions getting involved and it will quickly degrade to a public school level of tomfoolery. You’ll have strikes when those world’s best engineers want more money or more holidays. Just look at how good the French train system is — until there is a widespread transit strike, then the country grinds to a halt. I don’t want critical business processes in the hands of a public union that can shut it down whenever they feel offended. With a profit motive, there is a shared incentive to make things better — you provide the service, you continue to get paid. When a government agency employee gets paid regardless of outcome, there is no incentive or fear when a service gets slowed down or interrupted: their job is secure.
Having experienced public sector strikes in France on multiple occasions, there is no way I’d trust the infrastructure of the internet to be benevolently operated by a government entity.
Imagine the politics! Imagine people operating an e-commerce store selling sodas — sorry, but since we have a government mandate to reduce obesity, We are going to cut off your service. You run a porn site? We don’t like that, so we are going to cut off your service. You are running a website critical of our government/union/political party? We are going to slow you down. You don’t have correct diversity of your workforce? We are going to penalize your service.
As soon as you let politicians control something upon which you absolutely depend, you have given those politicians unlimited power. “Vote for us or your servers will go down.” “Agree to our demands or your business is toast.”
It’s scary to give government that power. If AWS goes down, a person will move their business somewhere else. But when the Government system goes down, there is no other options.
Governments can and should regulate, but they absolutely shouldn’t own. And, the regulation they do employ should have the sole purpose of ensuring competition can thrive. Look at how banking regulations have kneecapped the marijuana industry — now imagine that sort of power controlling the entire internet infrastructure.
We need more competition, not a socialized monopoly.
I love that in a comment about fucking space aliens and competent governments the thing that made you call it fantasyland was the latter.
Okay, the French have an incredible train system that goes down sometimes when the union feels the workers are being treated unfairly. That compares poorly to... what? To our total lack of a train system? To our anemic unions and abused workers? I read this and it sounds like a success story for government competence.
Imagine, your company hits $1T. POTUS gets you on stage. They tell you you did SO GOOD. We're really proud of you. We're gonna make you a statue in the Hall of Really Good Capitalists, and we have the best news. You are SO GOOD at this that we're gonna let you do it again. You're poor now, but we're gonna put your name in history books! If you get this rich again on hardcore mode we will make your statue bigger!
The industries that exist privately in such crucial sectors must also undergo heavy regulation.
I have no misgivings that Amazon and Google at their highest levels, pretty much only work out of private interest. It's nice when they align with the public interest but as soon as they don't, I fear what will happen.
Energy companies have no problems with polluting the environment. Between the environmental, political, and military consequences, it seems destructive when a profit motive has leverage over the rest of the country.
Aren't some highways in the east coast privately run toll roads? And right now Trump and the Republicans are trying to gut the USPS.
Disclaimer: I'm a current TAM with AWS.
The sophistry is all brain-hacking bullshit best dealt with like a poisoned drink - thrown in the face of the server.
I do not (I spent 6 years at AWS, 2008-2014), but don't believe in "evil" either; to support your point, though, the "alternative" to AWS is certainly worse.
I agree with your point that taking AWS away would cause a lot of problems (and actually, Azure and GCP are the redundancy to AWS; hopefully we don't get any meteor to hit that crowd, but if we do, hopefully there's only one, not 3).
I have no reason to doubt the benevolence of AWS at present, but how much faith do you have in the perpetuity of that benevolence? There is a tremendous power imbalance between Amazon/Google/Microsoft and the companies that depend on them for infrastructure, and the nature of capitalism and the declining rate of profitability means that eventually, the markets will demand for that power imbalance to be exploited economically.
When the Manorial system emerged in Europe, it was a largely benevolent force offering stability, security, and community in the wake of the collapsing Western Roman Empire - within a few generations it morphed into 1000 years of serfdom.
None! Literally none. This is a huge risk for our country, and we should thinking about what it means for the next 1000 years, not the next 10.
Bezos appears to truly, truly believe in Customer Obsession. The culture definitely softened while I was there though, and I can't imagine how it'll change in 200 years. I can't guarantee his great grandkids won't be dicks. I don't really want to live in the corporatist city state of Seattle By Amazon with its "benevolent" AI overlord and its drone stazi in 2234, ya know?
Yup, exactly.
The few physical workspaces that are still active out of necessity have a ton of sanitation measures in place. Regular cleanings, temp sensors, etc. I knew someone was paying attention to detail when those "foot handles" started appearing on the bottoms of the bathroom entry doors.
A lot of my colleagues and myself have been busier it feels than any time prior. There is honestly a real sense that a lot of people are suddenly depending on us more than ever. It does give the sense that we're critical infrastructure, and the leadership communicates and appreciates as such.
What does this mean, especially the latter?
As many problems as capitalism has, often monetary goals align perfectly with the 'ethical' action.
In my experience, capitalistic companies that optimize for long term survival (as is characteristic of Amazon) usually act in a less malevolent manner. However, any company that sees a revolving door of CEOs, will be seen to optimize for short term gains at the cost of consumer friendliness.
Let's say I want to ban Google from my live and I ditch my GMail account. Thinking along the lines of this author I would not be done. Actually I would not be able to have an email account at all anymore, because there are other people who are still on GMail and they might mail me and then I would be "infected." And therefore I would better just keep my GMail.
This is nonsense, of course. You're better of without GMail and Google and the others. You can't get all there in one day, but it is certainly worth it to take as much steps as you can.
I used to be a Google Guy. Android Phone, everything in my Google Account, Gmail and would use a Google service over anything else. Then I started to hear about Google randomly banning accounts and realized that having this one god Google account that basically ran my life is a major vulnerability.
So I started to diversify, not just to other services, but at Google as well. First I moved my mail, calendar, tasks to Fastmail, ditched my Android and got an iPhone, moved from Google Photos to iCloud. Next were the services I still needed from Google: Youtube, Google Play Console, Analytics, Search Console and a few others.
For those I created seperate Google accounts to manage every individual service. One for GP, One for GA and Google Search Console and one for Youtube. This way if Google bans my Youtube account, the damage is only contained to that one account and that one service.
That's how I did it.
I'm not sure how helpful that is given that Google is known to be able to correlate different accounts to the same person, it's happened before with Google Ads, for example.
Your old gmail account will linger, but soon, it will be relegated to spam and near-spam.
While a similar way of using email can be achieved in other mail clients [0] the simplicity of having such features by default it's by itself a good reason.
Some features that are non-trivial to emulate in other email clients are:
- Grouping emails with different subjects etc to the same
- Adding private notes is some emails
- Clipping specific parts
- Some UI specific features (Focus & Reply etc.)
[0] https://klinger.io/post/71640845938/dont-drown-in-email-how-...
I've submitted four "hi this is just a feature request, no action needed" tickets to FastMail over the four years I've been a customer. Every time, a person who appeared to have a clue (based on their responses) replied to me with at least confirmation of "sure, we'll think about it, might be a heavy lift" and they did two of them.
So I have a few Frankenstein's Monster accounts where I log in with something obsolete but get contacted to a current email address.
That's crazy. People change email address sometimes. Surely no major service actually does this?
Even in the digital realm, your financial data is mostly safe on account of PCI-DSS compliance requirements. So even in our connected world, a company isn't going to (legally) get your credit card information unless they're storing it in an HSM. Your personal health data is mostly safe on account of HIPAA. Even though a business you interface with might have a BAA with Amazon to store your healthcare data in an S3 bucket, Amazon is prohibited by law from actually doing anything with that data. Any serious digital business that wants to grow beyond a certain size needs to be SOC-2 Type 2 certified, which all of the major cloud providers happen to be.
The implication of being unable to "live without tech giants" as extending to being unable to prevent others from living without them is a bit of a stretch. The fact that you can't prevent others from interacting with "Tech Giants" (be they individuals or businesses) has been true for forever, and for any type of business. The idea this necessarily means that one ought to be able to prevent other individuals or businesses from interacting with them also is a more recent, but flawed idea.
I respectfully disagree.
When things were done that way, surveillance was possible but it was expensive. Someone would have to physically open every letter you sent, or visit the properties of organisations you dealt with to check their records. It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours.
It is similarly unlikely that, back in the days of cash and cheques, anyone was monitoring every purchase you made and compiling a profile of you without your knowledge or consent, again to be used for their advantage but not necessarily yours.
However, in the digital world with service providers like Google or the big payment networks, this is more or less exactly what is done routinely, every day, to everyone. Given the obvious risks involved, it is no unreasonable to question whether this is appropriate or whether those organisations should be subject to laws restricting what they can do.
Even in the digital realm, your financial data is mostly safe on account of PCI-DSS compliance requirements.
PCI-DSS is violated all the time by huge numbers of businesses, often without them realising. In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea. And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world.
Your personal health data is mostly safe on account of HIPAA.
I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue.
The implication of being unable to "live without tech giants" as extending to being unable to prevent others from living without them is a bit of a stretch.
Is it, though? Many of the dangers posed by the modern world and the tech giants that run it come precisely from the fact that there are two sides to many interactions and they only need to monitor one of them to get the full story.
You might choose not to use any Google services, but many people you contact may be using GMail, in some cases without your knowledge.
You might choose not to upload your photos to Facebook, but you can't prevent the people who were around you on your holiday uploading theirs that show you clearly enough for Facebook's facial recognition technology to identify you.
You might choose not to have a digital assistant on your phone uploading your voice to Google or Apple, but in a restaurant you are probably surrounded by people whose phones can pick up your voice from a much greater distance than any human would normally notice it and upload that.
Then there are all those modern camera systems in cars and homes and offices that are Internet-enabled rather than CCTV. The list goes on.
And on the other end of this vast data harvesting infrastructure are a relatively small number of awesomely powerful organisations, who are building up all kinds of profiles on you, without your knowledge or consent, to use for purposes that might not be in your interests, over which you have no say. This is a perfect example of the saying that just because we can do something, it doesn't necessarily mean that we should.
Yes, I mean I didn't suggest otherwise. What you're describing is a difference in degree, not kind. In principle not much has changed.
> It is extremely unlikely that your national postal service was routinely opening all of the correspondence you sent to a wide range of other parties, reading and analysing it, comparing it to who knows what, and using this information to their advantage but not necessarily yours.
This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense.
On the flip side, today, in the age of information, the market has produced tools that allow us to communicate via end-to-end encryption that has finally become somewhat insurmountable by even state actors. This is why the US government is actively[1] trying to outlaw warrant-proof encryption.
> PCI-DSS is violated all the time by huge numbers of businesses, often without them realising.
PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm.
> In any case, card payments are insecure by design, so I don't think citing them as an example of good policy here is a great idea.
I'm not sure that I agree. The EMV standard for payment cards is fairly robust.
> And of course PCI-DSS only affects card payments, not the many other payment methods used routinely by billions of people around the world.
This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet. If your argument is that most people use cash, then that's orthogonal to a discussion about the risks of digital systems.
> I'm not from the US, so HIPAA isn't much use to me. From various criticisms I've read, it might not be as useful as they think to those who are from the US either, which is a separate issue.
Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction.
[1] https://www.judiciary.senate.gov/press/rep/releases/graham-c...
Here we clearly disagree. I think the ubiquitous surveillance that happens today very much is a qualitative difference. A single data point of the kind that is captured might not be very interesting, and a single person leaving their home and seen by another person passing in the street would be forgotten in moments. But the huge databases that are built today, combining many types of personal data from many sources to build a picture of everyone's personal lives at an unprecedented level of detail, is something that has never happened before.
This is historically incorrect: the US government is known to have used its vast resources on expansive surveillance, even before the age of information. The FBI was known to listen in on telephone lines, and was known to have run a sophisticated operation of deploying surveillance vehicles all over the US. If your argument is that surveillance was once more expensive, the counterargument is that state actors have always been the entities most capable of bearing this expense.
Sure, but the expense meant that is was targeted. People expect the state to make some attempt to monitor criminals or those reasonably believed to be planning a serious crime. That's totally different from private multinational entities building up vast databases profiling billions of people.
PCI-DSS is absolutely not violated "all the time", that's a really bold and baseless claim. Yes, you're right that from time to time, it can be violated, but quarterly unannounced audits are the norm.
Not for small businesses, they're not. I don't know of a single small business that has ever been audited under PCI-DSS. And these are the ones that will keep your CVC code in the unencrypted spreadsheet on the unprotected laptop they use to track their customers' phone orders.
I'm not sure that I agree.
If I have someone's credit card in my hand, then right now I can walk into any shop in the area and buy up to £45 of goods without a question being asked. If I go online, even with just the details embossed on the card, I could buy way more from countless stores. With just a little more widely available personal information about the cardholder, I could buy even more still.
This is...factually incorrect. What "many other payments" are you talking about? Outside of cash, card payments (either physical or card-not-present) constitute the vast majority of payments for the billions of people on the planet.
Do you realise that there are entire first world countries where credit cards are hardly used? That outside the US, direct payment/debit schemes are widespread? Take a look at one of the big multi-method payment services. They offer hundreds of different options for accepting payments from different places around the world.
Then your beef isn't with the "Tech Giants", all of whom are American companies, under US jurisdiction.
So because Google is in the US, I shouldn't be concerned that everyone holding an Android phone within sight or earshot of me is potentially sending data about me to Google, that everyone I ever send an email to might be sharing the contents of the message with Google, and so on? Sorry, but I simply don't agree. Just because these huge multinationals may be based outside of easy legal reach for me, that doesn't mean they don't pose a danger to me or almost 70 million of my fellow citizens here, or the same for any other country.
I help run a small financial services business. We absolutely cannot touch card data (eg PAN) without being PCI DSS compliant. Very Good Security (VGS) exists precisely because of this, there is a market need for PCI-as-a-service. You can in theory ask someone to give you PAN-in-the-clear, but you wouldn't be able to grow a business large enough that one would be "unable to live without" you, per the writer of this article. If you are that kind of a service, you will absolutely face the consequences of not being PCI-DSS, and you have every incentive to just use a service like Stripe or Braintree to process your payments, where it's impossible to get that information in plaintext unless you're PCI-DSS compliant anyway.
> And these are the ones that will keep your CVC code in the unencrypted spreadsheet on the unprotected laptop they use to track their customers' phone orders.
The set of small businesses in the US that don't use Stripe, Square, Braintree, etc to run their payments is so minuscule as to be insignificant. These businesses absolutely do not have the ability to see your CVC code, it's all tokenized.
> Do you realise that there are entire first world countries where credit cards are hardly used? That outside the US, direct payment/debit schemes are widespread? Take a look at one of the big multi-method payment services. They offer hundreds of different options for accepting payments from different places around the world.
Yes? I'm not sure what your argument is here. Debit cards fall under PCI-DSS compliance. We're talking about payment cards, not just credit cards.
> If I have someone's credit card in my hand, then right now I can walk into any shop in the area and buy up to £45 of goods without a question being asked. If I go online, even with just the details embossed on the card, I could buy way more from countless stores. With just a little more widely available personal information about the cardholder, I could buy even more still.
First of all, this is false on its face because you would have to know their PIN. Second of all, the threat model of physical theft of a credit card is extremely narrow. And even there, it's easy to remotely disable a payment card once you know you've lost it. EMV is the industry standard because the actual threat model: replay attacks was identified and neutralized.
> So because Google is in the US, I shouldn't be concerned that everyone holding an Android phone within sight or earshot of me is potentially sending data about me to Google, that everyone I ever send an email to might be sharing the contents of the message with Google, and so on? Sorry, but I simply don't agree. Just because these huge multinationals may be based outside of easy legal reach for me, that doesn't mean they don't pose a danger to me or almost 70 million of my fellow citizens here, or the same for any other country.
It requires tinfoil-hat levels of paranoia to think that merely being within earshot of an Android phone renders you susceptible to surveillance. Unless Google has information on you, personally, it's extremely difficult to correlate background audio noise to you personally, and that would only be possible if you actually went and used Google's services. The only system that has been able to apply this level of indirect surveillance is the Chinese government, but that's because they have your information (by force), unlike Google which you can simply avoid using. And if you're this paranoid about indirect exposure to Google, you can send PGP encrypted e-mails, even to people that use G-mail. You have the tools!
And once again, there is a world outside the US, and some of its customs will be different to those you are familiar with. I've had more than one small shop or food place I buy stuff from clearly demonstrate that after a previous phone order paid by card, they'd just written down all the details and still had them on file, including the CVC.
I'm not sure what your argument is here. Debit cards fall under PCI-DSS compliance. We're talking about payment cards, not just credit cards.
Just for perspective, a rough calculation suggests that less than 25% of the money I have spent in the past 5 years was paid by card, whether credit or debit. The majority of the payments I make by far are via the UK bank faster payments system, standing orders, Direct Debit, etc. I don't think this is particularly unusual in the UK, or a lot of other places that have similar methods available.
First of all, this is false on its face because you would have to know their PIN.
And yet again, there is life outside the US, and the rest of the world doesn't necessarily work the same way you do. For example, you might like to look up contactless payments, which have been ubiquitous in places like the UK for many years.
Second of all, the threat model of physical theft of a credit card is extremely narrow.
And what about the person who had an opportunity to handle your card for a few seconds and record the numbers?
What about the problems inherent in those contactless payments I mentioned, where someone can literally walk past you in the street and use a device to scan your card details if they pass close to you?
What about the online businesses using the modern card payment services, but whose sites get hacked (or just cloned on a similar-looking domain) so that at the payment form/script stage it's not really Stripe or PayPal you're giving your card details to?
Apparently your threat model is excluding quite a lot of the potential threats.
It requires tinfoil-hat levels of paranoia to think that merely being within earshot of an Android phone renders you susceptible to surveillance. Unless Google has information on you, personally, it's extremely difficult to correlate background audio noise to you personally, and that would only be possible if you actually went and used Google's services.
No, it isn't. Voiceprints are a unique biometric marker, and the technology to isolate individual voices in a recording with a high degree of accuracy has existed for a long time.
You're potentially subject to surveillance any time you're within audible range of a device that monitors for trigger words (typically with considerably less than 100% accuracy) and then uploads the following audio to the mothership.
Or just because someone had an app that accessed the microphone, covertly or otherwise, and then uploaded the audio for whatever reason; take your pick.
Directly analogous arguments, other than the voice activation triggers, apply to photos taken on phones and subsequently uploaded to cloud storage or shared on social media as well.
And if you're this paranoid about indirect exposure to Google, you can send PGP encrypted e-mails, even to people that use G-mail. You have the tools!
Unfortunately, the person I'm sending to usually won't, and I have no way to determine whether they are using Google to handle their email anyway.
If they somehow got on a deranged crusade about paper being an ill and attempted to switch to parchment based backing their complaints that everyone else uses paper would be just as insane.
If they really are inescapable, they should not escape public scrutiny.
I think you missed the point of the comment you replied to. It's not that "just live without them" is impossible under a reasonable definition, it's that the author is using an unreasonable definition.
If large numbers of people stopped using just Google search and gmail, Google would most definitely notice and feel it hard. Or to phrase it differently, the choices of individual users absolutely can still decide the fate of these companies. This sounds obvious, but is not always true (it would be much harder for individual preferences to dethrone Microsoft, for example).
[0]: https://gizmodo.com/life-without-the-tech-giants-1830258056
*I haven't read both articles, so there may actually be no updates.
Stopped reading here.
Thought this was going to be an experiment on privacy. Like, blocking trackers and not using the giant providers SaaS offerings.
That said, I do agree that madness lies going too down the supply chain. Is using any device with a lithium-ion battery inherently immoral because they contain some cobalt that may have been mined in exploitative conditions in the Congo? Where do you draw the line?
That's what unique about these companies. When AT&T owned telecommunications infrastructure it wasn't also a major retailer, a movie studio, a logistics company, etc.
The issue that alternatives are harder to find and use is something that should be solved. Instead of pursuing policies like nationalizing Google into a public service, what if various public agencies tried to operate with free software internally and then exposed their tools to the world with things like public Searx and Peertube instances?
So I could choose not to use Amazon, but if I do business with only a few others, some of those people will do business with Amazon. The same goes for the Chinese Communist Party. Would that mean it's impossible for me to live without the CCP? There's a sense in which I could say that's true, but that wouldn't necessarily mean I shouldn't look for alternatives for who I depend on directly.
With Veganism and other stances of denial, it generates so much extra complexity and negative social pressure that sustaining them requires finding a niche social group to help you feel ok about it, and teach you strategies to help maintain it.
But if the very thing you are trying to quit encompasses the social medium, you're completely on your own.
Deleting my Facebook was social suicide, no joke. Most of my friends are old enough to rely on that platform alone. It was like losing a limb or two, and suddenly realising all your friends ever do is climb.
While I don't entirely agree with your comment (and certainly didn't downvote it), I did enjoy the double(?) metaphor here.
If you are concerned about supply chains, then Microsoft owning GitHub, which almost everyone uses more or less directly, probably should pop up high in the list of things. But for an end-user I'd again question if that is a meaningful concern.
(Sorta)
1) Many people don't use the tech giants and get by just fine
2) Actual tough stuff is getting by without the currently dominant Operating Systems for desktop and mobile and Office Software
THAT takes us some work
Also the AWS employee talking about 'Amazon and Google as the providers of the very infrastructure of the world' is absolutely ridiculous
There are a ton of cloud providers and in many countries Google and Amazon don't even have much presence
I'm sure the POS at your corner store somehow interacts with AWS or GCP, but I'm not sure that should 'count.' As well as not visiting any site that is hosted on a cloud provider.
You could almost certainly live a life with significantly reduced quality by living without the tech giants directly, but to not visit websites that are hosted on AWS, and still shop at a local shop that uses Square or other payment provider that's hosted in the cloud seems disingenuous to me.
(If you're suggesting that farmers and ranchers should go back to the days before production of plastics, hard goods, petroleum products, and rubber materials...well then they will cease to be farmers or ranchers, because 1700s-era tech won't survive market forces today.)
Similarly, no one can build computers in the US any more. Apple's Mac Pro project is interesting, but very low volume and mostly just an assembly effort.
I would counter that "old" farmers were able to use the seed from the current crop to plant for the next season so that it was self-sustaining. Now, with modified seeds from places like Monsanto where the plant from the seeds of this year's crop will not produce fruit. This forces you to need to buy new seeds each year.
I'm also suggesting that we go back to planting more than one crop per farm, and then even switching which part of the farm each plant is grown in. Crop rotation is such a huge concept that we've just thrown away. We can still use "plastic" and even "smart" equipment. We don't have to go back to stone age tools, that's just daft. We had that before July 5 1994 too.
I'm glad for the research I did 15 years ago; I still encounter situations where it becomes relevant, e.g. this discussion here and why certain water pipes are colored purple [or other colors, but at this time I remember only what purple means].
But supply chains for agriculture are a lot more complicated than sourcing seeds.
I agree with you that the current state is unsustainable. On a more general level, again, it's similar in manufacturing. Seeds or other raw materials, tractors or other specialized equipment.
Globalization adds and subtracts different kinds of resilience. Specialization only subtracts resilience.
Neither of our points has much to do with AWS though. :)
(Depending on how abstracted you want to get, but yes the farmer probably filled up their pickup for the morning delivery at a gas station that has a POS that connects to some service that interacts with AWS somewhere a long the line. Though the farmers I’d met likely used cash)
I'll buy elsewhere if it's < 5% more. I've no problem paying £5 delivery on a £100 item just to support 'the little guy' all other things being equal. But on a £10 thing, Amazon wins.
(not a farmer, but the point still counts)
You can easily live without tech giants! Stop using a smart phone, use a Linux PC/Laptop, pay for your few online services like e-mail, stop using the internet for shopping and everything else. You know, the way the entire world worked 15 years ago.
> Yes, there are alternatives for products and services offered by the tech giants, but they are harder to find and to use.
If life is somewhat difficult without giant tech corporations, this is inherently unacceptable? No - this is called living in the real world. You do very often have to choose between an immoral yet easy life, and a moral yet difficult life. This has been our constant choice for literally millennia. Every society has had to grapple with it. Entire religions are based on it. It is the completely unavoidable part of life that everyone is forced to participate in.
> If I were still blocking the tech giants today, I wouldn’t have been able to watch this week’s antitrust hearing online. C-SPAN streamed it live via YouTube, which Google owns.
So get a TV! I don't know if you know this, but C-SPAN is a TV channel! You can watch it without the internet! You can even make comments on it without the internet by calling a live show and speaking your mind! Amazing! (But, probably don't do this, as the average caller seems to have about the same political insight as the average YouTube commenter)
This whole premise - that life is impossible without tech giants - concedes that life is impossible without the internet. I assure you that it is not. It's up to you to decide whether that convenience and lack of expense is preferable to the alternative, which is doing things "old school".
When you install Linux, where is the OS downloaded from? Where do the software packages and updates reside? What about the source code?
If you blocked Microsoft (Azure + github), Google, Amazon (AWS), and Akamai, I'd be surprised if you could run any mainstream flavour of Linux.
Some *BSDs might work.
I minimize my interaction with the big computing-advertising-consumer entities but I know they're still there behind the scenes. It's all part of the same cesspool.
About 1000 mirrors distributed around the world by independent institutions using donated storage and bandwidth. Some distros may have "corporate-funded" primary mirrors on providers like AWS, but independent mirrors of those still pop up. The majority of the mirrors are universities and ISPs.
> What about the source code?
Most distros have "source mirrors", as most package managers will build a "source package" which includes the source code used to build the package, in addition to vendor patches and build instructions. If they don't provide a source mirror, you go to wherever the dev kept their source, which used to default to either SourceForge or a personal website, and is now mostly GitHub.
By default most distros have a list of mirrors that they try, and they also allow you to specify a specific list of mirrors if the defaults don't work. If your country shuts off internet access to the rest of the world, and there's no mirror in your country, someone can stand up a mirror at a local business and you can use that. And you can install Linux distros from a DVD, CD, floppy disk, USB stick, and local LAN. Even if you only have one copy of the install media for one release of one distro, you can make a mirror out of it.
The same is true for fedora and other distros of course. Many mirrors are hosted at ISPs and universities.
If Facebook is mirroring the Debian package repository you can still apt-get binary/source packages off another mirror.
the author of the article is basically writing - I'm too lazy to use alternatives
she is cementing her laziness by taking THE EXACT SAME ARTICLE She wrote a few years ago and recycling it
Six Degrees Of Separation is a fun game, but I don't think it's useful for this kind of debate.
yes but all it really demonstrates is that in an interconnected consumer society everyone is dependent on the biggest economic centers, go back 50 years and everyone was dependent on GE in the same way.
But think the other way, if you don't support them, you should avoid sites using them _and communicate so_. "No sorry, I won't, that's an amazon IP."
Using a site that's hosted on AWS === doing business with Amazon. It's just a very one-sided relationship where they get a ton of useful data and you get to load a JS app.
You can give them a lot, but you don't have to. Using a VPN and randomizing your browser user agent (if you even terminate SSL with an AWS service and not a VM run by the website owner).
I think it should be opposite - all websites should speed up. Why am I wrong?
My own PoV, is that I wanted governance 1.0 rolled back!
I agree, technology is neutral in itself, its just a tool. But, who runs all of it? Is it you? No. Is it comparable to other tools such as a shovel? No, again. The question I ask myself, is 'who owns the algorithm and its parameters?'. Do you? Or do you only have the impression of that?
If you are only 'leasing' the tools as you continue to use them, you are providing corporations the opportunity to learn all about everyone at scale. This confers huge advantages to whoever owns that data, they measure, store and analyse everything they can. But don't share it. There are many examples of this, but how about that amazon doesn't even release data on which books sell best? It simply provides a best seller list.
With that level of knowledge, much of which can be automated, and which you do not have access to, you have a massively asymmetric balance of power. I don't see how you shake off that yoke.
Like I say, I would prefer to move away from the archaic social and political order. But stepping into a highly monitored and supervised cage, no matter how gilded it is, isn't the answer for me!