Hacker News Reader

Comment by sdoering | Hacker News Reader

I strongly believe we have lost the war for privacy and security (against state level actors) already. Once the net adopted the platform model, we were screwed. Platforms are as easy to regulate, as for example the telephone companies were back in the days.

They were easily forced to comply with wiretapping demands of the government.

The moment a central platform controlled (most of) our communication and was able to provide security to the users by using encryption, legislators realized the danger and also the solution. They would just need to force these central hubs with laws as they did back in the day. Legislation was/is needed to break users' encryption and give government the access to all communication that was lost with modern forms of communication and encryption.

So on one hand, it is "just" a return to a previous state of affairs. On the other hand, given for example today's methods of automatically listening in and transcribing voice to text, this would be a way more massive intrusion and control mechanism.

View on HN

And I strongly believe apathy will be the death of freedom.

This is a needlessly negative outlook. Click the link, support the EFF. Educate your friends and family.

Defeatism is not a compelling philosophy.

Exactly. I see this defeatism all the time regarding climate change too. It's OK to feel defeated. But why the hell would you spend energy to spread that defeatism?!

To make it less questionable.

If you have been defeated, acknowledging it is crucial.

It's hard to make progress while denying the actual nature of the situation.

Not saying that's necessarily true in either of these situations, just that it's not a waste of energy to spread depressing truths.

"it's not a waste of energy to spread depressing truths."

It certainly is, if those "truths" are not absolutes. Find a way to redirect your -- and others' -- energies toward something positive and constructive. Spreading doom and gloom, full stop? Always a waste.

If you never move on to constructive action, that's a problem, for sure.

However, telling a sad or difficult truth and stopping there is still a big improvement on pretending there was no issue in the first place.

You have presented a false choice.

Saying negative things is just negative, full stop, as already stated. You can make this positive by suggesting a solution or asking someone qualified to suggest one and then helping them achieve it.

> Saying negative things is just negative, full stop.

I dunno, I'm not sure that's always an absolute. Example: your boss says the budget has been slashed and the department head will be downsizing the whole department by 50% in the coming months. This is very obviously a negative thing, but is your boss doing you a disservice by giving you a heads up? "Oh but he should give me guidance that I should work diligently but also prepare resumes and look into other options." Of course they should and it would be really nice if they also could find out for sure if your head is on the chopping block- but let me ask you this: even if your boss doesn't offer this very obvious advice or have any insight into the department head's persona non grata list, is knowing about this negative truth a net-negative for any employee this concerns? Of course not.

Or even more relevant to HN: a very outgoing individual who loves the face-to-face environment of the office has just been told that the CEO has decided everyone will be 100% remote starting next week until 2022. Is being told this negative truth a net-negative for the social butterfly employee who now at least has a brief chance to wrap their head around the idea and mentally prepare for the change instead of being blindsided?

Sometimes simply raising awareness that a negative thing is happening isn't a bad thing.

> I see this defeatism all the time regarding climate change too.

And I see people suggest that we aren't completely screwed because we got 10,000 people to walk down a street one time. Its an insane position and we need dramatic measures that the human race in its current form are unable to enact.

* Climate change is going to happen because people like cars and supermarkets and nobody is asking anyone to _actually_ sacrifice anything. Much of the climate change movement is "someone else should do something about it" and those that cut themselves by going "off-grid" just make themselves quieter and are replaced by twenty more people with growing carbon footprints.

* Online security is fucked because the vast majority of people can't handle more than a modicum of detail. Its on the technical class (i.e. the 5%-15%) to protect it by hook or crook. It will lose in a democratic battle to preserve it because people aren't interested enough to care and its too complex.

My suggestion is that defeatism posits a better question to answer: "What do we do once we've lost?".

The answer to that question yields something useful instead of the suspension of disbelief that the human race will suddenly turn over a new leaf.

It's needlessly negative to suggest we have to first "lose" to make positive change.

you're being facetious. We don't "have to first lose", its just the very likely outcome is that we will lose.

That's not to say its not worth trying but that we should assume failure, otherwise you end up like the UK's Brexit negotiators who were "all-in" on the "oh they'll buckle as the time runs out" strategy and have no plan if that doesn't pan out beyond "so what now?".

The basic strategy right now seems to run on the basic belief that human-kind will figure out its slowly destroying its habitat and change accordingly. I don't think we've even managed to all figure out the extent of the destruction let alone even start to change accordingly.

What habits have we changed since the 1990s within our population to cut global carbon emissions? I'm struggling to glue a couple of things together. If I'm not mistaken, global air travel has _soared_ within that time window and everyone is just sitting on their hands under the mistaken belief that renewables will bail us out while we all still drive in a car to go to the supermarket.

I’m saying framing the climate crisis as “lost” is a bad way to gain support for positive change.

Well sure, its not the best marketing campaign but I'm not marketing for them so its fine as an opinion, isn't it?

> I strongly believe we have lost the war for privacy and security (against state level actors) already. Once the net adopted the platform model, we were screwed.

This is very pessimistic. People still can understand the dangers (and are understanding) and switch to decentralized platforms, which by the way are actively being developed: https://joinmastodon.org.

And will just be banned and blocked

And (more pessimistic future) you'll go to prison if you install such an app, or visit a website that tells you those apps exist.

Already happened in some countries.

B.t.w. someone wrote long ago here at HN that the 2nd amendment about weapons, nowadays should be about cryptography instead. Maybe:

> A well regulated Militia, being necessary to the security of a free State, the right of the people to [use end-to-end encryption], shall not be infringed.

Well, if a mastodon instance admin decides to ban you, that's their personal decision. You can go to another instance.

If another user blocks you, that's on them but you have no right to push your messages into another user's home system.

If all else fails, you can host your own. It's ultimate free speech as intended and as someone who hosts a mastodon instance, it's a system that works pretty good, there is no noticeable hatespeech in my federated timeline.

edit: I might have misunderstood the GP, but I'll let the comment exist. Banning mastodon in the US is a non-concern since it's a french open source development.

I think that same logic applies to companies though so it's just shifting the problem over.

But I think GP might have meant banned at a government level?

I think you may have misunderstood the commenter. They seem to have been saying that Mastodon will simply by banned/blocked as a tool/platform by law.

I think tokamak meant they will be banned by law, which sadly I can see happening - it effectively happened already with napster and bittorrent in some jurisdictions.

To fight this, please use Mastodon and/or create an instance in it. It must become as widespread as possible to become the norm, then it cannot be (easily) banned.

I doubt a US ban will have much effect on a french open source project.

You're thinking of PeerTube. Mastodon's lead developer is from Germany.

The US govt will just convince their Nine Eyes friends to adopt the same legislation and that's the end of that, as well.

The authoritarian stream in the EU are already working on something similar, but it will be a much harder sell and i still hope we can stop it, before it is too late.

I can't. Napster was shut down for copyright infringement. Bittorrent is blocked in some places on similar grounds (although, notably, BitTorrent itself is still alive and well - the law enforcement action has been against distributors of copyrighted materials and sites like TPB).

But even if someone really wanted to get Mastodon banned and created a server full of illegal material to give politicians the fuel they'd need, the law enforcement answer there would be to go after that host. The overall network would not be liable because it wouldn't be hosting/distributing the material.

Once the illegal activity is defined as running the software itself, because it cannot be done legally, then all hosts become liable, regardless of what they host. Simply by launching it, you would have broken the law.

I fin it very unlikely to see distributed social networks like Mastodon or Diaspora completely banned. In the US, this should be protected under the first amendment, in many other countries, it's protected under similar laws. And many countries don't care as much about violating their citizens' privacy as the US does.

Do you really see most people leaving the likes of Facebook, Instagram and Twitter? I don't think they care about privacy enough to stop doing what's easy and fun

For talking about their personal life? Not really. But when talking about money or politics, I see more people going to telegram.

Even the fact that this bill is proposed proves that government lost some of the control that it had over private conversations.

I like Telegram, but I‘m not sure it is the prime candidate for privacy / secure communication. Hopefully Matrix gains traction. Element is getting better but is still full of bugs...

I couldn't see Matrix in the play store, the web page is unusable: I wanted to try it, not ,,learn more''.

I installed Element, but it required username/password pair. I understand that it's a bit more secure than using phone number+email for first authentication, but it makes discovery of friends too hard. It trades too much UX for security, just like PGP.

> It trades too much UX for security, just like PGP.

Thats similar to what eMail does, it trades UX for [nothing] (would place decentralisation there if it were not for gmail etc.)

Email is used for historical reasons, it wouldn't be good enough as a new service. If it disappeared, everybody would be just using Facebook for authentication / connecting with services.

I've not tried installing Element, but I imagine the app could gain the feature of automatically generating a password for you. Asking a user to select a username when joining a chat network seems like a reasonable UX, although having to pick a server is an extra burden.

Perhaps the creators of the app could partner with some big providers to allow the app to try creating your account on one of these providers at random (and keep trying different providers if your intended name is already taken on one that it tries).

I also agree with you about discovery of friends being hard unless users provide their phone numbers to a central server, so perhaps there should be an option for that when creating your account. This central database could run by an independent, audited, third party service. I'm not sure who could be trusted in that role (perhaps Let's Encrypt?), or how much it would cost, but it's an interesting thought experiment.

People have been leaving Facebook in droves. Hardly any of the original users use the platform regularly. Facebook has only remained relevant by buying relevant platforms as they start to take off. Companies that declines an offer or regulation to prevent this buy up behavior is what it takes. Social networks have no monetary buy in to discourage switching the moment your friends aren't on the platform any longer

You might get this impression if your main source of news is HN, but Facebook's monthly traffic among North American users has been steadily climbing quarter after quarter, year after year. Globally, it's up 8% YoY.

https://www.statista.com/statistics/247614/number-of-monthly....

...and they've been flocking to Instagram (also Facebook is still huuuuge)

Companies that are willing to play dirty are the ones that get investment and also are the ones who retain users. They have an inherent advantage over any platform that tries to be moral -- or alternatively platforms that try to be moral have an inherent disadvantage. As long as privacy and respectful user experience is on the bottom of the list of priorities of most users they are the ones who will be able to build momentum, and I can't imagine what could happen to change that.

https://news.ycombinator.com/item?id=19322448

U.S. users are leaving Facebook by the millions, Edison Research says (marketplace.org)

1293 points by rmason on Mar 6, 2019 | 616 comments

Why do "most people" need to do this?

The questions isn't "What do 90% of people do?". The question is whether or not those of us that care about privacy have the ability to be private.

Are you willing to cut yourself off completely from that 90%? Given current policies that third parties have no duty to protect and even a duty to provide their data to law enforcement, you can care about privacy all you want but if every person in your circle isn't just as vigilant you are still screwed. Once one person in your circle leaks data or metadata about you to a privacy unfriendly third party, you've lost the game.

There is nothing to say that 'decentralized' will be better for us on the whole.

Facebook and Google actually do a relatively good job of protecting our data. They have to live up to specific claims by government, which some people don't like, but otherwise, it's pragmatically safe.

'A million servers' here and there, without process, oversight, 'a lot to lose', lack of transparency, and it might be a whole lot worse for most people.

'Many leaks' at small companies may not have the public and regulatory impact as a 'single big leak' at G or FB.

For 'the tech literate' who know how to manage themselves, it may open up avenues of greater security, but for the net-plebes, not so much.

Think about the freedom that comes with ample food + health and lifestyle choices. Some people are incredibly more fit and healthy than any other people in history, but most of us are somewhat more sedentary, we eat to much, don't exercise enough.

> Once the net adopted the platform model, we were screwed.

So stop being another brick in the wall: stop using the platforms just because it is convenient. For example:

* https://old.reddit.com/r/selfhosted/

There is some irony in this being a reddit link.

A better link: https://prism-break.org.

Well, if we're talking e-mail:

* https://workaround.org/ispmail

* https://mailinabox.email

If we're talking photos:

* https://www.zenphoto.org

General storage:

* https://owncloud.com

2020, still a nightmare to make 2 computers both connected to the internet talk to each other.

One day IPv6 will get rid of the platforms.

Actual competition for ISPs / access provision is required for this. All consumer ISPs still ban "servers" on their pipes; this is a clear sign of insufficient competition.

My consumer ISP allows me to host servers. I can add on a static IP for a few bucks a month and as long as I don’t break any laws they’re cool with it.

Previously I had “business class” internet but that is just the name of the plan. Anywhere there was cable I could get business class plans.

> Anywhere there was cable I could get business class plans.

The one time I tried to get a business-class connection from Time Warner they refused to offer any business-class service to a non-commercial address except for their "Home Office" plan, which was basically just their top residential plan with a better SLA.

Huh?

It's nearly always in the fine print of the contract, but enforcement is on a selective basis.

Then we should abandon those big platforms and move to millions of self-hosted personal mini-platforms. That way, you control your data, and you control who you share it with.

> That way, you control your data, and you control who you share it with.

Well, you already control who you share it with, as you're the one initiating connections to sites like Facebook. It just happens people give a lot away to browse sites these days (admittedly exactly what they're giving away remains quite opaque).

Unfortunately even if we did move to one-platform-one-person, the question of data control remains as murky as ever. Suppose you are hosting a party so you send your street address to your friends so they know where to show up. Then they play a fun quiz game that tells them their Harry Potter patronus based on the street address of their friends (that means you). Suddenly some anonymous quiz maker (let's call them Oxford Synthetica) has access to your street address and at least one of your friends' info through no direct fault of your own.

Government and coporations are just systems. If people want a certain thing those systems change. Simple as. However, change takes decades sometimes. Just form good privacy habits so you don't even feel any inconvenience. And most importantly, tell people. Get the idea across that privacy has value. Tell companies you've chosen competitors over them because of their privacy policy. Ask businesses how long they keep your data. Ask people if you can use alternative technology.

It really is a case that if you give up then it will be over. Just make it a part of your life. I'm not asking you to rally every week. Just don't forget about it and positive change will come.

"Once the net adopted the platform model, we were screwed. Platforms are as easy to regulate, as for example the telephone companies were back in the days."

Perhaps - and most fall into this category.

However, you do have the ability to form a (simple, cheap) SCorp/LLC in the US jurisdiction of your choice and provision your own mail/dns/vpn/etc. by that corporate entity.

So now a corporate entity is the provider, and you are the customer, and notices/subpoenas/takedowns/requests will be seen by you and you will take action on them.

At the very least, you can self-provide your own VPN this way if you don't want to run your own mail services.

Except state actors are currently also using the blanket privacy and security to influence elections. This is a couple of levels above talking crap about your government or buying some drugs.

And if that is to the point that it scares you that they'd lock you up for such behavior then you need better government, not better privacy.

> I strongly believe we have lost the war for privacy and security

You are mistaken counselor (c) The Descendants. These three easy things improve your privacy by 10x:

- Incognito / Private browsing by default. Clears cookies used by trackers and platforms. Staying logged in is bad. Login, do your thing and close the tab. No Chrome, it has its own Id.

- VPN. Hides your browsing history from ISP and your IP address from trackers and platforms. Smartphone too, and disable Location and Background app refresh for most apps.

- Adblocker (uBlock Origin / AdGuard for Safari, iOS too). Prevents trackers and malware from executing.

Avoidance of social media should be in this list.

No, it is too harsh. These rules will work for most people. In social media, never share your address book and don't give your phone number, which is very powerful identifier. Unique email is good too.

That is just plain wrong. Even a distribuited model would have the same problems because they would be "platforms" to regulate. The truth is that they cannot win although they will demonstrate a mierdas touch and turn everything they touch to shit because what they are insane and demand the literally impossible. The "leadership" should probably be put in an insane asylum as a danger to self and others with no understanding of objective reality.

Yes, we have already a working precedent with the "Ministerium für Staatssicherheit".

these are all just battles though and all that losing these battles does is pass more and more power to the technical class.

I know where I'm watched and how not to be watched, I know how to very easily hide the odd activity. The average citizen no longer gets that for free and it really sucks for them but remember that's what this has always been about, trying to improve the lot of the average, not us. We're fine because we know and can do.

So its elliptic curve time for messengers but everyone that "knows" will get some European or underground US piece of software on their phone via an unofficial app store.

That https was established as defacto-standard was a huge success and I don't think it will go away again.

Freedom only works with some responsibility, but it seems to me that state level actors just try to keep up with the ad and tech industry in collecting data.

The EFF tries to blame it on Barr, but I think the wish for control is bipartisan, especially since a generation is in charge that doesn't really understand the problems of this data collection. Not that their younger compatriots seem more promising in assessing actual problems.

There might be a point where using a Asian or African social network would be preferable, but that is something not on the mind of common social media users. Sure, they do it if the product has appeal like TikTok. On bad days I wish users of social media (the self presenting kind) would be banned from all other sites.

Reply on news.ycombinator.com