I was hoping it would cover spy/malware that install remotely through many more infection vectors like clicking text messages. I guess NSO/Pegasus malware has this capability.
I barely use any apps and would gladly settle for a flip phone... I value privacy more than the ability to order food through my phone.
The irony of pointing out how to spot a "spyware" app disguised as a WiFi icon when the dozen Big G apps pictured alongside are collecting the same data...
There should be real protections for consumers to prevent ANY application from slurping up this data, and I don't mean just a disclosure or system setting to hamstring the application into uselessness. I mean, there should be regulations preventing the collection of this data in the first place, with hefty fines and punitive damages.
A lot of the tech I imagine you are referring to has been life changing for me, and if it cost normal SASS prices would not be affordable.
Regulations and disclosures are good, but a straight ban would (depending on how it was written) quite likely affect services that inherently require mass data collection, like Tile trackers, and might make other services have to do subscriptions and become unaffordable for many.
If there was a state sponsored Pine64 style company that could do all of what Google does for the same price without spying, it would be great. But at the moment, the FOSS community does not have true equivalents, or the budget or interest to do so, nor the marketing power to do the stuff that only works if everyone else uses it, and the non-spy commercial solutions have many of the same issues and cost too much for low income people.
I think part of the issue is that it is too affordable. The whole free content, free email, free infrastructure got us into current mess to begin with and since advertising was the only place that paid, now it is a part of the landscape. But on that front, pendulum may be swinging the other way.
And privacy itself is one of those terms that can easily led into a very broad discussion unless it is not clearly defined from the outset.
<< we need to be careful to find suitable replacements before we ban things.
Nah, as a society we were very permissive for the past two decades at least. It is time for tech to grow up and join the rest of the mature industries.
<< But at the moment, the FOSS community does not have true equivalents,
Sadly true. I am currently on Pine ( postmarketos ) since my main phone died. I absolutely love the idea and I keep trying to support it when I have a chance, but it is still not ready for prime time ( and I am not good enough to contribute in code ).
<< and the non-spy commercial solutions have many of the same issues and cost too much for low income people.
And this is why spying - ekh, totally voluntary data collection - should just be verbotten. We have seen where this road leads and it is not fun long term.
As far as effects on me, getting rid of modern tech would already be getting close to the authoritarian nightmare they talk about, far more than basically any of the laws other people complain about.
If the effects are harmful enough to regulate, it's the same kind of conversation as cigarettes and gas engines and a million other things that we put varying levels of restrictions on but don't ban.
Going after spy tech with more force than we go after everything else just seems like government enforced luddism.
You do have a point especially if I examine my thoughts on cigarettes, alcohol and so on to determine what makes spy tech more of a target in my life. I think the difference is that even without regulations and restrictions, I can escape both cigarettes, gas engines and so on if I so choose.
With spy tech, even if I take just about every step there is to take, even full blown luddism does not get me the world that was. These days, being a private person takes real money ( vide FB Zuckerberg buying property to ensure privacy on his real estate ).
You do have a point nonetheless, which brings me to this: what is an acceptable restriction on it to you?
One thing that definitely seems uncontroversial is protection for spaces that have an expectation of privacy. Obviously no democratic state has any business allowing AirBNB bathroom cameras, since basically nobody aside from criminals wants that to exist, and by extension any space that specifically claims to be private should have the same protection.
Requiring a "Facebook moderators may access these chat logs under some conditions" notice at the beginning of everything someone might otherwise think was private seems reasonable.
What I have more of an issue with is defining new spaces with that expectation.
The government should probably have stricter rules than everyone else on privacy, since they are the main group who both can and possibly might want to actually make use of data to harm an average person.
Digital search warrants and subpoenas have solved real problems, so I wouldn't want to get rid of those entirely, but there could be a central logging facility where you can get access to any data they have on you, get notified instantly (Or within a time limit that expires if you are arrested, if there's a need to temporarily seal it to prevent tipping off a murderer) of any new accesses, and appeal the decision that allowed them to access it, so they can't just rubber stamp give it to everyone without any transparency.
Encryption should be permanently made a right, along with anonymity networks like Tor, and Cryptocurrency in general(Although maybe not proof of work, and I sure wouldn't want to become an everyday thing we all have to deal with).
The big problem with spying is that it's just observing people and telling others what you saw, you can't fully eliminate spying without eliminating an important part of free speech.
In general, the GDPR seems to get things mostly right, but I still think the best solution is actually having private alternatives people actually would use by choice, and making sure those are legally protected.
The guiding principle for when that line is crossed is whether or not the affected person was completely and accurately informed about what is going to happen, and that they have affirmatively given their consent for it to happen.
> some privacy advocates seem to think that's still not enough.
I am one of them. I think the GDPR is inadequate in many ways, but it's certainly a huge improvement over the nothing that existed prior, and it's much better than anything we have here in the US.
But the things I think are inadequate about the GDPR still revolve around consent. I will admit that "consent" is a very broad term, though, and includes a whole lot of intricacies and nuances. It's a bit like "freedom" in that sense.
To me, it's just like any other data, licensing it to someone is no different than licensing the source code to something you wrote, if it's revokable the whole concept doesn't make sense, and you don't really own it so much as it's held in trust by the state.
But it seems like some people see it as something really personal and special that inherently shouldn't be treated like any other commercial asset, (Possibly because they've got more interesting lives than mine!) and there doesn't seem to be any compromise that doesn't make someone unhappy.
Revocability does make a lot of sense and I can think of a lot of very good use cases for that right, but also some ways it impairs P2P.
I think the only real solution is for private tech to achieve real parity with nonprivate tech, at least as much as is possible (Tech is almost never private compared to no tech at all, it can always be hacked), but I have no idea how that would be possible.
Technically it could happen, socially FOSS devs would rather work on minimalist stuff.
It's just completely banning the choice to use nonprivate services I have an issue with.
We live in a world where “buy this movie” on a streaming site gives you no kind of ownership, merely a temporary license to rent the data until the company decides they don’t want you to have it any more - treating personal data the same way doesn’t seem bad by comparison...
I agree with this. It's your data, you're free to license it out in any way you choose.
> if it's revokable the whole concept doesn't make sense, and you don't really own it so much as it's held in trust by the state.
I don't understand this. How does your ability to revoke a license you've issued mean that it's held in trust by the state? Revocability underscores that you own the data and can control what happens to it in the future.
By the way, almost all licenses are revocable.
> But it seems like some people see it as something really personal and special that inherently shouldn't be treated like any other commercial asset,
And those people aren't wrong. They're exerting their rightful control over their data as they see fit. If I choose to license my data out, I am also exerting my rightful control over my data as I see fit. There is no contradiction here -- in both cases, it's about consent.
It seems this is the article you were expecting: https://news.ycombinator.com/item?id=26639261.
I know you didn't mean it like this, but I find it funny that it reads like we've abandoned the idea of calling a restaurant and just talking to a person to order takeaway.
Also supports small business by saving them double-digit app fees!
Having worked in a restaurant, if someone took 30% of my gross it certainly would have been all of my profit and then some.
https://www.restaurantbusinessonline.com/technology/nyc-coul...
> New York, like many cities, put a limit on third-party delivery fees during the pandemic to help restaurants that had come to depend heavily on the service. Last August, it became one of the few jurisdictions to make the emergency measure permanent ... Last year, it passed a first-of-its kind law that would force delivery providers to share more customer data with restaurants.
I said they do not use GrubHub. They have their own system run as SaaS. The company they use takes care of the POS system, merchant accounts, and a white labeled app just for their store.
Does the SaaS/POS company let customers use one app and "install/subscribe" to each restaurant as needed?
In an abusive relationship that part is called the honeymoon period. The goals, the mindset of the perpetrator, and the end results are the same.
Or are you referring to the app in the Apple Store that optionally supports Apple Pay (not in app purchasing) where the merchant is charged the standard credit card processing fee - $0.25 + 2-3% of the price?
Would it be better if the person running the restaurant had to do all that themselves?
I’ve seen a mom and pop pizza shop that had all of the technology of a papa Johns thanks to all of the SaaS offerings available
Revenue for the major US delivery apps is currently in the billions, with feudal taxes.
Revenue may be in the billions. But they are all losing money. The smaller companies can easily be “lifestyle businesses” that hire in low cost of living areas and go after “enterprise devs” who are very happy to make $135k - $165K and don’t expect “equity”.
I spent most of my entire career as an “enterprise dev” working with SaaS companies in the bill payment space, field services, and health care.
I’m in $BigTech now working in the cloud consulting department working with a lot of the same types of companies.
The sad thing is that even if you do that, the restaurants are now almost guaranteed to use your phone as unique identifier and use that data for, hopefully, their own purposes ( hopefully, because the lure of selling data might be too much ).
Tracking cookies, browser fingerprinting, and ISP-level monitoring logs everything you do.
Various consumer database warehouses hoover up the data for resale/targetting by ad companies
Hint: once a business has it, at a minimum the FBI/CIA/Government has it. Likely, they've been hacked by China and Russia too.
In addition, the CIA/FBI run ISP-level and DC-level monitoring/hoovering.
Finally, there is no oversight. Either the FBI will cookie cutter whatever request they need after the fact to the rubber-stamp-anyway kangaroo oversight "Court", or they won't even bother. The CIA doesn't even need to care. The only limitation of widespread abuse is some sense of patriotism in the CIA/FBI, and of course that is pretty simple to frame/justify as needed.
The bottom line is that there is a 100% turnkey total information awareness infrastructure for any authoritarian regime that takes over the US government (see: Iraq war, false flag attacks, McCarthyism, etc). They know everyone you communicate with, your political views, your buying habits, and they will soon have AI software to maximize usitlization of the firehose for profiling, reeducation camps / gulags, and the like. The US government can deny you civil rights by declaring a US citizen an enemy combatant, and are more than willing to setup concentration camps for immigrants, and therefore "terrorists".
It was always the intent to make sight of citizens completely transparent.
The abuses stemming from a lack of privacy have not been realized because of political convictions, but because of technical limitations. The advent of advanced AI models will remove many of these technical limitations and allow corporations and governments to quickly build detailed profiles of every citizen that touches the internet.
This has been apparent since "Carnivore" was revealed to not be a conspiracy theory, but an actual system in THE LATE NINETIES, and ECHELON since the 1960s. And since then I would roughly say computing power is 20-40x more powerful (5x the gigahertz, 8x the cores), and storage is probably 1000x more scalable (40GB/280$ vs 14TB/200$).
I have no idea how old you are, but three years ago, heck that is well past the point you should have been aware of this. Look:
https://en.wikipedia.org/wiki/Room_641A
That was revealed in 2006. Basically, the crux of it was that there were "secret rooms" like that in EVERY SINGLE telco. Well, except apparently Qwest, which blew my mind at the time because they were the worst regional telco of them all, so the fact they stood their ground was a total anomaly in their usual monopoly extraction sociopathy.
One big sign of this is Tiktok. Tiktok is an attempt by the Chinese to subvert the normal monopoly the FBI has with social networks, since the US/EU governments are working with US/EU companies for facebook, twitter, etc. But Tiktok is Chinese.
So Tiktok looks like just another social network to a typical social network junkie, but then you read all these headlines where congress and the EU wants to ban it, seemingly strangely up in arms over just another video social network, and .... that's because the Chinese are doing what the US/EU have done for 25+years. The US government has ITS toys, and doesn't want the Chinese to take them.
That should clue you in to how much the government likes have total information access to social networks that are US/EU based.
A lot of this could be swallowed if the US exhibited healthy signs of a functioning democracy, instead it is another sign of an emerging postmodern totalitarian state. The last hope of this was our judicial branch, which has been so thoroughly compromised by 30 years of partisan nominations (read: pro-elite in all cases) and Iraq war case law that it will never go back.
I would stay quiet, but by the time I realized what was going on I had 10+ years of data on me. It doesn't matter anymore.
Remember though, privacy comes at a cost. Thousands of parasitic "startups" that live off of VC, produce nothing for sale, have no profits and rely on surveillance to demonstrate speculative "value" might suffer or even "go out of business", "Big Tech" might not rake in billions per quarter for selling ad services, "tech jobs" might be lost. It could be catastrophic. The entire economy could crash. It could put an AI-driven utopian future at risk. All because of the desire to maintain privacy. This is not just another HN comment conatining only FUD or hype-based predictions with zero factual support. "We take privacy seriously." It's threat to what we do. As an "industry" it's vital that we maintain peoples' trust while we surveil them. /s
https://prestersperspective.blogspot.com/p/schizophrenia-ran...
I'm just a hobbyist geek, though, so I may heavily overinterpret things (and the OP) here. :)
Thanks. I puked a bit. Put a damn /s on that thing.
If it was not in jest, seek help. You aren't thinking properly.
What if a company has no profits.
What if a company's product or service is "free". Is that sales.
What if a company has sales, i.e., online advertising services, but in its communications with employees and the public it continually suggests its "business" is something else. Why would it do that.
In any event, there is a question IMO of whether a "tech" company is even "in business" if it can only ever pay its employees and other expenses with investment rounds. Is it possible to "go out of business" if the company was never "in business" (assuming we accept the usual definition of a business).
We already know how VC and "tech" companies would answer these questions. Anyone who questions what they are doing is always wrong. We know that. We have heard it before. But VC and "tech" companies do not have a history of being honest. There is a credibility issue. Not to mention that trying to discredit people who ask questions is silly.
This thread titled "What happens when your phone is spying on you" is about (free) "smartphone apps" that collect data about people below peoples' awareness, strategically avoiding the issue of consent. Why is this even happening. Did VC and "tech" companies have anything to do with it. No, of course not. Performing such hidden data collection is exactly what they consider a "business". It seems that some folks would prefer not to be spied on even when it is essential to someone else's "business".
https://www.sysnet.ucsd.edu/~voelker/pubs/spyware-pets23.pdf
It's academic research, so this thread here expressing disappointment about the article is weird. We should probably just replace the press release with a link to the study itself.
From the abstract:
. In this work, we perform an in-depth technical analysis of 14 distinct leading mobile spyware apps targeting Android phones. We document the range of mechanisms used to monitor user activity of various kinds (e.g., photos, text messages, live microphone access) — primarily through the creative abuse of Android APIs. We also discover previously undocumented methods these apps use to hide from detection and to achieve persistence.
This was built after the NSO group hacks to lock down the device to be resilient to nation state attacks.
It limits some of the attack vectors you’re taking about (with a tradeoff of also limiting some features).
Apple also enabled true e2ee in the cloud where only you retain the keys.
Is there a procedure to realistically verify that your communications are e2e and not e2mitm2e ?
https://petsymposium.org/popets/2023/popets-2023-0013.php
PDF Paper: https://petsymposium.org/popets/2023/popets-2023-0013.pdf