Hacker News Reader

Comment by michaelt | Hacker News Reader

I sometimes wonder whether the people in the tech industry who worked on things like secure boot, attestation, and DRM saw this as the inevitability open source advocates always saw it as.

Did they think, as they worked to transfer final say from users to corporations, by technical means, that politicians couldn't transfer that control to themselves by political means?

Did they think they could lock things down to extract their 30% app store fee while enforcing rules through app review (and demonstrating censorship of sites like Tumblr) that politicians wouldn't want that same rule-setting, censoring power?

Did they think their employers were going to prevent that transfer, that the trillion-dollar companies would become some sort of Che Guevara style insurgents, running a guerrilla campaign to overthrow the very system that made them trillion-dollar companies?

View on HN

My impression is that people who can work on stuff like that are the kind who just take the stuff in the world for granted. "This is how the world is, we need digital restrictions so now we need to implement them." "I don't have a say about whether DRM or remote attestation is standard business practice or not, it is just how it is."

This is akin to how two kinds of people respond to law. The first kind think "This is the law, we must follow it" and the other kind think "This law doesn't make sense, we must change it".

People who look at pedestrian traffic lights and cross when it's green vs. people who look at cars and cross when there are no cars coming. The first say you must follow traffic rules and the second kind say they wouldn't be alive if they looked at the green/red light of law instead of whether there are oncoming cars: a green doesn't mean it's safe to cross and a red doesn't mean you can't cross if only there are no cars.

> My impression is that people who can work on stuff like that are the kind who just take the stuff in the world for granted. "This is how the world is, we need digital restrictions so now we need to implement them." "I don't have a say about whether DRM or remote attestation is standard business practice or not, it is just how it is."

I like to call those people "ventablackpilled". Being blackpilled is all about gloom and doom, but being ventablackpilled is beyond being blackpilled. It is when you actively want the world to be a worse place because you believe that that is how the world works.

You're giving too much thought into the issue or trying to construct something like a conspiracy out of it.

I sometimes work with people who worked on or at least worked with DRM-like stuff (Trustzone etc.). The people who make those systems and the structures that allow it falls squarely on banality of evil. It is not a big evil org or people with their own evil agendas (unlike Palantir, i think they are the true "ventablackpilled" ones). They are thousands of developers who push JIRA tickets like everyone. Many of them live in the developing world and they just pray to keep their jobs. The reason that big tech attracts developers despite their obvious and much bigger (IMO) evils is the same reason that attracts developers who make systems that can be completely closed down.

Many of the developers are not outright evil either. They sometimes voice their opinion. Their opinion doesn't matter in comparison to the business goals.

Sometimes it is understandable to write blocking software. Not all equipment is sold. Many industrial equipment is leased. So the actual owners want guarantees that their devices cannot be modified by renters.

The amount of info you can extract from an Apple phone or Graphene OS is limited due to same restrictions working in your favor too.

Similarly phones can be locked down due to radio restrictions. Nobody wants infinitely exploitable SDNs in peoples hands. It makes such SDNs a juicy target for enemies like Russia to exploit and turn into scalable attack vector as spoofing and jamming devices.

The reason those are attack vectors is also banal. We made our bed as engineers, voters, governments and business leaders one sloppy work at a time. We made shitty chips and shitty software with no care for security or safety. We sold millions of them and nobody wanted to pay to "do it right way". Worse is better. Silicon Valley style scaling up is the goal. Competition is for suckers. All those and every single one of us ate the fruits of shitty hardware and software that are protected by closed down systems. We engineers got the cushy jobs, our business leaders made 10x 100x gains from our work. We either had little voice (because making a big noise is guaranteeing that your cushy job no longer exists) or whatever we had is ignored in the hubris of shipping shit to billions of people.

<< We made our bed as engineers, voters, governments and business leaders one sloppy work at a time. We made shitty chips and shitty software with no care for security or safety. We sold millions of them and nobody wanted to pay to "do it right way".

I dunno. By that I mean, I am sure it happens, but I am not sure this is the reason for it. FWIW, I am not an engineer, but I have a window into that world.

In my little corner of the universe, we are going through belt tightening exercises already. So it is an interesting game of less meetings, shoving as much as you can onto others and the classic 'doing more with less'. In other words, even for internal customer's 'doing it the right way' is imply not a priority. On the other hand, getting more people, bigger budgets and somehow money saved is. 'Doing it the right way' is a distant ideal.

All that said, I don't think you are that wrong with the 'banality of evil' thought.

Ironically, the very OP statement is exactly that: trying to make the world a worse place because they believe that that is how the world works.

The solution to avoiding dictatorship is engaging in politics and preventing dictatorship directly through that. Trying to retreat into the (perceived) wilderness and build barriers to dictatorship doesn't really work. But since people drafting that statement don't believe that politics work and it is, in fact, possible to both have a vibrant political scene (we have what, five viable political parties vs the American two?) and not let kids send nudes, they try to drag everyone into the same mind frame.

I think it's vantablack unless you mean like a Starbucks Venti cup of black

much much worse are the ones taking the biege pills, who of course will drag anyone who notices into there world of where which one of 59 shades of biege constitutes the true way into non confrontational , we will escalate and swat you for any hint of agitation while we decide not to decide to not provide the very function they are in charge of,passivity and conformity to bieng childless and into flabby sad kinky stuff. legions of them.

The critical mass of people who don’t use critical thinking as their main means of decision-making.

> This is akin to how two kinds of people respond to law. The first kind think "This is the law, we must follow it" and the other kind think "This law doesn't make sense, we must change it".

What? I don't understand how this is a "two kinds of people" generalization, when the two categories aren't even mutually-exclusive?

One can think a law is bad and should change, while simultaneously recognizing the rule of law and following it.

It's pretty weird to try to pit those two perspectives against each other

Then you are the first kind. Since the law will not change, you will continue to follow it.

> "This is the law, we must follow it" and the other kind think "This law doesn't make sense, we must change it".

There's zero point in changing the law if you don't expect it to be obeyed and enforced. Those positions are not opposites.

If you don’t expect it to be obeyed or enforced, then I would say that means it should be fast tracked to be changed. “Show me the man, and I’ll show you the crime.”

You say "should be", I say "won't". One of those is a statement about material reality.

The point is that if you don't follow the law as is then what expectation can you have that anyone follows your changed law - and if no one does then what's the point.

There are laws in existence that no one even "law addicts" would follow unless brain damaged. On top of that sheer amount of laws makes on "following those" simply impossible. there are also conflicting laws. Some laws are even refused to be enforced by the police.

It is a dynamic world where respect for law, trying to change law and plainly saying: "go fuck yourself, not gonna do it" should and do coexist.

Absolutely all laws followed strictly to the letter would kill a society.

If there is a stupid law, there are several things you can do:

You can follow it anyway and make no attempt to improve the situation, allowing the stupid consequences to follow indefinitely. (Notice that anyone who follows the law while doing nothing because they've been convinced reform efforts will be ineffective are in this group.)

You can follow it anyway while trying to change it, attempting to limit the time the stupid consequences exist.

Or you can refuse to follow it.

But the people in the last group should still be trying to reform the law, both so that they don't have to risk being prosecuted for doing the right thing, and in order to get the people in the first and second groups to stop doing the stupid thing the people in the third group are already refusing to do.

Somebody had to work on it before it was how the world is. When Microsoft proposed a scheme involving remote attestation and DRM in 2003, the New York Times published a critical article. Google SafetyNet a decade later barely got a whimper out of major tech outlets, much less the mainstream press.

https://www.nytimes.com/2003/06/30/business/technology-a-saf...

>Somebody had to work on it before it was how the world is.

The mindset the parent described extends to what they're asked to do. They don't challenge it. It doesn't have to already be law for them to accept it and build it. It's enough that the ask comes from authority (a boss, a government) and pays.

>People who look at pedestrian traffic lights and cross when it's green vs. people who look at cars and cross when there are no cars coming. The first say you must follow traffic rules and the second kind say they wouldn't be alive if they looked at the green/red light of law instead of whether there are oncoming cars: a green doesn't mean it's safe to cross and a red doesn't mean you can't cross if only there are no cars.

Don't forget the selfish jerks who simply ask for whatever class of traffic that isn't them to be punitively regulated to their benefit.

(both literally and transferrable to other issues as a metaphor)

> The first kind think "This is the law, we must follow it" and the other kind think "This law doesn't make sense, we must change it".

Indeed. I can't understand the people who blindly believe any law is good just because. Stop, think. Is the law good? What's good about it? What's bad about it? Can it be abused? Then maybe it should be changed?

I advocate that every law should have an annual review to catalog every case where it has been applied. How many were sensible positive outcomes? How many were unintended consequences? How many were clear abuses of the letter of the law? Every legislator should vote on the record based on that annual review to either renew or cancel the law.

> I can't understand the people who blindly believe any law is good just because. Stop, think. Is the law good? What's good about it? What's bad about it? Can it be abused? Then maybe it should be changed?

I think many people have an expectation that (all) laws are just and needed because... somehow they're the law.

In reality, laws can be unjust, unnecessary, biased, and completely arm-wrestled together by people strictly following an agency of their own. Other laws are put together by sheer ignorance and lack of thinking beyond mere good intentions. The first question shouldn't even be "is this law fair" but "was this law made fairly".

It creeps me that people treat laws as axioms whereas they're just polished and reinforced opinions. Sure, many laws we can agree on, and many others that don't agree on aren't worth changing, but you should always question the law and question where it came from before choosing to accept it.

I can see the same pattern with technology such as the various digital restrictions management (DRM) schemes.

Most people live such sheltered lives that they haven't seen injustice or engaged with the subject matter seriously if they have not seen it.

> I advocate that every law should have an annual review to catalog every case where it has been applied.

I like this idea but frankly I don't trust our lawmakers to do a fair assessment of this. Maybe there's an independent, non-partisan committee that does this.

> I like this idea but frankly I don't trust our lawmakers to do a fair assessment of this.

Absolutely true. But at least it would force every legislator to put their name yay or nay on every law every year. There are few things that politicians hate more than having to be on the record for supporting or rejecting something.

Then we all could review the full list of laws they voted for or against and vote accordingly.

There are so many laws on the books that reviewing all of them every year is completely impossible. Doing what you propose would require the government to be greatly shrunk and simplified (which, to be fair, I'm not necessarily against).

Personally I would put myself somewhere between your two "kinds of people". Many individual laws are bad and should be changed, but the rule of law itself is a good, stabilizing force that should generally be respected. If people only followed laws they 100% agree with then that would be chaos, therefore even bad laws deserve at least a modicum of respect.

> There are so many laws on the books that reviewing all of them every year is completely impossible.

Oh well, so maybe there are too many laws, let's simplify.

That is only partially tongue in cheek.

I'd say if there is no time to review and vote to keep or cancel a law, it is automatically cancelled. If it was important maybe someone will reintroduce the legislation later. Fewer laws are better, we should consolidate around laws with the most bipartisan support and scrap the rest.

But also in how I envision the system, if a law is repeatedely affirmed year after year, it should receive an increasing TTL. The formula should also have some modifier for which party controls legislature at the time. So if some law is reaffirmed multiple times under legislatures controlled by different parties, it's probably a fairly uncontroversial law, so we can increase the refresh rate to 3 or 5 years (avoid multiples of 4 since that is election cycle). Over time, the TTL can increase and perhaps there should be a way to eventually promote it to a permanent law, but that should have a very very high bar.

One can dream.. of course it won't happen, so back to your country controlled by a few oligarchs grifting for their personal profit.

That doesn't really answer the question.

Suppose there is some peon at Microsoft who is ordered to write code for Pluton and then does it because they don't want to be fired, expecting to hide behind the Nuremberg defense. The people in your second group will naturally disapprove of this.

But regardless of that, we can ask the same question of the person giving the orders. Someone in these companies initiated these programs, so are they merely fools who couldn't predict the obvious consequences that others did, or are they truly malicious?

> Suppose there is some pe[rs]on at Microsoft who is ordered to write code for Pluton and then does it because they don't want to be fired, expecting to hide behind the Nuremberg defense. The people in your second group will naturally disapprove of this.

I would rather say: people who are too "rebellious"/"non-obedient" don't get into a position where they are ordered to write code for Pluton.

> My impression is that people who can work on stuff like that are the kind who just take the stuff in the world for granted.

Some are also doing it for the technical challenge, especially those working on new tech rather than refining what already exists. Like the people who try to solve the great problems of mathematics/physics (or find interesting new ones) for the challenge of it (and sometimes refuse prizes & recognition if they do solve or otherwise discover something vital).

This sort of person is often blinkered to the possible extreme long-term outcomes, or are able to mentally separate themselves from them (“I just made the discovery, I didn't use it to do anything bad” or “I was paid for it, follow the money source and blame them”). Of course once a genie is out of the bottle, other sorts of people are more than eager to ask it for wishes…

> This is akin to how two kinds of people respond to law. The first kind think "This is the law, we must follow it" and the other kind think "This law doesn't make sense, we must change it".

There exist more kinds:

- the "rebel": "this is a law/rule, so I have to trespass it". This often holds for people who are either annoyed by rules or red tape or for people who see no hope of changing the law. An example are the "blade runners" in London who organize to destroy lots of surveillance cameras at once, in particular those that are used to enforce low-emission laws. [1]

- the "evil": "this is law, so I will (ab)use it for my personal gain".

[1] https://www.independent.co.uk/news/uk/crime/ulez-cameras-van...

The rebel is just a subset of the second type, and an effective subset if you look at history.

The evil is just a subset of the first type, abuse and use are functionally the same action within a poorly or properly constructed law/policy.

This is spot on. My wife will walk to the ends of the earth to find a crosswalk because she doesn't want to jaywalk. I use my eyes to see if there are any cars and will cross when I deem it safe.

That said, I'm not going to pretend I'm one of those people who say "this law doesn't make sense, we must change it." it's more like "this law is not convenient to me right now and I am willing to suffer the consequences of breaking it" but frankly I'm not going to start a grassroots effort to try to change it.

Replying to this comment so I can refer to it later.

The people in the industry that I know were/are trying to stop fraudsters, script kiddies, nasty people, and governments from trying to exploit weaknesses and take unauthorised control of devices and services.

The problem with that is it generally requires a central point of trust.

Sure you can allow multiple points of trust, but for the unskilled user, that means that the little lock symbol becomes unreliable (or whatever)

Without commenting on the UK governments stuff (It is probably full of shit, but then thats what lobbying does) We as technologists need to engage with wider society and understand on their terms, the worries they have.

For this particular "proposal" it strikes at the core worry of today's kids. They are sadder, more insular, more dependent on mobile comms and exposed to much nastier stuff than millennials were at the same age.

AT my school in the very late 90s, a group of 14 year old girls went to the beach and took a disposable camera. Standard photos apart from one, which was a group of them topless. One of them brought them back from the developers into school. Somehow the topless photo was stolen and passed around various classes.

It ruined her month, even though she got the photo back. I suspect it left scars longer than that.

Now imagine not being able to get that photo back. Thats the problem for todays kids. One moment of stupidity and a lifetime of consequences. (under a certain age, if they took photos or videos of other kids, that makes them liable to be on a list, for life.)

You could say "oh education" but did you listen at that age?

Whats worse now is that there are no gates on what photos can be developed by the normal person. If you took any photo that was explicit, it almost certainly wouldn't be printed (hence why there were very little dick pics from that era).

Is what the UK government proposing workable? well looking at the OSA, almost certainly not.

However unless we, as a tech community engage with society, with useable answers that are understandable to the normal person, then we are going to be crushed by the weight of "something must be done". Absolutism is not our friend here. We need to engage and choose compromises, or lose wider freedom for ever.

>We as technologists need to engage with wider society and understand on their terms, the worries they have.

We were the vanguard blocking this to the public's benefit, now they've voted for it our only duty is to ourselves; to make sure the rules don't apply to us.

I mean I get that, but don't you also see thats dangerous?

I think its perfectly winnable argument. For example we already _had_ age gating in the UK, its just it was at the network level on mobile internet. It worked and was unobtrusive.

The antidote to the OSA was to just extend that to domestic internet.

That argument was lost, and lost hard. mainly because we didn't engage properly with a believable solution.

> to make sure the rules don't apply to us.

The point is, they don't really apply to the determined. the same argument could be made for painkiller blister packs. The level of friction that the packs provide reduce drug based impulse suicide by 40% (depending on which study you reference)

The argument against it is "I can't be arsed with pressing the little shits out, I just want it easy". The Populist approach is making it prescription only.

Unless we engage properly, on the right level, then we are going to be worse off.

> The problem with that is it generally requires a central point of trust.

The problem with it is that the people who want to use a central point of trust as a chokepoint for censorship, surveillance and monopolization keep claiming that this is required when it isn't.

> Sure you can allow multiple points of trust, but for the unskilled user, that means that the little lock symbol becomes unreliable (or whatever)

The premise being that if you have a monopoly then ordinary people can trust it. Only that isn't the case. A monopolist not only can be just as malicious or incompetent as any of the multiple players in a competitive landscape, they're more likely to be because the lack of competitive pressure allows them to be more abusive and complacent and more capable of capturing the government.

> under a certain age, if they took photos or videos of other kids, that makes them liable to be on a list, for life

That seems like a problem caused by the law. Why is it possible for any actions taken as a minor to cause someone to be put on a permanent list when we recognize that minors aren't mature enough to be held responsible for that?

> Now imagine not being able to get that photo back.

Now imagine what would be necessary to get it back. It's on some other person's private device. Either you invade everyone's privacy and private communications to check if they might have it or be privately sharing it, or they could be. The cure is worse than the disease.

> That seems like a problem caused by the law. Why is it possible for any actions taken as a minor to cause someone to be put on a permanent list when we recognize that minors aren't mature enough to be held responsible for that?

Its a second order effect. The problem is predators get children to take pictures and distribute them. To stop them escaping justice it requires a certain level of absolutism. In Common law, there are exceptions. However people exploit the system.

> Now imagine what would be necessary to get it back. It's on some other person's private device. Either you invade everyone's privacy and private communications to check if they might have it or be privately sharing it, or they could be. The cure is worse than the disease.

I mean there are loads of ways to look at this. But if we want to have strong controls over your data, then sharing should be controlled by the owner, not the platform. Currently there are no trusted environments that allow people to share securely and privately data without it being copied.

My understanding of what is being proposed is that cameras will have basic nudity detection on them, and they will refuse to take the pictures if the device is registered to a person under the age of 18.

That, more or less is not privacy invading, depending on how its done.

The central point that you are missing here is that something which was quite hard to happen in 1999 was destructive to a child life. Now its much easier to do, and there is an actual economy in sourcing, exploiting and trading these pictures/videos.

> Its a second order effect. The problem is predators get children to take pictures and distribute them.

It isn't. The solution is obvious. You punish the predators and not the children.

> My understanding of what is being proposed is that cameras will have basic nudity detection on them, and they will refuse to take the pictures if the device is registered to a person under the age of 18.

Which seems both problematic (now every device needs to be registered?) and ineffective (the predator has the children use a device registered to an adult or an older device without any such constraints).

> The central point that you are missing here is that something which was quite hard to happen in 1999 was destructive to a child life. Now its much easier to do, and there is an actual economy in sourcing, exploiting and trading these pictures/videos.

This seems to be your central premise but it's also not even true. If a predator got children to take such pictures with film camera in the 20th century and was then in possession of the negatives, there was no centralized system to detect this or prevent them from having a darkroom to make and distribute copies. The solution is to have the police arrest them, which continues to be the solution even now without needing to compromise the devices of every innocent member of the public.

> But if we want to have strong controls over your data, then sharing should be controlled by the owner, not the platform.

You're assuming the conclusion -- that there should be a platform in a position to control (i.e restrict) sharing. If communications are end to end encrypted, no one other the parties even knows what it is. That is what you are by implication prohibiting -- unintermediated private communications.

I am deeply worried about privacy. the problem that I have here is if we don't provide a sensible middle ground, we will get a terrible solution imposed (ie the age gate spyware, instead of the rollingo ut of the mobile block lists the UK already had)

> It isn't. The solution is obvious. You punish the predators and not the children.

the core problem is that in the UK more and more CSAM is being prodiced by kids themselves. Most grooming of digital images is done remotely, via exploitation. (ie I have pictures of you, please send more or I'll send them to x)

Now, because the person extorting them is not taking the pictures they had a defence of "they were sent to me, I didn't know what to do so deleted them blah blah blah"

These people hunt down the kids sending stuff to lovers and the like, that gets leaked, because kids are cruel, and try and extort them.

I would gently ask you to look in the changes into sentencing guidelines and the evidence used to compile that advice.

Yes, older devices can be used, and oncein the hands of extortionists then they are in deep shit. The point of this, and the point that Jess Phillipson was getting at, is if kids can't take these pictures as easily, they can't be leaked as easily which means there is much less (but not zero) chance of being exploited,

> You're assuming the conclusion -- that there should be a platform in a position to control

Sorry my bad phrasing.

the ideal solution here is end to end encrypted but also encrypted image but with the keys controlled by the owner of the image "private" computing is the answer, where every view of private images requires a key exchange. there are hardware locks to stop people getting at the frame buffer, only apps that you approve can have access, and flagged data that you send auto deletes and expires.

Ironically this is basically extreme copyright enforcement(everything you create, more or less is your own copyright)

But we can't get to that yet, because Ad tech/meta/google doesn't like that.

TLDR its less obvious but I also share your worry about privacy.

> the problem that I have here is if we don't provide a sensible middle ground, we will get a terrible solution imposed (ie the age gate spyware, instead of the rollingo ut of the mobile block lists the UK already had)

The problem here that if every year you're asked to make a new compromise between where you are and a fascist police state, you're only traveling in a single direction on the road to hell.

To actually stop them you need to turn around and go the other way. Dedicate your efforts to removing the existing authoritarian surveillance apparatus so that they have to spend their resources to stand still instead of you, so that failure is "it stays the same" and success is "authoritarianism declines" instead of the unacceptable premise that the only options are making it worse or making it worse even faster.

> Now, because the person extorting them is not taking the pictures they had a defence of "they were sent to me, I didn't know what to do so deleted them blah blah blah"

Any kind of sensible court is going to both take evidence of the extortion as an invalidation of that defense and also convict them of the extortion.

Moreover, "it's sometimes hard to punish the perpetrators" is a ridiculous rationale for punishing the victims in their place.

> But we can't get to that yet, because Ad tech/meta/google doesn't like that.

We can't get to that because that doesn't actually work, for multiple reasons in this context:

The first is the same reason every piece of Hollywood content is in the hands of pirates despite Disney et al demanding useless DRM. It simply doesn't work; a single vulnerability allows every piece of content to be extracted and once extracted by any one person it can then be distributed to an unlimited number of others forever. The entire premise is snake oil. The reason Hollywood wanted it to begin with, and Google and Apple adopted it to use against them, is the same -- it's hopeless at preventing copying but it enables the monopolization of devices because then unapproved competing devices are illegal.

The second reason is that the person in an image is not necessarily the person who owns the device, and the device has no way to know that. It does you no good for the "owner" of the image to control it when the device thinks the "owner" is the predator.

And the third is the pragmatic issue. People expect to be able to take a picture and share it with whoever they want. You take a picture of yourself and text it to your mom, both you and she expect her to be able to email it to friends and family etc. You take a picture of a defective mannequin to file for RMA and you expect the customer service rep to be able to upload it into their internal RMA system or forward it on to the manufacturer in another country. If the default doesn't allow this then people will justifiably object. But if it does then 99% of people will never change the defaults or even realize that they can, and then the proposal is worthless because the default everyone wants for the common case is exactly the thing you don't want in the problem case, since then the default allows the picture to fall into the hands of a thousand strangers and devices that aren't in the authoritarian ecosystem and you can't get the cat back in the bag.

In today's world the 14-year-old girl who took a topless beach photo of herself would likely be criminally charged as an adult for production, possession and distribution of child pornography. So there's something about how our legal attitudes have changed too.

> were/are trying to stop fraudsters, script kiddies, nasty people, and governments from trying to exploit weaknesses and take unauthorised control of devices and services.

While I don't doubt that's a motivation, the problem I have is it's really a question of likelihood. I feel that in terms of security focus it's very common for people to put on blinders and ignore the likelihood of an exploit in favor of "Ooooh look at this thing that COULD be exploited!"

It's fundamentally the problem I have with how CVEs are reported and handled in general.

In terms of secure boot stopping problems. Yes, it does stop someone from rooting a device which is great. However, someone that has access to root a device almost certainly also has the ability to just install a virus in the OS startup scripts. Or to modify a user executable. Or to modify the user's PATH environment variable to inject a malicious app in front of a commonly used one.

That's what I wish security focused people would weigh more heavily when they evaluate these sorts of threats. "What other damage could a malicious individual do if they had the same permissions to pull off this exploit."

> It's fundamentally the problem I have with how CVEs are reported and handled in general.

Yes, its more like a popularity contest.

But secure boot stopped(or stops) a whole bunch of driver/rootkit exploits, which was a big thing in the late 2000s. It means that a random driver that is inserted by some script kiddie raises a whole bunch of warnings, which it wouldnt have done before.

We have come a long way since windows 2000

It isn't TPMs nor attestation nor DRM making this possible. It isn't secure boot either. It's walled gardens with secure boot -yes, secure boot- that the consumer can't bypass. Secure booting isn't the problem in an enterprise setting -- of course we _want secure booting_ in the enterprise. It's consumer devices that can't be jail-broken that are the problem. Although even then, the silly age verification laws and the people pushing them don't even care if the OSes run on walled garden devices.

Corporate devices that can't be jailbroken are also a problem. It's a right-to-repair and e-waste issue.

But they are not walled gardens.

I would posit that any device that can't be jailbroken is a walled garden. Whether the wall is made of an app store or an operating system, it's not yours if you can't do what you want with it.

But corporate devices can boot any OS you might like.

Sure, they have MEs that maybe you can't disable, but you can firewall them.

Server kit is just not like consumer kit. Even laptops are [still, for now] a lot better than smartphones in this regard.

And yet you can secure boot Linux

For now.

It's been more than 20 years since I was hearing "for now", so I guess any time now huh

> Although even then, the silly age verification laws and the people pushing them don't even care if the OSes run on walled garden devices.

Believe me, the people writing the age verification laws care a great deal whether the age verification can be turned off by the device owner.

The whole exercise would be pointless if teenage device owners could turn the censorship off.

Would it? Parents who so choose could restrict their teenagers from owning a device and instead give them one owned by the parent and configured not to show adult content.

A sufficiently adversarial teenager could get a different one, but they could do that regardless since it generally costs even less to get some 18 year old high school senior or homeless adult etc. to lend you their ID than to buy another device.

How do you feel about California's age verification law?

Oh, the people who work on secure boot, attestation, DRM, and other such features know very well, but don't care. This is because the claimed benefits for them, such as less hackers, less malware, less bot traffic, outweigh any possible downsides for the society.

I think it's even worse than that. Our industry has a strong track record of only looking at potential upsides (and pretending they're certain) and not even seeing that there may be serious downsides.

It's a kind of blindness. The kind that is, in my opinion, is one of the major reasons why we ended up building a world that's more than a bit dystopian.

There is definitely a common type of computer security enthusiast for whom the need for security is absolute and costs don't even enter the equation.

The difference is who controls it. If you want to set up secure boot with your own keys, good on you, go for it.

That's exactly the shortsighted view I'm talking about - you are ignoring the cost of building/adopting a system that you may not control in the future.

Ironically, Signal folks have shown those leanings a lot when they forbade people from backing up their messages.

> Did they think, as they worked to transfer final say from users to corporations, by technical means, that politicians couldn't transfer that control to themselves by political means?

Corporations are already hostile enough that it doesn't really matter:

The report says that between 30 and 40 Rockstar employees working in multiple offices in the UK and Canada were fired on October 30, all of them part of a private trade union chat group on Discord. - https://www.pcgamer.com/gaming-industry/rockstar-accused-of-...

Leaked Amazon Whole Foods Docs: Workforce Diversity Helps Prevent Unions - https://www.informationliberation.com/?id=61403 (summarizing https://www.businessinsider.com/whole-foods-tracks-unionizat...)

Microsoft Are Fixated on “Hate Speech” With Lopsided XBOX Live Enforcement Strike System - https://www.techopse.com/microsoft-are-fixated-on-hate-speec...

They're ultimately employees. Their employers hire them to write the code that the employers want. If they don't write the code, employers just fire them and move on to hire some other people to write code. As much as how ethically questionable it is, it's still very rare that people would give up their jobs to defend their viewpoint.

The practical alternative is sabotage. Write the code poorly, with obvious bugs. Don't sign the full URL so the user can just delete the drm=true parameter.

A weak alternative since the remaining work to build an oppressive system is still reduced compared to before your contribution.

I am guessing they thought "My kids are depending on me to pay our mortgage and buy food"

Yet they stopped thinking as soon as their wallet got involved and never considered that their kids also need freedom and the ability to use technology that works for them and not against them. Selfishness and greed are the problem. The kids are just a convenient but shallow way to deflect from that.

Idk, sounds better than being dead, just in my opinion.

Nobody implemented DRM with a gun pointed at their heads, and anyone capable of implementing harmful technology has the skills to work on something else for lots of money implementing other things. It was always a choice.

That you could work someplace else doesn't mean someplace else is hiring someone with your skills, or that you could afford a pay cut if necessary.

This is true for fruit pickers or uber drivers or whatever but it is ridiculously out of place statement for software engineers.

I know a guy who's been looking for work for like a year, and he's got a math degree.

I get the idea of refusing on principle, but the older I get the more I have started to become pessimistic towards that stance.

I have seen time and time again that individual, principled stands like this do nothing to change anything and only hurt the individual. Unless you are part of an organized movement against something, opting out doesn't help.

Opting out at the very least means that you aren't the problem. I'd agree though that it's long past time people organized against these issues because one person has very little influence over how corporations act.

Or more likely these days, "I need to stay employed so I can legally stay in this country."

> Did they think, as they worked to transfer final say from users to corporations, by technical means, that politicians couldn't transfer that control to themselves by political means?

Makes me think of the most sobering line I ever saw in a museum (Berlin): The biggest atrocities were committed by people with a spreadsheet and a performance goal.

It should be present tense. Especially in Berlin.

> Did they think

Having argued these topics for decades, I think that a lot of people just truly can't foresee the inevitable consequences. I don't know why, the consequences seem obvious but because they are not spelled out, many people say it won't happen.

The problem is that even when you do spell out the consequences many of them will wave them away.

It's difficult to get someone to understand something when his salary relies on him not understanding it.

That was nicely put.

I think you can learn about it most by reading clever, capable people from big tech corporations. Their framing often involves tradeoffs against a slow but inevitable societal pressure that is helped by compromising on freedom.

So I don't believe they are ignorant of all your points; it's rather that they don't see a realistic way how tech, corporations, and perhaps even ordinary people can go forward (being better, or richer, or more sophisticated or whatever) without making that compromise. It's as if they saw the forking paths of the future, and none will end up without technical restraints, regardless of whether they do it or whether things just get worse and someone else then does them.

A lot of harm would be prevented if people didn't do bad shit under the assumption the next guy will do it if they don't. You're the next guy.

But they're right. The next guy will do it if you don't. And you'll be fired meaning you won't have any power any more, and the person who thinks DRM is good will be hired and become powerful in your stead. How does that help?

> You are the next guy

If you don't understand this, then you just don't understand.

Everyone can be the next guy. I can be him or the next next guy can. Do you know the prisoner's dilemma?

Yes, and I'm advocating for a specific quadrant.

You only get to choose a half. The previous guy chooses the quadrant.

I'll spell it out in case someone else truly doesn’t understand since you're just determined not to.

Pro-social actions are taken more often if you believe others will also take pro-social actions. The best way to do it is to believe you're the same as other people and that other people are good, and that you're not the patsy when you take a pro-social decision and others don't. Because you're the next guy for someone.

Twitter people expressly started their company with the idea of crowd-friendly semi-anonymous msgs on demand.

The game of GO delivers an idea where a very large construct can be built then in one move the entire thing flips to a different purpose... seems relevant somehow..

I remember piping up about all those things. But the excuses were everywhere.

- Oh but you can turn it off so it's no issue (secure boot). Well yeah but more and more stuff just won't run then (eg iOS apps on Mac). It will become the norm to stay inside the fuzzy walled garden just like it already is on phones. And if you stray you will just be blocked from any app that does something useful.

- But companies need to be sure you are who you say you are (attestation). Yes but they will abuse that power if they can profit from it.

> Did they think, as they worked to transfer final say from users to corporations, by technical means, that politicians couldn't transfer that control to themselves by political means?

Why does that matter? If it's bad for politicians to usurp that power, it's already bad for corporates to have it in the first place.

I'd rather politicians use power in a way that includes democratic oversight than, say, Peter Thiel doing whatever the hell he likes.

There's a selection effect. Some people thought these were bad and didn't implement them. Other people thought they weren't bad and implemented them. We use implementations from the latter group of people. Obviously.

Same thing is happening with age verification. We had the chance to just ask if the user is over 18 when setting the computer up, but we didn't do that so they're using a solution from a mass surveillance company instead.

> Did they think, as they worked to transfer final say from users to corporations, by technical means...

Your argument is flawed here. The truth is that measures such as secure boot do have real security benefits. They can be misused, like any technology can be, but that is not an inherent feature of the tech, but rather how it is implemented. And as the developers of such measures are not a monolith, it is unfair to paint them as merely trying to exert control. I'm not going to argue that some involved parties were trying to exert control. But lots of others were trying to implement a genuine security benefit for the users, and they don't deserve to be reprimanded as if they were some kind of apologists for authoritarianism.

There is no difference between the tech and how it is implemented.

> They can be misused, like any technology can be, but that is not an inherent feature of the tech, but rather how it is implemented. And as the developers of such measures are not a monolith, it is unfair to paint them as merely trying to exert control.

You can argue that exerting control is a good thing - a clever scam artist convinces a vulnerable user to paste an attack at the command line, and the benevolent OS vendor uses their control makes the attack impossible, no matter what the scam artist tells the user to do. A greedy software maker produces a spyware-laden, cookie-stealing update and asks the user to enter the admin password to install the update. The benevolent OS vendor uses their control to make such malicious updates impossible, even with the administrator password entered.

But even if the control is being used exclusively for good, it is, ultimately, control.

The phrase 'banality of evil' comes to mind.

Does that really still apply when the people in question make six or seven figures for it? At some point we should expect some kind of individual responsibility.

That's precisely what the phrase means. People are capable of evil acts just to earn more money or advance their career. There is no real malice involved, just wilful ignorance. Though that raises the question whether there even is a meaningful difference between the two.

I often also wonders if ideological zealots ever thinks of this passage while pushing their agenda for control:

    ...and it was allowed to give breath to the image of the beast, so that the image of the beast could even speak and cause those who would not worship the image of the beast to be killed.
    Also it causes all, both small and great, both rich and poor, both free and slave, to be marked on the right hand or the forehead,
    so that no one can buy or sell who does not have the mark, that is, the name of the beast or the number of its name.

Those who would think of such a passage (or any biblical passage) and those who push for a total-control agenda are disjoint sets.

Communism and fascism were both fueled by atheism (either explicit or functional), not a Judeo-Christian worldview.

"Ohne Gott und Sonnenschein bringen wir die Ernte ein." (Without God and without sun, we will get the harvest done.) - the slogan of East Germany in 1975 when people were hungry and it kept raining during harvest.

The existence and polularity of Christian socialist movements in Europe contradicts this thesis strongly.

We also had Christian fascist governments, like my home country Spain. One of the official doctrines of Franco's government was deemed "National Catholicism" :/

Christian fascism exists. In the US it's how fascism came to the country. Christofascism doesn't seem to have any problem with the absence of atheism.

that's not Christian though (in the sense that their beliefs are not scriptural and not subjected to scriptural review)... it's something else, and it's really ugly.

No true Scotsman

not exactly - I'm referring to scripture as the arbiter

13 Let everyone be subject to the governing authorities, for there is no authority except that which God has established. The authorities that exist have been established by God. 2 Consequently, whoever rebels against the authority is rebelling against what God has instituted, and those who do so will bring judgment on themselves. 3 For rulers hold no terror for those who do right, but for those who do wrong. Do you want to be free from fear of the one in authority? Then do what is right and you will be commended. 4 For the one in authority is God’s servant for your good. But if you do wrong, be afraid, for rulers do not bear the sword for no reason. They are God’s servants, agents of wrath to bring punishment on the wrongdoer. 5 Therefore, it is necessary to submit to the authorities, not only because of possible punishment but also as a matter of conscience.

I don’t think 1st century Rome had much in the way of digital surveillance.

Or even surveillance, for that matter.

Plenty of hubris, mind.

The implementation might change, but the pattern of absolute control is old as time.

"Implementation details are left as exercise for the reader.

When in doubt refer to the public API as specified in Revelations 13:15-17"

Rome had the "frumentarii", which was essentially a proto intelligence agency to do spywork for emperors.

Won't they have monitored their slaves quite closely?

They (developers) did what they did for money. Just like everyone else. And they would do it all again.

At a corporate level, no one cares about lots of freedoms, except if it is a selling point.

If 'keeping freedoms' is a selling point then the ideal position is to gain the kudos of appearing to support this whilst also getting the benefits of the loss of freedoms. Why not get both?

That's the Android way.

Its the Apple way too. Its the corporate way.

I always think of the lumberjack tasked with cutting down the last redwood giant. He hesitated a bit and was somewhat reluctant to start. Several of his coworkers understood that it was slightly emotional and said they would do it if he couldn't.

Did they think that the trillion-dollar companies would become some sort of Che Guevara style insurgents...

Arguably this plan is mostly working for Apple.

Why do people vote for large, strong governments that are able to take the power you suggest Tech is enabling them to take?

It's starting to feel like ethno-nationalism is the answer.

See: the PRC. Support for surveillance is allegedly high. Anecdotally, talking to PRC citizens in circumstances where they don't need to worry about said surveillance (e.g., when they're vacationing in Japan and I want to pester someone and practice my mandarin), they generally like it. Makes them feel safe.

The CPC has sold them on a vision of them as members of the state-race "Chinese" (which is not really an ethnicity any more than "American" is) and the surveillance as a thing that keeps them and their "Chinese" lifestyle safe from non-Chinese. Uighurs have to be extra surveilled until they're also Chinese, which, many are now according to the CPC.

So PRC citizens feel safe and cozy among in the country for "their people," not realizing this whole ethnonationalist concept is at best 100 years old, maybe even younger. During the Qing dynasty, there's a whole hell of a lot of people that think of themselves as "Chinese" that definitely weren't by the dynastic government.

I smell similar happening in Russia, the USA, and Israel, with State support. It looks like right wing groups are trying to pull it off in the UK and Germany as well.

>Anecdotally, talking to PRC citizens in circumstances where they don't need to worry about said surveillance (e.g., when they're vacationing in Japan and I want to pester someone and practice my mandarin)

I'm not sure you are aware that China has monitoring operations for its citizens outside China.

> I'm not sure you are aware that China has monitoring operations for its citizens outside China.

Sure, you and I know that, but most PRC people don't really believe in that or are aware. At least nobody I've met.

have successfully pulled* it off in the UK and Germany

Politicians always had that power, because it was always technically possible. To think we could have done anything to stop it once there was a will to do it is naive. If you doubt it, just look at Palantir. People like us built that - Thiel and his minions only paid their salaries.

Boiling the frog is a thing. As is laying the groundwork. Governments are much less likely to pull off multi-decade plans than they are to make use of whatever technology is already out there.

And they got filthy rich. If I built Palantir instead, I'd be filthy rich. It's a pretty rational choice to build Palantir. Sadly.

The sequence of this is reversed. First Thiel got filthy rich, and THEN he used that money to hire people who didn't whistle-blow to build Palantir.

If EVERYONE that got hired to build the enshittification of humanity would just speak up about what they were asked to build there is no 'next guy' - ar at least we all know that the 'next guy' is wilfully complicit in the evil done at the company and you can disinvite him to family reunions and refuse him membership in the golf club for humanitarian violations.

I.E. What good is a mortgage payment when the next guy cant hire a plumber because the whole town knows he's a vile POS?

But the line of people doing the work, and keeping their mouths shut about it is nearly an unbroken chain from start to end. And here we are because no one wants to be the only one speaking out against evil, when we all should be.

You could work at Palantir and leak details, and I don't think thats what this discussion is about. If you wanted to destroy a company from the inside by whatever means, you'd have to get hired there.

Right, the discussion isn't about one employee trying to take down a known evil operations, rather I was positing a situation whereby these evils never got off the ground, where all of the employees tasked with building Palantir, or the like, en masse simply refused to do nefarious projects and refused the work. If they ALL or MOST then disclosed that "super rich dude wants to build a thing to erode/destroy the freedom of all but the super rich dude club" then the common knowledge would be that the full group of "next hires" is both aware of this going into the job interviews and when the nefarious project is deployed against us all, we know they are expressly complicit in the development of evils.

That's not my view of how things are, or how they would ever actually be, just one loose idea of how we might have avoided the current outcome, if all of the developers at "Nefarious, Inc." had not been trying as hard as possible to join the ranks of some subset of "rich dude club" as a gradient above poverty in any nation.

I get the need to make a living; and I have actually gone from working profitably in IT to subsistence goat farmer who's wardrobe was entirely found at the local waste transfer station's "community exchange table" for over ten years. So I do know the cost of 'declining to participate in building tools for evil' firsthand. It's not a game; and it has serious outcomes if you aren't located in, or relocate to, a place with significant natural resources for survival. Requirements include clean and plentiful rainfall, long growing seasons, volcanic or otherwise enriched||enrichable soil, healthy wild game populations and functional local systems for ensuring the durability of the same, intact social networks of mutual support among a community of people in similar conditions with the cultural traditions for shared resources, and the willing support of your spouse, partner, and dependent family members.

The learning curve from suburban North America is not so much steep, as it is a cliff. The lessons are immeasurable; and there is so much we would/will do different the next time going from "here" to "there."

Stay tuned.

These people have names and addresses. Getting them out in the open will help a lot.

I'm not saying we should lynch them, but a good deal of public shaming is in order. Who knows, their kids might pick a different vocation.

While I'm not fundamentally opposed to the idea I'm not convinced its going to be effective. A lot of the leaders that ultimately approved these developments are already public figures and that doesn't seem to affect their motivations.

> Did they think

Pretty sure they didn't do a lot of thinking.

I guess they think "someone is going to do it anyway, so it might as well be me so I can be the one who gets paid for it". But yeah, I'm sure there is also a good chunk of tech workers who are indeed useful idiots who think they are the last link in the chain.

Meanwhile Signal Corporation keeps trying to connect to updates2.signal.org even when the app is not being used. "Automatic updates", remote code execution by default with no option to disable

Silicon Valley has its own ideas of what "privacy" and "surveillance" mean

To those folks, it does not mean privacy from Silicon Valley companies

The Signal app will keep on trying to connect to the mothership

Because to the people who work on Silicon Valley software, that is not a privacy violation

The battle is over _control_ over software not privacy or surveillance. The later is not possible without the former

Silicon Valley does not want the user to have control any more than they want the government to have control

use simplex then. Signal is what it is and it's not trying to be something it's not. E.g. use of phone numbers.

I don't use Signal

I test mobile apps on a throwaway phone to see what connections they try to make, if any

People forget how we got here. Whatever your philosophical stance, history has shown beyond a shadow of a doubt that giving most people complete control over their device has been an unmitigiated disaster.

Scams, stealing credentials, stealing money, botnets, viruses, losses of data, ransomware, etc etc etc.

What is better for most people is a locked down device like an iPad where each app has to be approved and they're incredibly sandboxed. 20 years ago we had people installing malware because a strange email promised them smiley face emojis.

When we transitioned from the single-user ODS-based Windows model (ie Win98/SE were the last of that line) to a multi-user restricted privilege model based on NT 3.0/3.5/4.0 (first as WinXP) it was meant to be better but privilege escalation was still too easy because of what users had become accustomed to doing and of what was needed to install software you downloaded.

Things like an App Store (on Mac and eventually on Windows) are actually a good thing. Signed apps are a good thing. Having to go out of your way to install unsigned apps is a good thing.

I really abhor "technical libertarians" because they never address these issues. It's all principle-based while ignoring reality, human nature and whether or not unfettered access gives users something they even need.

Also, other people pay the price. Where do you think these DDoS attacks come from? Compromised Windows PCs (primarily).

> Whatever your philosophical stance, history has shown beyond a shadow of a doubt that giving most people complete control over their device has been an unmitigiated disaster.

I'd argue that giving governments and corporations control over our devices has also been an unmitigiated disaster. You could say the same thing about any kind of freedom though couldn't you? Freedom is so dangerous after all. Look at all the problems it's caused. Giving up all of our freedoms would surely make the world better right?

People often misuse freedom. The answer to that is not to take freedom away, but to educate people on how to use their freedom, and only restrict those who have proven to be unable to handle it. Let's say your argument, that clueless users getting infected are an externality upon everyone else and thus they need to be locked down for everyone's good, is accurate (though I don't think it is). In that case, why should the majority of intelligent people be made to suffer because a minority can't handle the freedom? No, in that case the correct thing to do is to have a mechanism by which we identify people who are hurting others, and restrict them. Nobody would countenance the idea that because some people are irresponsible drivers, cars must therefore be unavailable and everyone pushed into using public transit. But that is the exact same logic people try to use to crack down on freedom of use for computers, even though they are nowhere near as dangerous as a car.

> I really abhor "technical libertarians"...

Well, I abhor those who try to take freedom away from people. So the feeling is mutual I guess.

What if the "clueless" users are 99.99% of the users?

Why as an Apple user in the UK am I considered too dumb to use a 3rd party app store but if I were 30 miles away in France I would be considered intelligent enough to cope? Because this was never about my safety. It was about their 30% as correctly supposed above.

Why in the UK Billy is considered a civil engineer but if he were 30 miles away in France it would be considered illegal for him to sign off on a bridge design? Different places arrived at different consensuses.

Either that or Apple don't want to lose their 30% until they are forced to, one jurisdiction at a time. I guess we all need to make our own inference as to which is more likely.

'Misusing freedom' is a funny concept.

There were many reasons to deploy these solutions. Much of it from the perennial reason “we can’t have nice things”. Che was a murderous psychopath so I’m not sure what he was to do with freedom other than some college kids though he was edgy in the same way Manson’s followed though he was edgy.

What defines a bad tech vs a good tech? Similar arguments can be made for most research including nuclear fusion, AI, vaccines, space, polymers, combustion engines, electric motors, semiconductors...

> What defines a bad tech vs a good tech?

Good tech empowers individuals and subverts authorities, corporations, oligarchs and governments. Bad tech subverts individuals and empowers authorities, corporations, oligarchs and governments.

Online is terrible for kids. Online is terrible for adults! Too many people don't have the agency or social skills to manage themselves. Conspiracy theories, anarchists and libertarians, misinformation and disinformation, weirdos and beardos and creeps of all description. People end up believing all kinds of things that just aren't real.

It'll be best for society if things are a little more regulated, a little safer. And I'm happy to help where I can. Listening to the terminally online about it would be counterproductive.

Reply on news.ycombinator.com