Hacker News Reader

Comment by fc417fc802 | Hacker News Reader

While I understand how we arrived at this point I find these centralized systems with special privileges frustrating. That they have repeatedly exhibited severe vulnerabilities and mismanagement is just the cherry on top.

There ought to be a specification of an open protocol that includes certificate based authentication. I should be able to have my pick of which app to use and then subscribe to whatever feeds I'm interested in from anywhere in the world. In addition the local network operator should advertise various local feeds.

What I'm describing is about as technically complicated as RSS plus public keys but as usual even moderate technical competency is a bridge too far for the government.

View on HN

It’s not a technical problem. And the problem is that it’s not centralized.

Everyone and their mom has their own system, managed by different people with different standards.

It’s like USB cables — yes there are strict technical standards but when you have a million different manufacturers, they all do it differently and some cut corners and bend the rules how they want to.

Look at how two different cities handle their water supply or their police — different management, different priorities.

> It’s not a technical problem.

I agree. It's a lack of technical proficiency on the part of the world's government's problem, which is another way of saying it's a political problem.

> And the problem is that it’s not centralized.

It is, though. The implementation might not be uniform but the architecture is inherently centralized. Subscribers do not get to pick and choose sources, that is decided by the network operator (AFAIK).

Consider, if BigCo wanted the ability to push alerts to people on their campus (who consent to receive them ofc) how would they go about it? If you have family who live elsewhere in the world and wanted to be apprised of natural disasters how would you subscribe to receive those alerts?

But the architecture doesn’t matter as much as the implementation. You can write standards however strict but Bob might not care.

Now you could try to enforce more onerous requirements but then people will simply just find an alternative — my own area has its own alerts on top of whatever else is already there.

Technical solutions are important but past some point, you’re dealing with a product or people problem and further technical improvements bring marginal benefit.

What emergency alerts would BigCo push to people on its campus?

There would be no consent btw, they'd just fire anyone who didn't enable the alerts.

Active shooter, chemical spill, any kind of building emergency like water stoppages.

And then if it wasn’t tightly controlled and carefully managed, probably things like social events with free snacks, company all hands announcements, and single cars blocking someone into a parking spot.

I see the usefulness of more fine-grained subscription, but also see the abuse potential from giving more people access.

> but also see the abuse potential from giving more people access.

If the end user has full control over subscriptions then spam will simply result in silencing or unsubscribing. As opposed to right now where it's all or nothing and it isn't even authenticated. So for example either I get spammed with amber alerts from 100 miles away or I opt out of wildfire warnings. Not a great trade off.

Well yes, there are many things that you must consent to as a condition of employment. Nothing new there.

I have no idea what they would push, the point is that certain large institutions may have a legitimate interest in reaching users on the premise from time to time. Airports, stadiums, and theme parks immediately come to mind. Anywhere there's a large gathering of people over a wide area which complicates any emergency response.

Why can't the local PD push out an alert to a particular neighborhood if they deem it useful for whatever reason? As long as they didn't spam me I'd voluntarily subscribe to that. As it currently stands I believe (at least in my state) they would have to escalate to a statewide institution and even then I don't understand the targeting to be particularly fine grained.

On top of all that alerts aren't currently authenticated.

Consent under threat of starvation isn't consent.

PSA: do not forget to properly format the cover of your TPS reports

Users have no interest in sysadminning their phones in this manner.

They wouldn't need to. By default the tower would send along the signatures for the proper local channel(s) and by default the OS would ship with an app that blindly subscribed to those. The difference out of the box would be that the sources were properly authenticated.

For users that wish to configure such things the difference would be that they could select the app of their choice (fixes the terrible UX), select the sources of their choice (not limited to those advertised by the tower), and filter as they pleased (fixes all the false alarms).

I think this is more useful that it might appear at first glance. Consider for example airports where the flexibility could be quite useful during an emergency response. Many venues would benefit from being able to send announcements of varying levels of importance. Nearly all of us walk around with network connected computers on our person yet our systems lack robust support for such basic functionality.

I think it would increase their trust in the phone system if they could, even if they don't use it in practice.

Reply on news.ycombinator.com