Comment by onemorepassword | Hacker News Reader

Comment by onemorepassword | Hacker News Reader

onemorepassword

People who defend this under the heading of "it's their service, don't use it if you don't like it", or "they're doing this for your convenience" completely miss the point.

There is a reason why we had strict regulations (a dirty word on HN, I know) for "old fashioned" mail and telephone. To eavesdrop on people's private communication was considered a disgusting practice that belonged in totalitarian regimes, and an unacceptable violation of people's rights.

Modern online services have circumvented such regulations, but that doesn't make what Microsoft, or Facebook, or Google are doing any more ethical or socially desirable.

All of this casual disregard for basic ethics can't continue without a serious backlash. And such a backlash won't just hit Microsoft e.a., but our entire industry.

It's time we stopped considering ourselves to be untouchable just because the law hasn't caught up yet, or because the majority of the people haven't figured out what the fuck we're doing.

Some changes through technology are unstoppable. This however, isn't one of them. It's a choice.

Disclaimer: I work for MS. My opinions are my own, but they are biased.

I think we need to make a distinction between automated services and humans eavesdropping. I'd feel weird if someone was snooping in on my conversations and clicking my links, but on the other hand I very much appreciate the little bot that sits in my IRC channel and displays the title of any page linked. Both monitor the chat and access links, but I value one and feel weird about another. I don't think there's a way to truly make a distinction between the two though, and I think saying, "nothing is ever allowed to access your communications" removes the possibilities for a lot of added functionality (the link bot being just the base camp of the mountain of things that are possible). I think the better choice here is to ensure that the public has a way to communicate securely, and that our mental model of "trust usually, distrust as the exception" needs to move to "distrust usually, trust as the exception". This is similar to how sudo works in a way - we maintain a lower level of security usually for the convenience, then escalate only when needed.

1. There is more transparency with your IRC bot.

2. Joining/forming another IRC channel is cheaper than creating a competitor to Skype.

3. MS looking at your messages implies that they have the ability to do so. If the conversation were entirely secure, only the other end of the conversation would be able to.

4. MS eavesdropping at all means that when law enforcement comes knocking, they can do so too. Law enforcement is not always your friend. More so in some countries than others.

5. The 'link bot' can be implemented in the client, rather than by a middle-man.

6. Such 'beneficial processing' could be opt-in at the client level. The message is encrypted between clients. Once a client has it, the message can be processed locally or sent off for processing. Sure this adds delay, but it's a trade-off for privacy.

The distinction between eavesdropping and an irc bot is intent, context, and result.

Intent: A irc bot that provide titles do so to translate machine readable URL's to human readable Title's to benefit both the one who writes it and reads it.

Intent: A eavesdropper tries to extract meaning out of being in a privileged position between two speakers.

Context: An irc is a public forum or at least a forum for invited participants. Expectation of privacy is low.

Context: A private communication between two parties is private. Expectation of privacy is high.

Result: An IRC bot that do what everyone in an irc channel is aware of is good. People feel happy by the increased value.

Result: An eavesdropper makes people feel scared, insecure and angry. It makes society worse, causes physical damage to people, and are destructive.

It really doesn't matter if its an automated or a human that does the eavesdropping. intent, context, and result do.

Just no. Plain and simple NO!

We don't need to make any distinctions. Private conversations are private.

And gentlemen don't read each others mail. Automated or otherwise.

What about when the automated service makes a summary of an email conversation?

Honestly I don't know what to think of this matter. All I know is that the capabilities of a malevolent intelligent individual are skyrocketing frankly.

As a dictator once said: Wish for sunshine, but build dykes.

The bot is "in plain sight", and can be kicked and banned by ops. That's a major difference. Further, the bot is only given the ability to eavesdrop when enabled by authorized participants (e.g. it was either invited or not kickbanned by people who could see when it joined the channel).

The visibility and lack of expectation of privacy creates a very different situation. If this "MS bot" showed up in your conversation and said "hi, I'm going to visit every URL you post unless you kick me off this conversation", it'd be a very different situation.

ircbots generally operate in public or group channels. I think there' a distinction between this and a bot operating in a private communications channel.

>I think the better choice here is to ensure that the public has a way to communicate securely and that our mental model of "trust usually, distrust as the exception" needs to move to "distrust usually, trust as the exception".

I can't square this with your previous stance easily. This would for me imply that private communicates should have end-to-end encryption. And that another party couldn't intercept URLs unless they were explicitly transmitted out of band by the client (which I would guess isn't the case here).

If that "automated eavesdropping" can be accessed by humans later, than no I don't think there should be a difference at all. It's the same thing. The only difference with the latter is that it doesn't happen in real-time. But the damage can be just as bad. So from that point of view, there's absolutely no difference.

> There is a reason why we had strict regulations (a dirty word on HN, I know) for "old fashioned" mail and telephone.

I would argue that the reason had to do with the fact that you couldn't encrypt, and you couldn't choose your provider. In a time when people could encrypt everything if they just cared, and when there are a ton of mostly independent ways to contact people and it's even easy to host your own, I wouldn't say that such regulations would be a good idea.

What were the regulations that prevented private landline providers from snooping on conversations?

Personally, I find this disgusting as well, and I agree that the lack of ethics in our profession is a huge problem, though fueled by user ignorance and apathy, but as much as I'd welcome an healthy backlash, I shudder to think of the lobbies that would "inform" the regulators when drafting such laws.

Do you really thing the law will "catch up"? It seems that things are headed in the opposite direction, and I don't see changing course anytime soon.

I find it ridiculous to think that early telephone companies did not abuse the privilege their hardware gave them.

Back before it could be tracked and recorded? When it was analog and switchboards?

Even if we had strict regulations, it would be all but impossible to prove impropriety of the snooping variety.

I think this is a problem we've always had that is being magnified by technology that allows us to realize that it is occurring.

The story of ultra-wealthy shipping magnate Aristotle Onassis is very interesting to read about. He was brazen in his profiteering and I've read stories that his rise to fortune started by eavesdropping on wealthy citizens making deals and buying stock etc when he worked as a telephone switchboard operator.

There was no expectation of privacy with early phone systems. I'm only 31 but when i was very young my parents (in small town Washington) had a party line [1] shared with some neighbors such that you could listen in on each others calls. See also the archetype of the gossipy telephone operator.

[1] http://en.wikipedia.org/wiki/Party_line_(telephony)

There was an tiny anecdote on a TED talk about the speakers grandmother working at a telephone switchboard in India. She regularly heard conversations she shouldn't have, including conversations with Nehru (the then president of India).

http://www.ted.com/talks/raghava_kk_what_s_your_200_year_pla... around 09:00.

Reply on news.ycombinator.com