Hacker News Reader

> > Web services are 'in' because that's the only way software can't be pirated.

> That is cognitive dissonance. If your revenue is derived from advertising then users installing ad blocking software is revenue-equivalent to users pirating your software. The fact that it's legal for users to do when piracy is not provides no support for argument that ad-supported services are on stronger financial footing.

It is not difficult to foresee a world in which "forging the appearance of a website" is illegal and userscripts and userstyles are forbidden as well. How many sites try very hard to block right click to hide their code?

There are five actors that can modify the appearance of a website:

* the author,

* the server,

* the network,

* the browser,

* the user (instructing a browser's add on).

By definition the author can do whatever they want.

But what if the server started serving slightly different pages, maybe with advertisements? This is happening now with hosted blogs and publishing platforms; it is frowned upon but accepted.

If the network changes the content of a page, for example adding advertisements, the network will have to face a lot of bad reactions, so very few networks are doing it now. (see http://justinsomnia.org/2012/04/hotel-wifi-javascript-inject... )

The browser is in a similar situation. When Internet Explorer wanted to modify the received HTML to "enrich it", there has been a big backslash from authors «Microsoft thinks they can improve my writing. This makes me want to get a gun and go to war.» «With smart tags, Microsoft is able to insert their ads right into competitors’ sites.» (http://alistapart.com/article/smarttags )

So the authors are against modifications to the way their sites appear. Their remaining problem is _the user_. Authors cannot force the user to see what they produced: users have the freedom to install an ad-blocker or strip the CSS away. But we have to realize that this may be only a temporary situation. With the app-ification of the web, userscripts and userstyles are gone. And the content producers are happy about this.

>>It is not difficult to foresee a world in which "forging the appearance of a website" is illegal and userscripts and userstyles are forbidden as well. How many sites try very hard to block right click to hide their code?

Not illegal, but made technically impossible. That will be the logical Result of the EME Standard, combined with WebCrypto where the Website owner, not the user controls the browser.

All of these users chanting about how great netflix "HTML5" is do not understand the long term game that is being played for control over the web browser

Modern computing devices are dramatically more secure than physical things like your house or your car.

Er, no. You can't break into my house from another country. Moreover, my computer is also a physical thing in my house, so it cannot easily be more secure than the house itself.

The patching of possible security breaches has become a weekly ritual. And there are hundreds of thousands of unpatched compromised computers sloshing around in botnets.

I'd be shocked and amazed if someone broke into my locked computer. Someone could break into my house with something as simple as a rock, though.

If an adversary has physical access to a computer, they can get basically anything. In unencrypted scenarios they can pull out drives and mount them in their own run time (OS). If the device is also running then coldboot attacks can allow the encryption to be attacked.

Finally, there is the eventual cracking of many encryption algorithms via cryptanalysis and moores law.

[1]: Answer about moore's law effects on bits of security http://crypto.stackexchange.com/a/1828 [2]: http://en.wikipedia.org/wiki/Cold_boot_attack

My computer is encrypted. It's far more complicated to break into my computer than to use a rock against a window.

Cold Boot is hard to implement, and can be mitigated by putting the 16kb of key memory on the L2/L3 cache or some other piece of memory that instantly clears on power off.

With FDE and memory encryption, how else can you get pass this?

Chances are your computer has already been compromised. Your house? Probably not.

If it was compromised already it's because it's safer for the hacker to do so than to break my window and go in my house. Safer does not equal easier.

Thing is, you would know if someone broke into your house with a rock through the window. Breaking into your computer, or breaking the encryption of your data on some server, can be done without nobody noticing for years.

Securing your data is a completely different problem, and a much more difficult one, than securing your house.

> You can't break into my house from another country.

An attacker could certainly pay someone to break into your house from another country in much the same way as they pay their ISP to deliver malicious packets to your computer.

> Moreover, my computer is also a physical thing in my house, so it cannot easily be more secure than the house itself.

That isn't strictly true. If your device has full disk encryption using a strong password, physical access doesn't get you much in the way of accessing the data.

It's easy to confuse this with the explanation of why DRM can't work, but they aren't the same thing. To access data you need either the plaintext, or the ciphertext and the key. DRM fails because you need one or the other in order to watch the content, which means an attacker inherently has in his possession what is necessary to get the data. But a locked or turned off device with disk encryption only gives the attacker the ciphertext without the key, which is an entirely different situation.

> The patching of possible security breaches has become a weekly ritual.

That's kind of my point. Nobody recalls your car windows when they're discovered to be vulnerable to the "blunt force with heavy object" attack.

> And there are hundreds of thousands of unpatched compromised computers sloshing around in botnets.

Hundreds of thousands out of billions is what, 0.01%?

> If your device has full disk encryption using a strong password, physical access doesn't get you much in the way of accessing the data.

Well, even if assuming that all your software is bug free, someone with physical access can either replace the unencrypted boot image with a compromised one which gives him remote access or install a hardware keylogger and come back later for the disk and password.

In the hypothetical situation of a targeted attack and attacker with physical access, FDE only protects you if you never turn on your computer.

There are plenty of effective ways to detect physical intrusion into a premises.

The amount of knowledge, skill, and effort to gain access to your computer from another country vastly outweighs the amount of skill and effort required to break your window and carry it out the front door.

Interesting perspectives, so here's another volley.

I think "users prefer ads to paying" is not a full explanation: I did include "paying is painful". If that's all there were - just upfront cost, how do we deal with the trend of connected software (Diablo III, etc) and devices whose primary developer feature is DRM?

The internet totally is the WWW. Well, it's an analogy. So no, it's not. But the analogy is useful in its most spirited form. There is no truly enforceable law and criminal and conspiratorial enterprises run abound. It's questionable whether the Feudal lords are making it better or worse. (One way they make it better is by having direct accountability.)

> I think "users prefer ads to paying" is not a full explanation: I did include "paying is painful". If that's all there were - just upfront cost, how do we deal with the trend of connected software (Diablo III, etc) and devices whose primary developer feature is DRM?

Connected software is a different business model. It has certain advantages for the developer (like collecting a monthly fee rather than a one time payment), but how is that supposed to be providing any security or other benefit to the user?

> There is no truly enforceable law and criminal and conspiratorial enterprises run abound.

There are lots of enforceable laws -- probably too many. And the threat is vastly overhyped. Actual criminals and criminal organizations are the likes of Ted Bundy and the Zetas Cartel. The internet version of that is supposed to be weev and Anonymous? They're not even on the same planet.

Moreover, what is the feudal lord supposed to do any better than anyone else to prevent some jerk from cracking into a webserver and stealing private data? If anything the centralization makes it worse by creating juicer targets. If the bad guys compromise Apple or Google you're roasted, toasted and burnt to a crisp.

> It's questionable whether the Feudal lords are making it better or worse.

I have a hard time thinking of any way they could legitimately make it better that wouldn't work just as well without a locked boot loader.

> (One way they make it better is by having direct accountability.)

The fact that they aren't accountable is half the problem. At best the user can throw away their device and buy one from a different vendor, but that's hardly much consolation when you can't get your money back. And the app developers have even less leverage. The only way to opt out is to abandon hundreds of millions of prospective customers.

If the Internet is the Wild Wild West, are we (the early adapters, the knowledgeable users) the Native Americans? New Business are coming, destroying our way of life? Ruining our lands, exterminating certain breeds, making our traditional ways forever extinct?

I guess it is an apt analogy.