1,792 karma · joined July 21, 2012
Twitter: @billpatrianakos http://billpatrianakos.me
[ my public key: https://keybase.io/billpatrianakos; my proof: https://keybase.io/billpatrianakos/sigs/WzS-Lp62IrKsUv4BBJWb19pavWFHOG2NMp4TTCFSc5Y ]
Oh, and seven days? Really? Even with such a thorough explanation I have to wonder how much time people have on their hands to buckle down and do this. This can't be something that's done sporadically. Not in 7 days.
First we all knew it would happen, then we found out it was happening, and now we're saying thank god for Stallman or we'd have never known and lets be sure to listen to him from now on? Stallman's idea of freedom doesn't work unless everyone gets involved. We live in the real world here and we know that isn't happening. He needs to live and let live a little.
It's pretty clear the idea is to imply there's a conspiracy. Everything is a conspiracy.
Really, I'd ask so what? How probable is it that they're just doing regular maintenance at 1am (EDT)? I think likely. But lets pollute what used to be a pretty great front page with baseless speculation over nothing. Even if it was an attack, how utterly meaningless. NSA website does not equal NSA internal network.
There are people from all walks of life from all sorts of industries who end up at the NSA. It doesn't mean they're all setting up systems and bringing back intel for spying. This is just a coincidence.
So I'm glad you brought this up but still think everyone is still going to play right into this article's trap. After all, conspiracy theories are much more satisfying to our egos than mundane reality.
Front end tools aren't perfect but that's why they've been iterated upon. And what language doesn't have shortcomings? It's amazing that people have created these tools that are flexible enough to be used in seemingly infinite ways without being too narrowly focused or being all things to all people.
But I think I'm getting ahead of myself. Where's the mess you're talking about? This is a common thing to say among non web devs but I never can get any specifics. If you approach front end development the way you would back end or desktop development you're going to have problems. It's a totally different way of thinking.
Looking back now it seems obvious but back then it just too overwhelming. With PHP there's this 'just get it done' attitude and futzing around with phpass wasn't something I could let myself do back then.
Of course I now regret it. I ended up using a different encryption library for password storage on my app. It isn't md5 but I know it could and should be stronger. So now I'm in a situation where I'm rewriting the codebase in a different language entirely and the cherry on top is that I need to migrate all my user's passwords and even some data from the original method to bcrypt, which I'm now using. It seems simple in theory but I have a feeling this is going to cause some headaches. However, its totally necessary and especially for the type of application I'm working on which puts a big focus on privacy and security.
I don't think it's dumb and pointless at all, really. Generally you wouldn't generate a salt yourself if you're using bcrypt however I'm sure there would be cases where it would be needed or even preferred for some reason. I would advocate for flexibility and education rather than rigidity and simplicity. That is to say, rather than make the function useless to those who'd need their own salt I think it's a better idea to allow these options while making sure developers know that they should only be used in certain situations. A function like this isn't bad because it can be misused.
But that didn't always happen. There do exist experienced PHP devs who would do password storage the right way but PHP up until now neither made it easy nor encourage these practices as they relate to passwords. Now I hope word gets out about this and people stop using md5() thinking their passwords are safe. Not that md5 is necessarily bad, but most people don't realize there are better tools for maintaining secure passwords.
Also, this reminds me a little bit of `has_secure_password` method in Rails minus some of the automation that comes with it.
Are you entitled to demand that free websites cater to you because you have some sort of moral authority?
You make it sound like all morally superior people (which I'm presuming is decided by you?) should have the right to get whatever they want and companies can't deny you service for any reason because... big companies are evil because they're big and being rich makes you a bad person? Is it okay to infringe on someone else's rights to exercise your own because you believe your motives are morally superior? What people like you always seem to forget is that there are others who don't feel the same way as you and your rights aren't the only ones that matter. It's basically fundamentalism.
Go ahead and be pissed off when Facebook or Twitter or some other company does something that makes it harder for you to use their services in a way it was never intended to be used for. Be pissed when actions that cater to their target market leave you out in the cold. But don't come back and act like they owed you something. Your cause isn't their problem. You're trying to make your way through life like they are and you can't just go around demanding that everyone you encounter owes you something because of some believe that you have moral superiority.
Give me a fucking break. There's a whole world wide web of tools that you suit you better. Rather than demand a tool not made for your purposes bend to your will, why not go use something else?
And I come from privilege? How would you know? Because if someone disagrees with your views it must mean they're the enemy and in your case it seems your "enemy" is anyone who comes from privilege. That's silly. I could just as easily say "anyone who would think what you think must come from a background of laziness and wanting a handout from everyone". I might come from privilege. I might not. Even if I did, that fact alone doesn't make me wrong. That's just another way to write someone off and make yourself feel better. It's the same as calling someone a fanboy when they praise a product you dislike.
I also try to put myself in the company's shoes. If I were them, this issue just wouldn't be my priority. It's a nice to have, not a must have and if I had to make the choice between what's best for the company (which also means most of its users) I'd make the choice to disappoint some people.
What I want from my world and what I expect from Facebook are two different things. I'm all for privacy and I want Facebook to respect that. But I also can't expect the world to cater to my every want no matter how morally just I believe my requests are. Taking my opinion on what I think we should expect from Facebook and turning it into a referendum on my morals, lack of morals, or cynicism is not only drawing false assumptions but severely exaggerating things. I can be in favor of using Tor to access Facebook and Facebook's right to refuse me access to it because of it at the same time. Things aren't so cut and dry.
Facebook is in the business of social networking, not activism.
The number of users using Tor compared to the general population is bound to be so low that they either shouldn't care enough to bother blocking it or if they did for some reason, really wouldn't put a dent in their daily actives.
Activists very well could be screwed, but that's really not Facebook's concern. Their no pseudonym policy makes perfect sense. Whether or not you like it or would use services that enforce it is an entirely separate issue. I feel like I don't have to explain this but I will anyway. Using a real name helps them help you find people you know (or at least whose name you know). That's the whole point. To start implementing policies conducive to anonymity defeats the entire purpose of Facebook.
I understand why Facebook is such a great tool for activists and dissidents and why a social network built especially for those people would not be ideal. That said, at the end of the day Facebook has no obligation to support such people. The fact that it's such a great tool for activists is just a side effect of the app's main purpose and use by the general population. I'd even go so far as to say that if they blocked Tor purposely in the future no one would really have any right to be outraged. I mean, you can certainly and understandably be outraged, but you really can't say Facebook has wronged you as being a tool for activists isn't really their mission. Complaining that Facebook wants to collect info to show you ads is like complaining that the coffee shop requires that you give them money to be served. Tracking is the way you pay to use Facebook and I doubt they'd ever implement paid accounts to get rid of the tracking and ads.
I'm sure there are some who work at Facebook who feel a moral obligation to support those activities but at the end of the day its a business and it isn't a business founded upon principles that fall in line with those of activists. If Mozilla created a social network, maybe then we could say the company has a moral obligation to encourage anonymity where people wanted but that kind of philosophy is just not in Facebook's DNA.
if you must conduct sensitive work, why do it on Facebook, a network that is committed to sharing things in public?
Changing the laws and/or enforcing them would be ideal but then it seems we'd end up right where we are again. Part of the reason for the secrecy of these programs isn't only national security but a way to circumvent the laws. From what we know about the current NSA controversy, these programs are mostly legal and being enforced just fine. Courts are ruling in favor of these things. That's not to say a debate over the 4th amendment isn't unreasonable.
Sometimes I feel there's a part of me that believes we could change the laws. The problem may not be our representatives exactly but rather the power that's been given to the military industrial complex. It's like a totally separate government unto itself, creating problems to solve to justify its own existence.
I don't doubt the authenticity of the leaks and I don't doubt Snowden saw abuses of power. My question is, is this really big news? I remember hearing about it in 2006 and since then I thought we all knew the government was vacuuming up phone and Internet data like it was going out of style. This leak is more confirmation of what we already knew with a few new surprises sprinkled in, but nothing that could overshadow the big problem which was that the government is intercepting about all communications within the US.
What I doubt are some of Snowden's motivations and the amount of information and power he really has. He addresses the question of why he chose to not be anonymous by dancing around the question with some hand wavy answer that just about translates to "because I'm gonna be a patriot and/or a hero". He calls a lot of attention to himself very unnecessarily too. It's almost like there's a part of him that wants to feel important.
Another thing that doesn't fit the narrative around this story is Snowden's role before he became a whistleblower. We're very quick to jump on the idea that the US government is this incredibly powerful, nefarious organization that's been competent enough to conduct a truly massive global and domestic secret spy program for 8 to 15 years depending on your sources. If that's the case, how do you let individuals like Snowden, with what we know about him so far (he's a young high school dropout hopping from job to job somewhat frequently, working for a contractor, who even describes himself as no one special with no special skills - ie an "Everyman") have as much power and access as he claims to have? If you're trying to keep a secret you make damn sure to compartmentalize the hell out of your organization so that no one person can see the big picture without having to go on a wild goose chase to put all the pieces together. Hell, even I don't have access to things you'd think I should have access to at my job and there's not a damn thing secret about it.
There's no defending the NSA though. What's happening is wrong and there's no gray area there. However, I don't think Snowden can be any help to anyone anymore beyond simply getting attention and having something to talk about in the absence of any other concrete facts. I see Snowden as the guy who brought up an issue we should have never let go back when it first came out and because of that I'm glad he came forward. Other than that, I think he overstates his role and maybe even some of the particulars relating to this spy program.
I wonder though if now all services regardless of their real focus will start marketing privacy as a feature and muddy the waters, making it hard for consumers to discern who is really about privacy and who just uses it as a marketing ploy.
But then there are the senators... These guys approved this activity long ago and while not all of them knew the specifics the Intelligence Committe did. They were taken into meetings where no note taking tools or anything with a battery was allowed and briefed about this.
Now that this story breaks the senate gets their panties in a twist like this is news to them. They simultaneously defend it and condemn it.
It isn't fair to make such a blanket statement about the entire Senate, I know but what I'm really getting at here is that what Rand Paul is doing doesn't strike me as sincere at all. It looks like a dog and pony show set up to make it look like someone gives a shit while they all keep getting briefed and voting for this stuff behind closed doors.
It's like set up a bunch of PR stunts to make us feel warm and funny then do the opposite while no one is paying attention. On this issue I feel like its the guys trying to get attention the most who can be trusted the least.
I hate to use this example because its a bit cliche but Google entered late into a field of established players and won. Microsoft beat IBM (this one applies only to the PC, I know IBM is still a force to be reckoned with). Stripe, Balanced, and Square are able to compete with PayPal for accepting payments. I know these arent all enterprise-specific but I didn't take the parent's comment to be about enterprise only.
The OP makes a good point here. These companies aren't out to intentionally harm their own users. They are out to make money and that sometimes has some side effects we don't like. But it is also entirely possible that they really do care about their customers/users too. Sometimes I feel like most people somehow have this idea that all these big companies are evil and really are involved in some mass conspiracy to harm us somehow. I once ran a company. I think this is somewhat related to this sort of war between companies trying to extract as much money per customer and customers trying to extract as much value from companies at as little cost as possible. But that's a topic for another time.
All the OP was really getting at with the conspiracy remark, and OP please correct me if I'm wrong, is that whether or not they intentionally gave the government access to some or all of their data they didn't do so knowing or intending for it to be used the way it was. They were trying cover their ass by complying with certain laws and the authorities and this massive cluster fuck was an unexpected consequence of that.
If you don't vote you have done nothing to even try to elect someone who you, in good faith, believe will do what you deem the right thing. Yeah, politicians are fucjing scum a lot of the time and lie to the point where its easier to trust the devil himself rather than a politican. That said, totally dismissing the system as one big huge scam is the lazy, cheap, and easy way out of your duty as a citizen. It's a total copout that lets you feel superior but in reality makes you completely inneffectual. The electorate may or may not have much power but it still has some. Voting is just one method of exercising your will over your government. It's important but we also need to be active in lobbying our government in other ways too.
Those in power want you not to vote. To take on this "I don't vote because its a sham" mentality is to play right into their little game. When enough people fall for it that's when it becomes a reality. I'd say its close to being a reality but it isn't too late to turn the tide. It's going to take some time which requires patience, something Americans don't have much of.
If you vote you always have the right to complain. If your guy loses you get to complain about how the other guy would've done things differently. If your guys wins and doesn't fulfill all his promises you still get to complain about how you were sold a bill of goods. If you don't vote, you're still entitled to complain but I personally won't take you as seriously because you haven't tried to affect change. This is supposed to be government for by and of the people but if you believe that Carlin joke (its a JOKE by the way) then it will no longer be that.