HNHacker News
TopNewBestAskShowJobs

dlmetcalf

114 karma · joined May 5, 2016

submissionscomments
dlmetcalf··on Reflections: The ecosystem is moving
Not necessarily. Microsoft kept trying to make a walled garden around the web. They might have had a lot of users, but the web fought back and luckily today we have 'world wide web', not a totally isolated Microsoft Web, Google Web, Apple Web, Firefox Web etc.

I hated the days when you constantly had to switch web browsers to get pages to render. I'm glad it's rare now, because we didn't give up on the hope of open systems.

Mark might have lost the battle to have HTTP/2 encrypted by default, but at least when Let's Encrypt came out, it still worked in all browsers.

Would we have been better to just give up and have lots of walled gardens instead? I don't think so. I'm glad we have WWW.

Personally I don't think XMPP failed because being open made it slow to adapt. I think we're mostly stuck because ICQ, AOL & MSN just got there first.

I don't envy being in Moxie & OWS's position of figuring out how to make this work. I'll add opinion and some of it harsh, though I'll reserve criticism until I've built something as awesomely globally deployed as Signal.

dlmetcalf··on Reflections: The ecosystem is moving
I guess at the end of the day, that exactly my concern too.

Signal is awesome, which is why we want to use it, but then suddenly the user finds they're now inextricably tied to Google or Facebook collecting their metadata - while we know Google themselves have been compromised (technically & legally) and are forced to hand that data over. Notably, to an NSA that has lied to Congress about it's operations, without consequence, and hence is now beyond oversight and reach of regulators too.

Also that the iOS code, which appeared to be free & open, is actually not, because other projects are denied permission to use in a way that's compatible with iOS's App Store). Ironically because the libraries are under GPL. Hey, blame Apple I know, or ourselves for not reading all Apple's T&Cs before promoting Signal, but it's disappointing none-the-less (while also still being OWS's right).

From all their history, the OWS guys seem to really want and be trying to do the right things, within the constraints and trade-offs available to them. The answers aren't trivial, but something about where it's all ended up leaves a very uncomfortable feeling.

dlmetcalf··on Reflections: The ecosystem is moving
Good to hear that's remained the case @moxie.
dlmetcalf··on Reflections: The ecosystem is moving
This is probably what made me double-take the most.

I don't understand why Guardian were denied permission to use the code. Sure, OWS aren't under any obligation to, but it doesn't really feel like it's in the spirit of openness at all.

The code might be 'open source', but it's neither free as in user freedom or beer, unless you're giving Facebook or Google your metadata now.

If the code can't be reused, it's pretty hard for users to move to something else. Unless that something else is totally starting over again from scratch.

It just feels weird that because of the Apple situation, in this case the GPL appears to work directly against user freedom.

I think a lot of people have been taken by surprise by that, to discover the platform is not what they thought it was.

dlmetcalf··on Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it
Nope. If you control the votes, you control the money, the laws that make it, the military (including intel services, alliances & secret police), plus the rest. You don't even need to buy a presidency then. Once you control votes, you can privilege escalate to do almost anything. There's probably nothing else we should be as truly concerned about securing properly. It's already been rigged and EXTREMELY probable it was exploited for George W. Bush's election too. Electoral security is an absolute joke and a travesty.

https://en.wikipedia.org/wiki/United_States_presidential_ele...

https://en.wikipedia.org/wiki/Premier_Election_Solutions#Con...

dlmetcalf··on Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it
IMO, if they consider that too complex to handle, then application security is too complex for them to be working on too. I wouldn't want a developer who doesn't even know how to handle pipes, to go anywhere NEAR apps needing secure implementations.
← PreviousPage 3 of 3