I think one of the great signals of good ethical behavior is the person who'll refuse to build a thing that they know should not exist, even when offered a great reward if they'll do so.
138 karma · joined January 10, 2018
Many of them are not stupid. On average, half of them are above average. They're just uninformed and busy with their own lives.
They're not good people, but if it weren't this set of people, another would take their place. The world is rife with opportunity for people of low morals.
It is society's fault that we have not explicitly codified what will not be allowed and constructed the right laws and enforcement to ensure that violators are ruinously punished.
Privacy of varying levels is and has been a functional requirement for smooth working of free society.
Economic disparities make the impact of lower levels of overall societal privacy have a disproportionate negative impact to those on the lower end of the scale.
There's enough of a delta in both the money paid for online advertising of a target nature and in the better results that yields for the advertisers for them to fund a very rapid turn-over.
There's enough money in it that if they must, they'll be able and willing to buy their way past any unionization issues.
Make their only defense be cooperation in prosecuting the offending party.
Or that they got a prescription filled. For Valtrex.
What would be helpful -- but that I am adamantly against -- would be tons of data drops, in communities across the nation, of local church leaders and local community leaders.
I'm not a graphic artist, but I hate mouse cords and hate having to recharge mice or deal with batteries.
So a series of Wacom "puck" mice on one (over the years, several) of their digitizer tablets has been my mouse substitute at my desktop. I bought the high end ones. On an average of every 3 to 4 years.
They stopped making the puck several years ago. Mine was starting to wear out, so I finally made the leap to Logitech's G703 and the Logitech G PowerPlay inductive mat. So same benefit -- the mouse is just magically always charged.
If I hadn't already switched, I would have anyway after the Wacom selling data thing...
They don't pay for the paystub data. The employers give it to them.
Although it's an invasion of privacy, to be sure, it actually does have some benefits for the employee.
In places outside San Fran, where people actually get conforming mortgages, having your data in The Work Number's database automates and cuts out the employment & income verification so that you don't have to track down records and submit manually and can potentially skip multiple must-connect phone calls between the lender and employer.
And furthermore it could be a plurality of those kinds of providers aggregating content.
Deploy single-sign-on schemes, and websites might participate in a plurality of programs from different vendors.
But at the end of the day, you'd pay one or two "providers" a monthly sub, they pool the funds, take their cut, and do prorata distribution of the pool based on views, eyeball time, popularity of content, lots of ways.
No need to perform microtransactions from a banking perspective. You're going to eat $20 of web content this month, and so will lots of others. And then those views can participate in the pool and get paid monthly or something.
1. The uplift of targeted advertising is unbelievable until you see the actual statistics. It's like slowly sipping a cup of coffee to wake up versus waking up to snort a line of crack.
2. Advertisers were abused and defrauded by adtech. Which has inspired all kinds of surveillance hellscape because the advertisers finally caught wise and have renegotiated to pay for actual performance only -- not clicks -- actually closed sales. But adtech wants paid if you do your research online, respond to an ad online, and then buy in store. And a whole lot of adtech now allows for that. Attributing an in-store purchase with no customer interaction to a prior web session by that same party.
The benefit of those two factors to the advertisers is such that we can't have a serious discussion about this shit going away without a law which assigns criminal penalties for being a beneficiary of the scheme.
As in, being a beneficent party of a targeted ad campaign becomes a presumption of criminal activity.
We have to make the advertisers culpable for the behavior of the companies serving up their ads.
It's a whole attitude. They're aware of their limited lifespan and intend to either buy their way into more and better lifespan (if possible), but in any event become actually powerful and rich.
At least on a certain scale, they're not wrong. It does work.
This is not to say, however, that they're not slugs deserving of a good salting.
The societal costs of surveillance capitalism are only just starting to appear, and it's going to get so much worse before it gets better.
And it's not all bad, but there's no preserving the little bit of good without canning the tons of bad.
In reality, being one BGP trick away from a mere dedicated individual or corporate owning certs for your domain is an actual risk today.
For example, in order to scale less expensively, the Great Firewall is architected such that it need not actively be in the middle of the entire flow of traffic and need not actively proxy. Historically, they didn't need it to do so in order to achieve their goals.
Now, however, the advancement of a combination of new technologies is finally closing that gap.
In order to maintain historic blocking capability it becomes necessary in the long run to actively MiTM all the connections.
But that can be made to scale and there are nations who can afford it.
How do we know? Because the job is not significantly harder than serving up all that content. (At worst it's a little more than 2x the work.)
And today most content is served up from a handful of privately owned infrastructures. If a corporation can build it, so too can a lot of nation-states.
The incentives to build this have changed.
Rather than death, if we look at the history of oppressive societies, the more likely outcome is a job offer, the kind they won't let you refuse but they'll make it so you don't want to refuse anyway. They find the clever people who are working around the filters and interception and hire them to be the watchers. They get perks like time to spend on a real private connection, etc. Meanwhile they are required to contribute to making the noose ever tighter.
And then massive CDNs will start to support it.
Some of them might even enable it, with encrypted SNI, on _every single listener on all of their IPs_.
DoH was designed to evolve into something nearly unblock able. Unless you active intercept 100%.
Which some people believed no one would pay up for or that it would be unscalable. This stuff only gets cheaper and easier.
I'm well aware of all that you've said.
My point was, they get TLS interception down, and they capture what they want from a target of interest.
When they look closely at your traffic and decide all these cat gifs have too much or too little entropy in the data that forms their pixels, they simply (if they're courteous) say, "Persuade me that you did not know that this app was helping you hide messages back and forth. Persuade me or we shoot you now." And then they shoot.
Chrome, etc., require that certificates which descend from publicly trusted roots have their certificates published in certificate transparency logs. Someone would quickly notice bogus certs being issued and the associated root would get blacklisted.
To the extent that Kazakhstan succeeds with this, it will only make other governments jealous of the capability and want it for themselves.
No doubt the NSA intercepts all kinds of things, but they're not doing it with TLS MITM technology (at least not without further additional hacks).