Hacker News Reader

o8r3oFTZPEon A key product of ubiquitous surveillance is people who are comfortable with it

AFAIK, it neiher was nor is common to serve the USPS with subpoenas or warrants in order to read someone's snail mail. In fact, I am not even sure there is an analogy with snail mail. How many people expected their mail to be read before the internet. Whereas it is well-known that third parties holding email routinely receive such requests.

We have no control over what "tech" companies do with the data they collect. As you point out, this is not part of any enforceable agreement. "Tech" companies make statements in marketing and "privacy policies", which they are free to violate unbeknownst to their users, but they generally do not enter into agreements that limit what they can do. It should not matter that the price is "free" because in the agreements they provide ("ToS") you are almost always promising to do (or not do) something.

The whole arrangement, the foundation on which the "tech industry" rests, is incredibly one-sided and I am not sure how much longer we can continue down this path with a straight face. IMO, we are living in a "reality distortion field" as Jobs would call it. However there are still some intelligent people around who (let's hope) are not on the take. Check out Lina Khan and Tim Wu: https://en.wikipedia.org/wiki/Tim_Wu

o8r3oFTZPEon A key product of ubiquitous surveillance is people who are comfortable with it

People will "disagree" and, IMO, that is why we have laws. To resolve the "moral ambiguity" that some folks have. A system of laws is not a perfect, mind you, but, IMO, its better than nothing. When there are debates on HN about tax avoidance/minimisation, people often claim the problem is with the legislature. Any suggestion of ethics is insufficient; they want laws before they will agree there is any reason for tax avoiders to change their behaviour. In the absence of "moral clarity", laws are helpful.

If one does not want persons other than the recipient(s) to read their mail without permission, is it a good idea to let a third party hold your mail for you such that it can be obtained through legal process by a fourth party without your knowledge. "Tech" companies providing "email storage" would never tell you not to use their "service" as it is against their interest.

o8r3oFTZPEon A case against security nihilism

I think you misunderstood. I am not insisting anything about security keys (physical tokens) requiring escalating amounts of personal information. I am referring to "two-factor authentication" as it is promoted by "tech" companies (give us your mobile number so you can use our website or "increase your security"). Call me a tinfoil hat if you like, but I am skeptical,^1 when the "solution" to "the problem of authentication" is giving ever-increasing amounts of information to Big Tech.

Regardless of intent, it seems very much in the spirit of trying to solve a complex problem by adding more complexity, a common theme I see in "tech".

There is nothing inherently wrong with the idea of "multi-factor authentication" (as I recall some customer-facing organisations were using physical tokens long before "Web 2.0") however in practice this concept is being (ab)used by web-based "tech" companies whose businesses rely on mining personal data. The fortuitous result for them being intake of more data/information relating to the lives of users, the obvious examples being email addresses and mobile phone numbers.

1. This is not an issue I came up with in a vacuum. It is shared by others. I once heard an "expert" interviewed on the subject of privacy describe exactly this issue.

o8r3oFTZPEon A case against security nihilism

Whereas saying "no one can write C without bugs" over and over is a good argument.

Its hyperbole. If the argument was "few people can write C without bugs" that would be much easier to digest.

o8r3oFTZPEon A key product of ubiquitous surveillance is people who are comfortable with it

Here is one way to look at the issue.

In business, when we negotiate an agreement with a business partner, if it is sufficently-sized, we (our lawyers) may include all manner of protections against potential liabilities or losses resulting from the conduct of either party. This does not mean that each party expects the other not to perform as agreed. Rather, it gives us assurance that if something does go wrong, each party has its interests protected, as negotiated and immortalised in the agreement.

Having privacy laws is just the "right thing to do". It is a matter of mutual respect. Even if no one is doing anything "wrong". We still need those protections.

"Gentlemen do not read each others' mail."

https://en.wikipedia.org/wiki/Black_Chamber

This idea had to come from somwhere. Perhaps the ethics are part of the human psyche. However, history shows the only way to see the idea realised is to have laws that enshrine it. Without rules, some people will, in fact, read each others mail. And no one will complain about it because there is nothing they can do.

Privacy laws are good for society. They represent our best interests and our sense of what is "right".

Just an opinion.

o8r3oFTZPEon A case against security nihilism

But you just did. :)

o8r3oFTZPEon A case against security nihilism

Who created that "problem we are trying to solve". It wasn't the user.

If the solution to the "problem" is giving increasingly more personal information to a tech company, that's not a great solution, IMO. Arguably, from the user's perspective, it's creating a new problem.

Most users are not going to purchase YubiKeys. It's not a matter of whether I use one, what I am concerned about is what other users are being coaxed into doing.

There are many problems with "authentication methods" but the one I'm referring to is giving escalating amounts of personal information to tech companies, even if it's under the guise "for the purpose of authentication" or argued to be a fair exchange for "free services". Obviously tech companies love "authenticating" users as it signals "real" ad targets.

The "tech" industry is riddled with conflicts of interest. That is a problem they are not even attempting to solve. Perhaps regulation is going to solve it for them.

o8r3oFTZPEon A case against security nihilism

I think you are misattributing the source of Heartbleed. Can you point out the security issues in NaCl. It is written in C. According to this "no one can write C" logic, there must be bugs because "no one can write C". https://nacl.cace-project.eu/

The other bizarre aspect of this logic is that not only is the author of the code irrelevant but apparently the task is, too. It would appear to apply to, e.g., even the most simple programs. The only factor that matters is "written in C". I use sed every day. It's written in C. Show me the bugs. I will probably be dead before someone finds them. Will I be using a "memory-safe" sed before then.

o8r3oFTZPEon A case against security nihilism

They want more data/information. Today it is two factors. Tomorrow it will be three. You love your Big Tech. I get it.

But personal attacks are not cool. Keep it civil, please.

o8r3oFTZPEon A case against security nihilism

All I am suggesting is that "hacker" as used by the Ars author could be a company, or backed by a company, and not necessarily a "nation-state". That is not far-fetched at all, IMO. The article makes it sound like "nation-states" are the only folks who could defeat the protection or would even have an interest in doing so. As the comment on the Ars page points out, that is ridiculous.

Assuming "hacker" could be a company what company would have such a motivation and resources to spy on people. The NSO's of the world, sure. Anyone else. Companies have better things to do than spy on people, right. Not anymore.

What about a company whose businesss is personal data mining, who goes so far as to sniff people's residential wifi (they lied about it at first when they got caught), collect audio via a "smart" thermostat (Nest), collect data from an "activity tracker" (FitBit), a "smartphone OS", a search engine, e-mail service, web analytics, etc., etc. Need I go on. I could fill up an entire page with all the different Google acquisitions and ways they are mining people's data.

Why are security keys any different. 9 out of 10 things Google sells or gives away are designed to facilitate data collection, but I guess this is the 1 in 10. "Two-factor authentication" has already been abused by Facebook and Twitter where they were caught using the data for advertising, but I suppose Google is different.

These companies want personal data. With the exception of Apple, they do not stay in business by selling physical products. Collecting data is what they do and they spend enormous amounts of time and effort doing it.

"That's all I know."

o8r3oFTZPEon A case against security nihilism

Guess who is "rolling your crypto" for you. The same guy who is the subject of your "fallacious benchmark". He writes in C. The problem with software is not the languages (seems a new one is created every month), it is a lack of competence in using them. (Over)Confidence is very commmon, competence not so much. I am thankful that Dennis Ritchie created C; I appreciated his humility and I do not blame him for others' mistakes.

o8r3oFTZPEon A case against security nihilism

This thread devolved into a debate over C versus Rust or other memory-safe languages.

1. Blaming the language instead of the programmer will not lead to improved program quality.

2. C will always be available as a user's language. Users will still be write programs in C for their own personal use that are smaller and faster than ones written in memory-safe. languages

3. Those in the future who are practiced in C will have a siginificant advantange in being able to leverage an enormous body of legacy code, of which a ton is written in C. Programmers in the future who are schooled only in memory-safety languages may not be able to approach C as a learning resource, and may in fact be taught to fear it.

There is a tremendous amount of C code that DOES NOT contain buffer overflows or use-after-free errors. It is amazing how easily that work is ignored in these debates. Find me a buffer overflow or use-after-free in one of djb's programs.

o8r3oFTZPEon A case against security nihilism

"But it's totally legitimate if that's your threat model."

Not mine. I have no plans to purchase a security key from Google. I have no threat model.

Nothing in the comment you replied to mentioned "trust" but since you raised the issue I did a search. It seems there are actually people commenting online who claim they do not trust Google; this has been going on for years. Can you believe it. Their CEO has called it out multiple times.^1 "[S]tupid waste of thought", as you call it. (That's not what I would call it.) It's everywhere.^2 The message to support.google and the response are quite entertaining.

1. For example, https://web.archive.org/web/20160601234401/http://allthingsd...

https://support.google.com/googlenest/thread/14123369/what-i...

https://www.inc.com/jason-aten/google-is-absolutely-listenin...

https://www.consumerwatchdog.org/blog/people-dont-trust-goog...

https://www.wnd.com/2015/03/i-dont-trust-google-nor-should-y...

https://www.theguardian.com/technology/2020/jan/03/google-ex...

https://www.forbes.com/sites/kateoflahertyuk/2018/10/10/this...

o8r3oFTZPEon A case against security nihilism

From the Ars reference: "There are some steep hurdles to clear for an attack to be successful. A hacker would first have to steal a target's account password and also gain covert possession of the physical key for as many as 10 hours. The cloning also requires up to $12,000 worth of equipment and custom software, plus an advanced background in electrical engineering and cryptography. That means the key cloning-were it ever to happen in the wild-would likely be done only by a nation-state pursuing its highest-value targets."

"only by a nation-state"

This ignores the possibility that the company selling the solution could itself easily defeat the solution.

Google, or another similarly-capitalised company that focuses on computers, could easily succeed in attacking these "user protections".

Further, anyone could potentially hire them to assist. What is to stop this if secrecy is preserved.

We know, for example, that Big Tech companies are motivated by money above all else, and, by-and-large, their revenue does not come from users. It comes from the ability to see into users' lives. Payments made by users for security keys are all but irrelevant when juxtaposed against advertising services revenue derived from personal data mining.

Google has an interest in putting users' minds at ease about the incredible security issues with computers connected to the internet 24/7. The last thing Google wants is for users to be more skeptical of using computers for personal matters that give insight to advertisers.

The comment on that Ars page is more realistic than the article.

Few people have a "nation-state" threat model, but many, many people have the "paying client of Big Tech" threat model.

o8r3oFTZPEon A case against security nihilism

"An entirely separate area is surveillance and detection: Apple already performs some remote telemetry to detect processes doing weird things. This kind of telemetry could be expanded as much as possible while not destroying user privacy. While this wouldn't necessarily stop NSO, it would make the cost of throwing these exploits quite a bit higher - and make them think twice before pushing them out to every random authoritarian government."

Apple could do more spying (excuse me, "telemetry") "as much as possible" in addition to NSO... because it would make the the competitor's spying more expensive.

This could be a unilateral decision to be made by Apple without input from users, as usual.

Any commercial benefits to Apple due to the incresed data collection would be purely incidental, of course.

Apple and NSO may have different ways of making money, but they both use (silent) data collection from computer users to help them.

o8r3oFTZPEon Show HN: Should I Get a House? a better rent vs. buy calculator

[deleted]

o8r3oFTZPEon Jeff Bezos’ Dystopian Legacy Goes Far Beyond Amazon

I remember reading stories in the late 90's/early 00's of workers in the Amazon warehouse becoming millionaires thanks to stock options and big jumps in the stock price. It sounds like that does not happen anymore except for employees in the offices. Perhaps employees in the offices know recognise that Amazon has overstepped its bounds but stick around waiting for vesting and/or (smaller) increases in stock price.

o8r3oFTZPEon A privacy war is raging inside the W3C

As the ad tech person interviewed in the article called it, "privacywashing" (as in "greenwashing" https://en.wikipedia.org/wiki/Green_washing).

o8r3oFTZPEon A privacy war is raging inside the W3C

Locked down devices. Then making more money from selling subscriptions, developer certificates, running "app stores", advertising services, etc.

To get the full functionality from the device, it is difficult to avoid obtaining an "AppleID". There is an "incentive" for users to sacrifice privacy and control to Apple. That appears to be intentional. Then the after purchase data collection and storage begins.

I am glad these practices have not spread across the entire hardware industry. Imagine buying an SBC and being asked to purchase an "RPi Developer Certificate" or register a "SiFiveID".

o8r3oFTZPEon A privacy war is raging inside the W3C

https://www.usatoday.com/story/tech/talkingtech/2018/05/04/a...

https://www.zdnet.com/article/apple-data-collection-stored-r...

https://www.apple.com/legal/privacy/en-ww/

https://www.apple.com/legal/transparency/account-preservatio...

Looks like they set this up in response to GDPR.

Interesting how the communications services create a pen register by default.

o8r3oFTZPEon A privacy war is raging inside the W3C

Progress. What would be neat is to see how much data Apple is collecting about its customers after purchase. Why wouldnt we want to know this. Could Apple provide option to hide true email address, tell app do not track and give visibility into data being sniffed without also collecting vast amounts of user data itself. We cannot answer that question until we see the data they collect. I used to be of the mind that Apple was not really hurting anyone until it became clear they are competing with Google and Facebook. Even Apple competing with Microsoft is unsettling because that company has been aggressively acquiring user data, also trying to compete with Google. On issues of user data, these companies have more similarities than they do differences. They are all hoovering it up, albeit through different channels.

o8r3oFTZPEon Ghidra: A software reverse engineering suite of tools developed by the NSA

"There is a lot of bluffing when it comes to cyber security."

I wish this topic received more discussion.

o8r3oFTZPEon Biden launches action on "Big Tech, Big Pharma, and Big Ag" – can it be real?

https://pubmed.ncbi.nlm.nih.gov/26817958/

Another line of research would be PBMs (Pharmacy Benefit Managers). These are another primary means through which drug prices are manipulated by Big Pharma, away from public scrutiny. Some Big Pharma companies have actually formed their own PBMs to provide better secrecy.

https://en.wikipedia.org/wiki/Pharmacy_benefit_management

Understanding what's really going on, i.e., exactly how it works, would require reading and understanding a significant amount of case law or working for Big Pharma. Note that understanding how it all works will not necessarily lead to change, unfortunately. PhRMA does a reliable job of making sure things stay the same year after year. These problems with gaming Hatch-Waxman have been around since the 90's. IMO, Big Pharma's lobbyists are far more skilled than Big Tech's lobbysists. Time will tell.

There is no single factor that is wholly responsible for higher drug prices. It is many factors. This is probably why it is such a difficult problem to solve.

Here is one example of one Hatch-Waxman "loophole." This is the one with antitrust issues that I had in mind when making that comment.

https://en.wikipedia.org/wiki/Reverse_payment_patent_settlem...

o8r3oFTZPEon Biden launches action on "Big Tech, Big Pharma, and Big Ag" – can it be real?

""Big Pharma" in the eyes of the public..."

What the public does not see is how the patent system is gamed by generic sellers. How this works is not something that can be easily explained in a single paragraph.

The problem is specifically mentioned in the Fact Sheet/Order. This is a legitimate antitrust issue but it is exceedingly difficult to succeed in the courts.

o8r3oFTZPEon Biden launches action on "Big Tech, Big Pharma, and Big Ag" – can it be real?

Is it fscked for physicians and various healthcare professionals (e.g., paid higher wages than other countries with different systems). Is it also fscked for wealthy patients who do not really care about costs.

o8r3oFTZPEon A call to minimize distraction and respect users’ attention (2013)

Interesting idea. I had a similar idea for HN comments. (@dang: take note.) Impose a delay from the point when a person first makes an HTTP request for a thread, i.e., first reads a thread, before they are allowed to comment in it. This would prevent "real-time" back and forth but it would also prevent knee-jerk comments. Before commenting, a reader would have time to digest the OP and the comments and think about them. A cool-off period. This might produce better comments. It would also prevent people from just jumping into threads that have activity to post mindless commments. It would provide an incentive to dig deeper into HN than only the first page. Digging depper into HN past the front page would give the reader more potential threads she could comment in, should they become active discussions. HN already has a limit on how fast people can comment, i.e., number of comments in a given period.

o8r3oFTZPEon Audacity fork without any sentry telemetry or crash reporting

Looks like they removed auto-updates or at least automatic checking for updates. I think that's pretty neat. As the in other comments, this is an advantage of open source. Things can be removed. I only wish this was more common amongst other projects. Imagine Firefox forks with all the telemetry and other annoyances removed. With closed source software, good luck getting anything removed.

o8r3oFTZPEon Otter Browser

Do you like the name better than "Chrome"?

If someone says "I use Chrome" what does than mean to you?

Just curious.

Perhaps some websites do not make use of all the standards, thus browsers do not need support for all the standards for these websites to "work". For example, HN does not require a popular browser. In fact it can even be used without a browser. Why are so many "web devs" using HN but few to none of them can/will design similarly fast websites. That's a rhetorical question. (That means everyone already knows the answer.) Do "web devs" actually use the sites they design. Why would "web devs" use HN when it does not represent their own taste in websites. What does that mean.

o8r3oFTZPEon Otter Browser

Do you like the name better than "Chrome"?

If someone says "I use Chrome" what does than mean to you?

Just curious.

Perhaps some websites do not make use of all the standards, thus browsers do not need support for all the standards for these websites to "work". For example, HN does not require a popular browser. In fact it can even be used without a browser. Why are so many "web devs" using HN but few to none of them can/will design similarly fast and flexible websites. Do "web devs" actually use the sites they design. Why would "web devs" use HN when it does not represent their own taste in websites. What does that mean.

o8r3oFTZPEon The web browser I'm dreaming of

Perhaps the author is just dreaming of another browser in addition to the one you prefer. One with different/less features. It is interesting how this is somehow a controversial idea. Is there some reason that the number of web browsers needs to remain small.

Different browsers can be really useful. Personally I do not need want the browser the author suggests at all, but that's just me. Every user is different. I use "links" heavily for reading HTML; it is particularly good for printing HTML tables. I do not expect anyone else to use it. (But some do, including user who actually paid money for features.) A different browser is simply an optional program I choose to make use of. I do not use it for anything financial or otherwise sensitive. There are other browsers for that.

In recent years I frequently see comments that seem hostile to the mere idea of more web browsers. I do not understand this. If this author wants some browser with some certain set of features, that is his business.

"Disagreeing" with someone's desire for a browser with different/less features because of the annoyance of native apps. It make no sense. (Blame the developers of today's "native apps", not users who want alternatives.) AFAICT, there is no suggestion in this blog post of trying to take away anyone's preferred web browser and make them use native apps. The author just wants more options besides the popular ones. A browser with different/fewer features in addition to all the everything-but-the-kitchen-sink, do-everything-under-sun ones written by online advertising-supported organisations.