We (people who work in tech) have a duty to fix these issues and to implement our products in ways that respect the privacy and security of the people who use what we build without passing the buck on to them. A Facebook user doesn't have to give a damn about encryption before Facebook put good encryption in place - the engineers at Facebook should just do it anyway, because it's the right thing to do.

If we build services that fail the user by allowing a malicious actor to violate their privacy then that is our fault. It is not the user's fault for not demanding we do our jobs properly. This is on us.

The maclicious actor is us. Don't work for shitty companies and implement stuff right for the companies you do work for.

Edit: Product owners give you jobs that are bad for the user/customer but they want it done ayways. Convince them why it's a bad idea and find another job if you can't.

If you think that being an engineer in tech is a job where you blindly implement someone else's will then you're failing to live up to both your potential and your responsibility.

There is no us. There's just hundreds of thousands of individuals, each doing their own thing. Some are angels, some are assholes, and a lot are in the middle. If you think that getting 500,000 people to make a pinky promise to be good is going to prevent shit from happening, that's just delusional thinking. No matter what you or I do, there will always be some asshole Investor/CEO/PM/programmer out there who will screw over people's privacy in order to make money, and you guilt-tripping the other 499,999 programmers is not going to change that.

If we want to stop shit from happening, we need systems in place to do that. Either regulatory, certification or market-based systems that catch and punish bad actors. In the absence of such systems, expect dysfunctional outcomes regularly.

I think we actually agree with one another, but I'm just coming at the argument from a slightly more positive position. We, as the engineers who build stuff, need to start making it clear that we don't like what the bad actors do, that we won't build it ourselves, and the "asshole Investor/CEO/PM/programmer" who does won't have a place in our industry. You're quite right that we need systems in place to stop this shit, but you're quite wrong if you think it's someone else's job to make that happen. We can build the certification or market-based systems right now.

Something really bad already happened: genocide. What else needs to happen?

The Netherlands (among others) required everybody to register their basic info, including religion, with local authorities. This made it very simple for the Germans to know whom to deport.

Your data can be used for other things than originally intended. But people do not learn.

So you may be right. More really bad things need to happen.

(FYI I'm german, I know what I'm talking about)

Fingers crossed that Trump's admin does something so terrible most people will want to use open source end-to-end encryption tools?