Making holier than thou comments about everyone else being sheep isn't helpful or thought provoking. Offer an alternative if it is a bad one (looking at you Mastodon). So here's mine: we need to change the power of digital advertising. Most of the most rent seeking companies generate revenue primarily selling ads to get more people to buy more crap. I want a VAT on all revenue passing through the digital advertising pipeline. My hope is that if these things are less profitable, it will reduce the over-sized impact these companies (social, infotainment [there is no news anymore], search, etc.) have on our economy and life. People are addicted to to fomo and outrage (faux?), I don't that that will ever change but we can try to make it less profitable.
Seriously? Perhaps heed the warnings? Whenever Apple tightened the reigns, thousand of apologists came to their defense. I wouldn't even have minded if they kept their obedience to personal decisions. But they extended their enlightenment to others.
And then take what actions, exactly? “Guys this is trouble” is …fine, but without “and we should therefore do”, it’s just kind of spitting into the wind.
People: Ignore warning, buy iPhone
You: "Don't buy Apple products" isn't an action.
Google phone? This is not an alternative if you care about privacy.
The allegory presented sounds insane (growing your own food) but honestly if you're not rolling your own flashed ROM on a 'droid then your privacy is dead already;
I understand throwing all your eggs in one basket is a terrible idea but Apples walled garden and heavy sandboxing was at least somewhat protective.
While the Pinephone isn't perfect yet, I would argue it will be able to replace Android/iOS in a few months.
Yeah this is the mobile phone equivalent of growing your own vegetables.
I get it, I'm a techy, but until the day is here where rooted phones aren't treated like a special case: for most people if they buy a droid then it's actually significantly worse for their personal privacy than an Apple device.
I don't want that to be the case, but until the pine phone is here and starts being a reasonable alternative; that's how it is.
Someone will have to buy the pine phone when it is not a reasonable alternative to support the effort and keep the ball rolling.
Sadly...I know. The unfortunate thing is my recommendation for my family/friends for a phone is an iPhone, because it really is the best for security/privacy today, and they at least support their phones for much longer than an Android.
> I don't want that to be the case, but until the pine phone is here and starts being a reasonable alternative; that's how it is.
Fortunately, I think that time is coming sooner than later.
It's no surprise why we got to this point.
Because that's who I'm speaking for.
The issue is that "the masses" just "go with the flow" and act like if everybody else is jumping off a cliff then it's ok to jump off a cliff too, and it is these mobs that move the markets and determine which products and services become the most popular.
However, in relatively free countries it is still possible to live one's life on one's own terms and not be in the same herd with the sheeple. It is definitely possible to live life without an iPhone and to have an Android phone with F-Droid rather than the Google Play Store as one's primary phone.
What is the follow-on? Which products should we buy then? Any phone other than Apple's? None?
It doesn't even need to be an "action". You will have to be at least conscious of what is happening.
That is not what is happening, right now ( or before that ) many are defending Apple, and also an attitude of not "my problem". Writing off any warning as either pessimistic or conspiracy. Having some healthy dose of skepticism is somewhat an unpopular view in modern day society. Especially in Tech and America.
An action could and will be taken once enough people are conscious of what is happening. Right now the scale and critical mass just isn't there (yet).
BTW I think one of the roots of our problem is that we seem to end up in these really weird "winner take all" distributions with only 2-3 main winners and rarely any serious alternatives. It happens with operating systems, browsers, it also happens within programming language communities, like Javascript, etc. Everybody piles up into one of the 2-3 most popular framework options (React, etc). Same thing for Linux distributions. etc.
It would be nice if we could figure out some sort of nudge or hack that would reduce this tendency and encourage more distribution of mass.
Issues are also being found way faster simply due to a bigger user base.
Don’t buy or use their products.
The only progress for things like this comes at the political level, through pressure on politicians or corporations. That’s where you should be spending effort if this sort of thing matters to you.
A few Linux nerds buying some fantasy spook-free glibertarian phone will not make a dent in the problem.
Still good to keep up the pressure on public officials. That any interior minister is very happy about that doesn't have to be excused. Anyone else should be more like French people.
However I do think there’s value in gentle, consistent evangelism of privacy in ways that don’t make people feel bad. Most folks actually don’t want their deeply private stuff to be accessible. I’ve found that there are good analogies and ways to think about it that folks can get on board with and start caring to some extent.
I absolutely agree that political progress is the ultimate solution. I think the only way that will happen is if enough people demand it.
Also, that spirit existed only in an adversary free environment. You may as well say the solution is for everyone to be nice to each other.
The solution is to build new technologies that are privacy preserving, transparent, don’t place trust in a central authority but are resistant to attack.
This is possible but nobody has built it yet.
Problem is you end up with a vastly inferior hardware device that costs nearly as much as an iPhone.
I’m still waiting for my Librem 5 preorder.
Would love to hear if anyone is actually using a Linux phone and enjoying it.
The Pinephone is $150/$200.
> Would love to hear if anyone is actually using a Linux phone and enjoying it.
I have one, and I throughly enjoy it! One of the neatest things about it, and I still have to wrap my head around it, is that it can do anything you can do on a desktop. SSH? No problem? Dev environment? "apt install build-essentials". Want to install XFCE? Knock yourself out!
It is still missing MMS, which is why I don't use it daily, but that should be changing much sooner than later.
In comparison my Galaxy Tab S6 is just so much more black box and some stuff just does not work with no apparent way to debug! Like, I tried to setup a samba or SSH server on it for easy data transfer, with zero success after trying all the related apps in frdoid and elsewhere. It just does not work at all! Most likely some brain dead "security" option one can't override 2without rooting the device that is impossible to track down in the mess that is Android.
Running root used to be very simple and semi-sanctioned. Now you have to essentially rootkit your phone (Magisk) for it.
Most of the AOSP programs are abandoned (thankfully ROM maintainers update them!), and you have to deal with a lot of things not working with Google Play.
You can do all these things with a $10 raspberry pi-w. It’s not obvious why it helps with having security and privacy.
The person asked: "Would love to hear if anyone is actually using a Linux phone and enjoying it."
...so I responded about what I enjoy about using a "Linux Phone". A "$10 raspberry pi-w" is not a Linux Phone.
The question didn't address "security and privacy", so I didn't add it. Though, since you brought it up, I will answer how the Pinephone "helps with having security and privacy".
- I have hardware (cut physical power) switches to kill the Microphone, cameras (independent for front and back), and Wifi/Bluetooth.
- I am running a full GNU/Linux distro that I have a lot more confidence in their want to protect users security/privacy.
- I can run software of my choosing on it (the Pinephone actually defaults to booting on an SD card! so it encourages you to experiement with OSes).
- There is serious effort to run the mainline Linux kernel on it, so it will not be artifically obsolete in 3-5 years (or be sutck on running some ancient swiss cheese kernel in 5 years like my old Pixel/Nexus devices).
- I don't have to install/link to some opaque binaries to even boot the system.
I'm sure I can think of more, but that's all I have for now.
What I have encountered is the requirements for it being a daily driver are user specific. I have seen a fair amount of users say "I need $FOO app to work", where $FOO is some an app only developed for Android/iOS (a common one is a banking app, there is almost no way that company will support a Linux phone). So I guess I would ask what your requirements are before I can say if it is daily driver ready or not.
My threshold for it being a "daily driver" is if I can fully replace the "phone" features of my Android phone, which for me, is: Calling, SMS, MMS, Voicemails. MMS is not yet UI functional, but will be sooner than later.
The good news is I am seeing the Linux Phone movement be a positive feedback loop: the more features add, the more users, and the more folks helping to add features.
So far though, they do nothing to solve the problems we are talking about. The software is not anywhere near audited, and even if it were, you are still interacting with people and services who are using unaudited software.
Many of the projects leverage a well known OS as their base (e.g. pmOS uses Alpine Linux, Mobian uses Debian), and actively ensure that anything that can be upstreamed is upstreamed. So it's not like you're downloading some random ROM off of XDA.
It’s not even close.
I actually completely agree with this.
> This is possible but nobody has built it yet.
Doesn't mean we should stop trying. Here's my $0.02 - I've been building an email solution based on Self-Sovereign Identity ideas, still in progress, but check it out: https://ubikom.cc or https://github.com/regnull/ubikom
Who is suggesting ‘stopping trying’?
To me the only thing that sounds like ‘stopping trying’ is boycotting Apple, as though that has anything whatsoever to do with the problem.
It doesn’t matter what vendor you use. The only thing you can do to help is to identify parts of the solution, explain them, and build them.
I don’t have time to check out your email solution but I hope it is part of the solution.
It became, "Sorry, AT&T carrier, AT&T rules."
I think people have a hard time seeing the ethics in the technology they choose to use. Maybe the next wave of net-natives will be able to rediscover that common thread of rebellion and resist. It's insidious, I'll give you that. It's not obvious what is being surrendered with every participation on these platforms but it doesn't take a genius to see clearly.
A strong step forward that gets nullified when Facebook buys the alternative app you're using, or when the app you're using does things as Facebook does.
You can propose all individual options you want, this is a collective issue that won't get fixed just by calls to individual action.
Chose open standards, use and contribute to FOSS, avoid social networks, get involved in your local community, etc.
No need to go to extreems or complicated plans, corporations follow the customers.
But nobody did listen. Quite the opposite. I never had a facebook account, and now today people are boasting when they leave FB. But 10 years ago ? Oh we were the paranoid extremists .
Even today my friends regularly pressure me to get whatsapp.
IANAL but we (via our elected representatives) can push a law that prohibit restrictions on execution of users' code on their own devices. Or we can split app stores from vendors and obligate them to provide access to third-party stores, like we do with IE and windows.
Also, it's completely doable to stop NSA/Prism totalitarian nonsense.
What we can do as tech people?
- raise awareness
- help people to switch from big tech vendor locks
- help people harming BT by installing adblockers, pihole etc
- participate in opensource (with donations or work)
- probably something else
The most pressing things that should be supported, to have the world I think we want:
1. Mandate open app stores. Your device, your choice. *
2. Mandate open browsers. Your device, your choice. The internet is fundamentally an extension of the OS at this point, so an free (as in speech) connection choice is a requirement for an open OS. *
3. Mandate open apps. Your device, your choice. Installing unsigned apps can be warned, but not prohibited (outside of enterprise devices).
4. Mandate configurable tracking. Your device, your choice. There must be a clear option to disable all tracking, along with an API / payment ecosystem for apps to detect this and request alternative payment. I.e. "free if advertising on + $5.99 if advertising off".
5. Mandate right to repair. The manufacturer must provide necessary technical specifications (hard or soft) for a base level of modification and repair. If the manufacturer no longer supports the device, everything must be released to the public.
* Selection must be offered at time of device setup. Installing alternatives can be warned, but not prohibited (outside of enterprise devices).
Buy a feature phone or a phone from a vendor who doesn't have this power.
Switch to Linux.
Stop buying from companies that abuse you.
Elect politicians who care about your rights.
You know what's not helpful? Attacking the messenger, regardless of how sanctimonious you think he is.
I'd argue: avoid using proprietary networks, avoid vendor lock-in with software and hardware, and use hardware that one is allowed to use their own software on. Champion using open and federated protocols for social tools.
I think solutions exist, but honestly, it isn't easy.
> Making holier than thou comments about everyone else being sheep isn't helpful
I would offer the GP comment isn't necessarily a holier than thou comment, it's a comment of frustration. Frankly, I feel the same frustration.
It's tiring to hear snide remarks of "ohh yeah, we can include you for something because you don't have an iPhone". Hell, I have openly heard, even on this forum, that people don't include folks on social conversations with EVEN THEIR OWN FAMILY because of the dreaded "green bubble". (FYI, MMS is entirely done over HTTP and SMS! How is Apple's MMS client so bad that it can't handle HTTP and SMS?).
Or there is the "why don't you have WhatsApp/Facebook/Instagram/etc." and people think your some sort of weirdo because you don't want to use those networks.
So to be honest, when I see something like that, I think "Well I'm not surprised, this is what happens when you are locked out of your own hardware".
> What are you doing to fix it?
While GP may not be doing anything, others are helping and actively working for alternatives. For example, I have been working to get the Pinephone to have MMS and Visual Voicemail support so I can use it daily. I an very fortunate to work with a lot of very talented and motivated folks who want to see it succeed.
I'm dependent, just as you say, and have no illusions about that.
Getting into this situation wasn't my decision (it was a collective "decision" of our society), and getting out of this won't be due to anything I'll personally do either.
The only difference between me and the average joe is having understood that we have a problem earlier than most.
Pretty cheap, too.
Nothing, because my phone is rooted Android.
Are you sure intel, AMD, Arm or windows TPM aren’t snitching on you? Do we need to make our own silicon from ingot?
There’s no technological solution to this problem, only social and legislative.
>The system that scans cloud drives for illegal images was created by Microsoft and Dartmouth College and donated to NCMEC. The organization creates signatures of the worst known images of child pornography, approximately 16,000 files at present. These file signatures are given to service providers who then try to match them to user files in order to prevent further distribution of the images themselves, a Microsoft spokesperson told NBC News. (Microsoft implemented image-matching technology in its own services, such as Bing and SkyDrive.)
https://www.nbcnews.com/technolog/your-cloud-drive-really-pr...
Didn't the Windows 10 TOS extend that scanning to local storage as well?
I don't step in the lowest parts of the internet hell, but I am also not very picky about it. I have never encountered child pornography in 10 years of almost pathological internet usage.
Additionally, by calculating hashes of media on peoples devices, you can quickly determine networks. A private image you shared with your friends? Unique hash and everyone that has it is probably in your network. That is aside from the issue that they would also just read your contacts.
The TPM FUD has really gone out of hand.
1. there's no such thing as "windows TPMs", whatever that means.
2. TPMs basically has zero access to the rest of the system. It's connected via a LPC bus, so there's no fancy DMA attacks to pull off. Over that bus the system firmware sends various hashes of the system state (eg. hash of your bootloader), but that's about it.
That's the specification. Have you actually monitored the bus using probes? Did you check that the TPM is only connected to LPC?
Isn't this the definition of FUD?
>Did you check that the TPM is only connected to LPC?
Dunno, you tell me. https://en.wikipedia.org/wiki/File:TPM_Asus.jpg
What would concern me is if we see a big revenue stream from their software. Then i'd question them not wanting Linux on their machines.
But imo you already gave them what they want when you buy an M1. I don't see a reason why they care beyond that.
In fact, I predict that Apple will at one point start selling software as a subscription, like SaaS. Other OSes don't fit in that model.
That’s not a difficult prediction. https://en.wikipedia.org/wiki/Apple_Arcade:
“Apple Arcade is a video game subscription service offered by Apple Inc. It is available through a dedicated tab of the App Store on devices running iOS 13, tvOS 13, iPadOS 13, and macOS Catalina or later. The service launched on September 19, 2019 after being announced in March 2019”
They also have “hardware as a service”. https://www.apple.com/shop/iphone/iphone-upgrade-program:
“The easiest way to upgrade to the latest iPhone. Get a new iPhone every year AppleCare+ coverage included Works with your carrier Starting from $35.33/month”
The day apple wants it's OS anywhere it can get it, because it brings in money independent of just it's hardware is the day i actually believe Apple cares about the software revenue.
Right now Apple's software is hardware locked. Google by comparison cares much more about the software side than Apple, imo.
[1] https://www.applemust.com/apples-50b-services-target-just-is...
- (Potentially) programmable top notch security chip with no overhead encryption
- Fanless (Air), cool running, fast processor with very low power consumption
- All metal body
- Top notch HiDPI screen with color accuracy.
- Top notch sensors
- Excellent, illuminated keyboard
- Big trackpad with pressure sensitivity and taptic engine
- Excellent battery life
- Excellent battery endurance
- Very high sound quality, good speakers, good mics.
- High quality webcam
- Light for its class
- WiFi with plenty of antennas, MIMO support and all modern standards, incl. forward facing ones.
- The ability to use nix-darwin for configuration management. It may be incomplete, but there’s no Windows equivalent.
- Higher single thread performance than any other device.
Everyone betting on the same horse is usually a bad strategy.
By the way, here's what Linus Torvalds (the creator of Linux) thinks about using the M1:
https://www.zdnet.com/article/linus-torvalds-would-like-to-u...
The problem is, you pay the same price for a Thinkpad/Elitebook and you get ridiculous gotchas like missing wireless antennas (at most you can find 2x2, if you're lucky). Or the configuration you like doesn't come to your country, or the vendor doesn't allow custom configuration for your country unless you buy 10+, etc.
OTOH, I pay the premium, I get what I configured, with top notch small specs (antennas, wireless chips, etc.). You can't find a spare 40mm SSD for your Elitebook after three years, but Apple will service your device happily.
If you get the said SSD from the vendor, its quadruple the price, so it's Apple's price territory again.
At that price range, there's no advantage in hardware prices between Apple, HP, Lenovo and Dell. They're equally cheap/expensive. So, IMHO, you pay less on the long run for an Apple laptop, which you can use for 7-8 years without problems.
Yes, the desktop has higher throughput. Of course it does. But that doesn't mean I don't feel a fraction of a second's lag whenever I do basically anything, and on the M1 that just... doesn't exist.
So it's not just a matter of feel.
Yes. It's slightly deeper, much more resistant to dust and one can write with very low effort, but with crisp feedback. It allows me to write at least 10% faster with no effort. I similarly use an old Microsoft Sculpt Comfort at office and Logitech G710+ at home.
Good keyboard is something hard to find.
For example, take the monitor - there are monitors with higher refresh rates or more resolution (Retina does 'only' 6K). Also, Mac OS colour processing has no good equivalent elsewhere, so you won't see as much benefit from Apple's monitor without Mac OS.
On the software side, Apple has the unique position to force every developer who cares about their user base to rebuild their stuff for a completely different CPU architecture.
M1-based products are anything but overpriced. The Air’s price is comparable to modern flagship smartphones.
At this point in history, you can't avoid Apple's ecosystem if you want to use their ARM-based laptops/desktops unless it's a hobby of yours. And it's sad, because this is the best hardware I've ever owned.
Retina Display when it first arrived was literally THE reason I started switching to Apple ecosystem as it was exponentially better to look at that screen, and I'd even pay more for a 4K display on a MacBook if they brought it.
They're not EliteBook/Thinkpad tough, but they're more than enough unless you're going to handle it rough.
I can calibrate a screen regardless of the OS I use with the help of a good calibration device, and having a good panel is a good start for that. On desktop, there are possibly better panels for pure color accuracy, I won't argue that.
OTOH, on the portable space, their hardware formula is pretty robust.
Worse, it would take some time for me to even trust Linux on M1 laptops to not fail exactly when I need it - that's the nature of reverse engineering. Since they don't have the specs, the only real test is lots of people running it for some time and reliability is more important to me than specs.
As for monitors, Apple's colour advantage is more than good calibration - the entire ecosystem can handle 10bit HDR. That's something AFAIK you won't get elsewhere.
The only difference in this is who you trust. Be it Apple, the community or someone you pay, you're still trusting that someone else's interests align with yours and they did things correctly.
In other words, this is not a technical problem. It's a problem that needs to be solved through regulation, because 99% of the people can't verify by themselves that their devices are actually private and secure.
Not really. There is a huge difference between trusting a single for-profit entity (who provides backdoor to iCloud in China) or huge number of independent people (each would like to get famous/rich for finding bugs).
Plus the hardware is nice and actually works.
I agree with what you say in principle but here I am using an iPhone to type this while it’s been nearly 2 years since I ordered my Librem 5.
Making decent mobile devices that are more secure than an iPhone is not an easy thing.
Secure against entities they don't like. But intentionally insecure against entities they do like.
But the kernel is only a tiny fraction of the system. There simply is no Linux system that even attempts to solve the problems Apple solves. There could be, but there isn’t - this is what we mean by the term ‘wishful thinking’.
You are speaking as if you know the opposite. Any links?
Is it worth it, though? Is being "better for mobile computing purposes" worth all of this, and whatever else will come next - which we know is just a matter of time, because no one cares enough to stop buying from them?
It’s not clear that governments would give the open social networks an easier ride either. It could be argued that distributed FOSS developers are easier to pressurise into adding back doors, unless we officially make EFF our HR/Legal department.
The other problem is workers have a right to be paid. The alternatives are FOSS and/or distributed social media. Who in good conscience would ask a tech worker to give away their labour for free, in the name of everyone else’s freedom?
In a world of $4k rent, who amongst us will do UX, frontend, backend, DevOps, UO, and Security for 7 billion people, for anything but the top market rate?
The real alternative is to attack the actual problem: state overreach. Don’t attack people for using SnapChat — get them to upend the government’s subservience to intrusive law enforcement.
imho, we have everything in the foss world working tightly except great UX/UI. in my experience in the open source world – which is not insignificant – great UX is the only thing stopping us from a paradigm shift to actual tech liberation.
even outside of corporate funded work/commits, we see an astounding number of people donating incredible amounts of their time towards great quality code. but we still thoroughly lack great UX/UI.
i’m not talking about “good”, we have some projects with “good” UX, but very very few with great.
there are many reasons and I’d be happy to share what some of them are, but in my mind great UX is unquestionably one of two primary things holding us back from actual truly viable software liberation.
How could this be argued?
All millions of them at the same time?
You'd only need a few important ones, and all you'd have to do is compromise them in one way or another. This can be done via coercion, via money, or by physically or virtually breaking into their system(s).
For example, if money can be an incentive, you can stimulate a FOSS dev to add a NOBUS vulnerability in code. Also, since all the code is public, organizations like NSA can do in-house fuzzing, keeping the findings to themselves.
Independent audits should help against backdoors. Again, the FLOSS nature of software and huge number of developers are essential here.
Here's the hope: the tech workers doing it for 'free' because they're scratching their own itch. So it would not be an act of onerous charity. The techies make some free open source decentralised clone of Reddit, say, then some folks among knitting communities, origami enthusiasts, parents groups, etc. copy it for free and pay to run it on their own hardware.
Now any person who owns an Android is a potential predator. Also, if you are trying to jailbreak your iPhone, you are a potential predator.
Of course, they won't be shown photos of victims of brutal dictatorships like Russia, Belarus, China, etc. They love it that phone manufacturer keeps their phone free of malware.
They love it that phone manufacturer tells their phone free of malware.
Fixed that for you. See: Pegasus.
Congratz, investigations got a bit harder, but now all people have to life with a tool that will be used against them when needed. No sane person can believe that this isn't used for other "crimes" (how ever those are defined) tomorrow.
The only thing that's changed here is that there is more encryption around, and so legal guidelines are being written to facilitate this, which has been happening for a long, long time.
(I don't disagree with your overall point, and child porn is definitely the thin edge of the wedge, but this isn't new and presumably shouldn't be too surprising for any current/former megacorp as they all have systems like this).
"It's been happening for a long time already, the only difference now is a 0.1 degree increase", says the frog while being boiled alive.
When I read that this shouldn't be surprising, it has an aftertaste of "Dropbox is not interesting/surprising because ftpfs+CVS have existed for well over a decade"
This has been standard practice for well over a decade amongst all big internet platforms.
Like, one can argue that regardless, people's messages should not be readable for any reason, but that's gonna be a tough one to get through a court of law.
The obvious difference here is that backdooring encryption is an all or nothing affair, which may require new thinking (it definitely does).
But the ship around this particular form of backdooring has most definitely sailed.
Like, the only reason Apple is new to this game is because they haven't been in the storage/media sharing business for as long as their competitors.
> 1) You willingly delegated the decision of what code is allowed to run on your devices to the manufacturer (2009). Smart voices warned you of today's present even then.
99% of the population will delegate the decision of what code is allowed to run to someone, be it the manufacturer, the government, some guy on the Internet or whatever. For that 99% of the population, by the way, it's actually more beneficial to have restrictions on what software can be installed to avoid malware.
> 2) You willingly got yourself irrevocably vendor-locked by participating in their closed social networks, so that it's almost impossible to leave (2006).
"Impossible to leave" is not a matter of closed or open, but it's a matter of social networks in general. You could make Facebook free software and its problems wouldn't disappear.
Not to mention that, again, 99% of people will get vendor-locked because in the end nobody wants to run their own instance of a federated social network.
> You willingly switched over essentially all human communication to said social networks, despite the obvious warning signs. (2006-2021)
Yes, it's been years since I talked someone face to face or on the phone and I cannot send letters anymore.
> 4) Finally you showed no resistance to these private companies when they started deciding what content should be allowed or banned, even when it got purely political (2020).
No resistance? I mean, it's been quite a lot of discussion and pushback on social networks for their decisions on content. Things move slow, but "no resistance" is quite the understatement.
> Now they're getting more brazen. And why shouldn't they? You'll obey.
Is this Mr. Robot talking now?
But now more seriously, in December the European Electronic Communications Code comes into effect, and while it's true that there's a temporary derogation that allows these CSAM scanners, there's quite a big debate around it and things will change.
The main problem with privacy and computer control is a collective one that must be solved through laws. Thinking that individual action and free software will solve it is completely utopic. A majority of the people will delegate control over their computing devices to another entity because most people don't have both knowledge and time to do it, and that entity will always have the option to go rogue. And, unfortunately, regulation takes time.
Anyways, one should wonder why, after all these years of these kinds of smug messages, we're in this situation. Maybe the solutions and the way of communicating the problems is wrong, you know.
>99% of the population will delegate the decision of what code is allowed to run to someone, be it the manufacturer, the government, some guy on the Internet or whatever. For that 99% of the population, by the way, it's actually more beneficial to have restrictions on what software can be installed to avoid malware
I do not agree with this. You are saying people are too stupid to make decisions and that is amoral in my opinion.
>"Impossible to leave" is not a matter of closed or open, but it's a matter of social networks in general. You could make Facebook free software and its problems wouldn't disappear.
Data portability is a thing. This was the original problem with FB and thats how we got 'takeout'.
>Yes, it's been years since I talked someone face to face or on the phone and I cannot send letters anymore.
>Is this Mr. Robot talking now?
Using the extreme in arguments is dishonest. We are talking on HN where it is a selective group of like minded people(bubble). How does your delivery driver communicate with their social circles? Or anyone that services you? You will find different technical solutions are used as you move up and down the social hierarchy.
>The main problem with privacy and computer control is a collective one that must be solved through laws.
Technology moves faster than what any law maker can create. We do not need more laws as technology advances but rather an enforcement of personal rights and protections enabling users to be aware of what is happening. It appears you are stating "people aren't smart enough to control their devices" and "We need laws to govern people" vs my argument that "people should be given the freedom to chose" and "existing laws should be enforced and policy makers should protect citizens with informed consent".
> I do not agree with this. You are saying people are too stupid to make decisions and that is amoral in my opinion.
How much of the code running on your data do you personally inspect? (Don’t forget device firmware) When your browser ships an update, do you reverse-engineer the binary? Do you review all of the open source code you use looking for back doors?
Would it be accurate to say that you don’t do that because you’re stupid? I don’t think that’s reasonable, any more than it would be to say you should carry around a test kit for any food you are planning to buy at the supermarket.
> Technology moves faster than what any law maker can create.
This is a common claim but it’s too simplistic. Laws do get passed relatively quickly when there’s a clear need - think about how things like section 230 arrived relatively soon after the rise of the web - but in most cases it’s more a clarification of existing laws. For example, cryptocurrency wasn’t mentioned in previous laws by name but the IRS had no trouble taxing it under existing laws.
Privacy shows why the “just let people choose” approach doesn’t work: you the individual have no negotiating clout with Facebook or Google, and there are many cases like revenge porn where the problem is only visible after the decision has been made.
Laws are how societies agree to function. If you don’t like the laws, you need to get involved because there simply isn’t a way to get good results by demanding that the system accommodate people who don’t show up.
> I do not agree with this. You are saying people are too stupid to make decisions and that is amoral in my opinion.
No, it's just saying that most people have other priorities. If you want to make the world a better place, educate more people so that their priorities change towards caring more about the software that runs on their devices, instead of attacking people with weird non-sequiturs.
I'm not saying that at all. I'm saying that it's impossible for all people to make informed decisions on all the issues that surround them, because of both knowledge and time. And it doesn't just happen with computer and privacy, see food, for example. Do you make all decisions about what's allowed or not in your food chain? It's impossible! Unless you dedicate quite a lot of time to it, you can't know if certain foods have certain ingredients, and whether those are harmful or not. That's why we have regulation on food. We trust that regulation because we need to do more things than just worrying constantly about our food.
In the same way, most people delegate control on what can run on their device because they don't have the time or knowledge to inspect constantly what is running on their devices.
> Data portability is a thing. This was the original problem with FB and thats how we got 'takeout'.
And did takeout solve any problems? No, because it's not a technical issue.
> Using the extreme in arguments is dishonest. We are talking on HN where it is a selective group of like minded people(bubble). How does your delivery driver communicate with their social circles? Or anyone that services you?
The GP used the extreme by saying that "essentially all human communication" has been moved to social networks.
But yes, we do agree that HN is not the real world. So I'd love to know what were the warning signs to people like a delivery driver, or basically anyone that wasn't active in computer circles. Not to mention that, before, social networks, most communication was done through channels controlled by third parties (phone, letters, television). From a non-technical standpoint, things didn't change that much.
> We do not need more laws as technology advances but rather an enforcement of personal rights and protections enabling users to be aware of what is happening.
"Enforcement" is done through laws and regulations.
> It appears you are stating "people aren't smart enough to control their devices" and "We need laws to govern people"
I'm not saying that at all. I'm saying that people shouldn't need to invest a significant amount of time constantly verifying that their devices and networks are doing what they say they are doing, and that laws and regulations should be applied to corporations instead so that people can reasonably trust that the ones offering those devices and networks are doing things somewhat correctly.
And again, this has been done already with quite a lot of things. There are regulations for cars, food, furniture, clothes... Not because people aren't smart to control what they use, but because it's impossible for any one person to have the time and knowledge to control everything that they use.
Imagine applying your argument when talking about, say, carcinogenic substances on food. You could argue that the best way to fight that is for people to grow their own food and check that their food doesn't contain those substances, or trust that some company that sells them food is doing it for them. Or, you could push for regulation and organisms that ensure that those substances don't make their way into the food chain.
Well, this is the same. Most people have other things to do instead of learning to ensure that their devices are secure and private and then checking that for everything they get their hands on. You need regulations so that there's a consensus on what can you expect, and then enforcement so that the products you get actually comply with those regulations.
The suggestion is not that people need to continually invest large amounts of time to manually verify their freedom is being upheld. It is that they should inform themselves once in order to understand the issue and be able to ensure their governments are not secretly becoming totalitarian states.
I'd bet that most people in HN live in democracies.
> Who will put pressure on governments to formulate just laws if people are so hopelessly misinformed and cannot possibly take the time to understand the issue of being parted with their freedom?
You don't need to know biochemistry and medicine to know that you don't want carcinogenic elements in your food, right? In the same sense, you don't need to know how to check that a channel is private and secure in order to push for regulations that make your communication channels secure.
>It is that they should inform themselves once in order to understand the issue and be able to ensure their governments are not secretly becoming totalitarian states.
Which is exactly the same thing I'm proposing: push for regulations that align with their interests.
Yes, but you need to be able to conceive what cancer is and (roughly) how and why it appears in order to understand and fight the concept of carcinogens. Most people today still haven't realized the cancer and the carcinogens in the story of privacy. This is despite the fact that this was widely known in a prior time (see Stasi).
> Which is exactly the same thing I'm proposing: push for regulations that align with their interests.
Yes, except it's not happening because people are complacent, which is why people are fuming when they see stuff like this here.
I pretty much agree with you. That said, the position that this particular issue is one in which regulations can save us is naive. The basic political reality is that the very people/organizations which are pushing for further encroachments on our rights and destruction of our privacy as people are the same people and organizations responsible for regulating the companies which offer us these services, software, and devices. When you live in a world with blatantly malicious state actors (the US Government) pressuring and demanding these encroachments as an end-run around existing regulations (the Fourth Amendment of the US Constitution), whom exactly is supposed to create and enforce these privacy regulations?
Not true. If you have interoperability between different networks, you can leave. This is how ActivityPub (e.g. Mastodon, PeerTube, PixelFed) works.
> Not to mention that, again, 99% of people will get vendor-locked because in the end nobody wants to run their own instance of a federated social network.
You just switch to any other instance, because Mastodon doesn't prevent you from doing that.
> The main problem with privacy and computer control is a collective one that must be solved through laws. Thinking that individual action and free software will solve it is completely utopic.
We need both. You cannot force Facebook to allow interoperability when there is no other social network.
If all your friends are in a Mastodon instance and you think that instance is scanning your messages, you'll find it hard to leave because leaving the instance for another that doesn't share messages with that one means stopping communication with your friends.
> You just switch to any other instance, because Mastodon doesn't prevent you from doing that.
Controlled by another third party. Not to mention that, with enough users, there will be feature divergence so "switching" won't be that easy.
Want a real world example? See email. Open protocol with multiple client-server implementations. However, most people use one of the major providers (Google, Microsoft...), there are incompatibilities between clients and even if you "can switch", it's not that easy nor gets done often. Yes, you can switch to ProtonMail or something more secure if you want, but that won't solve the problems of the 99% of people that will use general providers and won't even know they can't switch.
> We need both. You cannot force Facebook to allow interoperability when there is no other social network.
Right now you could force Facebook to be interoperable and be open source and still 99% of the people would be on the original Facebook instance. Again, it's not a technical issue.
Everything is controlled by a third party except self-hosting. Mastodon allows that too. Closed networks don't.
> Yes, you can switch to ProtonMail or something more secure if you want
So you answered your own question.
> but that won't solve the problems of the 99% of people that will use general providers and won't even know they can't switch.
My point is that they are able to switch due to the openness of the platform.
> Right now you could force Facebook to be interoperable and be open source and still 99% of the people would be on the original Facebook instance. Again, it's not a technical issue.
Yes. It's not just a technical problem. But there is a technical side in it. Millions will immediately switch given a possibility. What happens next, who knows.
And my point is that most won't, and the ones that do will still go to another platform that's controlled by another third party and they'll still need to rust that the platform is not doing things they don't like.
> Millions will immediately switch given a possibility.
Switch to where? To another company that could do weird things out of the eyes of the users? Do you think all of those millions are going to run their self-hosted Facebook?
My point is that privacy and security is not something that will be solved by federation or open source. For open source and federation to be useful in that regard, you need most people to actively research and check that the tools that they use are private and secure. If they don't, they're just trusting someone the same way they trust Facebook now. And most people (that includes most people here on HN) don't have both the time and knowledge to do those checks.
In other words, this is a collective issue. Trying to solve collective issues by individual choices is not the best path.
I disagree. Here's why:
> For open source and federation to be useful in that regard, you need most people to actively research and check that the tools that they use are private and secure.
This is the key point. You do not need most people. You need some people. And you can always find some people who verify everything and self-host for you. This is how Signal and Matrix appeared and became (relatively) famous.
And what happens when another app comes and says that "it's secure" and people start using it instead of Signal or Matrix? What happens if Signal starts requiring some payments (running servers is not free) and people move to other apps? Maybe those other apps are open source and federated, but the federation protocol is found later to have a backdoor, or some instances run data mining on the messages, or something like that. Who will be faster, the users flocking to those apps or the few number of verifiers getting to work and detecting those issues?
If you want most apps to be like Signal or Matrix, the solution is easy: push for legislation and certifications that ensure that, no matter the app, a certain level of security and privacy is enforced. It's not perfect, but it's far better than just relying on trusting that some people invest a lot of time on that research.
First, early adopters come and verify it. They bring their friends. If it's really secure and they find no serious bugs, more people join. Then, a bridge is created between the services.
> What happens if Signal starts requiring some payments (running servers is not free) and people move to other apps?
This is a problem with a non-federated protocol actively fighting against third-party apps and servers. It will definitely happen with Signal in this way, which is why I'm not using it and not recommending.
> Maybe those other apps are open source and federated, but the federation protocol is found later to have a backdoor, or some instances run data mining on the messages, or something like that.
Such backdoor will be quick and easy to fix, and to verify that it's fixed. Unlike with Apple's Pegasus. No system is ever 100% secure.
> Who will be faster, the users flocking to those apps or the few number of verifiers getting to work and detecting those issues?
Users are typically very slow to move. See Whatsapp & Facebook. But what's your point?
> If you want most apps to be like Signal or Matrix, the solution is easy: push for legislation and certifications that ensure that, no matter the app, a certain level of security and privacy is enforced.
This is definitely an important thing to do, but it's not enough. There is such legislation already in Europe: GDPR. Unfortunately it cannot dramatically change the industry quickly, because of the monopolies and network effects.
That's quite the optimistic path. What if the app starts being used by teenagers, for example? Or by people with less technical abilities?
> This is a problem with a non-federated protocol actively fighting against third-party apps and servers.
Federated services still need to pay for their servers.
> Such backdoor will be quick and easy to fix
Again, pretty optimistic on that.
> and to verify that it's fixed. Unlike with Apple's Pegasus. No system is ever 100% secure.
Pegasus was external malware. What makes you think a Pegasus for federated servers or open source phones can't exist?
> Users are typically very slow to move. See Whatsapp & Facebook. But what's your point?
Security research takes time, probably more time than users need to move from apps.
> There is such legislation already in Europe: GDPR.
And GDPR has accomplished way more in way less time than technical solutions. I wonder why.
> Unfortunately it cannot dramatically change the industry quickly, because of the monopolies and network effects.
Don't those monopolies and network effects affect the technical solutions you propose too?
My point is that of course you need good technical solutions, but just those by themselves are useless, because most people don't have the time and knowledge to reliably distinguish which ones are good and which ones are bad (and "good" and "bad" are relative too), and other differential features (price, capabilities, ease of use) that are easier to notice will weigh more on their decisions.
This is not a problem unique to tech and privacy. Food security, climate, building safety... almost everything you buy has had the similar issue of how to have "things done right" where deciding whether it's done right or not is hard for most people. Almost everything has been solved (or almost solved) with regulation, and just "better products" haven't been enough.
Truth is even if our tools evolve, our chains evolve faster.
https://link.springer.com/chapter/10.1057/9780230298125_11
Signals intelligence intercept and analysis centres have been called Black Chambers for a long time, including the first such group in the US, predecessor to the NSA:
Instead, we as a collective decided to offload these tasks to the government and make broad decisions through voting. This allows us to focus on other things (at work, with our actual job, at home, you can focus with what matters for you, whatever that might be).
For instance, I tried to avoid Facebook for a while and it was working well, I just missed few acquaintances but could keep in touch with the people who matter for me. Then suddenly they acquired Whatsapp. What am I to do? Ask my grandmother and everyone in between to switch to Telegram? Instead, I'm quite happy as a European about the GDPR and how the EU is regulating companies in these regards. It's definitely not yet there, but IMHO we are going in the right direction.
The RSA-155 Challenge (512 bits) was not beaten until 1999.
Then they came for the Socialists. And I did not speak out Because I was not a Socialist
Then they came for the trade unionists And I did not speak out Because I was not a trade unionist
Then they came for the Jews. And I did not speak out Because I was not a Jew
Then they came for me. And there was no one left To speak out for me
(2) and (3) are bad, but a tangential bad to this: it’s no good having an untainted chat layer if it’s running on an imperfect — anywhere from hostile to merely lowest-bidder solution — OS. (And most of the problems we find in software have been closer to the later than the former).
(4) for all their problems, the American ones held off doing that until there was an attempted coup, having previously resisted blocking Trump despite him repeatedly and demonstrably violating their terms.
1) You willingly delegated the decision of what code is allowed to run on your devices to the manufacturer (2009). Smart voices warned you of today's present even then.
2) You willingly got yourself irrevocably vendor-locked by participating in their closed social networks, so that it's almost impossible to leave (2006).
3) You willingly switched over essentially all human communication to said social networks, despite the obvious warning signs. (2006-2021)
4) Finally you showed no resistance to these private companies when they started deciding what content should be allowed or banned, even when it got purely political (2020).
Now they're getting more brazen. And why shouldn't they? You'll obey.