I'm disappointed that Jacky Rosen (D - Nevada) is a co-sponsor. She's a former software developer and should know better.

I just watched some of the Senate hearing on Log4J and she seemed reasonably together on security, open source etc. I was feeling optimistic that she could become the Senatorial analogue to Judge Alsup[1]! But if she's on board with EARN IT, scratch that idea.

[1] https://www.theverge.com/2017/10/19/16503076/oracle-vs-googl...

Junior senator up for re-election in a marginal state. Chances are that support on this was traded behind the scenes because of party dynamics, or she thinks it will play well with her constituency (which is Nevada, not California or Oregon...).

The personal ideas and knowledge of any given politician are just a starting point for the political choices they make.

I've worked as a software developer for 8 years so far. I have yet to meet a single fellow developer who is privacy-conscious.

At my previous employer, among the 40 or so developer staff worldwide, there were only two of us who used Signal: myself (security focused backend dev) and the devops team security expert. Everyone else: just use WhatsApp so we can all communicate in the same place. Caring about privacy can be exhausting.

I believe that strong E2E encryption is critical to individual privacy, but I also believe that it doesn't really matter when most every nation state can compromise any phone at any time simply by knowing the phone number and sending a zero click SMS or MMS message to that phone.

Until laws are implemented that forbid this and/or security improves to do so, it doesn't matter how good the encryption is if it's running on a fundamentally insecure device.

It's very hard for security conscious people to attract other people to more privacy conscious platforms. People love the practicality, and don't want to trade for they can't see or understand.

I'd love to use signal, but it'd be a very silent place, and have to have WhatsApp anyway. So, instead of trying to entice others, I just try to win a one small battle at a time, reducing my cross-section step by step, where I can.

Well, Whatsapp hasn't done anything egregiously bad yet and they got a lot of goodwill/good PR from their E2E implementation vouched by Moxie et al. So what's the big issue with Whatsapp beyond that the client is not open source?

WhatsApp has already had multimillion euro fines for their privacy practices. Just because it has E2E encryption does not mean it doesn’t sell other data. A company whose business model is to sell your data is going to sell your privacy along with it.

Being open source is nice, but not required for privacy.

https://www.cnbc.com/2021/09/02/whatsapp-has-been-fined-267-...

There are a lot but it seems they slowly become a minority. Large companies priming them to be less careful with user data is an issue here.

> I'm disappointed that Jacky Rosen (D - Nevada) is a co-sponsor. She's a former software developer and should know better.

I don't know why you feel this way - IME software devs are the least likely to care about privacy.

Maybe they've been so acclimatized to being online all the time, or maybe it's because they feel that they aren't at risk.

In any event, the first people to throw away their privacy has always been software developers. Just look at how many of them use Chrome, for example. Or how many of their personal projects are tied to some proprietary tooling that, as a first action, grabs their data.

But software developers know. Surely, surely, there can't be anybody who knows, understands and still supports this stuff‽

Did you forget a /s tag...?

Most people would trade their mother for some shiny - that's why we have laws to protect from predatory behaviour. And software devs are just people, in the end.

Oh come on, I said I was "disappointed", not "outraged" or something more extreme.

But yes, I think that understanding helps, and Judge Alsup, whose programming background informed a sane ruling on copyright and APIs in Oracle vs. Google, is exhibit A.

Alright so here's a question: what makes you think that your (presumably) armchair understanding of the bill in question is better than hers?

They had senate hearings for log4j?

Specifically a Homeland Security & Governmental Affairs Committee hearing.

Here you go!

> Senate HSGAC Hearing on the Log4Shell Vulnerability

https://www.youtube.com/watch?v=iTgTe5HBYvg

Pretty even split down the aisle on this one. Which in this case is a bad thing.

I actually see it as hopeful.

If this were polarized, it would mean that no senator could risk offending their base by opposing it. They wouldn't budge in the face of popular outrage.

Since it's bipartisan, it means neither party's base badly wants it to pass (which we would already suspect from our own personal experiences).

I'd say this is actually pretty partisan if you ignore the mostly imaginary lines between the parties and think in terms of establishment vs. non-establishment.

Yup, a lot of heavy hitters in there too.