Comment by drdaeman | Hacker News Reader

Comment by drdaeman | Hacker News Reader

Careful with this stuff. It looks nice, but it may bite.

The "states shall not impose any obligations" is a great thing, but "shall ensure that ... guaranteed ..." isn't so much. Your Parliament basically tells you how to write your software, and while this particular cause may be good[1] - the general concept isn't healthy.

Granting governing bodies this level of control... that must require exceptional levels of trust in those bodies and all future ones that could be their successors. I'd argue that it's better to have the very contrary thing - a ruling that no governing body may ever dictate how one can secure their communications and how they can't (or, in more general terms - how one can write their software). Oh, and keep the "states shall not impose" clause, of course.

Yes, that leaves data-miners with their messengers still vulnerable, but I think it's less important than a general non-interference principle. And I'm for having fines for calling non-E2E messengers "secure" if the wording may confuse user into thinking it's E2E - that's basically misadvertising. The issue is information gap and "clever" marketing - fix that and things will be good.

_____

[1] It may be a problem for early prototypes, if they had started with UI/UX and a simple insecure "TCP socket server"-level stub for the messaging layer. Mandatory implementations are always a barrier.

>Your Parliament basically tells you how to write your software

Buildings have strict construction codes, and this improves the overall quality of buildings. If developing software is to be more like other professions, it should strive to move in this direction

Other professions? I don't think all professions should strive to get more and more regulated. On the contrary, I'm sure that some shouldn't. For example, if government starts messing with artistic expression (painters, graphic designers, musicians, typographers and many other professions) - that would be a disaster. Same goes for most scientific research, with exceptions for hazardous and dangerous facilities. That were all obvious cases, of course, but I'm sure there are more examples, I just need to think about it (and I'm slow).

As many other regulations, construction codes are there, because otherwise unrelated people lose property, get injured or even die. A building may deprive neighbors from enough sunlight, and that is unhealthy, so there are standards for insolation. A badly done electrical wiring can overload or short circuit - and the fire doesn't know about property ownership and jumps onto the neighborhood.

In a imaginary scenario, if one's on their own land, with no one else around (and no woods to burn, no basins to pollute, etc etc) - I don't think mandatory state building codes would make any sense. And in the virtual space, things are frequently just like that - if something goes kaboom, it only impacts that system. Of course, some exceptions apply (NTP DDoS amplifiers, misconfigured MTAs or hacked websites abused for spam, etc).

And I think IM apps are very different from housing. Usually, compromised communications do not have any impact on third parties. And when they do there are usually provisions for that, e.g. HIPAA.

>if something goes kaboom, it only impacts that system

And its users. Unless you're the one living in the house (in which case I agree, do whatever you want) there has to be a certain guaranteed safety so the roof doesn't fall down on its tenants. I don't want to be a civil engineering expert to choose the place where I live; I expect the plumbing to work and the electricity to be safe. Likewise, a software user shouldn't have to be an expert in order to get safe software.

Most commercial software products aren't pieces of art, they are pieces of engineering like cars and bridges, and should behave as such

(Of course, there is software that is more akin to pieces of art; videogames come to mind. Even then, they shouldn't compromise the privacy of unsuspecting users)

> And its users

Users are part of that system. If the system in centralized - it's a bus, not a car - if it crashes, everyone get injured. (BTW, should EP mandate distributed architecture or 6-nines SLAs? Reliability is as important as confidentiality.) The real problem is not that communications aren't encrypted or something. It's that users aren't aware what they get and what they don't.

> I don't want to be a civil engineering expert

Neither do I. But regarding software - I don't need to be an expert to hear "we can't access your messages even if we would want to". Why need government for that? And why make it mandatory? I just don't see your point except for analogies with other professions. What's the point of programming being like car manufacturing?

Personally, I want to be informed but free to chose whatever fits my requirements. That doesn't work well for buildings and cars (for the reasons I've mentioned in the parent comment), but that works very well for software. Non-mandatory certifications and attestations works just fine - e.g. we have IM software audited.

Interventions may be necessary if no one builds E2E messengers (assuming there is a demand - and there is), or all existing software is unusable. But I don't think the communications software market is that unhealthy.

And as I've said before, if someone advertises something as e.g. "100% secure" or "we can't read your messages" but it's false - that's basically a misadvertising.

But isn't this the same issue with Net Neutrality regulations? We're asking the state to enforce net neutrality, but it opens a can of worms. Tomorrow it would be "all data should be treated equally, except for govt data which should be prioritized above all." "All data should be treated equally, except for terrorist data, which should be prioritized/blocked".

This is true of any government at all. "We're asking them to arrest murderers, but what's next, arresting suspected communists?" Well, maybe, depends who you elect. Every government power can potentially be abused.

It is. And this is controversial statement but I'm really not sure how I feel about Net Neutrality.

Where I'm from (Russia), we had (and still have, to a some extent) a lot of competition in ISP space. This had happened just because government weren't particularly looking at that direction at the time (90s and early 2000s).

If one ISP did some weird stuff that upset customers, the market had actually worked and they lost profits, making them reconsider. This may sound weird, but that really was like that - "power" users were vocal, and word of mouth did spread fast. And absence of NN allowed ISPs to do things that were actually beneficial to the customers, like routing specific traffic differently so e.g. gaming would be smoother and files would download faster. Just because content customers meant good reputation - a stable userbase with steady growth. So I don't believe NN is a good idea if the market's right. It only makes sense if it's bad, with a few giant telcos and no competition.

[Edit: ignore this paragraph, please. I'm keeping it, but indeed it's a long stretch.] When the government decided they're going to get a grip on the tubes, things immediately got worse. No NN here, though, just censorship - a great pile of unsound kludges with mandatory monitoring and automatic fines if something goes through. But NN here would've killed tiniest ISPs just as well.

That's just how I see things. It very well could be that I'm mistaken here.

I appreciate the well-thought-out counter perspective. Do you still live in Russia and do you still feel the same way? If you had to put yourself into the shoes of a US voter, how would you feel?

Thanks.

Yes, I still do, and feel the same way.

I don't yet feel that I understand US realities well enough to be able to have a proper, informed opinion. Still, from what I've heard, there is very limited competition in a lot of areas, when there are essentially mono- and duopolies. In that case, NN may be beneficial, as it acts as a safeguard, as consumers can't vote with their feet. If things are really bad, I think I'd be for NN, but I'd really prefer there'd be some "this must be carefully reviewed in 4-5 years" clause. Otherwise... I'm not really sure, sorry. But, either way, I'd support those who seek to improve ways for new ISPs to start up and grow, as I've heard the entry barriers are very high in the US.

I got selected in DV 2018 lottery so, hopefully, if I'll get a visa approval, I will have to form a proper first-hand opinion in some years. :)

>I got selected in DV 2018 lottery

Congrats!

I don't think it is easy to compare how censorship works in Russia with how Net Neutrality would work in the US (or some other country) it is comparing apples to eggs.

Of course. Where they're comparable is that both are government-mandated interventions. Censorship... Yes, now I think I shouldn't have mentioned that, and omitted previous-to-last paragraph. Sorry about this.

My overall point was unrelated to what the current government does, though - it was that absence of NN can be beneficial - but only if there is a lot of competition, so when not being neutral doesn't help customers but hurts them, there is a proper feedback loop that makes ISP either have losses or reconsider.

> If one ISP did some weird stuff that upset customers, the market had actually worked and they lost profits, making them reconsider

The problem in the US is the telecoms are divided across neighborhoods in a way that you don't get a choice. I only have the option of Comcast at my apartment building, it's that or no internet / use a 4G hotspot / satellite maybe? My parents house is similar, AT&T offers internet, Comcast only offers it as a package with cable tv. Both just began offering maximum rates of 30Mbps down / 6Mbps up this year! And this is in the suburb of a major city.

So when my ISP pulls crap, raises prices, or does something else I disagree with, I can't just change providers without also making several lifestyle changes.

Reply on news.ycombinator.com