Comment by nonrandomstring | Hacker News Reader

Comment by nonrandomstring | Hacker News Reader

nonrandomstring

This seems an intractable mess.

- Our phone hardware and operating systems are intrinsically insecure.

- There is no practical/effective data gathering regulation (and I'm not sure it's possible to craft any without destroying innovation)

- All social media companies are doing it, leading to jeers of "hypocrisy!"

- All governments play the same games, reducing the arguments to "Whose side are you on?" That's effectively meaningless in a globalised world. The consequence is more nationalism and an ever more fragmented splinternet.

- The only proposed solutions amount to more authoritarian, controlling and regulatory responses.

What can we do?

There is a solution. Stop protecting these companies. Burn down WIPO. Tear up practically all "intellectual property" laws. Revoke millions of patents. Repeal all DCMA type laws regarding reverse engineering. Kick trademark and brand protection law to the curb.

The real problem is gargantuan monolithic, captive audiences that exist because incumbent monopolies enjoy protectionist measures that amount to a giant international trade racket.

Creating a real market that forces radical interoperability would solve many of the problems we see today. Who would care about TiKToK or Facebook if they were one of 500,000 small "Social Apps" that connected to a standardised international network.

Hell, we could even give it a catchy name, like "The Internet".

I disagree with weakening trademarks. It's important for people to know who made the stuff they're getting.

I agree with your argument, but not your conclusion. It is important for people to know who made the stuff they're getting. Signing code is a perfect example. Unfortunately I think "trademarks" are a 20th century idea. There are many ways of supporting authenticity of provenance that aren't easily corrupted and weaponised as a way to stymie competition.

> There is no practical/effective data gathering regulation (and I'm not sure it's possible to craft any without destroying innovation)

Yes there is: Don't

Anything that is not fully and obviously intentionally completely public is e2ee and inaccessible outside of the user's device. Information that is provably necessary for providing a paid service can be collected and kept until the second it is no longer necessary so long as the process is publicly documented. Any weights, faux anonymized data or similar derived from the pii must also be deleted.

I think that's far to vague to be workable and sounds incredibly expensive (unless everyone uses those loopholes).

Storing data on user's devices isn't great, it takes up storage space (adding cost) and relies on the user to manage the backups (which lots of folks don't do). Users also switch between devices, so you'd need some sort of cross-device syncing or something.

e2ee implies that the data can only be decrypted by the user's key. If the user loses their key, they lose data access. Since keys are user managed you need to deal with user support/education and build interfaces to support key management. e2ee isn't something you can bolt on an existing system. This sounds quite expensive to implement, so you'll shift significant funds away from other development (destroying innovation).

If today I'm running a Django site that allows users to message each other, do I need to change from my server-side template rendered system to a client-side rendered system?

For loop holes, I'd expect people to claim that they can't rely on device storage, need to support multiple devices, need to support customers who can't manage keys, perform heavy-weight rendering that would consume too much device battery and run slowly, etc.

These ideas are very 2020s focused. As the software industry evolves, would we need to convince politicians to allow us to use better technology that challenges assumptions we have today?

For messaging, Matrix has solved almost all of the problems you're claiming are insurmountable. Key management can be assisted with m out of n type secret sharing, or we just treat people like responsible adults, and if they lose their keys, then tough, those messages are gone now.

For loopholes, the solution is to just not believe the bullshit. Have a very high standard of evidence required and/or require fully informing the user of exactly what is stored, where it is stored, who can access it, and publicly sharing all code that touches it.

It's been proven over and over again that the current model does not work and that the people in charge are narcassistic children who cannot be trusted and lie constantly.

The GDPR is a half measure designed as much around enabling surveillance as safeguarding privacy. Anonymisation is a blatant lie. 'Innovation' is just a codeword for doing the same things we did before but worse.

Not insurmountable, just very expensive. You're describing a worse user experience too.

Matrix probably isn't a good example. That's an impressive project with great developers. Most companies don't have equivalent staff, nor the budget to hire.

> publicly sharing all code that touches it

That's a huge request.

If an industry has proven repeatedly they can't be trusted not to stalk people and lie about it followed by being recklessly irresponsible with data and lying about breaches, then it's the bare minimum that should be enforced.

It would also encourage the innovation that you're so keen on because users wouldn't be trapped and you couldn't sit on one feature forever. You'd have to have an ongoing value proposition like every other vocation in all of history.

I agree something should be done, but strongly disagree with this specific approach.

Is profiting from my data not a huge reward for such an effort?

Sadly none of this is doable in the current version of capitalism (and in pretty much every country that is drinking from it). Corporation interests, especially those of large corporations, override pretty much everything else.

Please elaborate on what other "version of capitalism" is necessary.

Hope we are not advocating that everything be owned by the state, as if that would allow more competition.

Please be more creative than your assumption that trying to do better than capitalism means everything becomes state-owned. Markets have value, capitalism is materially different from a market economy.

This is a low-value comment that doesn't add any value to the conversation. GP explicitly asked "Please elaborate on what other "version of capitalism" is necessary." which this comment does not attempt to answer, the language used here is unnecessarily abrasive, and the "assumption" this comment claims was made by GP doesn't actually exist.

Except, interestingly, in the bad guy of this story, China, where overcritical capitalists are regularly submitted to the state.

Will be interesting to see which loadout is more functional long term, China’s or the USA’s.

What exactly do you mean by "capitalism" here?

I think they're indicating that both Google and Apple will have sufficient motivation to weaken the security of their devices as long as there's money involved with it. With the combination of corporate interest and a lack of accountable oversight, it can be plainly assumed that all of FAANG is an equally dangerous domestic security risk.

Reply on news.ycombinator.com