Moxie Marlinspike on 17 Mar 2026
1,035 karma · joined September 23, 2014
I suspect inequality and wealth transfer explains much more of the observed trends than the author acknowledges at the end. In each of the verticals discussed, there have been strong (albeit sometimes less obvious) trends for consolidation among institutions and organizations. This includes companies, government contractors, and even vendors in ecosystems we tend to think of as decentralized like local schools, where significant consolidation might be occurring over time at the level of food suppliers like Aramark, utility companies, or diesel fuel suppliers for school buses.
These organizations' compensation and capital structures, in turn, likely grew increasingly unequal over time. Stockholders, stakeholders like executives, and intermediaries like insurance companies in those organizations likely extracted more and more capital relative to traditional stakeholders like the college students, physicians, and teachers addressed in the post.
Wealth transfer from traditional stakeholders (college students, physicians, teachers) to organizational stakeholders (execs, stockholders, suppliers in consolidating markets) seems like both a cause and a consequence of the 'cost disease' discussed in the post.
Gladwell's uninformed gee-whiz speculation seems like an excuse to parrot the claim that Snowden "may have been the dupe of a foreign-intelligence service" without mentioning any evidence or even a clear argument beyond its appearance in a book. Maybe Snowden was that or worse, but the only argument Gladwell seems to construct to support the claim is that he was a dupe/fool because he didn't go Harvard like Ellsberg.
Another potentially self-serving issue that Gladwell conveniently glosses over in this piece: We could also make the argument that Ellsberg also had a much more effective and courageous press and educated population behind him. But it's easier to smear community college drop-outs and discuss a hypothetical "Edward Snowberg" than a hypothetical New Yorker with more reporters like Jane Mayer than commentators like Gladwell.
My argument was that Gladwell is painting a cheap caricature of a "hacker" when it's both easy and reasonable to interpret a quote like the one above in the broader context of the full speech/event and the dozens of others that he's given in recent years.
I'm not trying to argue that Snowden has or doesn't have respect for governing institutions. I think that's Snowden's story to tell. But my read of the piece is that Gladwell reached some "clever" sounding conclusion - perhaps in a "blink" - and then found a quote that supported his narrative, which reads more like Harvard-worship in Ellsberg's favor than careful presentation of arguments/evidence. This strikes me as misleading and dishonest in light of the sheer volume of interviews, tweets, etc. from Snowden that (at least to me) paint a more nuanced and careful picture.
Both were imperfect people in unique situations, but Gladwell's distinction seems to boil down to "Harvard, game theory, & Nobel prize winning PhD advisor" in the case of Ellsberg vs. "community-college dropout" in the case of Snowden, followed by Gladwell falling over himself to redefine "insider" right after spelling it out in detail with the language of class, prestige, and societal privilege.
I don't think Gladwell understands enough about either person - or "leaks" in general - to draw meaningful conclusions.
Gladwell's process serves well enough as a lazy caricature for the piece but doesn't represent a good-faith articulation of his subject's views, which is hard to excuse in light of the dozens of events, thousands of tweets, etc. that are much more accessible than Ellsberg material was decades ago.
Gladwell could have interviewed Snowden and Ellsberg but probably chose not to, perhaps because it was easier to trash-talk someone whose life is under threat at an especially sensitive time (pardon consideration) for a "clever" contrast with Ellsberg than to try to represent his perspective in good faith.
I'm surprised Appelbaum hasn't been directly suggested as a potential source[1,2].
[0] https://securelist.com/blog/incidents/75812/the-equation-giv...
[1] http://crypto.stackexchange.com/questions/12661/what-could-l...
[2] http://www.nakedcapitalism.com/2014/01/jacob-appelbaum-30c3-...
For example, by what definition would this not be 'safe'? Do you mean in comparison to Firefox's defaults, which enable profoundly privacy-invasive tracking, hide the contents of the cookie management dialog box, and enable the delivery of malvertising at will by visiting "safe" websites - just to name a few?
MitM positions exist on the internet for all users today, both for HTTP and in the situation of "new HTTPS bugs". So you point out risks taken when using the internet in general, and the Tor Browser Bundle already mitigates many of those risks via NoScript and various patches. I've used Tor Browser Bundle daily for all purposes - including online banking and shopping - for several years with zero problems. Malicious exits exist and get flagged out of the network rapidly. Essentially all remaining risk is trivially defeated by toggling the 'block all unencrypted requests' pref in HTTPSEverywhere, which is part of the Tor Browser Bundle and could be built into an implementation in Firefox with a warning for HTTP traffic.
And you're probably thinking of 2009-era Tor network experience. For me, Tor network performance routinely boils down to ~200ms additional latency with ~1.5-2MB/s download speeds. The difference between that and an average broadband connection is barely noticeable.
I recommend using the Tor network and the Tor Browser Bundle before criticizing this idea.
But they probably also knew (from a look at their commit logs, it's pretty obvious) that the technical work could not continue without them. So it strikes me as a pragmatic compromise.
Mozilla is certainly treating the cookie management dialog box, which has been broken for years, as optional. Same with accepting Mike Perry's patches and various other examples.
If Mozilla could actually do better in terms of privacy and security features than a handful of Tor Browser Bundle devs, they wouldn't need efforts like this and their work would speak for itself. I still use Mozilla code every day and am grateful for their work, but this sort of rhetoric is unimpressive.
I doubt history will look kindly on these practices, and the story makes me even more eager to see RIM and its products in the dust bin.
Thinking of mutual colleagues of mine and how long this apparently has been happening (and to be clear, not about this or other victims) reminded me of something Larry Lessig wrote about his own abuse:
"The real evil isn’t the Hitler. The evil is the good German. The evil is all those people who could’ve just picked up the goddamn telephone and stopped it."[0]
Notably, Lewman volunteers at Transition House (http://boston.cbslocal.com/2014/10/01/technology-used-as-wea...), founded IPVTech (Intimate Partner Violence tech), and appears to work/volunteer with other organizations associated with victims of domestic and/or sexual abuse (http://wiki.lewman.is/CV#work-with-trauma-victims-including-...).
Perhaps Lewman was unaware (this seems unlikely given the DailyDot article's reporting of "mishandling" or "botching" the situation), but it would surprise me if someone with that orientation turned a blind eye to the alleged behavior.
CMU Research Ethics Reporting: https://www.cmu.edu/research-compliance/report-problem/index...
CMU Research Misconduct hotline: https://www.cmu.edu/research-compliance/research-misconduct/ or call 877-700-7050 for 'anonymous' reporting
CMU IRB contacts: https://www.cmu.edu/research-compliance/human-subject-resear...
CMU Office of the President contact page: https://www.cmu.edu/leadership/president-suresh/contact/inde...
Also of note - Ethical Tor Research Guidelines: https://blog.torproject.org/blog/ethical-tor-research-guidel...
Perhaps even more importantly, I hope this public ruling will make it more difficult for any of us to tell our grandchildren that we didn't know[0] about serious things going seriously wrong.
0. e.g. "And, at that moment, I really realised that it was no excuse that I had been so young. I could perhaps have tried to find out about things."
Your comment left the why part of my question a little ambiguous, but I'm assuming from your response that it's a combination of because everyone else is doing it, the US sort of has to in order to remain competitive because everyone else is doing it, because it's not prohibited, and because it's not in the public interest (assuming you mean US public's interest here).
I wanted to apologize for mincing your words a bit upthread - this comment makes more clear the distinctions you draw around misconduct, "legitimate" / de facto practices, and what's in the public interest.
Thanks again!
To the extent he amassed and shared with journalists the type of information you're talking about, Snowden has previously stated that he felt he needed to prove to journalists that he was an authentic source.
Your claim certainly still applies in the form of "he didn't need to do that" or "he didn't need that much material to establish bona fides" or even "he's lying" but to my knowledge, he didn't release damaging information himself.
Snowden did leak information to journalists who then decided to report on it, and I'm sympathetic to the idea that Snowden should have assumed journalists would be inclined to report on damaging information that didn't reflect misconduct. Snowden may also have made different assumptions than you do about what constitutes misconduct.
I didn't mean to imply that you had the "wrong" political view or even one that I disagreed with. It just struck me as internally inconsistent given the (apparently wrong) assumptions I'd made about your perspective from other comments on the topic over the past few years.
And of course I'm not surprised that there are lots of Americans who oppose what Snowden did, but as someone who tends to pay attention to your comments, I was surprised by one of the reasons you seemed to.
Perhaps you meant something different, but that's not how your comment reads.