Neofeudalism and the Digital Manor

https://locusmag.com/2021/01/cory-doctorow-neofeudalism-and-the-digital-manor/

by walterbell • 6 years ago

288 235 6 years ago

jl65• 6 years ago

The chaos and banditry is caused by software churn. Nothing is ever finished, so nothing is ever secure, so you must ally yourself with a powerful warlord.

This is why I am in the process of migrating my website from HTML to PDF/A.

mwcampbell• 6 years ago

This is why I am in the process of migrating my website from HTML to PDF/A.

With tags for accessibility, I hope.

jl65• 6 years ago

Yes. I use LibreOffice Writer to export Tagged PDF/A-2b.

mxuribe• 6 years ago

...migrating my website from HTML to PDF/A.

I'm genuinely curious as to how having an online presence (like a website) implemented as PDF is advantageous? Do PDFs offer some security or authenticity of content that html lacks? Not bashing, really just want to learn.

baud147258• 6 years ago

I think the idea of using PDF/A is that you only have to maintain a single file that contains all the content, without external dependencies like pictures or fonts. It also supports ways to sign the file, to protect its integrity. At least it's how I understand it.

Edit: following the link on the parent's profile, there's a few explanations (in https://www.lab6.com/0):

"""

PDF makes a stand against the churn.

I’m publishing this document in PDF because:

- PDFs are self-contained and offlineable

- PDFs are files.

- PDFs are decentralised.

- PDFs are discoverable.

- PDFs are independent of browsers

- PDFs and a PDF tool ecosystem exist today

- PDF is an open standard

- PDFs are part of the web

- PDFs are page-oriented

"""

(abridged for readability, each of the bullet points are expanded in the document)

jl65• 6 years ago

Thank you to the sibling content for quoting the headlines from my polemic, but yes, validated PDF/A is guaranteed to contain only static content with no tracking malfeatures and a vastly reduced attack surface compared to HTML5.

It’s hilariously impractical if your goal is to build a web application, so a direct comparison to HTML5 isn’t fair, but if you just want to publish information, PDF/A is state of the art.

api• 6 years ago

This is a really good point. The endless and often needless churn in software creates a treadmill effect, making it really hard for open source and smaller companies to keep up. It inherently favors large players with deep pockets able to employ vast numbers of developers.

ericwood• 6 years ago

This confuses me; the core of HTML is relatively unchanged since its inception and static HTML is fairly secure. PDF is notoriously complex and has had many security issues associated with it as a result. Regardless, if it's content you're producing I'm imagining it can be done securely with either format?

jl65• 6 years ago

PDF is notoriously complex but PDF/A isn’t.

selfhoster115• 6 years ago

PDF/A is a reduced subset of PDF, optimised for archival storage. A compliant PDF/A reader has a greatly reduced attack surface compared to a full PDF format reader.

tomjen3• 6 years ago

PDF/A is meant for archive purposes (e.g remain pixel perfectly the same when read out of some tape archive 50 years from now archival purposes) and doesn't allow things like javascript. Plus it requires fonts to be embedded.

twic• 6 years ago

Buddy just post one big PNG.

f4308• 6 years ago

What really puzzles me about Apple fans and it's userbase is that they do not care. They simply do not care at all what's being done to them.

It's the strongest example of consumer cultism. Absolute in their exceptionalism and ignorance. Similar problems discussed in the article are found in Tesla.

The lowest common denominator of consumer cultism is surveillance and it's no surprise that both Apple and Tesla do exceptionally well in authoritarian countries like China.

When our data is worth more than a barrel of oil, strange things are happening.

jasonv• 6 years ago

And what to do about it?

Windows & Linux probably aren't the answer to the trillion-dollar juggernaut that is Apple.

OSS has drawn the talent, and there's a lot of talent building enterprise applications, most of which are the bricks in the wall of mega-tech as they re-write our rights.

Macs are great if you want access to the financial funnel that is the app stores now. That probably defines the echo chamber of silence that exists on this subject.

oblio• 6 years ago

Windows & Linux probably aren't the answer to the trillion-dollar juggernaut that is Apple.

Windows, that indie project from the mom & pop software store :-))

Microsoft is another trillion dollar corporation, not that far behind Apple.

staplers• 6 years ago

  They simply do not care at all what's being done to them.

This is an ignorant view to take. I'm a pretty dedicated apple user but only because the other options don't have the tools I need and the UX I desire.

Likely many of the flaws apple products have are piling up to a "straw that broke the camels back" situation for users in a few years or decades.

When you assume other's intentions and feelings, bad things happen.

amelius5• 6 years ago

So you're saying that privacy (Apple knows what apps you're running and when) and autonomy (Apple controlling which apps you may run) are less important than the improvements which Apple has made to its OS over competitors?

This is totally fine. But there's where the friction between the two viewpoints is.

rootusrootus• 6 years ago

What really puzzles me about Apple fans and it's userbase is that they do not care.

Alternatively, they know what's going on and approve of it.

Consider that this blog post frames the issue as one of surveillance, instead of an anti-malware effort. If you are inclined to be anti-Apple-at-any-cost, then you will agree with the blog post. If you are a happy Apple user, you are inclined to go for the latter explanation.

It's the strongest example of consumer cultism. Absolute in their exceptionalism and ignorance.

Now you're being ridiculous, snobby, and insinuating that you are of course immune to such motivations. Sucks to see this on HN.

saghm• 6 years ago

Consider that this blog post frames the issue as one of surveillance, instead of an anti-malware effort.

It does address the idea of this system being intended to combat malware in the fourth and fifth paragraphs. The point it makes is that there's nothing stopping it from being used against legitimate software too, other than the benevolence of the "warlord" who controls it, so you're still just trusting them to protect you and hoping they don't take advantage of it.

gumby• 6 years ago

What really puzzles me about Apple fans and it's userbase is that they do not care.

They are hardly alone. There are so many issues to worry about you can really only afford to pay attention to a few. Water pollution, food pollution, being able to to be housed and fed 20 years ago...the list goes on and on. And computer security is obscure and way down the list.

And specifically addressing your case, the same is true of Windows and, TBH, all Linux distros. You've checked everything on your machine for back doors?

mistermann2• 6 years ago

They are hardly alone. There are so many issues to worry about you can really only afford to pay attention to a few. Water pollution, food pollution, being able to to be housed and fed 20 years ago...the list goes on and on. And computer security is obscure and way down the list.

I would be quite surprised if American citizens were not able to come to a reasonable (at least partial fix) consensus on most of these issues in fairly short order if there was a platform designed specifically for making such decisions. Of course, getting any substantial value out of this knowledge would require a means to pass legislation, but "democracy" is at least as compromised and beyond control of the citizens as our software is.

Nonetheless, I think it would still be valuable to have a grassroots way for the public to actually voice their opinions on matters, at least then we could all have a good laugh in higher resolution at how we allowed control over our destiny to slip out of our hands, without putting up even the slightest fight.

shmerl• 6 years ago

Those who care mostly never used Apple in the first place. So naturally those who use it usually don't care.

There are some refugees from Apple periodically though.

coldtea3• 6 years ago

What really puzzles me about Apple fans and it's userbase is that they do not care. They simply do not care at all what's being done to them.

Or, you know, we're as informed (or more) than you, but have different priorities and opinions.

Other people that are not merely mindless sheep, where you and those agreeing with you are the only smart people? What a wild concept!

I've used anything, from 4 major unices of yore, to FreeBSD, a dozen of Linux varieties, Windows, and modern Linux.

I still enjoy macOS more and I agree with lots of the decisions taken in that ecosystem (not every one, but more than not).

You are free to buy something else.

The lowest common denominator of consumer cultism is surveillance and it's no surprise that both Apple and Tesla do exceptionally well in authoritarian countries like China.

A non sequitur if I ever saw one...

julianmarq• 6 years ago

> What really puzzles me about Apple fans and it's userbase is that they do not care. They simply do not care at all what's being done to them.
we have different priorities

That's a different way of saying "we don't care". You aren't really contradicting the other person's point.

type04• 6 years ago

I still enjoy macOS

I would enjoy macOS if it subscribed to open source ideals, but then it wouldn't be Apple right

You are free to buy something else.

That's exactly the advice I give to everyone who asks me about appel

zaptheimpaler• 6 years ago

Ah yes, let me guess... we should all move to Linux & Pinephone right?

amelius5• 6 years ago

What really puzzles me about Apple fans and it's userbase is that they do not care. They simply do not care at all what's being done to them.

From what I see in discussions: they do care. But it seems they have simply accepted Apple as a benevolent dictator.

sorokod• 6 years ago

To use the article's terminology, Apple is the lord of the manor which makes owners of Apple hardware, serfs.

Klonoar2• 6 years ago

What?

I think if people bothered to read beyond blind hatred, they'd see Apple users _do_ tend to care - and are often very critical of Apple, which is what you'd want. Hell, read any of Sneak's comments on here - they might be the perfect example.

Ultimately, until another ecosystem can match what Apple provides (Windows & Linux do not), I don't see a particular point in attempting to switch. I'd rather be critical of Apple, disable the things I don't like or trust, and then do actual things with my life.

na85• 6 years ago

What really puzzles me about Apple fans and it's userbase is that they do not care. They simply do not care at all what's being done to them.

I'm not really an Apple fan, per se, but I do own a macbook and the reason is this: It's not worth my time to switch to Linux. I have a core i7 Thinkpad that I also run Debian+KDE on, and the user experience is much worse, to say nothing of track pad quality and battery life.

I'm a parent and I'm not a software developer in my professional life, which means every minute spent figuring out why Linux won't do $thing properly is a minute not spent on more important things.

The opportunity cost of using free software is just too high for my use case.

nickik• 6 years ago

Apple and Tesla do perfectly well everywhere, in China and guess what, in Switzerland, one of the most democratic countries there is. You are suffering from strong does of selection bias.

ramphastidae• 6 years ago

And yet you can identify no real alternative. Last I checked Apple is the only company with a consumer-grade operating system that (1) has refused to turn over user data even after legal challenges from the federal government and (2) doesn’t generate revenues from advertising and selling user data.

AnthonyMouse3• 6 years ago

Are you ignoring alternatives like Debian and PureOS? They may not be as widely used but they exist.

f4308• 6 years ago

And yet you can identify no real alternative.

Qubes/Whonix/Tails or any hardened linux distros is a practical and widely accepted alternative in the security field.

To my knowledge I don't think I recall anybody using a comprehensive "pen test" framework on a Mac.

has refused to turn over user data even after legal challenges from the federal government

While this is true, it never stopped the agencies from getting their data through other means.

There is a company in Israel that specializes in unlocking iPhone data. It recently lead to the arrest of a child sex cult ring in South Korea.

doesn’t generate revenues from advertising and selling user data.

neither does Microsoft if you consider the metrics are used internally and using it to optimize their product to maximize revenues.

I will agree that it is less pervasive than Google or Facebook.

est31• 6 years ago

has refused to turn over user data

You don't need to turn over any data if you transmit which programs people start in the clear, unencrypted, easily observable, to one of your servers.

And they do turn it over. They tried to make icloud end to end encrypted but then didn't do it at the behest of the US government. They employ the same tactics as zoom by claiming that icloud is encrypted, trying to make people believe that it's end to end encrypted. The encryption key still sits with them though.

Yes, there are some high profile cases where they very publicly refused the feds. Got a lot of publicity. That was their main goal, to paint an image of them not turning over user data.

Maybe apple indeed collects less user data than Google. But they still collect many things, and it's way harder to escape apple's collection than to escape Google's collection as their OSs are so locked down.

sneak2• 6 years ago

has refused to turn over user data even after legal challenges from the federal government

Apple turned over the user data of over 30,000 customers without a warrant to the US government in 2019, per their own transparency report (see under FISA).

Apple also does not end to end encrypt device backups specifically to aid the FBI.

You have subscribed to a false narrative.

azernik• 6 years ago

Take this quote from the article, and s/Google/Apple/g: "If you don’t mind being spied on by Google, and if you trust Google to decide who’s a scumbag and who isn’t, this is great."

renewiltord2• 6 years ago

Wait, you'll pay me $50 (just under today's Brent crude) for a list of everything I downloaded and ran (what Apple gets)? I'll maybe even throw in all the names of the `a.out` that I create for no reason.

Sure, what the hell. It's a deal, email me and I'll run:

    find ~/Downloads -type f -executable

On video for you.

boxed2• 6 years ago

We care. And Apple cares which is why they publicly said this system as run right now was a mistake. Within a week of this going public.

The article linked here is pretending that didn't happen. And you are pretending, against all evidence, that Apple users don't care. But it's apple users who complained and sounded the alarm in the first place. Your statement is so obviously and trivially false it's crazy to see any one up voting it.

nbzso2• 6 years ago

What really puzzles me about Apple fans and it's userbase is that they do not care. They simply do not care at all what's being done to them.

I am Apple user and I care a lot for my self and my privacy. Thats why I will not support this company with my money. Some people are aware, but unfortunately we run a business in which Mac OS as software platform is superior. Little Snitch is installed in all my Apple computers. In last 5 years after every os update, telemetry from mothership is exponentially more. I don't like this direction and have taken active measures to change my business operation and remove everything Apple related excluding some graphic software and audio. Windows is not an option.

Apple is a company that openly dislikes professional users and focusing marketing efforts to semi pro audience by using powerful tribe psychology, trends and sentiments to create public perception of a Good Shepard and Guardian.

In reality they know that future is data based and Google has advantage in this market. So they correct direction to recondition public over the idea of personal computing and transform Mac OS to iOS UX with already established consumer habit of no control and minimum transparency.

From business perspective the idea that someone will have a log file with my office activity is non acceptable. Period. Apple knows this and recently stopped standalone updates. This pushes businesses to avoid sandboxing of Apple computers in corporate network.

The message is clear. You rent Mac Os as a service, the price is your data. It is Beautified Google:)

etripe• 6 years ago

we run a business in which Mac OS as software platform is superior

Out of curiosity, what business is that? Music? Video editing?

BryantD2• 6 years ago

I love the idea of a Ulysses Pact. Something like https://support.apple.com/en-us/HT202491 would be good. I note that while right now there’s no way to override the malware safeguards, Apple's promising to fix this. (I believe that update was made after this article was written, btw.)

Now: it’s absolutely true that Apple could change their mind. Given that possibility, I understand why someone might prefer to avoid Apple. I'd be sincerely interested in some thoughts on how you can make such a Pact enforceable, or do you just have to take it on a case by case basis?

grishka• 6 years ago

there’s no way to override the malware safeguards

There technically is, because Macs don't come with locked bootloaders, and, you know, system files aren't exactly burned into one-time programmable memory. I mean, you could patch the binaries and have it your way if you really want to. But in reality you don't even need to do that — you only have to completely disable SIP and add change the kernel arguments (something like `amfi_get_out_of_my_way=1` iirc) to disable signature verification altogether.

BryantD2• 6 years ago

TIL! Although I’d argue it has to be accessible by my mom before it’s really useful.

SoSoRoCoCo3• 6 years ago

"There is no way for us to defend ourselves: even skilled technologists who administer their own networked services are no match for the bandits. To keep bandits out, you have to be perfect and perfectly vigilant, and never make a single mistake. For the bandits to get you, they need merely find a single mistake that you’ve made."

Ooof. What a boot-to-the-face reminder. Despite my use of a Tor Router, three ubikeys and Google authenticator, password manager, non-GSM voice (GoogleVoice), and several hard tokens from various financial institutions, I still have no idea if I'm doing enough because I don't control any of my three OSes, including Ubuntu 18.04 (we almost missed elliptic key backdoor in OpenSSL, what else is in there?).

gen220• 6 years ago

You could run your system completely in RAM, to at least limit the duration of exposure.

Persistence is overrated! :)

xaduha• 6 years ago

You're joking, but I don't think I will be running Windows without uwfmgr.exe aka Unified Write Filter if I ever decide to use it as my main OS again. More people should be aware of it. It's only for Enterprise editions, but maybe there are similar options out there.

walterbell4• 6 years ago

Or a VM with snapshots / non-persistent storage.

MichaelZuo• 6 years ago

To go one step further, have three, or more, identical fire walled systems running and have them vote on every calculation with the votes sent to a hardwired switch, that prevents the system from advancing if there’s a disagreement, and shuts off power to the RAM if there’s too many in a row. The chances of any compromise happening to all the systems within the same nanosecond would be infinitesimal.

bboylen• 6 years ago

For anyone unfamiliar and curious, this is how the Tails OS works.

https://tails.boum.org/

nyolfen• 6 years ago

fun reminder that canonical refuses to use tls on their repos

prutschman2• 6 years ago

Do you have reason to believe there's a problem with the gpg signatures in their repo?

dmm• 6 years ago

The packages you download can be easily inferred even transmitted over tls. What does tls buy you? That's the argument at least.

You could always download them over tor.

goodpoint2• 6 years ago

Yes because it allows caching and encrypting the traffic would provide no benefit.

APT supports downloading over Tor if you want to hide which distribution you are using.

f4308• 6 years ago

If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes.

The reason that number stations continue to operate is that it really is the best way to communicate/order under surveillance which almost certainly is happening in every embassy in non-friendly countries.

One time pads are truly unbreakable and it's techniques have been refined for the past 80 years since Cold War began.

Luckily you don't need a shortwave radio anymore and the CIA I believe utilizes emoticons. Even if you intercept a bunch of smiley faces followed by a wink, how do you figure out the contents of the message when the medium to decode is completely unknowable?

It was only when they captured a few Cuban spies were they able to break the number stations operating out of Havana but this is perhaps the only case in history.

ardy425• 6 years ago

If what you are communicating needs to be guaranteed to never be crackable, you only need to use the oldest and most secure way of communicating before the days of internet and computers: short wave transmitted one time pad codes.

I'd say using a dead drop is probably even older and more secure. I don't think it'd attract any extra attention unless you're already being followed.

A numbers station is really only useful to a particular use case that seems exclusive to nation-state spies: you don't care who knows you're transmitting, but you need the message and the location of the recipient to be absolutely secure.

SoSoRoCoCo3• 6 years ago

It's not that I'm a spy. It's that I want to protect myself digitally as much as possible, despite being forced to interface with the internet by large institutions.

We can go back and time and argue about the lack of security just four decades ago (George Hayduke[1] had a series of books on how to exfiltrate info in the 60's & 70's through social engineering). However, here we are: in a virtual world that is simultaneously more secure and less secure than ever. Compare: we have evolving security protocols that are being hardend every year by attacker's pushing on them, yet our entire lives are open like never before for the picking-off by one clever blackhat.

It is maddening, and I consider myself far more cognizant of the issues than a typical chain-letter sharing, 8-char all-text passwording, facebook user.

[1] https://www.amazon.com/Screw-Unto-Others-Revenge-Occasions/d...

cortesoft• 6 years ago

You can't operate a number station in someone else's country.... they might not be able to crack the code, but they can sure track down the number station and turn it off/arrest the operator.

mhh__3• 6 years ago

It was only when they captured a few Cuban spies were they able to break the number stations operating out of Havana but this is perhaps the only case in history

Bad OPSEC (Reuse of pads) allowed the West to extremely painfully decrypt chunks of soviet communications - finding just how bad communist infiltration was in the process.

https://en.wikipedia.org/wiki/Venona_project

opportune2• 6 years ago

Let’s take a step back here.

Everybody has a different standard of privacy they want. There are different levels of trade offs they can make as they become more secure. What you’re describing is the top level of security but it’s not very convenient to use. It also uses private keys which makes establishing a new connection challenging.

There are as I see it a few main security modes: stopping automated surveillance and hacking, stopping low effort surveillance and hacking, and being “perfectly” secure from the most motivated adversary.

Being perfectly secure on a networked computer is basically impossible. Governments likely have access to back doors and 0days that can compromise anyone (and keep in mind if the person on the other end has bad opsec, you’ve already lost). But they’re probably not going to unleash the fire and fury on Joe Schmo, and would probably be reluctant to target someone security-minded who might identify how they got pwned and publicize the vulnerability unless they have a damned good reason.

Most people don’t need never-crackable, they just need to be reasonably assured that only a very motivated adversary could crack them.

backing3• 6 years ago

"Google" authenticator

Kalium• 6 years ago

Information security is not a matter of secure or not-secure. Throughout history, it has always been a matter of available resources and risk management.

Failing to consider security in terms of resources and risk leads to moments like this. The crushing fear that you're not doing enough, never doing enough, never sure enough...

It's a bottomless pit of anxiety. You can always add on more protections, more tools, and more layers. Your anxiety is never really soothed because you can never actually fully banish risk.

As long as you conceive of information security as deterministic or binary, you're going to struggle.

pabs3• 6 years ago

Qubes might be a better choice than Ubuntu, for additional compartmentalisation.

gnicholas• 6 years ago

It would be great if there were a way to ally with multiple 'warlords' to achieve security without having to trust just one of them. It should be possible since there's the hardware level, the OS level, and the application level. At least for computers, it should be possible to build an alliance that doesn't require you to put too much trust in any single warlord.

Of course on mobile, there's so much vertical consolidation (especially on iOS) that you just have to pick one warlord.

EDIT: curious about the downvotes — what part of this do people disagree with? That it would be good to not be stuck with this dilemma? That mobile is vertically integrated?

m4632• 6 years ago

He's a very eloquent writer.

As far as I know, the door isn't quite shut on macos, and maybe a ulysses pact is sort of in place.

But if they could do that for ios, I would be so. happy.

ece2• 6 years ago

I only see two differences between MacOS and iOS: kernel development is allowed on MacOS, and running self-signed code doesn't delete itself even if you don't pay like it does on iOS. Running unsigned code doesn't exist on MacOS anymore with Big Sur, unless you self-sign everything. Stop kernel development (going to be "higher friction" going forward) and a daemon to delete self-signed code, and it's iOS.

Allowing neutral parties to do app-signing for Chromebooks, Windows 10 S or i/MacOS (the way SSL-certs are issued and trusted by browsers, Mozilla App Store anyone?), alternative app stores (iOS), alternative signed-OSes on hardware (Occulus) are all Ulysses pacts that Apple, Google, Microsoft, Facebook and others could do.

m4632• 6 years ago

I thought you could still disable stuff on macos and then run your own code to your heart's content. You know, boot into recovery and turn stuff off. Is that not true with Big Sur?

On the other hand, there is no procedure like this on ios. I think you can run your own code, but you need an apple id (therefore apple's permission) and you can only run code for 7 days.

chaganated• 6 years ago

"for wide is the gate, and broad is the way, that leadeth to destruction"

codeulike• 6 years ago

Reminds me a bit of "Serving at the Pleasure of the King" - Coding Horror, 2011

https://blog.codinghorror.com/serving-at-the-pleasure-of-the...

hinkley• 6 years ago

If Microsoft added a feature to Windows that duplicated a popular application's functionality, developers would be screaming bloody murder

Jeff had already forgotten ten years ago that we did, in fact, scream bloody murder. They kept doing it. For decades. And now they wonder why there are people who will never cut Microsoft a break for anything.

Ericson2314• 6 years ago

NixOS everywhere is the only thing to me that feels like enough sovereignty that good security is possible.

Tons of Free Software is too complex or just shitty be secure (not that proprietary software is better though!), but at least I am in full control of that which I need to fortify.

EGreg• 6 years ago

At Qbix, we have recognized the Feudal nature of Web 2.0 for a while. You can talk about this for years and years (as people have done with UBI and other things) or you can build the solutions. The same way that talking about vegetarianism is never going to convert people as much as the Impossible Burger, an actual meat alternative, ever will.

About 20 years ago, the original Web 1.0 has disrupted AOL, CompuServe, Prodigy etc. which were walled gardens. It unleashed trillions in value through new business models like SAAS and E-Commerce. But there is no good open source alternative these days to the Web 2.0 feudal lords, including Google, Facebook, etc. Because it's harder to do.

Without sound overly cocky, I think we are perhaps the closest to do it. You can see for yourself at https://qbix.com/token (you can ignore the token part, as it's optional, but it's basically building a micropayment monetization model for digital content, including journalism and open source software, on the new open source Web 2.0)

dweberz• 6 years ago

The only path that makes me hopeful involves a combination of 1. FOSS software (ie forkabke when the warlord misbehaves) 2. user owned / governed networks, so the warlord can't easily get extractive against their users.

type04• 6 years ago

You are forgetting the importance of open hardware, in ideal world we shouldn't need to install Libreboot to fight proprietary drivers and firmware that can be turned against you any second.

thombles3• 6 years ago

Unfortunately the way he describes the "Ulysses Pact" is fantasy. He makes it sound like it would be just like today, except a savvy user could sideload Signal for example if Apple was compelled to remove it. What would _actually_ happen is a long list of companies would say "brilliant, we don't have to conform to the app store guidelines any more" and go sideload-exclusive. Within a matter of months it would be common for users to have both official and unofficial app stores, sowing widespread confusion, and UX would go to pot while apps run in the background, chew up battery and take advantage of undocumented/buggy APIs to track users or steal data.

The warlord analogy is a good one. It's a tough nut to crack. The only defensive mechanism that's actionable for the average user is to keep as much data as possible offline. Sure, if Apple wants to they can ship code that exfiltrates data off my external USB hard drive, but that's way beyond the threat model we're discussing today.

itsoktocry• 6 years ago

So what you're saying is you are willing sacrifice personal privacy and security so that technically illiterate people can have a good user experience?

I understand that from Apple's perspective, but I, personally, couldn't care less about the battery life on someone else's phone. I feel like the market would sort it out, probably with optional walled gardens. That's better, no?

thombles3• 6 years ago

So what you're saying is you are willing sacrifice personal privacy and security so that technically illiterate people can have a good user experience?

Well, yes. Who is this for if not the tech-illiterate? I’ll be fine. I can use PGP and Tor if I want to.

ClumsyPilot• 6 years ago

"What would _actually_ happen is a long list of companies would say "brilliant, we don't have to conform to the app store guidelines any more" and go sideload-exclusive"

This hasn't happened in Android, why do you think it would happen with Apple?

thombles3• 6 years ago

Because Apple’s policies are so much more restrictive, particularly around background modes and streaming games.

cageface4• 6 years ago

It hasn't happened on the Mac app store either. If anything it's put pressure on Apple to make the Mac app store a better experience for developers and users. It's only where users have no option as on iOS that Apple has been able to really abuse its power.

covid21• 6 years ago

It has happened on Android.

Most importantly, Malware creators can just convince people to enable other sources. Most users don't understand the significance.

theamk2• 6 years ago

I dunno, Android has sideload capabilities forever - all you need to do is to go to setting and check the checkbox. But still, most people only use the google's store.

Even Chromebooks, which are super locked down by design, has "developer mode". It needs to be activated via obscure process, and when active it shows up a warning screen on every boot, but it is still there.

breck10• 6 years ago

We need to abolish IP Laws (aka "Imaginary Property" aka "Illogical Property" aka "Incongruent Property" aka "Invalidates Property Laws"—the other term is a big lie, don't repeat it). Not "reform". Not "compromise". Abolish.

If 2020 taught me anything, it's that society can come close to the brink pretty quickly. I thought there was an inevitable trend toward freedom, but recently think it's perilous. We need ideas to flow to create a more distributed, less unequal, world, and we need it now. We need to unshackle the people.

If anyone is working toward this, let me know how I can help (including funding). I'm supporting things like SciHub/LibGen and the like, but we need far far more organizers fighting to #EndIp, #AbolishCopyright, #AbolishPatents.

Trolls feel free to reply with the rote lies about how these laws make any sense. Anyone with a conscience doing something about it please get in touch and let me know how I can help!

konjin3• 6 years ago

IP laws are bad because they have been taken past any sane limit. However the original terms would are not too onerous, with provisions and updates there is no reason not to give the people who invent things short and clear monopolies on their ideas.

15 years is plenty of time, then everything needs to be released into the public domain.

krapp3• 6 years ago

with provisions and updates there is no reason not to give the people who invent things short and clear monopolies on their ideas.

The lack of a monopoly creates competition which accelerates innovation and leads to cheaper, higher quality products for the consumer. The person who invents a product should simply be one competitor in the market, they can have the first mover advantage, but shouldn't be allowed to control the market entirely.

If we believe in the FOSS ethos that no one has the right to own software, even if they write it, then why would this only apply to software? Why not to all forms of intellectual property? Why do I have a moral right to fork, rewrite and redistribute Firefox but not Star Wars or Pfizer Pharmaceuticals?

breck10• 6 years ago

Slavery laws are bad because they have been taken past any sane limit. However the original terms would are not too onerous, with provisions and updates there is no reason not to give the people with capital short and clear monopolies on their slaves.

15 years is plenty of time, then every slave needs to be released into the public domain.

wait_a_minute• 6 years ago

I am genuinely interested in understanding how we could have innovation in a world where a creator is not entitled to benefits from their invention. Including any monetary benefits if they so choose.

breck10• 6 years ago

If everyone who says they will stop creating new bits if they can't control people anymore, were to stop creating new bits, that would be a great world.

(Btw, an example for your question is to look up the origin of this thing we are using to communicate—the WWW)

losteric• 6 years ago

Recipes do not have patent protection, yet there is plenty of innovation in restaurants.

There are many paths to an innovation. I don't think the first person deserves such a monopoly. American IP law, in combination with the generally letigious society, has always seemed like a net source of innovation friction...

Avicebron• 6 years ago

Because if financial reciprocation is your first incentive to be creative you've already lost the mind game. If you are a creative, you will understand that sometimes we just like to do things...

chordalkeyboard13• 6 years ago

a world where a creator is not entitled to benefits from their invention

This is a mis-statement of the anti-IP case. Given the abolishment of IP laws, creators are not prevented from benefitting from their invention. They merely no longer have the benefit of the state regulators in preventing others from following the inventor's example.

Including any monetary benefits if they so choose.

The "monetary benefit" here is the power to exclude others from manufacturing the invention with the power of the state, and to compel society at large to pay for enforcement of this monopoly.

disown2• 6 years ago

I am genuinely interested in understanding how we could have innovation in a world where a creator is not entitled to benefits from their invention.

We've had innovations for thousands of years without IP. Not to mention that Linux and GNU exist for a reason. Do you think people will stop writing books, making music, etc without IP laws.

Including any monetary benefits if they so choose.

How does removing IP laws prevent you from profiting from your work?

rektide• 6 years ago

I am genuinely interested in understanding how we could have innovation in a world where a creator is not entitled to benefits from their invention. Including any monetary benefits if they so choose.

they are entitled to the benefits of their creation. by executing their idea better than others. and selling that execution competitively.

ajb• 6 years ago

Recent successful companies have largely done so because of execution, not IP protection. They have had competitors trying the exact same idea who still lost. This is especially the case with the move to SaaS, even copyright isn't so important as in the days of packaged software. A lot of the unicorns innovated on business model, and business models aren't protected anyway.

65102• 6 years ago

Real innovators care about the journey not the money. Some money is needed sometimes to get or keep going, we have this money, we have plenty of money.

We can also chose to reward innovators both for the effort and the result. It should be in proportion tho, an invention that makes you the owner of the world is not desirable for anyone else.

And finally, the most ironic, you don't have innovation if you are renting it. (they don't even have to let you rent it) Its a well crafted con that turns you into a subject to be exploited in any way the ~~innovator~~ owner chooses.

pdkl95• 6 years ago

Andrew "bunnie" Huang explains an alternative model of innovation in his talk An Alternative to the American way of Innovation[1].

The over-simplified summary is that instead of worrying about the losing the monopoly protection of copyrights and patents - which are expensive to enforce and often bypassed - consider the new types of innovation that become possible when you have access to the all of the knowledge that was previously locked behind IP monopolies.

[1] https://www.youtube.com/watch?v=S39fhrGjr4U

cannabis_sam• 6 years ago

a world where a creator is not entitled to benefits from their invention.

Do you mean a world where YouTube takes money from creators and give it to corporations that claim ownership of public domain music, or do you mean independent artist who gets zero money from their Spotify plays, since the three company cartel of record companies have forced streaming services to pool the artists’ money and then give most of that money to the biggest artists fronted by those same three record companies..?

This abuse is wholly dependent on the outrageous IP laws we live under.

Which creators are you talking about?

Viliam1234• 6 years ago

Who is the "creator"? If it is someone who composed a song or wrote a book, that word makes sense; without them the song or book would not exist. (Ironically, copyrights for songs are often not owned by the people who composed them, because contracts with publishers often require selling the copyright to them. At the end, you may be forbidden to sing your own song without paying.)

But in patents, sometimes it is just a person who noticed that existing technologies X and Y could be used together, and filed the patent first. If not them, someone else would have noticed it somewhat later. Even worse, someone else may get the idea independently a few weeks later... and then be sued for using it. Actually, if you invent something, it is always risky to use it, because you can never be sure whether someone else didn't patent it before you. (Did you do an expensive research of existing patents? Maybe you used a wrong keyword.) (By the way, patents also sometimes do not belong to people who had the idea.)

schnable• 6 years ago

If 2020 taught me anything, it's that society can come close to the brink pretty quickly. I thought there was an inevitable trend toward freedom, but recently think it's perilous. We need ideas to flow to create a more distributed, less unequal, world, and we need it now. We need to unshackle the people.

This seems like an odd claim, as society as a whole was able to weather the pandemic overall in incredible comfort due to technology and content created under our IP regime. And we got a vaccine, covered by IP laws, to people with incredible speed. If anything - it's working well.

I think the burden is on you to demonstrate that we'd have these things without the IP environment of past 100 years.

chordalkeyboard13• 6 years ago

weather the pandemic overall in incredible comfort due to technology and content created under our IP regime

strike "under" insert "in spite of"

demonstrate that we'd have these things without the IP environment of past 100 years.

IP are laws that prohibit who is allowed to manufacture and profit by certain types of goods. The burden of proof rests on those who think that those goods would not exist if more people were permitted to produce them. The presumption is that prohibitive laws have the effect of decreasing the things they prohibit.

65102• 6 years ago

https://www.hrw.org/news/2020/12/10/urgently-waive-intellect...

boxed2• 6 years ago

IP includes trade marks. We absolutely can't abolish that. So be careful when you say stuff like this.

breck10• 6 years ago

I'm not actually sure we need government to enforce trademarks. All a trademark system is is a central registry. Seems like the private sector does just fine with that (domain name system, github, npm, twitter, etc).

yyyk• 6 years ago

The diagnosis is correct, but the prescription is lacking. His technical idea is fine, but this is a political issue that cannot be solved by technical means alone.

If any 'warlord' implemented Doctorow's idea, they'd just weaken themselves. Eventually the legal and financial incentives will ensure the 'warlord' returns to form or is replaced. There's no replacement for a political pressure campaign to make digital neofeudalism obsolete by changing the relevant laws.

mistermann2• 6 years ago

There's no replacement for a political pressure campaign to make digital neofeudalism obsolete by changing the relevant laws.

https://thehill.com/hilltv/what-americas-thinking/494602-pol...

Sixty-nine percent of registered voters in the April 19-20 survey support providing medicare to every American, just down 1 percentage point from a Oct. 19-20, 2018 poll, and within the poll's margin of error. Support among independent voters was steady at 68 percent. However, support among Republican voters declined 6 percentage points over the course of two years, from 52 percent support in 2018 to 46 percent in 2020.

I doubt you'll find many issues as fundamentally important and with as much bi-partisan support support as Medicare For all, and no politician is ever going to actually try to get that passed, despite what they may claim on TV or the campaign trail.

I am afraid we will have to find a way to be content with the legislation that is chosen for us by the Reality TV political system we allowed to form while we weren't paying attention.

worik3• 6 years ago

Is it impossible to use a MacBook (? Apple laptop thingee) without a Internet connection?

Seems very odd to me.

renewiltord2• 6 years ago

No, it will function just fine. Just verified with my Macbook Pro 2019 on OS 11.

markus_zhang• 6 years ago

Classic feudalism: The king offers lands for loyalty, army and better development of his lands.

Modern feudalism: extend land to everything that generates revenue.

konjin3• 6 years ago

Interesting take but it's missing the other part of feudalism: the Catholic Church.

Today we don't have one monolithic church but we do have a very large number of priests who can excommunicate you over nothing at all. The larger outside of the centres of powers you get the juicer target for these people you get.

This has gotten so bad the Linus of Linux fame has to have a literal guard around him at all times as to not be accused of rape: https://www.theregister.com/2015/11/06/linus_torvalds_target...

1vuio0pswjnm73• 6 years ago

"As with Apple, the best way for Google to avoid being ordered to turn over data on its users is to not collect or retain that data in the first place. And, as with Apple, the next best thing is to give users the power to turn off that data-collection and data-retention altogether, something Google's gotten marginally better at in the past year."

Google is very aggressive in its data collection. Its scope keeps increasing not vice versa. For example, I have been experimenting with blocking some of YouTube's data collection using a forward proxy to deny certain request URLs. It appears one could do this within Developer Tools using request blocking and regex. But who would ever use that. Is it any coincidence this is not named "User Tools".

It is possible to watch YouTube videos without having every interaction with the website logged and collected by Google as "data". You will not see any ads if you do not use the Google-supplied Javascript video player. However avoiding data collection takes some effort on the part of the user. Tech companies know this, they know most people are not really "into computers" and cannot be bothered to spend time fiddling with them. We cannot expect Google to make avoiding data collection "easy" for anyone. This is no different from expecting tech companies to "self-regulate".

ece2• 6 years ago

You can go to https://myactivity.google.com/ and turn off everything there. I think most users can do atleast that if you have a Google account. Using adblockers, fingerprint avoiding browsers, and diligently opting out of all forms of tracking where possible is also doable. This only minimizes data collection.

It's sending companies like acxiom and sift science requests to delete your data based on identifiers that most people will likely not do.

I would like to see banning of data collection IDs, including IDFAs. No ad re-targeting IDs, no Verizon injecting IDs into network traffic, no Facebook SDK IDs, no IDFAs enabling data collection. I think that would do wonders for big tech minimizing their data collection.

1vuio0pswjnm73• 6 years ago

This requires sign-in. (Signing-in, the "business" of creating non-anonymous profiles, is as I see it the essence of the problem. "Tech" companies hoping to do "work" for free and profit via online advertising want to build profiles for advertisers to target, without having to ask for consent to create them. Some users do not want profiles nor advertising.) "Myactivity" does not stop data collection. It is, to quote the web page, for "managing" the data they have already collected and will continue to collect going forward absent intervention from the user. The data collection is already happening before one ever signs in. Sure, someone can tell Google to stop collecting, but by then it's too late. They have created a profile at Google's urging , identified themselves and put their name on data that Google has already collected and attached to other identifiers. The solution is simple, as stated above: stop collecting data on people without their prior consent. Legislation could address this, but I doubt the US will ever see any meaningful regulation in this area. As I am typing this I am thinking of the case where Google was sniffing people's Wifi and storing the data. I can find the cite if needed. They later stopped after people complained, and they were sued, but that was a nice example of how aggressively they pursue data collection "within the bounds of existing law". Wrong but legal (for now). This is the "tech" industry in a nutshell.

krebs_liebhaber• 6 years ago

You will not see any ads if you do not use the Google-supplied Javascript video player. However avoiding data collection takes some effort on the part of the user.

I watch most of my YT videos through mpv, which (AFAIK) uses youtube-dl as a backend to get the video stream. Am I still vulnerable to tracking?

1vuio0pswjnm73• 6 years ago

What I do is only use the videoplayback URL and reject/divert all the others. This requires having the proxy delete the range parameter in the query string portion. If you observe the traffic when using the YouTube website, there are many HTTP requests for things we do not need if we are not using Google's Javascript player. And there is no need for Cookies and many other HTTP headers if only using the videoplayback URL. Sometimes I may do two downloads: one for the video and one for the audio. YouTube seems to be now using similar/same approach for their user video as Facebook. With some videoplayback URLs pointing to only audio, and some pointing to different screen sizes.

I doubt you are as vulnerable to as much tracking as someone using the YouTube website.

I find youtube-dl breaks quite frequently and so I wrote a simple downloader myself (for non-commercial videos) in a few lines of shell script. I have found it is easier to fix quickly if there are significant changes at YouTube than waiting for the youtube-dl project to release an update.

sneak2• 6 years ago

I'm a little bummed that this repeats the standard apple-vs-the-FBI (in the San Bernardino shooter case) false narrative.

Apple provided all of the shooter's phone data, unencrypted and available to Apple thanks to the non-e2e iCloud Backup (on by default on every iPhone) to the FBI.

The whole "Apple is naughty and won't unlock it for us!" narrative was a coordinated marketing effort carried out by Apple and the FBI following the Snowden/PRISM thing.

Apple doesn't need to backdoor the phones. iOS uploads a complete backup of the phone's data, effectively unencrypted (in that it's encrypted to Apple and Apple can decrypt it at any time they wish without the user, their pin, their password, or their phone) every night when it's plugged in.

Neofeudalism and the Digital Manor

Related Stories