EU negotiators agree new rules to rein in tech giants

https://www.politico.eu/article/eus-digital-markets-act-adopted/

by raimue • 4 years ago

309 341 4 years ago

hrnnnnnn• 4 years ago

Parliament also succeeded in convincing the Council of interoperability requirements for messaging services, meaning outfits such as WhatsApp, Facebook Messenger or iMessage will have to open up and interoperate with smaller messaging platforms. For group chats, this requirement will be rolled out over a period of four years.

This would be great. I remember using pidgin back in the day and it was really convenient to have every messaging app in one interface.

2000UltraDeluxe• 4 years ago

Yeah, saw this and immediately thought of Pidgin. This is also great for smaller platforms -- If I could use something like Pidgin again then I'd probably log into ICQ again for the first time in... a very long time.

kuboble2• 4 years ago

I wish so much for that to happen. I still remember jabber being popular in Poland 15 years ago. One of the reasons I switched to gtalk at the time was the fact that it allowed me to keep my jabber contacts. Little did I know they would kill it in a couple of years.

8fingerlouie7• 4 years ago

meaning outfits such as WhatsApp, Facebook Messenger or iMessage will have to open up and interoperate with smaller messaging platforms

The way i read it, they're calling for open standards, which can be a good thing.

Sadly, open standards also slow down the development of new features, as everybody needs to be "on board" for new features to roll out. Take email (SMTP, IMAP, etc) as an example, where no major progress has been made in 25+ years, despite the platform being hopelessly insecure.

There has been some unsuccesful attempts at security, like PGP and Protonmail/Tutanota, but as they're addons they haven't seen widespread adoption.

Feel free to replace email for TCPv4/v6. The only successful open standard i can think of would be HTTP.

Open standards, once they mature, usually mean "lowest common denominator".

kuboble2• 4 years ago

Yes. That lowest common denominator will be probably being able to send text messages. Maybe a little more.

It's a big thing. And it's a great thing.

Already in email you have some cool features that only work Gmail to Gmail but you can still send basic emails to people outside of Gmail.

Businesses will not need business accounts on 6 different platforms just so thay can have a simple chat with all their customers.

pif2• 4 years ago

open standards also slow down the development of new features

On one hand, that is not right: open standards mean no walled garden, rather than each garden equally ugly.

On the other hand, that is exactly the point: no new feature can be used to buy the users' freedom to interact with customers of other services.

DocTomoe• 4 years ago

Open Standards enable downward compatibility, they do not prevent innovation that builds on top of them.

Nothing prevents people from releasing a new RFC describing their feature and how to implement it. See: EMail attachments (RFC 1521) which came after the original EMail definition (in RFC 822). And what you describe as "email insecurity" is just a common disagreement which encryption method to use in your MIME attachment (defined in RFC 989) - your argument sounds a bit like protesting that not everyone is using Word files when sending text attachments.

(Note: EMail metadata is deeply "insecure" and can theoretically be used to glean information about communication - but if that's your concern, maybe email is just the wrong format for you and something like encrypted messages over a network of Kafka-style message streams, ideally with lots of noise in it, would be better suited).

grishka6• 4 years ago

Sadly, open standards also slow down the development of new features, as everybody needs to be "on board" for new features to roll out.

Capability negotiation is a thing. It's perfectly fine to support some baseline feature set (one-to-one text messages) and build more optional features on top of it. But, yes, it's important that the protocol is designed to be extensible in the first place.

chockchocschoir3• 4 years ago

Sadly, open standards also slow down the development of new features, as everybody needs to be "on board" for new features to roll out. Take email (SMTP, IMAP, etc) as an example, where no major progress has been made in 25+ years, despite the platform being hopelessly insecure.

A more successful example of open standards would be the various standards that browsers use. Would you say that browser innovation has slowed down? The model adopted there is less "Wait for everyone to adopt this new standard we wrote" and more "If you have a feature you found many people are using, suggest it as a standard and we'll get all browsers to implement it".

This model could be replicated to messaging solutions as well, without slowing down any innovation as companies can add new features, as long as they get standardized over time.

hnlmorg• 4 years ago

Not always. One can use an open base but add proprietary extensions. This is exactly how the web has evolved from Netscape and IE having different tags in the 90s to the 00s CSS `ms-` / `o-`, prefixes. This is also how XMPP was designed: common base but support for extensions (open or otherwise).

Email is a totally different problem because it's a suite of a multitude of different standards used across countless different platforms. At least with proprietary messaging services Facebook et al will still be the implementation standard that most people will use (given that habit has already been well established) but lesser used 3rd party clients wont have to worry as much about Facebook breaking the protocol to intentionally break support for 3rd party clients. However I'd wager you will still see new proprietary features added that will not function in 3rd party clients if just to convince users that the 1st party app is the better client.

pooper• 4 years ago

Feel free to replace email for TCPv4/v6. The only successful open standard i can think of would be HTTP.

Btw, does anyone here remember off hand what happened to the "concern" the banking industry had with TLS 1.3?

My understanding is someone just came in at the last moment and basically wanted to change the entire design of TLS 1.3 because their workflow would no longer work because of forward secrecy.

https://news.ycombinator.com/item?id=12641880

arlort2• 4 years ago

I think in this case it's more about services allowing stuff like third party clients or providing APIs, not binding themselves to a specific standard

So if I'm whatsapp I have to allow third party clients, but I can also change my API as needs change, as long as I don't lock it.

freeone3000• 4 years ago

Yeah, but, I can send email to someone no matter what platform they're on. I can visit their website. I think this is "successful".

belorn• 4 years ago

Email is hard to replace in a similar way that BGP, IP, UDP and other old protocol is hard to replace. One need to have everyone switch everything, including hardware, at the same time in a coordinated fashion, and one also need to align incentives so that everyone agree that the money and time is worth the benefit of the new protocol.

Close standards is not inherently different (people who work in telecom can likely attest to that), but closed standards has a higher probability to be owned by a single entity. A single entity has a much easier time to coordinated a switch with themselves, or align their own incentives with their own incentives. If you are alone or don't need to work with others, cooperation is trivial. Obviously, having everything owned by the same entity also has its drawback. If you don't like the new price, features, tracking and forced advertisements, well tough luck. While spam is an issue with email, I am not forced to wait 3 seconds and click "skip add" every time I read an email. I also don't need to pay per email, in contrast to sms. Email could had been much worse if it was a closed standard owned by a single entity.

account422• 4 years ago

Email lacks development precisely because interopability is intentionally limited by existing stakeholders via opaque "spam" policies. We need regulation to require better interopability here as well so that we can have innovative mail providers that do no have to spend all their energy on being able to send mail at all.

cesarb• 4 years ago

Sadly, open standards also slow down the development of new features, as everybody needs to be "on board" for new features to roll out. Take email (SMTP, IMAP, etc) as an example, where no major progress has been made in 25+ years, despite the platform being hopelessly insecure.

The usual answer for avoiding the need for everybody being "on board" with the changes is capability negotiation. Unfortunately, that doesn't work for email since it's a unidirectional, store-and-forward protocol: the sender has no way to negotiate capabilities with the recipient (or recipients, in case of a mailing list). If for instance I invent a new rich-text format for email, I have to include a fallback format on every message, since I cannot know whether the recipient can read my new format.

Feel free to replace email for TCPv4/v6.

With TCP, there's another issue: middleboxes. While TCP does have working capability negotiation, unrelated third parties (which were not part of the negotiation) interfere with things they don't understand. If for instance I introduce a new TCP option which when negotiated changes the meaning of the sequence number field, a stateful firewall would drop the data packets even though they're valid for both endpoints. Due to the large amount of middleboxes in the wild, the design of TCP has been effectively "frozen", in that any enhancement will break unexpectedly for a large subset of users.

The only successful open standard i can think of would be HTTP.

What saved HTTP was SSL/TLS. By making it hard for middleboxes to interfere without actually acting as an endpoint (with negotiation), it allowed the protocol to evolve. The best example is HTTP2: while there is a cleartext version of HTTP2, nobody uses it because it would get broken by middleboxes.

viccuad2• 4 years ago

The way i read it, they're calling for open standards, which can be a good thing. > Sadly, open standards also slow down the development of new features,

No. They are asking for endpoints and public APIs. Nobody is forced to adopt a standard, that is a fallacy you have just built (and has powered a tangential thread of 20 messages and counting.. debating something that is not in the topic).

Services will be forced to provide public endpoints and public APIs. Nobody is forcing them to shape them in any way. Consumers can decide to interface with them, or not. The onus on implementing and interfacing with them lays on the consumers. You don't need an agreement between everybody.

varajelle• 4 years ago

But email evolved. You can now use a 8bit encoding, use formating with html content. Is encrypted with TLS. Send calendar events. PGP did take of for people who care. You can even revoke emails.

shafyy• 4 years ago

Sadly, open standards also slow down the development of new features, as everybody needs to be "on board" for new features to roll out.

Stop repeating this talking point of big tech. This is FUD. Sure, developing the standard further requires more work and is slower if just one person alone developed it, but the upsides clearly overweigh.

Furthemore, everonye is free to build their own features in their own app that are not part of an open protocol (good examples are snooze or send later features in email).

PS: As a sister comment pointed out, open standard is not even in the scope of this new EU act. It's only about opening up their APIs. They are not foced to use an open protocol.

pabs32• 4 years ago

Pidgin is still there, still works and supports modern chat platforms too, via plugins:

https://pidgin.im/plugins/

Of course, some platforms ban you for using alternate clients.

chockchocschoir3• 4 years ago

Pidgin is still there, still works and supports modern chat platforms too, via plugins

Nice!

Of course, some platforms ban you for using alternate clients.

Less nice... Doesn't seem like that list outlines which platforms will/could ban you either, which makes the entire list a no-go for me, and I'm sure others.

cf141q53253• 4 years ago

Also with offTheRecord Messaging for encryption.

I am really loving this news, i was able to convince some of my old icq contacts back then to switch to jabber this way. And why wouldnt they if its all the same interface?

dureuill3• 4 years ago

good news. we also need interoperability requirements for social networks. like twitter and facebook must be mandated by law to provide access to their networks to smaller networks. only then would people be free to leave these networks without suffering from "network effect"

scim-knox-twox• 4 years ago

So, you mean "Fediverse" ;)

https://wikiless.org/wiki/Fediverse?lang=en

kmlx8• 4 years ago

like twitter and facebook must be mandated by law to provide access to their networks to smaller networks.

makes no sense. you can already pull all your data out of those services and import it into whatever other service you want.

agilob• 4 years ago

interoperability requirements for messaging services, meaning outfits such as WhatsApp, Facebook Messenger

Who will be decrypting WA and Signal message to pass them to Facebook Messanger?

kmlx8• 4 years ago

yeah, i don't think this was thought out, or at least i haven't read anything on this subject. how does the draft text deal with cryptography?

FartyMcFarter2• 4 years ago

There's no need for decryption. If you want to send things to Facebook Messenger, you can just send it to that service directly.

arlort2• 4 years ago

Presumably if you as a user want to use an app that interoperates with Signal, Whatsapp and Messenger then you'll be logging in with your signal, whatsapp and messenger credentials and give it permission to read your messages and relay them

I don't think this is to be interpreted as "from now I need to be able to send messages from a Whatsapp client to a Signal client"

Of course any such app would be able to read all the messages in the clear and would be able to store them in the clear, leak them, sell them or whatever. As with any other case in which you choose to use a chat app you have to trust the chat app to read your messages if it wants to

I imagine if that's the case whatsapp or signal, when you do a first login from a different app, will flash a warning that you're using a third party client which might not be trustworthy

martin8412• 4 years ago

Why would they need to decrypt anything? If they use open standards such as the signal protocol, there's no need to decrypt anything.

https://signal.org/docs/

Bancakes• 4 years ago

At the end of the day, chat apps are nothing more than a bunch of text, some compressed pictures, and maaaybe a voice recording. It's very simple data to be transmitted, and any problems with interop are self-made bloat and proprietorship.

GuB-422• 4 years ago

What about Signal?

Moxie is strongly against it. Although the app and protocols are open, he doesn't tolerate third party clients on Signal official servers and he doesn't want federation. Even though I disagree, he has some good arguments.

And if WhatsApp has to interoperate, why not Signal?

MezzoDelCammin• 4 years ago

To quote the original article : "platforms with a market capitalization of €75 billion or turnover in the European Economic Area equal to or above €7.5 billion"

I'm not sure what the current market cap for Signal is, but I'm fairly sure they don't have a turnover of 7+bn in the EU.

tyrfing2• 4 years ago

Signal, Twitter, Snapchat, Discord, Zoom, etc won't be affected. Maybe even TikTok. It's basically just anything by Google/Apple/Facebook/Amazon, and perhaps a few odd ones like Steam and Epic's services.

merrywhether2• 4 years ago

I wouldn’t be surprised if the response was a Chrome-esque “drown the competition in feature velocity” approach. iMessage could add new features (with totally necessary payload shape updates) fast enough to prevent any integrations from working well and competing effectively. Throw in some EME-style approval-requiring binary blobs to enable decryption and a dash of CSAM-style regulation compliance and open vs closed won’t really matter (like we’ve seen on the web so far).

soperj• 4 years ago

Hopefully regulators catch on to that crap.

pmontra• 4 years ago

They can do that as long as they keep the interoperability. Text with UTF8 emojis should be enough to start with.

Actually I expect the usual outrage about limiting innovation or threats to leave the EU but consider that this interoperability is also a moat especially if they agree on some complicated protocol with no previous implementation.

paxys3• 4 years ago

I'd say that's a feature not a bug. Let iMessage roll out exploding balloons and whatever else they want in every update. I want to use my own client which should just stay compatible with the core functionality – sending lines of text back and forth.

And if they are deliberately breaking existing third-party apps for no reason, well I'm sure EU courts would like to have a word.

cabalamat• 4 years ago

Should mandate interoperability for all social media.

tyrfing2• 4 years ago

Seems like it does, but the size restrictions are crafted so it only applies to Facebook/Meta and not any of the smaller platforms.

matheusmoreira2• 4 years ago

Interoperability is great but how is this going to affect end-to-end encryption? Will every app be required to support it?

eterevsky2• 4 years ago

EU officials have agreed on landmark rules

I'm not sure what this means in terms of the timeline. Will it be voted for in European Parliament and if yes, when? To what extent this may be changed in the final edition? And if it's adopted as a law, how much of a grace period will the companies have?

ganzuul• 4 years ago

If you start doing the right thing now not only can you beat the competition, you don't need a grace period.

Vespasian6• 4 years ago

The trilog between the parliament and the member states decided upon a text.

Next each chamber will vote on it but this is usually just a formality since they gave the negotiators a mandate beforehand.

If it passes, the text will become a EU directive which needs to be incorporated into national law by the member states.

After that it becomes enforceable.

the_duke2• 4 years ago

Edit: whoops

M2Ys4U2• 4 years ago

If it passes, the text will become a EU directive which needs to be incorporated into national law by the member states.

The DMA is a Regulation, not a Directive. It doesn't need to be transposed in to national law in member states.

Regulations become law across the whole EU (and usually the EEA as well) as soon as they are published in the Official Journal.

Zenst2• 4 years ago

Yes, somewhat reminded that some things move slow. Of note I remember the whole Microsoft monoply for web browser fiasco by the EU with the time they got around to a rulling/actioning, Google had come out of no were and usurped Microsoft as the dominante browser.

elcomet• 4 years ago

Why do you say it was a fiasco ? It seems to have worked as expected, browsers are much better than IE from those days due to competition.

kmlx8• 4 years ago

lots of confusion in this comment.

Will it be voted for in European Parliament and if yes, when?

the European Parliament only votes on a text. It cannot take decisions by itself. it can only present a voted upon text to the EU Council. and even then it's not a given it will become a directive.

And if it's adopted as a law

There is no such thing as a "law" in the European Union. (Simplified) The EU has directives and regulations. Text is drafted by the EU Commission, which is then sent to the EU Parliament which is then sent to the EU Council. And the same text can bounce between those institutions for some time. Finally, if all goes well, it becomes an EU Directive. After this member states have a few years to put the Directive into national law.

This process is extremely cumbersome, full of gotcha's, and overall, inefficient, but it's the best thing these politicians came up with. Most likely the next level of simplification would normally involve some sort of federal union.

eterevsky2• 4 years ago

lots of confusion in this comment.

That's why I'm asking these questions.

I still don't quite understand on which stage this initiative is at the moment and how long until it is enforced.

M2Ys4U2• 4 years ago

If it passes, the text will become a EU directive which needs to be incorporated into national law by the member states.

The DMA is a regulation, not a directive btw.

FreeHugs5• 4 years ago

One reason the EU missed out on the internet is our unlimited willingness to be regulated. And we keep piling more and more bureaucracy on top of it.

This only cements the power of US big tech like Google and Facebook.

And it sets the stage for the next big applications of the web all being build outside the EU as well.

Here in Germany, everyone is afraid to start a web startup. And if they do, they spend endless amounts of energy on agonizing over the GDPR and how to build useful international services without using international tools. We sanctioned ourselves by making the use of foreign SAAS illegal.

If you are in the EU, try out surfing the web via a non EU IP once. It is an eye-opening experience. No cookie banners! Only Europeans have to deal with those.

But it gets worse: Look at European websites from a US IP. You do get cookie banners. European companies deal with degraded user experience, slower build time and worse monetization. On a worldwide basis. While the rest of the world only applies these downsides to the European part of their business.

mschuster917• 4 years ago

One reason the EU missed out on the internet is our unlimited willingness to be regulated.

Bollocks. The key difference between here and the US is the simple fact that we don't have enormous amounts of "dumb money" from pension and hedge funds screaming to be invested into anything that remotely smells like it could be worth money one time - remember Yo! which got 1M funding?! - and then founders making big money at IPO time, which many of them then choose to invest into new startups.

That means that you have to either rely on philantropic investors, family or borrow money from banks at ridiculous interest rates (and often requiring deposit of a car/house or other expensive assets to back the loan).

Navigating GDPR and the laws here is easy - one might say, life is even easier here than in the US for startups because you don't have to fear getting kicked in the nuts over bogus patent and other IP claims or absurd multi-million dollars civil damages lawsuits.

FreeHugs5• 4 years ago

Dumb money is not the basis for the web as we know it.

Look at where we are communicating here. On a US website built by a single person.

drumhead2• 4 years ago

Why aren't they investing their "dumb money" in EU web start ups then?

netheril96• 4 years ago

In this case, the rules only apply to corporations with large enough revenue, so startups remain unaffected.

ivancho2• 4 years ago

Oh, man, such a shame about all these laws.. [checks notes].. protecting users from predatory company behavior. Things would be so much easier if we didn't have those laws - we could all start web startups.

FreeHugs5• 4 years ago

Regulating local companies is making things only worse. That is the reason why all of Europe depends on foreign tools in the first place.

It is a similar death spiral to how we deal with the housing problem. People have a hard time finding affordable apartments in the city centers? Create more laws that limit rents! Does this create more apartments? No. It just send the local housing market further down the drain.

thow-58d4e8b3• 4 years ago

This is already a pattern in HN discussions: legislation is proposed, news outlets vaguely summarize it, the HN crowd interprets the summary in absurdly maximalist way without bothering to read the spirit and letter of the law; outrage ensues. This is coupled with an "I-know-better" condescension towards authorities, reinforced by a weird ideology that code is above law

The legislation, at least the one coming from Brussels, is nearly always reasonable in scope, extent, impacts, penalties, and tends to strike a fair balance between specificity and vagueness as to allow the courts for some wiggle room for interpretation

As an example, with interoperability, the final legislation might stipulate something similar to this:

* once a software service reaches sufficient market size

* the core functionality of the service must be exposed for interoperability

* any breaking changes to core functionality must allow for sufficient period of backwards-compatibility and deprecation warnings. Exceptions for security breaches or other emergencies

So, for Youtube, this would mean logging in, viewing videos and history. It doesn't mean that every single feature of every single web site must be publicly exposed and be backwards-compatible for eternity

matthewmacleod5• 4 years ago

One reason the EU missed out on the internet… Here in Germany, everyone is afraid to start a web startup

The EU does actually have a variety of "internet" companies – and that includes Germany! There are certainly less of them; regulation could be one of the things that affects that, but it seems way more likely to be a wildly different environment for funding. Investors are more conservative and far less likely to throw dumb money at anything that moves, which means fewer successful unicorns. I'm not sure that's the best approach, but I'm not an investor.

they spend endless amounts of energy on agonizing over the GDPR

No they don't. GDPR compliance is generally fairly straightforward for any company which isn't trying to deliberately harvest and profit from your data—particularly a new company with no legacy—and in any case represents a set of practices that should be followed by any company dealing with private data in any case.

By the same token, those startups have to worry far less about the nonsense patent and IP environment in the US. So worst case we'll call it a wash.

We sanctioned ourselfes by making the use of foreign SAAS illegal.

This did not happen. Use of non-EU SaaS is legal, subject to it being compliant with local regulation.

I'm always a bit weirded out by strenuous objections to GDPR – it seems to me that the data privacy environment in Europe is broadly pretty sensible. You need to:

- know what data you are using

- have a good justification for using it

- take appropriate precautions to secure it

- make sure users are aware of what you are doing with it

- allow users to access and correct the data you hold on them

I find it hard to object to that.

FreeHugs5• 4 years ago

That sounds very theoretical. I witness the journey of several German startups for a while now and get a very different picture.

Many of the most powerful web tools are not compatible with the GDPR. Google Analytics. Ad marketplaces. Free CDNs. And its all a moving target. I see small companies struggling for years now with these problems. And they will keep struggling for the forseeable future.

emptysongglass2• 4 years ago

You are declaring things as facts but my experience is yes startups do spend huge capital on ensuring GDPR compliance and neurotically worry over it.

I also have experience from two start-up scale-ups that many clients are saying we won't work with you if you use a US Big Cloud. The EU alternatives are much worse and this causes lots of developer waste now ensuring the platform runs as well on the Big Cloud as it does with really terrible EU-cloud.

1234letshaveatw• 4 years ago

Reading this is so entertaining. "It's not the regulation that has depressed the EU startup scene, it is depressed because we in the EU are too smart."

hnbad2• 4 years ago

Funny how I have worked both as a developer and a business owner building applications for startups and established businesses alike and yet as both a consumer and a professional I'm glad to live under EU jurisdiction instead of the US because all those evil privacy protections and regulations mean I can have a reasonable expectation that companies can't just do what they want with the data I entrust them.

People like you love to complain about cookie banners but somehow fail to acknowledge that the reason cookie banners are a thing is that companies go out of their way to try and game the regulations instead of actually implementing them. Sure, you can't build the next Facebook in the EU but maybe not being able to build a business on intentionally abusing your users' trust is not a bad thing.

If you just want to get rich, there's still plenty of nigh-unregulated banking and speculative investment you can get involved in with narry a consequence. If you want to build software, I'm not very sorry you're inconvenienced by regulations that actually protect people from your overreach.

trh0awayman2• 4 years ago

I would say most people don't agonize over it because most people don't follow GDPR here in Germany. I think more and more people are slowly complying, but certainly in the last 3 years no one has cared.

I personally believe GDPR will never be properly enforced and most people will ignore it. The easy parts of GDPR (cookies, fonts, I guess CDNs now) are automatically detectable, and the hard parts (deletion of data, data processing agreements, necessary collection) are not. There is no way to automatically find out if someone is storing IP addresses in their access logs.

One of the really funny things I encountered in Germany is the emphasis on data privacy/protection...

But every single citizen has to inform the government where they live and their religion. You also have to inform your boss of your religion. If you make creative content, you have to publish your address as well (unless you can afford to start a business at another location).

You can find out where anyone in Germany lives for a small fee.

Those things have about 10x greater impact on my day-to-day life than Twitter finding out I watched a "cancer prognosis" video. I know they're not mutually exclusive, but it shows where priorities lie.

mschuster917• 4 years ago

But every single citizen has to inform the government where they live and their religion. You also have to inform your boss of your religion.

That depends on the religion. For a bit more context (read the full history in [1]): As part of the 1800s separation between state and church, the major ones (Catholic and Evangelic-Lutheran) got the right to a percentage of employed people's wages as a sort of "membership fee". This gets deducted by the employer out of your paycheck and collected by the tax office, then distributed to the church you're a member of. Over the years, the right to collect these taxes expanded by quite a number, although currently only the Roman Catholic, Old Catholic, Evangelic-Lutheran, Free Protestant and Jewish synagogues use that right.

In real life, no one but HR at onboarding cares which religion you specify.

Also note, this is not exclusive to Germany. Italy, Sweden, Austria, Finland, Denmark and Switzerland all have a similar system.

[1] https://de.wikipedia.org/wiki/Kirchensteuer_(Deutschland)

mhitza2• 4 years ago

Every developer should try to understand GDPR to a basic level, as those basic principles are good enough of a baseline. Won't go into minutia, cause at the enterprise/large scale level you'll need a DPO (data protection officer) and follow stricter auditing practices (among other things).

Second, cookie banners are unrelated to GDPR. They became mandatory years before the GDPR, and the level of intrusiveness is because websites don't follow the "spirit of the law". With time hopefully the cookie banners dark patterns will subdue (after a few more entities get fined).

In terms of EU startups, what I'm familiar with, is them getting bought by US corporations, and not failing under the pressure of EU pro-consumer bureaucracy.

CaptainNegative• 4 years ago

A high level overview may be possible, but any amount of actionable detail is impossible for laymen and lawyers alike. The GDPR is intentionally vague; there are entire academic papers from respected researches dedicated to trying to parse individual sentences from the document. See e.g. Cohen and Nissim's 33 page article on intepreting the sentence

To determine whether a natural person is identifiable account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly.

https://arxiv.org/pdf/1904.06009.pdf

Turns out writing vague laws lets you turn entities you don't like into cash cows.

thow-58d4e8b3• 4 years ago

websites don't follow the "spirit of the law"

A perfect counter-example to people rambling about EU legislation - Wikipedia.

Consistently in the top 10 sites in the world for 15 years, yet there's no cookie banner, no GDPR consent screen, no personal data hoarding, no dark patterns, etc.

ClumsyPilot4• 4 years ago

So you like that your code is protected by intellectual property so that you can make money off it and noone can just take it and use it whoit permission?

But you dont like that your users data is protected by GDPR, so that you cant take it without permission? Thats unnessesary regulation holding back business?

Does not sound like it has anything to do with regulation, it sounds like you want the fovernment to give you an advantage.

Dracophoenix3• 4 years ago

There's no contradiction.

Intellectual property protection is opt-in. It requires the individual to enforce his rights before a court in the relevant jurisdiction. The government only facilitates registration and adjudication. Courts don't force individuals into global protection schemes against claimant's own will.

Whatever the expected merits were, GDPR's existence as a policy has been of little more use than a protectionist beating stick in service of the EU. It gave the EU the power to dictate how websites are to be designed. Non-Europeans with business interests inside the EU had no say or representation in the matter. Governments shouldn't claim universal jurisdiction over the Internet, whatever their reasoning for such claims might be.

koonsolo2• 4 years ago

Fellow EU entrepreneur here: you being downvoted says enough about what kind of people are commenting here.

US works with a "better ask forgiveness than permission" model, where you are pretty free to do what you want, but people can sue you.

EU works with the opposite: create rules and keep companies compliant with those rules.

It's pretty obvious to see that the 1st model is very beneficial for startups and bootstrappers.

chalst• 4 years ago

I didn't downvote but I thought it was a weak comment: it's a generally valid perspective but doesn't seem tailored to the actual news, which is mostly tailored to large capitalisation/turnover companies.

The general pro-vs-anti regulation dimension of the argument over tech policy seems to lack the necessary nuance if it doesn't ask about antitrust. The lack of antitrust regulation in the US has meant that the SV pipeline which fifteen years ago supported a diverse tech landscape is at risk of degenerating into one that only aims to produce targets for monopolists to buyout. It's a possible future of your "1st model" I'd rather we were more worried about.

watwut• 4 years ago

That does not make US less regulated. It makes regulations unpredictable and unevenly enforced.

Also, cookie banners are mostly bad faith restriction implementation. You can have functional cookies with no banner. What you cant have are those tracking cookies which is what the whole thing is about.

yywwbbn• 4 years ago

Are there any actual cases of EU startups being fined under GDPR without being given a chance to fix their stuff. I was under the impression that the enforcement so far has been pretty lenient.

sofixa7• 4 years ago

This only cements the power of US big tech like Google and Facebook

Au contraire. This regulation will force the big tech companies to open up their platforms, thus enabling innovation and competition.

deburo• 4 years ago

If you are in the EU, try out surfing the web via a non EU IP once. It is an eye-opening experience. No cookie banners! Only Europeans have to deal with those.

I'm in Qc, Canada and I see them very often. Is it only checking for a US IP, and everything else gets the banner?

andrew_3• 4 years ago

In the U.S. and I'd seen so many of them that I have an extension installed specifically to hide them while browsing.

ivancho2• 4 years ago

The new rules for so-called gatekeeper platforms, derived from years of antitrust enforcement in the digital economy, include restrictions on combining personal data from different sources, mandates to allow users to install apps from third-party platforms, prohibitions on bundling services, and a prohibition on self-preferencing practices.

The first one sounds very damaging to adtech, but might not be enforced.

chmod775• 4 years ago

mandates to allow users to install apps from third-party platforms

Some people at Apple are getting a headache right now. Other companies that have been dabbling with the idea to lock down their OS probably too.

If this happens my next phone might even be an iPhone.

Vespasian6• 4 years ago

I had the same thought.

Apple makes great hardware and the main thing that was holding me back from getting one was their heavy handed approach on what applications I am allowed to install on my device and from what source.

If this works I would probably go for it.

ericmay12• 4 years ago

I’m the opposite. I buy an iPhone specifically because I want a locked-down device. World is about to get a little worse on this front.

natch3• 4 years ago

It doesn’t allow people to install abusive and spyware apps on their spouse’s, girlfriend’s, coworker’s, roommate’s, and children’s devices… not to mention harmful ones on your own… that’s a feature.

If you really want some nasty stuff on your phone for some reason you can always write it yourself or find something open source and install it with Xcode. You are free to do this; the idea that you are not is a myth regurgitated by haters who don’t think for themselves. Just good luck doing it on someone else’s iPhone without their permission.

black_puppydog• 4 years ago

This is nice to see. It's fully in line with a report [1] by a (relatively new) French "expert group" within the government found. They were looking specifically at the security implications. Of course, the report is short and written for political decision makers, so not super technical.

Money quote:

The checks made during the audits conducted by current application stores owned by operating system developers are indeed all reproducible by third parties.

[1] https://www.peren.gouv.fr/rapports/2022-02-18%20-%20Eclairag...

com• 4 years ago

This is a surprisingly well-written report that an intelligent reader with exposure as an end-user to the mobile phone ecosystem should be able to comprehend, that summarises the risks around malware and app stores and a possible approach to opening up side loading of apps structurally.

Masterful communication on top of solid analysis. I’m going to keep a copy just to review when I’m writing my own reports to stakeholders.

toyg8• 4 years ago

Apple literally begged for this hammer to fall, ignoring calls for openness for 15 years and openly mocking efforts to get them to play ball (like the recent Dutch case, to which they responded by amending rules on dating apps, blatantly ignoring the spirit of the ruling).

I expect they employ enough smart people that they prepared for this moment of reckoning despite the hubris of their leadership.

oxplot5• 4 years ago

ignoring calls for openness for 15 years

I very much want this to happen now. However I would not have wanted this 15 years ago when the platform was a baby and little was known on how to move it forward. Last thing you wanted at that time was layers of regulation and laws that would hinder the speed of development.

15 years is probably too long and this could have happened 5-10 years ago.

matheusmoreira2• 4 years ago

Good, laws are supposed to be a headache for monopolists. If this happens, my next phone will also be an iPhone.

emsy• 4 years ago

It will be fun to see how tech companies will react when they get to taste their own “my platform my rules” medicine.

giorgioz7• 4 years ago

ah wow this is a brilliant sentence! I never saw governments as platforms but they DO ARE! In fact I was always critizing Apple App Store 30% by saying: "What is the App Store a government that can charge me a 30% tax?" and in fact my fear is the reconstruction of a DIGITAL FEUDAL SYSTEM.

Where there is a King that charge a tax and then there is smaller and smaller nesting of feudal lords that charge other taxes.

KING US Government charging 20-45% income tax

  DUKE Apple charging 30% App Store tax
  
  DUKE Google charging 30% Google Play Store tax
  
  DUKE Microsoft charging X% Microsoft Store tax
    
    MARQUEES Spotify/Netflix/Airbnb charging a fee for their platform

I think we need to be careful to not smother the fire of innovation which brings social mobility across classes/income groups. If we allow Apple/Google/Amazon/Facebook to suffocate the innovation coming from the smaller companies we might find ourselves into a new medieval/dark age period with a lot of zero sum games and hierarchy and little innovation.

blue12• 4 years ago

*Marquis

dgb23• 4 years ago

The economist Yanis Varoufakis elaborates on this. I think he makes a good and important point, and is incredibly smart and knowledgeable. But I also think this view of economy and corporations is too total. In the end these things are symptoms.

zajio1am• 4 years ago

KING US Government charging 20-45% income tax
DUKE Apple charging 30% App Store tax

Note that Income tax is in reality earnings tax (as expenditures are generally subtracted), while Apple/Google fee is based on just income.

lowbloodsugar3• 4 years ago

Seems like you are arguing that Apple should be able to choose which government it wants to run under when using the France platform.

can16358p9• 4 years ago

While I think big tech needs to be controlled, I think this is the wrong approach.

This will slow down development by being forced to implement interop where they shouldn't be forced to IMO, and will confuse less savvy users (e.g. "Why can't I send this $platform_native_content to Bob but can send perfectly to Alice in the same app?").

Controlling entities' presence within the public (the Internet) is one thing, forcing to do things within their own platform/domain is another.

Sadly, EU picked the latter.

Vespasian6• 4 years ago

Well then they better get their shit together and implement the features on both ends.

They have lots of devs and project management experience. If they don't want to do interop it's just fair that customers are complaining.

Nothing a typical chat group on WhatsApp uses is particularly innovative or unique. Text, Voice, Images, Video, map links and attachments probably cover roughly 99% of the use case and everyone supports that.

They are free to compete on additional features.

can16358p9• 4 years ago

They can, but why they should be forced? I mean its their own platform, they shouldn't be used to offer interop. They _could_, if they wanted to, but it's their platform after all, and forcing a private company to open their own pripriatery platform to 3rd parties is plain wrong and against the rights of the company. It's theirs after all.

The right thing here would be making a standard, modern way of communication that supersedes SMS/MMS with a push for global adoption that has all the necessary features of sending videos/images/links/locations etc. with E2EE that is part of GSM technology suite which is either super cheap or free, to offer a sensible alternative to free but closed down services offered by giant companies. That would be much more fair play for a free market.

the_duke2• 4 years ago

Full functionality with platform native users, limited functionality with third parties is still a lot better than no functionality for third parties.

The bigger issue is malicious compliance. I can see companies deliberately making the experience horrible.

can16358p9• 4 years ago

I think it will just mess things up UX-wise. From what I've observed, people expect things to be simple and just work.

If there is an inconsistency introduced (e.g. I can send something to one user but can't to another) it will just confuse the users more.

About malicious compliance, yup, it will probably happen. If I were a company with my platform and someone comes to me and says that I have to open up my own private platform, I probably would implement the bare minimums to not get fined, and cripple that part in every conceivable way, while still "complying" with the law. I'm a private company and want people on my platform, simple as that.

fifticon• 4 years ago

I fail to see any relevant innovation happen in the current fragmentation of giant silos.

can16358p9• 4 years ago

Well, it brought up to here what we have. Even though there are many people complaining, what we currently have, even if fragmented, is a great collection of apps that are free and allow us to send text/images/videos/rich links to anyone using the app on Earth in a split second.

Not saying that it couldn't happen in other setting, but innovation definitely did happen in the current fragmentation of silos.

andrew_3• 4 years ago

We've been living with similar limitations for a very long time now. See: blue versus green SMS bubbles. As an Android user, iOS-sent SMS/MMS means lower quality photos, extremely low quality video, and I get "So and so loved this message" instead of a heart emoji. I believe people will adapt and recognize differences quickly.

ByteJockey• 4 years ago

forced to implement interop

I didn't read this as the EU forcing the apps to actually implement interop. I read it as forcing them to publish the details of their protocols and not ban people for using 3rd party clients.

Now, will market forces force them to implement interop? Maybe, but based on my reading an app that doesn't talk to other apps is still legal.*

*Do not base your entire business strategy off of a single HN post from someone who is not a lawyer.

Havoc• 4 years ago

Seems like a good thing.

Looking at the google lawyer privilege drama it sure seems like big tech needs a firmer hand

naoqj3• 4 years ago

It's so easy to destroy a sector when you have nothing to lose.

giorgioz7• 4 years ago

Can you clarify in this instance what is

- the sector

- who has nothing to lose

- and what could be lost

I think I understand who/what you imply but I don't want to misunderstand you.

naoqj3• 4 years ago

* Tech sector

* The EU

* Tech sector

ckastner3• 4 years ago

It's so easy to destroy a sector when you have nothing to lose.

The EU is choosing to favor acting on behalf of their people, rather than some sector. If that sector can't make money in ways that are not immoral with regards to the people, so be it.

For example: Why shouldn't a 30%-fee walled garden be destroyed?

naoqj3• 4 years ago

Because it's their corporation and they can do whatever they want with it, and because it's far from a monopoly since there are alternatives.

robertlagrant4• 4 years ago

30% fees are not immoral. You may not like them, but that's very far from the same thing.

A moral question would be "how much should governments control voluntary interactions between customers, platforms and products?" The immoral answer might well be "As much as it will help them gain short-term votes", not the moral one.

postingawayonhn2• 4 years ago

I don't feel like I need protecting by the EU. Overall I'm very happy with the products produced by the US tech sector.

amelius• 4 years ago

EU has tech (Linux, ASML), they just chose to not screw their real users, a costly but morally better decision.

igorkraw3• 4 years ago

I pray that this, especially the interoperability requirements comes through not only with teeth, but with claws and a ravenous hunger. I believe one of the key things that allow innovation to foster is beating down the rentseekers,i.e. enabling adversarial interoperability https://www.eff.org/fr/deeplinks/2019/10/adversarial-interop... and making it easy for individuals to tinker and innovate without needing capital or lawyers to protect themselves. I am severely envious of the californian "right to compete" for these reasons https://www.callahan-law.com/are-non-competes-enforceable-in... and a "right to interoperate" will go a long way towards breaking monopology-enabling network effects.

sofixa7• 4 years ago

There are serious fines attached ( up to 10% of global turnover, 20% for repeat offenders) so it will have plenty of teeth.

lekevicius• 4 years ago

GDPR was up to 4%. As far as I know, this was never applied to anyone. I would expect the same here. Fines will likely be somewhat reasonable.

tomp• 4 years ago

“up to” isn’t serious

“at least” would be serious

But that would require for politicians to actually want to do something to benefit the people, not just themselves and their bribers/lobbyists.

Isinlor• 4 years ago

Digital Markets Act give very broad executive powers to EU Commission to make sure that it will get implemented.

Specifically:

- article 7: Compliance with obligations for gatekeepers

- article 10: Updating obligations for gatekeepers and

- article 11: Anti-circumvention

Fines are up to 10% of annual global turnover, or daily fines up to 5% of average daily annual global turnover.

In more detail:

Article 11, Anti-circumvention

1. A gatekeeper shall ensure that the obligations of Articles 5 and 6 are fully and effectively complied with. While the obligations of Articles 5 and 6 apply in respect of core platform services designated pursuant to Article 3, their implementation shall not be undermined by any behaviour of the undertaking to which the gatekeeper belongs, regardless of whether this behaviour is of a contractual, commercial, technical or any other nature.

2. Where consent for collecting and processing of personal data is required to ensure compliance with this Regulation, a gatekeeper shall take the necessary steps to either enable business users to directly obtain the required consent to their processing, where required under Regulation (EU) 2016/679 and Directive 2002/58/EC, or to comply with Union data protection and privacy rules and principles in other ways including by providing business users with duly anonymised data where appropriate. The gatekeeper shall not make the obtaining of this consent by the business user more burdensome than for its own services.

3. A gatekeeper shall not degrade the conditions or quality of any of the core platform services provided to business users or end users who avail themselves of the rights or choices laid down in Articles 5 and 6, or make the exercise of those rights or choices unduly difficult.

toyg8• 4 years ago

The stated aim is to reduce the need for complex antitrust cases, so yeah, chances are they will come with significant teeth - in the form of baseline requirements that you either clear or get automatically fined for.

giorgioz7• 4 years ago

Oh founders please do not sell your shares to Apple/Google/Microsoft/Facebook/Amazon!

We are in danger of creating Big Monsters that will devour everything until there won't be founders anymore...only employees. Once there will be only employees in truth there will be only servants.

We need a lot of small/medium tech companies to maintain freedom and competition instead of 2-5 mega corps.

tommiegannert• 4 years ago

The future will be/is that entrepreneurs create new cool stuff, and runs it until the valuation is high enough they feel it's pay day. They sell to big corp, who are large code maintenance (and patent accumulation) shops, scales them to bigger users and runs until deprecation.

The entrepreneurs, though, continue on with the next idea.

belter• 4 years ago

Digital Markets Act- [Status]: "Awaiting Parliament's position in 1st reading"

https://oeil.secure.europarl.europa.eu/oeil/popups/ficheproc...

"The Digital Markets Act: ensuring fair and open digital markets"

https://ec.europa.eu/info/strategy/priorities-2019-2024/euro...

From here:

https://news.ycombinator.com/item?id=30777016

"...The legislation is now expected to target companies that have a market capitalisation of at least €75bn and run one core online “platform” service such as a social network or web browser, according to two people directly involved in the deal..." "...To qualify as a “gatekeeper” — the powerful internet groups that are the focus of the new law — a company will also have to have at least 45,000 active users, the same people said..."

"...Google, Amazon, Facebook, Apple and Microsoft all meet this standard, but it is likely to also include far more groups than previously thought such as accommodations site Booking.com and ecommerce group Alibaba..."

----------------------------------------

Examples of the “do’s” - Gatekeeper platforms will have to:

- Allow third parties to inter-operate with the gatekeeper’s own services in certain specific situations

- Allow their business users to access the data that they - generate in their use of the gatekeeper’s platform

- Provide companies advertising on their platform with the tools and information necessary for advertisers and publishers to carry out their own independent verification of their advertisements hosted by the gatekeeper

- Allow their business users to promote their offer and conclude contracts with their customers outside the gatekeeper’s platform

Example of the “don’ts” - Gatekeeper platforms may no longer:

- Don't treat services and products offered by the gatekeeper itself more favourably in ranking than similar services or products offered by third parties on the gatekeeper's platform

- Don't prevent consumers from linking up to businesses outside their platforms

- Don't prevent users from un-installing any pre-installed software or app if they wish so

----------------------------------------

nonrandomstring4• 4 years ago

This has to extend to business as well as consumer use. Give people the power to choose technology in all contexts. That's all we need.

You use Zoom, Teams, Facebook or whatever you like, I'll use my Jitsi or home grown WebRTC solution. Fairness can be that simple.

But interoperability legislation can only go so far to fixing things because we also need to tackle:

- Regulator and institutional capture by vendor lobbying (bribes)

- "Preferred solution" impositions masquerading as fake security "policy"

- Lack of skills in organisations.

- Poor education about the risks of technological mono-cultures

- Technical lock-in measures, DRM, TPM enclaves

BigTech domination has been going on for 10-15 years now, and it has become more than just than just a set of facts around market shares and network effects. It's gotten soaked into our culture and the marrow of our institutions and will take a good deal of pain to chase out.

kmlx8• 4 years ago

You use Zoom, Teams, Facebook or whatever you like, I'll use my Jitsi or home grown WebRTC solution. Fairness can be that simple.

that's naive. the problem is that we moved away as an industry from that model for 2 specific reasons:

- widely used standards take decades to change just slightly, or never (see SMS, email)

- interoperability means either lowest common denominator or a huge cost to keep things interoperable

both are horrible for innovation, both are a killer for funding, both pull money away from other things.

all for giving "jitsi" or your "home grown webrtc solution" a reason to exist.

meanwhile apps like zoom simply took everyone by storm during covid even thou lots and lots of others (including webrtc and jitsi) existed for a long time.

nonrandomstring4• 4 years ago

that's naive.

Please attack my arguments, don't make aspersions as to my disposition.

the problem is that we moved away as an industry

Please don't try to define the narrative from a parochial viewpoint. No. we didn't. Some of us did. And those few have arguably done a great deal of damage to "the industry".

widely used standards take decades to change just slightly, or never (see SMS, email)

It's arguable that they _should_ take a long time to adapt, because stability is also a value. That doesn't preclude the emergence of new and better standards which have a fair chance of adoption in the market for protocols. Interoperability would be a key factor in their success of course.

interoperability means either lowest common denominator

I see no justification for this statement. There are many factors that portend lowest-common outcomes, like efficiency, reckless engineering in pursuit of fast time to market... but interoperability isn't one of them.

or a huge cost to keep things interoperable

This is what you're really shooting at isn't it? Less profit for people who want to "move fast and break things" and get out when they're done extracting. I prefer to build lasting things and treat technology as a part of long-term culture. It's just a personality type thing.

horrible for innovation

Advancing dichotomy between standards and innovation is simply disingenuous. The entire existence of the internet is a counterexample.

killer for funding, both pull money away from other things.

Money.

all for giving "jit.si" or your "home grown WebRTC solution" a reason to exist.

No. Everything else you've said is about differences of value and philosophy. Fair enough. But on this point you are missing some fundamental understanding of technology.

It is not "all for" my choice. Choice is a means not an ends. Choice is what underpins the drive for innovation, but ultimately there is telos (purpose) in technology beyond making profit. Those ends include resilience, opportunity, reliability, hybrid vigor of hetrogenous systems to name a few. Naivety is having a partial or immature understanding of a bigger picture, though I would not accuse you of that of course.

respects

nonrandomstring4• 4 years ago

You do realise that Microsoft Teams, Meet and Zoom Browser clients are all basically WebRTC underneath right? (Sometimes changed to make them deliberately incompatible with everything else).

Zoom illegally sold users' personal data [1] and Teams unsurprisingly turned out yo have all the security features we'd expect from Microsoft [2]. Jit.si comes out looking pretty good.

It's hard to hold up as paragons of good tech products that required a global pandemic to do their marketing and still couldn't deliver the goods without getting caught with their hands in the cookie jar.

[1] https://www.cbsnews.com/news/zoom-app-personal-data-selling-...

[2] https://www.forbes.com/sites/thomasbrewster/2020/04/27/your-...

pjerem• 4 years ago

Did I interpret correctly that I’ll soon be able to install a multi-protocol IM app on my iPhone without going through the App Store ?

I can barely believe it. It looks monumental in terms of competition potential.

robertlagrant4• 4 years ago

The primary feature will be end to end decryption.

slaymaker1907• 4 years ago

Yep, because we have absolutely no way to do e2e encryption without closed protocols like GPG.

toyg8• 4 years ago

The "soon" has to be interpreted in a political context, so we're likely talking a few years. FAANG will put their lobbyists on overdrive to get extensions to whichever cut-off date is approved.

sofixa7• 4 years ago

Honestly that's some great news and it was about time for such a regulation. It will curtail monopolies/oligopolies and enable a lot of new innovation. Win-win, with the only "losers" ( as in lower profit margins, not actually losing anything) being the huge tech companies like Google, Meta and Apple.

niemandhier• 4 years ago

The interoperability features are needed. We all should have a look at Russia and see what can happen if your infrastructure depends to strongly on locked systems.

Sure this time we all support the sanction, next time it might be us.

tgv• 4 years ago

Interop can be useful, but who gets to collect all the data when you hoopkup e.g. WhatsApp and Telegram? Both, I'd imagine. How would you remove data/opt out of a platform you never accessed before? There's a lot of leeway there.

emilfihlman• 4 years ago

This is awful. EU has no idea how to properly regulate tech.

ddaalluu2• 4 years ago

I imagine being told which tech I have to use when developing my services. When they pay my bills they just might have a saying but only just. What even is the reasoning for this?

tebbers• 4 years ago

Pretty funny to think that Apple has been going on about their platform without realising that they run on the EU's legislative and societal platform. Which also comes with rules.

lowbloodsugar3• 4 years ago

Pretty funny that you think it's ok for EU government monopoly to enforce rules but not ok for Apple to do so, despite not being a monopoly. Which is it? Are rules ok or not ok?

pzduniak• 4 years ago

Apple didn't win any elections, so they can fuck off.

wil421• 4 years ago

So now we will have to accept 2 pop ups on every website?

dzink• 4 years ago

If only they’d apply those rule to grocery store chains as well. The model for the big ones is to charge stocking fees for any shelf space (250k per item at times) and then replace the best sellers with proprietary generic brands. So soda giants who don’t want competition can just buy out the shelf space to keep smaller players out and then lower the quality of ingredients of their mass stocked products and boost the marketing to keep the shelf space monopoly. The best new products try out and then fizzle out in that environment in exchange if more generic tastes or artificially tasting junk. This model needs to be stopped in more than just online marketplaces. It is the original sin of chain retail.

hda111• 4 years ago

I‘m not sure if this is a good thing. Despite email being an open standard we have now the situation that most emails are processed by either Google or Microsoft. When the same happens to Matrix we will have a situation where it’s so hard to make your own home server that nobody wants to do it anymore.

oxplot5• 4 years ago

processed by either Google or Microsoft

Let's first clear up why this is: spam control. Google along with the rest of the industry has essentially killed email spam through the many additions to classical email standards. From reputation based delivery, to spam databases, crypto signatures and more. This isn't just to reduce an eye sore in your inbox. Spam does real damage, financial and otherwise.

Despite the complexity needed to run a reliable email system, it's still possible to do and many do. It also allows for innovation without a lot of capital (e.g. licensing fees paid to walled garden owners). Without open interoperability, it's either impossible (e.g. general iMessage), limiting (e.g. iMessage, WhatsApp for business) or expensive to do.

pflanze• 4 years ago

Let's first clear up why this is: spam control.

I'm running my own mail server. The problem with regards to spam is not that it's hard for me not to be inundated by spam: I'm just running spamassassin and qpsmtpd with mostly standard configuration and my account on my own server is rather better at catching spam and not ham than my Gmail account. The problem I've always been fighting with (it's better lately) is that Google (and to a lesser degree Yahoo and Microsoft) tends to put my mails into the recipients' spam folders.

It's understandable that a minimal level of centralisation is necessary with email so as to build up server reputation. I think that level is already satisfied with just a few dozen or maybe hundreds of emails sent per day. If there are many installations of that size, companies like Google are forced to accept mails from them, and there's no need for further centralisation.

Google along with the rest of the industry has essentially killed email spam through the many additions to classical email standards. From reputation based delivery, to spam databases, crypto signatures and more.

I don't see Google having had an exceptional role in "killing" email spam that way. Spam databases (both server reputation as well as content fingerprints) existed before Gmail started, DomainKeys was designed by Yahoo[1], the DKIM (the current way to add cryptographic signatures) RFC[2] does not list anyone from Google as its authors, bayesian learning was published by PG[3] in 2002. Gmail launched 2004[4]. Giving reputation much weight was something easy for them to do and it does tend to come at the cost of small legit servers.

They had a solid implementation early on (both the spam filter and, for the time, a top notch HTML UI), had of course a good name, and were free, so they were a default choice for anyone who was with an email provider that didn't do well (like many (most?) ISPs). There are reasons for people to flock to a strong, large company, that's not different here, but I contest that spam necessitated this.

That said, any new protocol would do well to take the problem of handling spam seriously and learn from and improve upon the past.

TL,DR: my argument is that spam is (somewhat) easier to handle in a centralised way, just like most problems are, but handling spam doesn't inherently require centralisation.

[1] https://en.wikipedia.org/wiki/DomainKeys [2] https://www.rfc-editor.org/rfc/rfc6376.txt [3] http://paulgraham.com/spam.html [4] https://en.wikipedia.org/wiki/Gmail

cryptica• 4 years ago

IMO, based on their current business models, big US tech companies would be better off financially by pulling out of the EU entirely than by allowing interoperability via public APIs.

They will lose most of their users to small platforms if they provide too much interoperability - Not just in the EU but all over the world. Their monopoly over the bulk of the world's user accounts is their only real competitive advantage.

That said, in terms of social good, open APIs would be great.

toyg8• 4 years ago

They can (and likely will) produce a layer of bureaucracy that could keep out any non-EU player if they wish, stuff like having to register with them with EU-based company information before they give you an API key (this is just an example).

TheCoelacanth2• 4 years ago

If they did pull out, that would be probably the largest business opportunity in human history, with a $16 trillion economy suddenly having no large competitors in many sectors.

I'm sure entrepreneurs in the EU are salivating at the thought of that happening.

paxys3• 4 years ago

If that's really the case then they'll pull out of the EU market rather than comply with this law. Let's see if that happens or not.

Luker88• 4 years ago

Honestly? Looks good.

They only missed one: must provide human support for any and all products and supported services.

Google/MS/Apple have 0 user support for account/app suspension/removal and we have seen many stories here on how final those things are, and without any recourse possible

colinmhayes• 4 years ago

Pretty sure a ton of companies would cease to exist if they had to provide human support. Maybe that's a good thing, but really all it would do is strengthen incumbents who can afford the massive call center bill.

Markoff• 4 years ago

so, all the software companies need to do is implement also SMS feature in their messengers like Signal does for instance and they will be immediately interoperable, while keeping their own messaging service separated

acd• 4 years ago

Mind boggling that content recomendation by tech giant algorithms that is used by european consumers are unregulated.

The algorithms maximize content view / platform usage diregarding mental health and addiction. Further there is no regulation that the content from recomendations are from reliable truthful sources.

EU negotiators agree new rules to rein in tech giants

Related Stories