Goodbye, and Thanks for All the Bikesheds

https://queue.acm.org/detail.cfm?id=3818307

by Ygg2 • 4 days ago

291 261 4 days ago

queue.acm.org

close045• 4 days ago

And before you ask: Yes, I’m laying this one squarely down before (and partly on the toes of) the tech bros: We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary.

Ah, the famous “maybe if I take a step back they’ll appreciate it and not push harder”. Or maybe it’s “if I give the leopard my face maybe it spares my body”.

I’ll let reality speak for itself: look no further than Stingrays and every bit of legal abuse they enabled, where innocent people are spied on in bulk with flimsy excuses. How well did it work out when the protocol was already maximally compatible with laws?

There’s no “minimally compatible”, you either have the privacy technically guaranteed or you don’t. If it’s technically allowed to breach it, it will soon be done as a matter of routine under the guise of “protecting”, “preventing”, and so on.

So in the end we didn’t lose anything, what we did was we gained a short period in which we could all taste that freedom. If we used your proposal nobody would have had even that to begin with.

This logic would have been easier to forgive if it came from youth and inexperience, from someone who never got to know about the endless abuse of surveillance that was inflicted indiscriminately on everyone.

I promised myself I would never join their ranks.

A wasted opportunity, missed by at least 1 article :).

ball_of_lint2• 4 days ago

This. Author does talk about a lot of facts but seems very defeatist wrt whether an anonymous, encrypted internet can be preserved.

I do recognize their point that it's been made very hard to catch and prosecute cyber criminals. I think there are ways to improve that that don't destroy the privacy of everyone. But if that's the real goal, why isn't it the big pitch line of the Parent's Decide Act?

lkjdsklf• 4 days ago

I also found the compromise bit of the article strange

The minimally compatible is what existed before. The Snowden leaks showed that the Government, and not just the US government, would abuse the shit out of that for mass surveillance.

So now privacy advocates no longer trust that such a compromise can exist

It’s strange that the author both recognizes that the Government broke the social contract and then says privacy advocates should just keep trusting them in the same article

inigyou12• 4 days ago

A working solution can forestall a worse one. Because of the age verification law in California, which is very explicit that you only need a device-wide checkbox, nobody can use the argument that they need a passport scan to comply with the law.

close045• 4 days ago

We’ve had the “compromise” solutions forever before the harder stance tech took on privacy in the last few years, and governments abused them into oblivion. Every time the tech allowed it, it was legally abused and applied much wider than initially promised. This isn’t just about age verification but also encryption.

Every time you step back, the opposing force advances one step and soon you’ll have the same discussion again except from an even weaker position. Do you really think that once the framework is in place everyone will forever be content and not push for the next step?

Like the author, you are advocating for the “small backdoor”. Or like another commenter put it, the prophylactic that only gets you a little pregnant. There’s no such thing.

slater• 4 days ago

old men who had no idea what I was talking about but were 100 percent certain that they had the infallible answer

HN existed 20 years ago...? /s

edit: yes it did, lol

0xblinq2• 4 days ago

Proof: site design

red_admiral3• 4 days ago

Proof: not built with react :) Long may it stay that way.

sealeck• 4 days ago

It’s interesting to claim that the ‘tech bros’ oppose hardware attenuation and age verification when this will massively benefit them; everyone will be forced to use their operating system and the government will have exercised its power to protect Microsoft’s god-given right to make money, Peter Thiel’s age verification startup’s ability to collect people’s data and their ability to trace the identity of any critics through identity-based age verification.

That’s why large tech companies are lobbying in favour of this!

zeroCalories• 4 days ago

Lol this feels trite to say, but tech bros are not ideologically homogenous. You and the author are mixing up different people commonly identified as tech bros.

Scaled2• 4 days ago

Didn't know ACM was anti-privacy. Glad I haven't paid dues in who knows how long if they're spending them to platform these noxious opinions.

busterarm14• 4 days ago

It's not anti-privacy to point out the obvious that privacy-advocacy is sometimes at odds with governments and the will of voters at large.

Privacy is being abused by criminals to victimize people at scale. Just because privacy is a moral good doesn't mean you are morally off the hook for enabling criminals.

Governments are so aware of this they're passing sweeping laws against it. This is your new reality -- you can't just bury your head in the sand. The whole point was saying that there could have been a middle ground that protected more of your rights than where you're at now if it weren't for the absolutism.

Turns out that being an absolutist isn't helpful.

failuser5• 4 days ago

The laws they pass do nothing to stop the criminals. Do you think an “age verification” law can stop any criminals?

Scaled2• 4 days ago

Age verification is not the will of the voters. It is the will of large political donors (specifically tech companies and religious censorship groups). It is certainly not the will of adult citizens who use adult websites, who have overwhelming shown in their usage patterns they will abandon any website that tries to do age verification.

Parental controls remains the right way to do age gating. It works today and has no privacy impacts.

close045• 4 days ago

The guy’s logic is “if only we had allowed a small backdoor from the start they wouldn’t be forced to install a large backdoor now”. Other technologies that were open to the law were endlessly abused for surveillance.

His theory is bunk, there is absolutely no middle ground to be had with the people who want a backdoor. There are no small backdoors.

deathanatos• 4 days ago

Gotta disagree. The encryption part needed to happen: without it, there's just too much opportunity for governments to intercept unencrypted traffic and abscond with it. We saw that occur with Snowden, and with programs like MUSCULAR in particular.

I don't think it's that encryption was harmful, it's that it wasn't enough, and in a sense I agree with TFA & the Sun Tzu bit: it needed to be complemented by legislation that added decent privacy protections, and it largely wasn't. That was a mistake, I suppose, but the current political situation, esp. in the USA, disfavors privacy regulation getting done, ever. The Democrats are … maybe spiritually for it? … but not terrible effectual at getting it done; Obama's response to Snowden was "meh" at best, and Congresspeople, in particular Feinstein especially, let the DNI walk all over her. The GOP has no interest at all in regulating corporations, at all, ever, so with the House/Senate/POTUS all (R) at the moment, it's going to be until at least Nov before it is possible to even think that these might get addressed, and even that's … generous, and I won't be holding my breath for it to occur.

Stuff like what we saw in another thread today — with LG wantonly installing spyware — and things like Flock would have happened in addition to network intercepts; they are not happening instead of. Corporations and the government will do whatever the People permit them to get away with.

Dylan16807• 4 days ago

Privacy is being abused by criminals to victimize people at scale.

Almost all victimization is being done without end to end encryption. This is not a problem caused by privacy.

ETH_start5• 4 days ago

He's very clearly arguing against absolute privacy on the Internet and is saying that the people who advocated for it, which he besmirches as "tech bros", are responsible for the governments going too far now, instead of a happy compromise having been set out at the beginning, which by the way totally mischaracterizes the history of the Internet, where the governments were trying to impose total surveillance from the very beginning.

orf2• 4 days ago

Wow, you missed the entire point of the article.

chaps• 4 days ago

Honestly? It's weirdly written and incredibly hard to understand what their point is. I can't tell if they hate or love privacy.

some-are-better• 4 days ago

Wow, re-read the fine article. He was NOT stating that he wants the outcome you think. He is afraid it is going to happen because the younger generation has no clue or ability to maintain FOSS.

evilduck• 4 days ago

This whole thing can be reduced to "think of the children", see the literal example around paragraph ~30. I'm not sure I've ever seen anyone try so hard to equate being pro-privacy with being pro-crime.

schaefer• 4 days ago

From TFA:

In this last Bikeshed in acmqueue, I will ponder the far future of free and open source software (FOSS), hoping to upset so many readers that...
During the past couple of decades, rampant neoliberalism and “globalism” allowed...

And I’m out. I guess congratulations to the author. Mission accomplished.

But I’m disappointed that the article took a turn towards partisan politics.

failuser5• 4 days ago

I don’t even know which party he champions. There is no pro-privacy party in America. That quote can come from either side of the establishment. Both increased surveillance.

busterarm14• 4 days ago

None of the ones you're thinking of. PHK is Danish. Danish politics and society at large leans pretty left. Even what you might call the rightwing party there consider themselves as bourgeois-liberal, or "not-socialist". The farthest they'd generally position themselves is center-right.

Except for shit like Stram Kurs, which nobody really supports or tolerates.

ToucanLoucan2• 4 days ago

You should've kept reading:

During the past couple of decades, rampant neoliberalism and “globalism” allowed the U.S. tech industry to capture almost the entire European IT market, including all “social media.” This has recently proved to be a ghastly mistake, and now the EU, along with its member states and companies, are scrambling to claw back their digital sovereignty.

This is not a partisan political statement, it's a factual one. It is simply a statement of fact that neoliberal world markets have permitted hyperscalers to cross national boundaries and provide the same services at scale to governments worldwide, and like, without even going into any U.S. politics at the moment, isn't that... really weird? Like many EU governments had essentially put their ability to function as states in the hands of a foreign actor. That's WILD.

gordian-mind• 3 days ago

The term neoliberalism has no meaning, it's purely used in a pejorative way by leftists. If you want to talk about world markets, just say world markets. Or "free market", but it has free in it so it makes the effect less powerful.

Also, the reason the EU does not have that many tech companies is not global competition; it's that it takes 6 months to hire someone, you cannot fire them ever, and nations tax you based on your unrealized valuation because they don't really believe you should be running things on your own.

fzeroracer• 4 days ago

There are some incredibly strange equivalences going on in here that make me think the person in question is indeed quite out of date.

The people pushing for the destruction of privacy and attested software integrity ARE the tech bros. I'm sure there are people here that will vehemently disagree with me, but we see the biggest tech companies pushing for age verification and we see founders and rich folk gleefully giving up their earlier pro-privacy stances in favor of supporting locking down identity. They're building up their moat in real time because not only does it let them kill that pesky FOSS, but also it means they can legally gather even more data from individuals in question.

It also goes hand-in-hand with the increasingly authoritarian bent a lot of those same people have taken and these resources will absolutely be used to crack down on minorities and things they don't like.

I think your head would have to be firmly planted deep underground to somehow not connect the two dots. As another poster here said, they're literally lobbying for these age verification laws because it benefits them.

raincole2• 4 days ago

I was about 50% sure this whole piece is parody when I read through the LLM part, and after I read the whole thing now I'm 99% sure.

intended7• 4 days ago

I'm sure there are people here that will vehemently disagree with me, but we see the biggest tech companies pushing for age verification and we see founders and rich folk gleefully giving up their earlier pro-privacy stances in favor of supporting locking down identity.

I vehemently disagree, because this is not what is happening.

The Age verification domino toppled first in Australia, and then other governments found the example was good enough and followed suit.

The issue that HN conversations miss, is that the dominoes were set up over years. People have constantly been trying to deal with the many, many issues thrown up by social media. Issues ranging from the Myanmar genocide, content moderation, fraud, child safety, sextortion, to name just a random grab bag of issues.

Voters, governments, NGOs, victims and even tech firms, have been trying to figure out what to do for a decade+.

Voters, and non-tech-literate society used to complain about the status quo. The political will to change it reached critical mass, and is now in progress.

failuser5• 4 days ago

This is a very strange read. If that was posted on a random blog, I would have dismissed it. I didn’t know that that cell (anti tech bro, anti big tech, pro age verification laws) in the alignment chart is populated by actual people. And by intelligent people even.

Also the fact they call it “age verification” when they clearly build an identity verification and we just accept their language is crazy.

red_admiral3• 4 days ago

I have a feeling it splits by gender. I know a couple of professional programmers in that corner of the alignment chart, but they're not "bros".

inigyou12• 4 days ago

I am anti big tech, that's why I support the California digital age assurance act, it pre-empts things like persona by saying that a simple checkbox is age verification.

onraglanroad• 4 days ago

I tried to give this a fair chance but it's really an incoherent rant.

There is nothing of substance here. You don't like AI, I get. But it still exists and pretending that no-one finds it useful is utterly foolish.

Edit: I overuse the word utterly. Nice to identify one of my tells.

dgellow5• 4 days ago

He acknowledged the LLM tools are useful, and ponder on the economic viability. I don’t see something that seems to say he doesn’t like AI? he seems to be mostly a critic of AI boosters

andix4• 4 days ago

I don't think age restriction will impact FOSS in the long term. If there are some regulations that threaten FOSS now, they are going to be adopted in the long term.

Regulations for age restriction are understandable. A lot of modern technology is harming kids (and I don't mean dirty videos, social media seems to be much more harmful).

A sensible regulator would leave some responsibility to the parents, but require restrictions for consumer devices (smartphones, laptops). Maybe even enable age restrictions by default, block replacing the OS or the firmware, and only allow it once the age was confirmed.

I don't see a point of including all kind of OS or software into this regulation. Just the ones that are preinstalled on consumer devices, and commercially distributed to consumers. Once the age of the user was confirmed, the devices should be able to become as open as we know them now.

logifail3• 4 days ago

A sensible regulator would leave some responsibility to the parents

(Speaking as a parent of three) why can't we just leave all responsibility to the parents? In our experience in the offline world it seems this applies!

I speak as someone who's taken each of my three children - for two of them, multiple times - to the emergency room to be treated for broken bones incurred in the course of Real Life[tm].

Yes, they play contact sports.

Yes, we use Family Link with pretty restrictive settings.

Despite the series of broken bones, I'm still in favour of kids playing sports and still dubious about the effect of screen time on young minds...

mejutoco2• 4 days ago

Even in the offline world that is not the case. Ex. Alkohol sales

Barrin922• 4 days ago

why can't we just leave all responsibility to the parents?

because we don't live in a 15th century peasant village. The average adult reads at a 7th grade level, 20% of adults are considered functionally illiterate, most adults can't navigate digital spaces, privacy and social media themselves or take on trillion dollar companies.

This also hasn't applied in the offline world since idk, Kant and Hegel, every modern state recognizes that children are persons and citizens in development, not private possessions. If your children have broken bones you can't explain or your parenting is considered to threaten the welfare of your child you can be pretty sure you'll have the authorities at your door quickly, and countries like France have given children the right to sue their parents in case they breach their digital privacy. So called 'sharenting' laws exist because it's not guaranteed that parents are even respecting the privacy of their own children.

II2II• 4 days ago

(Speaking as a parent of three) why can't we just leave all responsibility to the parents?

Then I'm sure that you appreciate that there are both legal and informal checks in place ensuring that you can take responsibility for your children in the offline world. For example: I would be surprised if your children were able to play organized sports without your permission. Failing to ask for permission would deny you the responsibility of protecting your child as you see fit.

intended7• 4 days ago

Why do you use yourself as an example of parenting?

The issue isn’t the parents who can’t imagine bad parenting.

saghm8• 4 days ago

I strongly disagree. There are no kids in my household, and no one else ever uses my devices, so the idea that I need to prove that I'm not a kid for me to be able to pay bills or file taxes on a stock device is ridiculous.

dash23• 4 days ago

I don't understand the force of that argument. Where is the "so" coming from?

delusional4• 4 days ago

Is anyone proposing age verification to file taxes? I'd hope you already have to provide some sort of stronger proof of identity to file a tax return anyway.

armchairhacker3• 4 days ago

"Age restriction" can be implemented where stock devices are completely unrestricted. For example, just with better parental controls and education: children don't have access to property, so the parent takes their device and enables the parental controls, but you own your device so leave them disabled.

And this wouldn't affect Linux or FOSS: on a child's device their parent installs either a proprietary OS or a FOSS with parental controls, but again, on your device you install whatever you want.

zug_zug• 4 days ago

A lot of modern technology is harming kids (and I don't mean dirty videos, social media seems to be much more harmful).

If that's all we want then that's trivial -- just make certain phones that don't have access to social media, or have whatever limitations enforced. And kids only get those phones. I don't think anybody's addicted to desktop social media.

This gets us the privacy and the protection at once.

inigyou12• 4 days ago

That's how the California act works, but we lumped it under "age verification" anyway. If you have to select whether the device is for someone over or under 18 in a drop-down menu, apparently that's "age verification"

intended7• 4 days ago

It likely would! It is also probably the better solution all in all.

However society doesn’t have the stomach for that (yet).

Also, as the article correctly identified, society is gearing up to deal with other types of crime online.

tbrownaw• 4 days ago

social media seems to be much more harmful

The stuff I've seen on this doesn't look terribly convincing. It seems to mostly be along the same lines as saying that since some people get bullied or hang out with a bad crowd, socializing in general is harmful.

leftyspook• 4 days ago

The sensible regulation would be aiming at socially harmful features of tech, not forcing people to provide proof of identity to a third party in order to continue harming themselves with the same exact features.

Imagine if such an approach was taken to, for example, food safety? Instead of closing down a restaurant that has poor hygiene, you'd be instead horce the restaurant to hire a private security contractor to check people's IDs to verify that they are old enough to consent to getting a foodborne illness. That's an absurd approach.

fragmede2• 4 days ago

Except we do that for venue that serve poison aka bars, so if you put it that way, it doesn't seem totally absurd.

andix4• 4 days ago

Sadly a lot of tech is potentially harmful for kids. And also adults, but they should be able to handle it better.

But it extends to many other common items. Kitchen knifes, cars, lawn mowers, ...

skybrian2• 4 days ago

I think a reasonable way to divide up responsibilities would be identify child-locked devices, not people. It should be trivial for a website to identify a device with a child lock turned on. Then it's up to parents to make sure their kids get a child-locked device. Manufacturers can make it easy to turn on, and society can help by not selling devices to kids without a child lock turned on.

It won't work against a determined teen (too many unlocked devices out there), but it doesn't have to work perfectly to change the culture that most kids have to deal with.

inigyou12• 4 days ago

This is part of the very sensible Digital Age Assurance Act that is currently the law in California. It prohibits facial recognition, but requires each device to have a child lock. FOSS can implement this no problem.

close045• 4 days ago

What disconnects this discussion from reality, and maybe causes questions like “why don’t they just do it this way”, is the assumption that this is really only or even mainly about age verification and “protecting the children”.

The reason it’s not done “this way” or “that way” even when those are objectively better ways to achieve the stated goal, but rather in an unexplainable way broader way is because the goal is broader that that and age verification is just the tip of the spear. The rest of it is laying the groundwork for a framework to control the freedom on the internet by linking identity to speech and action.

Look at what solution is implemented to decide what problem is it supposed to fix, otherwise you’re just looking at the smoke and mirrors.

Not that every state and country is on board with this, but it’s getting a lot harder to maintain the pressure to keep these initiatives down. Every time they get pushed one step forward it’s that much harder to regain that ground.

pornel• 4 days ago

I think legislation could quite sensibly require OSes and browsers to have easy to enable well-integrated parental controls (which mostly already exists). Browsers could voluntarily send "I'm a child" flag, if you want to make it every website's problem.

But the current legislation is stupid. Treating toddlers like hackers, and forcing every website to deanonymize users. It is so backwards, that it's hard to believe it's not done on purpose as the first step to ban anonymity and strictly control all online access. In the UK of course they're already talking about having a VPN ban, because the hacker toddlers are learning how to mask their IP addresses.

imhoguy• 4 days ago

It is already happening. E.g. soon F-Droid and any unattested open source Android app distribution will be gone, due in Sep 2026.

Same with GitHub and similar, we have CLAs for a while now for licensing. But I see project maintainers are frustrated with AI generated slop PRs and bad actor contributions. The ecosystem will be closing. You will be able to read code, but forget creating PR without some ID verification (because this is for kids or against terrorism).

andix4• 4 days ago

soon F-Droid and any unattested open source Android app distribution will be gone

This is not connected to age restrictions. It might've been used as an excuse.

st3fan• 4 days ago

"LLM-assisted code review won't be a huge disruptor" is quite the prediction. Because it already is in a very big way. The take on LLMs seems incredibly out of date and out of touch with reality. (Which of course, has moved/advanced very fast the past months/year)

readthenotes1• 4 days ago

Maybe he's trying to prove the point of why he's ready to retire...

delusional4• 4 days ago

Did you continue reading? His argument is exactly that, like all the previous model checkers, LLM's are going to give us some bugs for a while. Then that is going to stop.

His argument is not that they aren't going to find any bugs, but rather that at some point those bugs will be fixed. At which point we will continue on as usual.

simianwords4• 4 days ago

At which point we will continue on as usual.

This part is the load bearing claim. Why would you continue on as usual? I'm using LLM's everyday on code reviews and they still catch bugs.

refulgentis• 4 days ago

I did, his argument is that we've already discovered ~50% of all bugs discoverable by LLMs.

I'm treading lightly after you said "did you read it" to OP, I do believe we both understand that argument isn't nearly air-tight. (i.e. it implies either humans get so good at code that bug-introduction-rate falls percipitously, or, LLMs are so awesome they write all of our code bug-free. Neither of which jives with the thesis, that LLM code review is a nothingburger long term)

The best steelman we could say is "he meant 50% of all existing bugs in all currently existing code", which is still incompatible with a time-bound on their usefulness, unless we expect the rate of new code to fall percipitously.

The steelman I'm using, is they're speaking both loosely and strongly and intend us to understand these are strong opinions, held loosely, and they care for us enough to share.

ang_cire2• 4 days ago

How would they stop? Are you insinuating they're going to have reviewed all code at some point, and that new code for them to review will just cease to exist? Or that they'll just decide to stop finding bugs they're finding now in new code when they review it? All the previous model checkers didn't stop giving us bugs to fix, which is why his premise is wrong; every big company is still running SonarQube because it still gives you bug findings. So will AI.

If the argument were instead that it will cease to find new classes of vulnerabilities and bugs, that may very well be true, because that is a question of the limitations of programming and at a lower level computer architecture, but that's not the argument the author made.

dgellow5• 4 days ago

That’s not his prediction, he made it clear they are useful. His conclusion for that section is this:

The only real question for me is: Are the LLM-code-review tools economically viable outside the bubble?

simianthoughts3• 4 days ago

So is he suggesting that in the future, models of Opus 4.8 tier will no longer be as affordable? Like it would become 3-5x more expensive?

Now that's quite a prediction.

layer84• 4 days ago

He explains how he thinks it won’t be a disruptor:

Just on that repeated experience, I suspect we have already seen more than half of the “worst software bugs found with LLM-tools” list.

On the other hand, it’s not clear to me how you think that it already is “in a very big way”.

ang_cire2• 4 days ago

Which is such a crazy assertion, given that not even Mythos was trained explicitly as an exploit finder. Even if the US's profit-driven capital for AI dev dries up, China's state funding for results-driven AI isn't drying up, and they're going to keep building better models as long as the results are there (which they are), for better or worse.

j452• 4 days ago

Was it ever decided on what color the bike shed should be painted?

red_admiral3• 4 days ago

The whole age verification thing is being pushed by one "techbro", because he wants others to deal with cleaning up his mess.

SoftTalker2• 4 days ago

I make this point pretty much every time I comment on this subject and it's generally downvoted. It's more than one, but one may be the most obvious. The social media and big tech companies made their bed here. They want to operate as if they have no social responsibility and just blame all the bad stuff on users and parents. This was never going to fly over the long term.

encomiast• 4 days ago

There's another misdirection here as well. Much of this mess doesn't just affect children. It's really pretty bad for everyone.

ai_critic• 4 days ago

First read of this pissed me off, but subsequent reads gave a much different opinion.

Do yourself a favor and read this, a few times, and take a moment to actually try and see what the author's getting at.

delusional4• 4 days ago

And please remember that Poul-Henning is an old-hat and well respected in the field, he's also not a product of American culture. Consider that he might have some useful insight that covers some blindspots your particular culture might not.

bothers3• 4 days ago

The relevant field is politics, not CS.

ball_of_lint2• 4 days ago

Oh it's so nuanced and hard to parse that he's arguing for compromise.

The trouble is, compromise isn't really a tenable option with encryption. Either you make a draconian law that forces all electronic devices to run approved software only, or people will have access to easy encrypted messaging. There's really no middle ground, because where the smallest weakening of encryption affects everyone's privacy, only outlawing encryption completely will get it out of the hands of criminals. The cat's out of the bag.

Author here and in earlier writing seems to make the argument that a little compromise would make the courts less unhappy, but I think that's misattributing motivation. These laws actually are originated by big tech, who think they will be shielded from liability and make more money off of selling your data. https://github.com/upper-up/meta-lobbying-and-other-findings

sfn42• 4 days ago

make a draconian law that forces all electronic devices to run approved software only

That would outlaw programming. It's just not feasible at all, anyone with any kind of tech literacy understands that encryption is here to stay. It's also necessary for the web to function at all for the things we use it for, such as banking.

There is no way to prevent people from communicating in secret. Even if they did strictly control digital communication people would just communicate some other way.

intended7• 4 days ago

I don’t think the author is arguing for compromise though?

I think the author would love to see more enlightened policy, but he doesn’t believe it’s going to happen. Hence the closer: “ Please make my predictions come out wrong.“

Also, these laws don’t simply originate from big tech. That particularly OSINT study was done by someone who wrote their own interpretation of the data points they uncovered, to create a narrative that was comforting to them.

Big tech has been aware that a reckoning was coming, because they and safety advocates have been fighting for years now. The fact that there was no actual teeth or ability to enforce e regulation, and that harms were evolving beyond reason and imagination was general knowledge.

Meta is lobbying to influence the shape of the manacles they know are coming.

dwedge2• 4 days ago

I struggle with this because the author is lumping FOSS and "tech bros" together as taking the blame for what a handful of large corporations have done, and thinks that our punishment is what those large corps are lobbying for. It seems like an argument that this is a necessary evil to protect the kids - despite admitting that this is not the real reason for the laws - and then says that those of us who care about privacy are either very rare or "mythical".

bothers3• 4 days ago

I struggle with this because the author is lumping FOSS and "tech bros" together

This is on purpose.

This is the intent.

forgetfreeman2• 3 days ago

Individuals who genuinely care about privacy are absolutely mythical in the tech industry. If they were commonplace Google would find themselves under continuous seige by a combination of protestors and bizarrely well-funded FOSS projects aimed at every business niche they inhabit. Doubly true for Meta. Bitching online about proposed legislation while private industry maintains exquisitely detailed records of every aspect of your existence is at best performative.

jubilanti• 4 days ago

I detest this writing style, where you assert arguments you don't actually believe in and know are in bad faith, in that sniveling "prove me wrong" tone, to provoke some kind of reaction.

Well, mission accomplished, reaction provoked. I'm not going to read this multiple times. I'm going to fire off this comment and remove it from my brain forever.

fragmede2• 4 days ago

Not a fan of Cunningham's law, I see.

https://lawsofsoftwareengineering.com/laws/cunninghams-law/

fsckboy• 4 days ago

are you referring to GP or OP or both?

j452• 4 days ago

I'm surprised to see a publication about ACM join in the blabbing about LLMs instead of show and tell.

Talking isn't doing, just like word generation isn't an outcome.

simianwords4• 4 days ago

I think the mechanism is that ACM has a certain archetype of "bro" self selected into the group. They all have similar views like hating big tech, loving FOSS, pro government regulation and so on. The author probably fills a gap of a priest. This publication itself needed a priest to do the sermon and who better than the author. He touches on all the points of interest here and there and keeps everyone satisfied.

At least, this is what I have come up with because this blog is mostly incoherent blabbering.

raincole2• 4 days ago

the weights of the model—which you have to sell many million times over before you turn a profit—easily fits on contemporary pocket-sized storage devices.

Which model is this author talking about? Which pocket-sized devices? Where can I get them? No one is using Gemma 4 to find cybersecurity issues.

Edit: there are a lot of sentences that I can't distinguish from sarcasm in this article. I guess I read it too seriously.

dgellow5• 4 days ago

He’s talking about storage required for the weights. Not actually running the model.

A large model like Kimi 3 should be something like, 1-2TB? That’s a pocket size hard drive

layer84• 4 days ago

There are even 2 TB USB thumb drives.

busterarm14• 4 days ago

I guess tech has grown too large and fractured and maybe most working software engineers are too young to be familiar with phk and his points of view.

He's been a strong privacy and FOSS advocate for decades and has more credibility on both of these topics than nearly anyone on this board.

He also has an account and comments frequently. phkamp. I suggest reading some of his comments before making judgment.

So many kneejerk and nuance-less opinions. Absolutely hilarious that people are thinking the guy who wrote MD5crypt and BSD Jails is anti-privacy.

Also eye opening watching how many people are getting frothing-at-the-mouth mad seeing somebody with that pedigree coming to different conclusions than they do.

mananaysiempre• 4 days ago

Sadly, after the 2024 anti-E2E-messaging piece[1] I do in fact think he’s pretty anti-privacy overall. Perhaps calling that pro-regulation is more correct, but my (non-American) experience over the last, say, twenty years does not include literally a single piece of regulation that traded privacy for more government control (however reasonable) and went well, so, same difference. Accomlished hacker holds some wrong-to-downright-harmful political opinions; wouldn’t be the first time.

[1] https://queue.acm.org/detail.cfm?id=3703126

busterarm14• 4 days ago

It's extraordinary to me how highly intelligent people can't tell the difference between saying "don't this because people don't have the right to do it" and "don't do this because even if you're correct you'll go to prison for it".

That's the difference he's pointing out in your linked article. There's nothing "anti-E2E" about that piece that he wrote. He says explicitly that people can have whatever standard of encryption they're comfortable with in the post. His piece is entirely about letting all parties to communication decide their limits on privacy. It's a solution that lets people maintain their rights, lets businesses stay compliant with the law and also meets with political reality.

The staunch privacy advocates acting like privacy has to be all or none are right but not in the way they believe. If you continue to build privacy technology where the only option is total privacy then don't be surprised when nation states take all of your privacy away. There's no privacy in prison.

Also you can be totally justified in working on such tools, but western liberal governments will still imprison you for it. Hell, a guy sat in jail for four years just for ignoring a court order to unlock his phone (United States v. Rawls). He won the appeal but still sat in prison and judges can do that. That's kinda the point of the article.

phk is doing nothing more than telling people the temperature of the room outside of their bubble.

girvo3• 4 days ago

I’m mostly seeing people disagree with the substance of his argument, though. Your argument through authority is weak.

busterarm14• 4 days ago

Really? I'm overwhelmingly seeing people just complain and call him a crank without really making any arguments. There are some arguments but it isn't the majority of the comments, or even what I was responding to.

hassan18911• 4 days ago

yeah man its cool

arbirk• 4 days ago

Just use fedora

r_lee• 4 days ago

my personal guess is that the opportunities for anonymity on the Internet will shrink until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone. As the parent of a daughter, I am totally on board with that.

depends on the age but.. they've probably discovered all kinds of shit already or heard about it from others

elric• 4 days ago

I don't think he was talking about "the birds and the bees"-talk, but about the "some random men will send you unsollicited dick pics just because you're a girl"-talk.

Joker_vD2• 3 days ago

A talk like this, but broader and including all kinds of human communications/interactions in general (including AFK/off-line interactions), will still be needed to happen between a girl and the girl's parents in the foreseeable future, due to the basics of human nature; it may as well include the online behaviour.

After all, there is a reason why "some random women will send you unsolicited vag pics just because you're a buy"-talk doesn't need to happen with boys.

sfRattan2• 4 days ago

The attitute expressed in the quote, "until mothers no longer are forced to have 'the talk' when their daughters get their first mobile phone," is both wrong in its assumptions and dangerous for its well-known consequence: the enabling of petty tyranny. Forced, indeed.

There will never be a world populated by humans in which you do not need to have numerous talks with your children about the nature of humans, especially humans they do not know and cannot trust, and about the technology those other humans know how to use. Saying you are forced to do so on account of some particular new technology is like saying you are forced to provision food for yourself on account of this newfangled capitalist system... As if needing to provision food for oneself were not a state of affairs dating back to the dawn of cellular life. And as if the uglier parts of human nature emerge from the smartphone and do not in fact date back to the dawn of humanity as a species.

Demanding everyone on the Internet show their papers to the government so that the author can hand their teenage daughter a free, always-networked pocket computer plus microphone and video camera without having to think about any related risks is an attitude repugnant for its laziness, its entitlement, its delusion, and most of all its contempt for the freedoms of others.

antonvs2• 4 days ago

Well put.

But the problem is, those same forces you're describing are employed to fool people into believing the fictions that support these regressive movements. The real danger we should be focusing on is "won't someone think of the impressionable adults".

listic• 4 days ago

until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone

I fail do imagine what kind of world is he implying.

simianwords4• 4 days ago

He really seems to think he made some deep insight on the "bubble" that he seems so confident about.

So, it is not obvious to me who will be training new iterations of these models once the current bubble explodes, in particular if the returns are diminishing the way I have experienced.

It looks like he has no clue on how market equilibriums work. He really seems to think LLM's will just like.. stop existing.

So in their world, people would suddenly realise that AI is actually not that economic and we can't have Opus 4.8 quality models just with updated knowledge cutoff perpetually. So in his future, things won't just stall, they will literally go back.

He's really putting his emotional weight on this particular kind of future.

Either that or he's making nebulous emotional claims - its his blog so he can do it.

throw0101a• 4 days ago

For those unaware, PHK created (amongst other things) the MD5crypt password hashing algorithm ($1$…). It came before bcrypt (1999), scrypt (2009), SHA2crypt (2016), etc, and was committed in 1994:

* https://svnweb.freebsd.org/base/head/lib/libcrypt/crypt.c?re...

* https://github.com/freebsd/freebsd-src/commit/3b2b7f71deba2a...

* https://phk.freebsd.dk/sagas/md5crypt/

* https://en.wikipedia.org/wiki/Poul-Henning_Kamp

bothers3• 4 days ago

Okay.

What qualifications does phk have that are relevant to the current subject?

necovek2• 4 days ago

He has a daughter and thus does not want to worry about her online well-being yet (see article).

But I believe that's misplaced, because she will be vulnerable as an adult, and there was never a way to produce encryption which was not easy to turn to non-crackable encryption for those not wanting to play along with national laws.

lysace• 4 days ago

To clarify: not MD5 itself. It was created in 1991 by Ron Rivest. (It is my experience that knowledge of these things isn't as widely distributed as one might hope.)

I first came across it in 1995/1996: Wow, what a magical tool for backend web stuff! I used it for everything.

vanderZwan• 4 days ago

Wait, is that the same guy who co-authorer the Floyd-Rivest Algorithm? Hmm, looks like it[0]. Huh, neat.

[0] https://en.wikipedia.org/wiki/Floyd%E2%80%93Rivest_algorithm

NooneAtAll3• 4 days ago

is the difference between MD5 and MD5crypt the same as between Java and Javascript or are they actually related somehow?

ctoth• 4 days ago

When Edward Snowden revealed that Somebody Important had been taking an interest after all, the tech bros, who had grown up free of adult supervision, felt betrayed and started a campaign to encrypt everything and anything so that prying eyes could never again look them in the cards.

TIL: Phil Zimmermann was a "tech bro" and had a time machine.

PeterStuer• 4 days ago

"We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary"

Unfortunately, no, you can't have a prophilactic that just makes you a little bit pregnant. We used to know this.

sneak2• 4 days ago

Right now, there is a LOT of shrill propaganda from the tech bros, who call themselves “privacy advocates,” about how mandatory age checking is the gateway drug to comprehensive identity checks on the entire Internet, and ridiculing the valid civic concerns governments are trying to address as merely “think of the children” strawman arguments.

Oh, it’s not a slippery slope. It’s a single step: age verification IS identity verification, and it abolishes anonymous publishing on the internet, allowing on day one for violent retaliation against political speech.

If you think that authoritarian governments won’t be abusing this instantly, you are sorely ignorant of history.

inigyou12• 4 days ago

What is the Digital Age Assurance Act in California? Is it identity verification? If so, how?

sneak2• 4 days ago

State-based regulations on tech are largely irrelevant. See CCPA for an example.

stfnon• 4 days ago

goodbye

MetaWhirledPeas3• 4 days ago

I had to stop reading halfway through to respond.

In comparison, tech sisters advocating for an absolute right to privacy seem to be a very rare, and maybe mythical, species.

Ever heard of Meredith Whittaker?

We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary.

This has to be a joke. There's private, and there's not private. There is nothing in between. This is not about tech bros. This is about guiding principles, about personal liberty, and about freedom from tyranny.

It may not quite be a law of nature, but my personal guess is that the opportunities for anonymity on the Internet will shrink until mothers no longer are forced to have “the talk” when their daughters get their first mobile phone.

In addition to "the talk" guess what else they won't be forced (or allowed) to talk about? Political dissent.

This chunk of the article is both sexist and defeatist. Now to read the rest.

MetaWhirledPeas3• 4 days ago

I finished the article. My own bad prediction: If FOSS "dies" it will continue to thrive in 3rd world countries, where no one bothers to administer punishment for the heinous crime of not letting your government's LLM read every word you type. The 1st world will ignore all this until it becomes apparent that the (former) 3rd world countries are suddenly in a position to economically surpass everyone else, and at that point the wise will see that their desire to keep a stranglehold on online activity was actually a bad idea that allowed their dominance to wane and wither.

sph• 4 days ago

Ever heard of Meredith Whittaker?

The fact that you name one makes her very rare indeed.

girvo3• 4 days ago

I mean I can point to a half dozen that I know personally but they’re not famous shrug. This seems like a weird argument to make to me, and besides the overall point the author was attempting to make anyway

tommydee2• 4 days ago

- Cindy Cohn, Executive Director of the EFF

- Eva Galperin, Director of Cybersecurity at the EFF

- Runa Sandvik, formerly of Tor Project

- Yan Zhu, EFF Fellow and CISO at Brave

And many, many more.

It rankled me more than a bit that the author apparently looked around his bubble in Denmark and the FOSS community, saw no "tech sister" privacy advocates, and decided to paint with the widest brush possible and assume there are none anywhere.

narnarpapadaddy• 4 days ago

This is about guiding principles, about personal liberty, and about freedom from tyranny.

The point he’s trying to make, as I understand it, is that states adapt. They don’t just throw up their hands and say “guess we can’t do anything about that encrypted traffic.”

The response to distributed kinetic kill capability in the US, for example, is for police to become more militarized and treat every encounter as a potentially lethal one.

There's private, and there's not private. There is nothing in between

It’s not an argument about privacy per se, it’s highlighting that the stronger the protections against state surveillance and intervention, the stronger the state becomes. By taking an absolutionist stance, we push our institutions to towards the same in response.

I’m not making an argument or against encryption or privacy, just pointing out the systemic effects.

izacus2• 3 days ago

Expecting that governments won't respond to software which is tailored to prevent them from investigating crimes (e.g. Signal's primary marketing is all about preventing government access to chats) was so utterly naive that only privileged techbros could make it up.

Other people understand that picking a fight with someone will result in a fight.

dzonga• 4 days ago

I think the author is missing a layer of abstraction.

yeah - once regulators come into play - the private ecosystems take over. discord is already a precursor to this.

the era of mass public social networks will come to the end. next it will be just private networks of individuals. likely the won't interact.

how the dynamics play out - I don't know - but if you study history - you will know what behaviors will happen.

andrekandre• 4 days ago

  > the era of mass public social networks will come to the end.

its just my unsubstantiated guess, but i feel like this is the end-goal of these age-verification laws...

but if that were true, what i don't understand is why don't they just go after the business model itself legal-wise instead of indirectly with age-verification...

weltensturm• 4 days ago

I assume it's because age verification is something the attention slop merchants can work with, and they'd rather lobby for that instead of letting their entire business model be uprooted.

I'm sure "child friendly content" is part of their calculations, and I'm sure they'll try to interpret the rules in a way that maximizes their profit.

BirAdam• 3 days ago

The owners of the social networks are billionaires with great lawyers and lobbyists on staff. They get politicians to introduce bills pushing the responsibility to the OS instead of the social network.

Of course, I am not sure why anyone trusts the global elite after JE. Telling any system the age of a user could be more harmful to that user than the supposed harm of the software itself.

hinkley15• 4 days ago

A bit of an aside, but after someone introduced me to the notion of Reversible Decisions, it quickly became apparent to me that the solution to the bikeshed problem is to throw money at it before the roosters can start preening about which color the shed should be.

Decisions that are reversible should just go with the instinctive answer of whoever volunteers to work on it.

I've been in many meeting rooms where, because of the number and caliber of people in the room, we've blown $5000 worth of combined salary arguing about basically nothing. I've been in a few where that number was well over $10k.

If you're going to assign a relatively medium talent engineer to solve a problem, it's cheaper to let them solve it twice, maybe even three times, than it is to try to figure out what the right solution is before touching a keyboard. It helps them grow to give them that autonomy, and more importantly training your team out of reflexively reaching for optimization for every single feature saves gobs of money over time.

The interface for a piece of code matters to everyone. The internal implementation details mostly matter to the bus number on that code. If they're happy with it, that matters a lot. That can be overridden by the consequences of that design, but I've seen a couple cases where the bus number for a module wanted a solution with fewer consequences but the group wisdom wanted something flashier but also more brittle.

pinkmuffinere2• 4 days ago

+1! I've fallen in love with many of Amazon's in-group concepts, and maybe I'm just drinking the koolaide, but they have the concept of a "two-way door", which is exactly this -- a decision that can be made, unmade, remade, etc relatively cheaply. If you can identify that a choice isn't very dangerous, you can focus on the things that really are instead.

shepherdjerred• 4 days ago

Amazon's leadership principles are fantastic. They are applicable to anyone doing any job at any level.

hinkley15• 4 days ago

Amazon unfortunately downplays the value of ethics over numbers, and we see how that has turned out. The numbers say that counterfeit goods are just fine.

busterarm14• 4 days ago

This often massively discounts the cost of reversing decisions. People often work to build things without any thought given to those who have to maintain it afterwards. Especially when it's not them.

I worked at a large, publicly-traded multinational where decades prior and they were still just a 4 man startup they decided the database server and all timestamps should be in the local timezone.

They are still using EST today even when they have global sharding of their customers/databases between US, EU, LATAM, SEA...

--- you're also assuming that the product roadmap will afford your engineers any time to build it the second, third, fourth, etc. time.

hinkley15• 4 days ago

When you first introduce the idea you'll find a bunch of people think decisions are Reversible which are not, as you say. And the flip side of Reversible decisions is the Last Responsible Moment, which runs afoul of Hofstadter's Law, and people wait until halfway past the last responsible moment.

The key to reversing a decision is getting over Sunk Cost, to start thinking of some code as scaffolding. Scaffolding allows you to get on to other work and then remove it after, because it's either not needed or the 'real' solution has been installed. People get defensive when you propose to rip out their code. Hey that code made us $250k at a time when we were about to miss payroll. Yes. It did. Thank you for your service. But now it's costing us $30k a month and that shit needs to go.

Getting people to figure out that if a decision is important, making it later is actually the sane thing to do, is a challenge. Because many people's intuition is that we should put energy into this now while it's fresh and we have abundant energy. We can 'solve' it and not have it dangling over our heads. But we don't know the right answer yet. We don't know the strength of our tools or the expertise of our coworkers.

The product roadmap is now and has ever been complete bullshit. Refactoring teaches that you amortize rework across all new stories. That's just how it goes.

(And everything should be in GMT unless you can literally point me to a several hundred page treatise on why another time zone is the correct one. Yeah I've worked west coast places that got bought by NY or Chicago companies and it's a clusterfuck if you both didn't use GMT)

xg15• 4 days ago

There seems to be some general pattern here that you can find pretty often in "dev war stories" contexts:

(1) We're a small startup/new product team/etc, let's just build the MVP and keep everything simple!

(2) Now we're not small anymore and suddenly have all kinds of nonfunctional requirements we never imagined before! But our simple architecture from before is making everything a pain now!

The natural instinct is then to compromise on the "simpleness" of the first prototype and already try to anticipate all the scaling and nonfunctional requirements that might come later - but that rarely seems to work, as you can't really how (and if) the project will grow.

Seems to me, the real question here is why those teams are still using the "MVP" code even after being well inside the "scale up" phase. Shouldn't this be the point where you gradually migrate to a codebase that is more manageable at scale?

ponector• 4 days ago

> People often work to build things without any thought given to those who have to maintain it afterwards. Especially when it's not them

Because for maintenance there is a different team and budget. Same goes about the meetings. Recent example: it's okay to blow $1000 in man-hours to discuss and reject an increase of the compute capacity of my virtual workstation. I bet the cost associated with request was ~$25 of increase to the monthly bill. But it is from the other budget, so it was refused.

mr_toad3• 3 days ago

This often massively discounts the cost of reversing decisions. People often work to build things without any thought given to those who have to maintain it afterwards. Especially when it's not them.

This is often because no thought was put into making decisions reversible. Version control, CI/CD, virtualization for example can make it easier to reverse decisions and make it faster and easier to replace bad designs.

phil212• 3 days ago

I sort of agree. But I kind of think it misses the point.

Bike shedding means no decision is made. That is the worst possible outcome as it provides absolutely zero value. Even a wrong decision provides at least some value even if it fails horribly. Maybe we paint the shed black and it burns down due to excessive heat, but it’s a bike shed so who actually cares if we need to rebuild the entire thing and paint it white this time.

And when it comes to bike shedding, getting it “wrong” is by definition already low stakes. It just doesn’t matter a whole lot.

Even the timezone example isn’t really that material IMO. Sure, it’s an extra annoyance to normalize timestamps to locale in every app/debugging query. But in the end it’s just not that big of a deal.

Worse would have been that early team arguing about it for 6mo without implementing anything. Then no one would be employed currently to curse those early developers to begin with.

Often times the only wrong decision is not making a decision. Very rarely are there decisions to be made that are not overtly obvious which are actually material. These exceedingly rare situations are where the winners from losers get sorted out - but that sort of decision in my experience so far happen a handful of times during an entire career.

As I moved up the ladder in my life I’ve often found my job is to basically flip a coin when a decision choice is presented to me. Very rarely is the topic worth me spending any material amount of mental energy on.

happymellon• 4 days ago

but I've seen a couple cases where the bus number for a module wanted a solution with fewer consequences but the group wisdom wanted something flashier but also more brittle.

Only a couple? This is some peoples entire job, we can refer to them as "enterprise architecture".

Lived experience is a decade ago, and you once saw Kafka solve someone's queuing problem so now everyone's api interface has to run over Kafka. Even synchronous ones.

hinkley15• 3 days ago

Let me rephrase that. I've seen a few cases where it became a major issue, rather than just being a fact.

Often people are smart enough to not ask questions they don't want the answer to. If the three people trusted to handle a problem all are in agreement as to how, then the peanut gallery may just be confounding issues in order to pad resumes or to feel important and involved.

crabbone3• 4 days ago

This is what usually happens if you let incompetent people make design decision: they stay with the first and worst version forever.

Right now I'm in the process of leaving a company where this happened over and over again. The company's product and design aspects were always neglected in this specific way: whenever a problem was discovered its solution was assigned to whoever would write the code to solve it. That's it. The QA would be notified a week or two before the release and after the solution was "finished". The QA would then not be allowed to even comment on the overall design, only the superficial bug reports were allowed to go through.

Needless to say the product's code-base is a dumpster. The morale is low because it's a daunting task to deal with this dumpster on a daily basis. Now, even if you wanted to, you wouldn't have a budget to fix the previous design mistakes because of the layers of more mistakes that were added on top of them due to the low morale and lack of budget / lack of procedure for making better design decisions. The only thing that keeps the product afloat is its uniqueness in a rather niche field and the backing of a large company that acquired it, but doesn't really depend on it and has no time for a thorough audit.

luipugs• 3 days ago

I would have assumed code reviews would have sussed out those issues earlier in the cycle?

hinkley15• 3 days ago

This is what usually happens if you let incompetent people make design decision: they stay with the first and worst version forever.

This is what usually happens when you confuse the decisions that mattered from the ones that didn't. It's like back before 'just use a linter' was the solution to code formatting. You'd start a project, you'd have the 'code style meeting' and everyone would bash themselves into the rocks of whitespace and bracket placement, and never get to things like code organization, structure, and naming of things.

So then you end up with code that uses the same noun in three places to mean 3 different things and uses it as a verb in a fourth.

You only get so many opportunities to really change the direction the boat is steering and you can wear out your welcome trying to exceed it. If you get some things right they'll let you do a few more.

ukoki• 4 days ago

This reminds me of my experience as a senior contractor joining teams that seem to enjoy endless discussion. For example, when implementing a new feature using an open-source library or framework they will want to make a prototype of all possible libraries, make a report about each of them, have some big discussions about which to choose, and only _then_ start the real implementation. My advice is always to just pick the one your gut tells you is the right one -- if the prototype works, then that _is_ the implementation and we can stop considering alternatives unless we have a good reason to reconsider them.

If a decision is hard to make, its often because the differences are small, and therefore it doesn't matter much and you might as well decide by dice-roll.

Ma8ee2• 3 days ago

If a decision is hard to make, its often because the differences are small, and therefore it doesn't matter much and you might as well decide by dice-roll.

My life became soo much easier when I had that insight. I used to spend so much mental energy on decisions that most often were inconsequential.

hinkley15• 3 days ago

I don't know what the black art of tool selection is, but I'm at least a couple std deviations above average on picking libraries that have legs. Nobody gets it right every time, but some people seem to get it wrong every time.

Be sure the work is given to someone who puts some intention into tool selection and you'll probably be okay though. We don't need three different tools doing the same kind of tasks. But sometimes the old old stuff gets moved to the new tool because the old tool couldn't handle that scenario.

mr_toad3• 3 days ago

If you're going to assign a relatively medium talent engineer to solve a problem, it's cheaper to let them solve it twice, maybe even three times, than it is to try to figure out what the right solution is before touching a keyboard.

What’s even worse is when a lot of talented people spend a lot of time planning a solution on paper which turns out not to be workable in practice, and then they throw good money after bad trying to get the unworkable solution to work, rather than admitting they were wrong.

tuatoru• 3 days ago

In accounting this is the concept of "materiality". If some asks "is this material?", they are asking if it's worth spending significant time looking at it or deciding.

Remember to * 3 when assessing. Choose wrong, and you do the job, undo it, and do it again.

hinkley15• 3 days ago

Always fun when they manage to categorize it wrong 3 times in a row.

One of the hardest parts of my job is trying to convince people where the pool of blood on the floor is coming from. We are forever stitching up the wrong wounds and missing others entirely.

Pain sneaks up on people and they often don't realize they're in pain until someone takes it away. This is probably why Refactoring is one of my favorite tech books. It's a set of tools and justifications for chipping away at that pain bit by bit, instead of tolerating more and more while productivity grinds to a halt.

At the end of the day, if only three people really have to care about a thing and they're fine with it, is it their business to run the project the way they prefer/tolerate? It does matter if the opportunity costs and externalities are affecting other projects. If they don't have time to work on other features because of the mistakes they never correct. If other people's flow is constantly interrupted trying to work around their quirky stuff. But if we don't see any of that, or only rarely, then it's more that my internal architect trying to be bossy rather than lift all boats.

ButlerianJihad• 4 days ago

Regarding the article title, is the editor trying to make a witty reference to Douglas Adams? Because that is not the phrasing that Adams used -- it was So Long, and Thanks for All the Fish (rather than "Goodbye") so unfortunately, any intended humour sort of falls flat for me. Sadly, the nerds at ACM should know better.

hinkley15• 4 days ago

— Day 1-2. Tried $tool out. Oh boy! We have some work to do.
— Day 3-5. OK, there were a couple of solid bugs there, and a fair number of what were technically bugs, but not actually all that bad.
— Week 2. I guess that was it?

There are a bunch of tools in the developer toolbox that some people never use, and the opposition use religiously. We are especially bad in this industry at turning things into a boolean where they should be a dial or a continuum. Something about that intro to Logic class either rots our brains or works as a filter to keep most of the philosophers out.

In sports there are drills one does a couple times a month instead of every day. You're trying to harden pathways in the brain to make certain reactions be more automatic, to correct subtle errors and suboptimal answers to problems. You don't do them all the time because they're expensive in some way, like time or danger.

I think this is an area where we miss a lot. I don't do TDD all the time. Maybe a week every couple of months. And it's a split between very hard tasks and very simple ones where I practice it. It's easier to work on first principles on a simple problem, but sometimes when you're stuck on a very difficult one, you have to go back to first principles anyway.

"Difficult" can be further broken down into several categories. 1) I don't know how to solve this, 2) the problem is straightforward but arduous and I don't know if I have the stamina for it, 3) I thought I solved it but it's not working.

TDD is a good way to get yourself into bottom up thinking and 'work the problem' by testing your assumptions one at a time. At the very least you have something to show for your work at the next standup even if the answer still eludes.

Similarly, a linter can be good while you're building up muscle memory for writing code the way the current team thinks it should be written. However, it can be a nightmare when you're trying to do exploratory development to fix a bug. I've landed PRs on two different FOSS projects to run the linter after the unit tests for this very reason. I don't fucking care if the code is Clean right now I only care if I've fixed the NPE that is crashing production. The PR is a problem for an hour from now. I need to make it work and then I can make it right.

bsiverly• 4 days ago

I feel like “tech bro” is the scapegoat for all bad things in tech these days. It’s fairly dismissive of the ongoing debate and advancement of technology overall IMO

luciana1u• 4 days ago

we replaced our bikeshed with a JIRA board and now we paint tickets instead, somehow it's worse

mimd2• 4 days ago

I have met women in tech who have been privacy conscious and paranoid about state control. Or even a healthy stream of non-tech women worried that it will be used to attack their sex and to discriminate. I don't think the author is correct in his belief that there are not a considerable amount of women worried about privacy. And to make such a board claim, and in light of my experience, would indicate either hubris or sexism.

If anything, he frames that he is concerned about his daughter as a father. The viewpoint of patriarchy.

intended7• 4 days ago

As a counter point, the larger point that the author was making resonated with what I have seen.

As in - women in tech who value privacy and rule of law, and are also advocates for child safety and (better versions of) age verification.

In addition, for obvious reasons, you see more (more being the key word) women showing up for issues like NCII.

mimd2• 4 days ago

I'm not fully sure of what is the total composition of opinions, and will not dismiss your experience. Indeed the hyper privacy all high costs group might be a small percentage. But I know several that use tails openly, despite being vehemently protective of women, while knowing less men that use tails. Certainly not "mythical" in my book. Futhermore the ignoring of viewpoints of non-tech women, the majority of women, expressing constant worry of state discrimination via information collection even though it's regularly hitting the news is bad. Tech is not the only party to this, indeed that's one of the reasons for this scenario as he correctly pointed out. His claim was overbroad so as to improve his argument, an annoying manipulation. Additionally, he used emphasis on wife/daughter, yet not including their voices, while minimizing his own position, which warrants the further parthian shot.

ETH_start5• 4 days ago

Irrespective of the legitimacy of the arguments made, I find that the use of the term "tech bros" is similar to how the terms "far-right" or "Trump supporter" were used during the COVID lockdown era to delegitimize any critic of the restrictions.

rfmoz• 4 days ago

This matches what I’ve seen in practice, individual tasks may become faster, but the overall development process doesn’t automatically improve. Heavily dependant of the real hands behind.

MrDresden• 3 days ago

"And before you ask: Yes, I’m laying this one squarely down before (and partly on the toes of) the tech bros: We could have designed our protocols to be minimally compatible with “a nation of laws,” but the tech bros insisted that compromise was treason, and, as a result, we will lose more privacy than necessary."

It is getting mighty tiring to be continuously put in the tech bro libertarian camp just because of my sex, choice of occupation and stance on privacy.

That being said I don't see it as being impossible for a privacy preserving system to be put into place where the central certificate authority (state) offers a way of authenticating the age of the individual without leaking further information, and the client not offering up details about what is being viewed.

For example Meta wants to authenticate a users age and simply receives a boolean response indicating that they are of legal age or not, without anything more.

This could be implemented quite easily in some European countries that already use government issued electronic authentication systems (Auðkenni in Iceland and DigiD in the Netherlands spring to mind).

Goodbye, and Thanks for All the Bikesheds

Related Stories