Security quotes of the week [LWN.net]

Security quotes of the week

Posted Oct 16, 2016 4:46 UTC (Sun) by Garak (guest, #99377)
In reply to: Security quotes of the week by Cyberax
Parent article: Security quotes of the week

> You seem to have ignored my request for translation. If you speak with Chinese ISPs that's the experience you'll get (I just wrote "I don't understand what are you talking about").

I expect international ISP business/govpolicy relationships to be very diverse, all situations relatively handled. But given that, I still think I advocate a sane policy to aim for. AFAICT you are fine with the status quo. You know that I get that already. Move on please.

> Cyberax, I will ask you again, focus on your first points until I can grasp them instead of moving on to such nonconstructive debate tactics. Because realistically any plan that requires ISPs to work against their clients is doomed.

I see it the other way around. I see the status quo as working against their legitimate clients in favor of spammers and hackers. I think you mispaint the picture that what I suggest would wreak havoc. I think it would work out much better.

to post comments

Security quotes of the week

Posted Oct 16, 2016 5:42 UTC (Sun) by Cyberax (✭ supporter ✭, #52523) [Link] (38 responses)

> I expect international ISP business/govpolicy relationships to be very diverse, all situations relatively handled. But given that, I still think I advocate a sane policy to aim for. AFAICT you are fine with the status quo. You know that I get that already. Move on please.
I'm realistic about the status quo and I actually don't want to have additional layers of useless regulation.

> I see it the other way around. I see the status quo as working against their legitimate clients in favor of spammers and hackers.
Spambots run on computers of legitimate clients.

Security quotes of the week

Posted Oct 17, 2016 3:23 UTC (Mon) by Garak (guest, #99377) [Link] (37 responses)

> I expect international ISP business/govpolicy relationships to be very diverse, all situations relatively handled. But given that, I still think I advocate a sane policy to aim for. AFAICT you are fine with the status quo. You know that I get that already. Move on please.

I'm realistic about the status quo and I actually don't want to have additional layers of useless regulation.

I think the bottom line is that I'm trying to hold the FCC and early prominent cyberpolitical voices to their Free Speech on the Internet line. In a way that I don't expect you to take the time to understand and agree with.

> I see it the other way around. I see the status quo as working against their legitimate clients in favor of spammers and hackers.

Spambots run on computers of legitimate clients.

I think the key thing is that the strategy I advocate minimizes the time that spambots run on the computers of legitimate clients/people. And at the same time, minimizing far greater harms from the issue in aggregate. Although from a biological perspective, I must confess our own bodies probably found more of your-style balance in their own battles with virii/bio-malware... herd immunity...

Security quotes of the week

Posted Oct 17, 2016 9:52 UTC (Mon) by farnz (subscriber, #17727) [Link] (36 responses)

The easiest way to implement a "no spam" policy is to cut off anyone who's use of the Internet causes offence. Otherwise, you have to distinguish "abusive speech" from "acceptable speech" in a form that's very, very hard to automate (if it was easy, neither Facebook nor Google would ever be in the press for bad decisions around speech, and yet Facebook definitely has been recently over censoring a photo).

Thus, you're asking for conflicting goals - you want Free Speech, except where it's abusive - and it's next to impossible to sort that out. Similar limits apply to Free Speech in real life - I am restrained by the US Government from engaging in certain acts of political speech, because of the consequences of doing so.

Security quotes of the week

Posted Oct 17, 2016 12:43 UTC (Mon) by mathstuf (subscriber, #69389) [Link] (26 responses)

> restrained by the US Government from engaging in certain acts of political speech, because of the consequences of doing so.

Do you have an example?

Security quotes of the week

Posted Oct 17, 2016 12:49 UTC (Mon) by farnz (subscriber, #17727) [Link] (25 responses)

Yes - for example, I'm not allowed to give someone detailed plans for lynching a presidential candidate, including details of where said candidate will be, together with instructions to make sure that said candidate dies to remind people of how America has previously treated certain groups as "less human".

More generally, any political speech that involves violence is criminalised due to the violence; indeed, we often describe violent political speech as "terrorism". Thus, there are clear limits on "freedom of speech" in the USA; I happen to agree with those limits, but they exist, nonetheless.

Security quotes of the week

Posted Oct 17, 2016 13:00 UTC (Mon) by mathstuf (subscriber, #69389) [Link] (24 responses)

Those are really only enforcible on "true threats" which is a technical legal term. Satire, exaggeration, etc. are still allowed. I recommend following Popehat for posts describing why various cases are or are not free speech.

Security quotes of the week

Posted Oct 17, 2016 13:24 UTC (Mon) by farnz (subscriber, #17727) [Link] (23 responses)

Sure, but that does cover certain forms of political speech - for example, I can't hold an unsuspecting white Harvard student hostage at gunpoint to remind people of what it's like for ghetto-dwelling blacks when they interact with the police. I shouldn't be allowed to, either, but that is a form of political speech that's prohibited due to the clash with someone else's rights, and is banned by the US government - and no amount of crying "Freedom of Speech!" will cause my First Amendment right to speak to override your common law right (it's not constitutional) to not be held hostage.

Security quotes of the week

Posted Oct 17, 2016 13:33 UTC (Mon) by mathstuf (subscriber, #69389) [Link] (22 responses)

There wouldn't even be a first amendment question there. You'd be charged with reckless endangerment, assault with a deadly weapon, and/or kidnapping. Going in with a first amendment defense would, I imagine, get an exasperating glare from the judge while your other charges would be handed down.

Security quotes of the week

Posted Oct 17, 2016 13:36 UTC (Mon) by farnz (subscriber, #17727) [Link] (21 responses)

Exactly my point - if I engage in a particularly violent form of political speech, my freedom of speech isn't even considered as part of the court process (nor should it be - that way lies madness). Thus, there are limits to "Freedom of Speech", where you simply declare a form of speech "not speech" in order to escape the question.

Security quotes of the week

Posted Oct 17, 2016 20:38 UTC (Mon) by nybble41 (subscriber, #55106) [Link] (6 responses)

> ... if I engage in a particularly violent form of political speech, my freedom of speech isn't even considered as part of the court process ...

This is not a Freedom of Speech issue because what you are describing is assault, not speech. Any action can be viewed as self-expression, but not every form of self-expression is speech.

To an extend the government dug this hole for itself by outlawing various things which ought to be perfectly legal (victimless crimes)—things which are not speech per se, but which may be needed in some cases as a precursor to effective speech. This creates a grey area where a law about something which is not speech in its own right may be deemed unconstitutional on First Amendment grounds due to its chilling effect on actual speech. However, this only concerns things which one has a natural right to do, which obviously does not include kidnapping and assault.

The generalized and consistent version of Freedom of Speech is the Non-Aggression Principle, but no government is going to adopt the N.A.P. freely since that would make it impossible for them to continue to operate.

Security quotes of the week

Posted Oct 17, 2016 20:42 UTC (Mon) by farnz (subscriber, #17727) [Link] (5 responses)

But *why* is it not speech?

I'm doing it to make a political point; it's intended as a grand statement about the way the police are perceived in certain communities. It's assault as well, yes, and that takes priority over freedom of speech, but why is it not speech to state in an overblown fashion that the police are not trusted by all parts of American society?

Basically, this is a case where freedom of speech is (rightly) overridden by other rules (such as the one against kidnapping and assault), but there's no particular reason why it's not speech, beyond the fact that you can't claim that you have absolute freedom of speech and that other rights override it.

Security quotes of the week

Posted Oct 18, 2016 2:58 UTC (Tue) by nybble41 (subscriber, #55106) [Link] (4 responses)

> But *why* is it not speech? … I'm doing it to make a political point; it's intended as a grand statement about the way the police are perceived in certain communities.

It isn't a Freedom of Speech issue because the restriction is not about the *content* of the expression, but rather the means. It's not what you say, it's how you say it. Freedom of Speech means that the government isn't permitted to step in and prevent you from making your point, or punish you for doing so, no matter how much they would prefer your silence, but it doesn't mean that you have any special rights over others or their property. The content of the speech can be whatever you wish, but your means of expression are limited what you normally have the right to do.

Freedom of Speech is a very narrow application of the Non-Aggression Principle which only covers the use of your property for the purpose of speech. Both are negative rights (non-interference) rather than positive rights (something which must be provided to you). The N.A.P. implies the freedom to use your own property (and _only_ your own property) for any purpose you wish, including speech. In both cases the old adage applies that "your right to swing your fist stops at the end of my nose". You have every right to express whatever you want using your mind, your voice, your paper, your ink—but you do not have the right to use me, or my venue, as part of your speech without my permission.

There is really too much emphasis, in my opinion, on the Freedom of Speech per se. It misses the more fundamental principle at stake and overlooks the fact that the same freedom should apply to other private and non-harmful uses of one's property. Moreover, by protecting only "speech" we open the door to restrictions on _effective_ communication methods which, while not _directly_ based on the content of the speech, still make it difficult for anyone lacking sufficient wealth and/or political connections to have their message heard by the masses. Rather than directly targeting undesirable speech, those in power can limit effective speech _in general_ to those with whom they share common interests.

> ... you can't claim that you have absolute freedom of speech and that other rights override it.

Actually you can. This is where negative and positive rights differ. Positive rights are always in conflict, because they mean that you're owed something and others are compelled to give it to you. This inevitably creates tension and a situation where everyone tries to live at the expense of everyone else. Negative rights, being grounded in non-interference, can be absolute without contradiction. You have the absolute right to freedom of speech, or more generally, the right to property—no one ever has the right to prevent you from speaking, or from otherwise using your own property. Of course, the same is true with regard to yourself—you do not have the right to prevent others from speaking, or to interfere with their own use of their property (including themselves). The only actions which are permissible are those which respect the absolute natural rights of everyone involved.

Security quotes of the week

Posted Oct 18, 2016 4:05 UTC (Tue) by mathstuf (subscriber, #69389) [Link]

I agree with this. I couldn't come up with a way to say how the kidnapping example was wrong to me, but nybble41 has done well in finding words for me at least.

Security quotes of the week

Posted Oct 18, 2016 9:38 UTC (Tue) by farnz (subscriber, #17727) [Link] (2 responses)

See, this is where my model of rights and yours differs; in my model, rights conflict, and the NAP is how you decide on the most equitable resolution of that conflict.

So, in the case of our abused Harvard student, they have a right to not be molested, which conflicts with our activist's right to speech. The NAP tells you that, in this situation, the abused student's right to not be molested is stronger than the activist's right to speech, because the activist is intruding on the student, not the other way around.

I get concerned about the "it's not about the content, it's about the means" argument, because (again taken to extremes because easy cases only make for nodding heads, not considered arguments) saying that it's unlawful to use mechanical or electrical means to amplify your speech is solely about means, not content, and yet would suggest that you can't use the Internet to exercise your right to speech.

And no, you can't. If you have absolute freedom of speech, then exercising your right to speak takes precedence over all other rights and principles; you've continued to say that you have freedom of speech conditional on the non-aggression principle. This is a reasonable position, but it does mean that my right to speak is not an absolute override on all other rights.

Security quotes of the week

Posted Oct 18, 2016 15:04 UTC (Tue) by nybble41 (subscriber, #55106) [Link] (1 responses)

> I get concerned about the "it's not about the content, it's about the means" argument, because ... saying that it's unlawful to use mechanical or electrical means to amplify your speech is solely about means, not content, and yet would suggest that you can't use the Internet to exercise your right to speech.

True, because that would not be a restriction on your Freedom of Speech, but rather on your freedom to use the Internet. This is why I said that the Non-Aggression Principle is more important than the narrow application of Freedom of Speech. Under the N.A.P. they don't have the right to deny you the use of the Internet (as an outside party with no property rights at stake), for the purpose of speech or anything else. However, as long as the prohibition is on Internet use _in general_ and not just the use of the Internet for specific types of speech, the rule would not violate the Freedom of Speech.

> ... you've continued to say that you have freedom of speech conditional on the non-aggression principle.

No, I've said that the Freedom of Speech is one application of the Non-Aggression Principle. They aren't in conflict, they're the same thing. Rights being universal, your exercise of the N.A.P. in the form of Freedom of Speech must respect the fact that others have exactly the same rights under the N.A.P. Speech is no different from any other action you might take in this regard. However, there is no profit in trying to debate this point within the self-contradictory framework of conflicting positive rights. You will not find an objective answer there to the question of which rights are "more important", only subjective opinion.

Security quotes of the week

Posted Oct 18, 2016 15:47 UTC (Tue) by farnz (subscriber, #17727) [Link]

So, as an example, if I said that you may not use electrical or mechanical means to declare your support for a political party, is that a restriction on my freedom of speech (because you've restricted content), or on my freedom to use amplification? I'd argue very strongly that it's a restriction on speech, even though it's phrased as a restriction on means too, because it's about the content, but if I'm understanding you properly, you'd say it's a restriction on means, because the key is that it's about the amplification effect that electrical or mechanical means give me?

And you're still avoiding the conflict issue - even within the NAP, there are contradictions (for example, is it illegal for you to reflect coloured photons from your clothing onto me? If not, is it illegal for you to use a perfect mirror to reflect photons from my terawatt laser pointed at my property onto me personally?)

Security quotes of the week

Posted Oct 18, 2016 19:27 UTC (Tue) by Garak (guest, #99377) [Link] (13 responses)

Exactly my point - if I engage in a particularly violent form of political speech, my freedom of speech isn't even considered as part of the court process (nor should it be - that way lies madness). Thus, there are limits to "Freedom of Speech", where you simply declare a form of speech "not speech" in order to escape the question.

Your choice of the word/phrase "_escaping_ the question" seems disingenuous to me. One could as easily and correctly characterize it as "_address_ the question". The problem I see with the status quo is that politicians and legislators and activists and speakers of all kinds would like to pretend their way out of this new equation-

A) The Internet facilitated an exponential grown in speech (via decrease in price/cost), much like the printing press did.

B) With that exponentially greater set of speech, an exponentially greater set of judicial overhead is necessary to maintain the same balance of correctly judged Free Speech versus Criminal Speech.

My perception is that a lot of politicians and businesspeople have been riding the wave of (A), while doing their best to ignore (B). Same basic equation as the (BS buzzword) IoT manufacturers trying to sell new forms of utility without bothering to consider the resulting new forms of (in)security. However I think that in an Ayn Randian sense, reality will continue to confront this problem in the form of unpleasant side effects.

Security quotes of the week

Posted Oct 19, 2016 8:13 UTC (Wed) by farnz (subscriber, #17727) [Link] (12 responses)

I've taken an extreme case, because extremes force you to think about your reasoning. However, once you've said that something I do is enough to convert my speech into not-speech (in this case violence pushes that line), what else is an acceptable reason to convert my free speech into not-speech?

While I disagree fundamentally with mathstuf, he's espousing a consistent libertarian position, where the NAP is the core principle, and freedom of speech is merely one way in which the NAP manifests; thus, for him, there is no contradiction - there is no core belief in freedom of speech, it's just something that naturally falls out, complete with the common sense limits, as a consequence of following a much more important principle.

However, if you're trying to say that freedom of speech is a right, and then having to define things as "not-speech" in order to avoid invoking that right, then you get into a thorny mess - who gets to define what is and is not speech, and why them?

Security quotes of the week

Posted Oct 19, 2016 19:46 UTC (Wed) by Garak (guest, #99377) [Link] (4 responses)

However, if you're trying to say that freedom of speech is a right, and then having to define things as "not-speech" in order to avoid invoking that right, then you get into a thorny mess - who gets to define what is and is not speech, and why them?

Judges. Because that is their job.

Security quotes of the week

Posted Oct 19, 2016 19:54 UTC (Wed) by farnz (subscriber, #17727) [Link] (2 responses)

OK, and then what legal guidance does a judge have such that they aren't just making decisions from the seat of their pants? Is it "not-speech" if it offends a thin-skinned person to the point of tears? Is it "not-speech" if your contract with your communications provider does not explicitly say it's speech? Is it "not-speech" if I'm richer than you and offended by your statements? Worse, is it "not-speech" if you're complaining to an ISP's abuse desk, but "speech" if an ISP's customer sends you data that you don't want?

The normal job of a judge is to take the law, and the situation before them, and to twist the two together such that any reasonable person would agree that they've correctly applied the law to the situation; however, if you have a right to freedom of speech, but things that are "bad" are not-speech, what stops the judge deciding that as a matter of law, running a server on a "residential" Internet link is "not-speech"?

Security quotes of the week

Posted Oct 19, 2016 20:28 UTC (Wed) by Garak (guest, #99377) [Link] (1 responses)

OK, and then what legal guidance does a judge have such that they aren't just making decisions from the seat of their pants? Is it "not-speech" if it offends a thin-skinned person to the point of tears?

I hate having to try to explain things as if to a small child in their first government/civics class, but... The obvious general answer is that most societies have fairly well laid out sets of guidance that judges must demonstrate a sufficient knowledge of before they are allowed to become judges. Law schools and so forth.

Each country and society has its own. In some societies, you'll get crucified for saying certain things. In other societies, you'll get beheaded for not saying certain things. In many societies, you will be punished for burning the local flag, but not a foreign flag. In some societies, you will be punished for burning certain books, but not punished for burning other books.

RFC-Garak1 was about forcing the automation to happen, with local official judicial settings being the ultimate bottom line of that automation. Because there just is no better way to go about it that I see. I will continue to spend as much effort as I can muster, to convince those around me, focusing on the local, extending to the global, galactic, and universal, that nobody should be punished for burning any book or flag that they own. And I won't accomplish that mission tomorrow, or next year, or in my own lifetime. That's just how I see it. $0.02...

Security quotes of the week

Posted Oct 19, 2016 20:34 UTC (Wed) by farnz (subscriber, #17727) [Link]

It's clear that you didn't pay attention in civics. The point of law school and the like is to make it easier for the judge to correctly apply law to the cases in front of them, such that (in general) it doesn't matter which judge you end up in front of, they'll all make the same decisions given the same set of facts. Then, for the cases where a mistake is made by a judge, you have an appeals process, which (ultimately) compares the law to the decision, and either confirms that the judge was right in their application of law to the case, or that they made a human mistake.

If you're saying "free speech, but only speech, not speech-like things", you need a legal definition of "speech" that judges around the country can apply. Otherwise, there's a simple way to define it for RFC-Garak1 - "speech" is spoken words transmitted by sound waves, while anything electronic is not speech; et voilà! we have today's situation unchanged.

Security quotes of the week

Posted Oct 20, 2016 12:48 UTC (Thu) by Wol (subscriber, #4433) [Link]

> Judges. Because that is their job.

And what freedom do Judges have to JUDGE?

I don't know if or how the case has been resolved, but I gather it's very recent - a man who everyone KNEW COULDN'T HAVE DONE THE CRIME was due to be executed, and nobody would step in and do anything about it, because as far as the American system was concerned, "he had had due process". The fact that it was a clear and blatant miscarriage of justice didn't enter in to the equation.

For all his faults, that was one thing that was admirable about our Judge Denning - if he thought something was wrong, he would do something about it, law or no law. As the bible says, the job of the Judge is to protect the weak and powerless!

Cheers,
Wol

Security quotes of the week

Posted Oct 19, 2016 20:19 UTC (Wed) by Garak (guest, #99377) [Link] (6 responses)

While I disagree fundamentally with mathstuf, he's espousing a consistent libertarian position, where the NAP is the core principle, and freedom of speech is merely one way in which the NAP manifests; thus, for him, there is no contradiction - there is no core belief in freedom of speech, it's just something that naturally falls out, complete with the common sense limits, as a consequence of following a much more important principle.

However, if you're trying to say that freedom of speech is a right,

I think you misconstrue the debate. Nobody is arguing for freedom of speech as so much of a right that mobs can form and rule the countryside via a sufficient number of death threats. Nobody is arguing for that. That necessary and pedantic debate is very, very old. I'll admit that it would be legitimate to throw that same sentiment at RFC-Garak1, except that there, the debate I'm trying to have is only very very old in Internet Years. In human years, it's still fairly young IMHO.

Security quotes of the week

Posted Oct 19, 2016 20:23 UTC (Wed) by farnz (subscriber, #17727) [Link] (5 responses)

In which case, please define which definition of freedom of speech you're working to - under the NAP derived version, you don't have freedom of speech on the Internet, full-stop, as to do so would require that you forced someone else to carry your bits.

Security quotes of the week

Posted Oct 19, 2016 20:35 UTC (Wed) by Garak (guest, #99377) [Link] (4 responses)

please stop pretending like you are debating my points with me in good faith. You are trying to derail the debate down pedantic rabbit holes. I clearly have an above ground goal (to be able to run my own email server like Hillary Clinton without paying a lexus lane 'business class / server allowed' tax to my ISP)

Security quotes of the week

Posted Oct 19, 2016 21:29 UTC (Wed) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

You have a strange fixation on email servers, that's for sure. Never mind that you can get a month of VPS subscription for less than the cost of a latte.

But anyway, you seem to be under impression that freedom of speech entitles you to get heard. That's simply not true.

Security quotes of the week

Posted Oct 19, 2016 23:01 UTC (Wed) by pizza (subscriber, #46) [Link] (1 responses)

> Never mind that you can get a month of VPS subscription for less than the cost of a latte.

In all fairness, a VPS beefy enough to handle proper spam filtering will cost about two lattes per month.

(Which in turn is costs less than the single static IP added on my "business-class" connection)

Meh. Comcast.

Security quotes of the week

Posted Oct 20, 2016 13:26 UTC (Thu) by Wol (subscriber, #4433) [Link]

And how much did it cost for the hardware to defeat the DoS on Krebs's post?

My thing about rights is nice and simple - THERE AREN'T ANY. It's my DUTY to protect free speech for others, so I can get to enjoy it too.

So all these IoT botnets and stuff clearly fall foul :-)

At the end of the day we have a DUTY not to be malicious or negligent - everything else can flow from that.

Cheers,
Wol

Security quotes of the week

Posted Oct 20, 2016 9:41 UTC (Thu) by farnz (subscriber, #17727) [Link]

I am debating in good faith - if all you're after is a fully Neutral Network, where you're not restricted from operating "servers" on your home line just because it's "residential" service, not "business" service, then say so. You've brought in a whole pile of deeply difficult issues (freedom of speech, abuse handling in the face of malicious actors) that I've got experience of from the hard side of the problem, and I'm discussing those in good faith.

I agree that "server" restrictions on "residential" lines are nonsense; not least because I have bought consumer devices that act in some senses as a server (games consoles can, as can my VoIP handset and my Slingbox), but which no residential provider would restrict due to the consumer blowback of restricting devices. However, that's entirely orthogonal to the issues you've brought into play of abuse handling and freedom of speech, which apply whether you run "servers" or not.

Security quotes of the week

Posted Oct 18, 2016 18:39 UTC (Tue) by Garak (guest, #99377) [Link] (8 responses)

The easiest way to implement a "no spam" policy is to cut off anyone who's use of the Internet causes offence. Otherwise, you have to distinguish "abusive speech" from "acceptable speech" in a form that's very, very hard to automate (if it was easy, neither Facebook nor Google would ever be in the press for bad decisions around speech, and yet Facebook definitely has been recently over censoring a photo).

That is an important key point, though my stance is that it absolutely can and should be automated, with the logical caveat that the real issue is that such automation requires plenty of person-hours of work. Work which those who advocate the status quo are happy with not getting done. Work which I believe is worth doing and getting done.

Thus, you're asking for conflicting goals - you want Free Speech, except where it's abusive - and it's next to impossible to sort that out. Similar limits apply to Free Speech in real life - I am restrained by the US Government from engaging in certain acts of political speech, because of the consequences of doing so.

That sounds nonsensical. I would respond that what I am asking for is not conflicting goals, but your next sentence would be the explanation of that point.

Unfortunately, for most of the Internet's relatively brief history, and probably still, most legislators and others have taken the path of least resistance. Pretending that they can eat their cake and have it too. The cake being the idea that the Internet(tm) is a magical place where Free Speech is possible, without the work expenditure mentioned above to tackle the important point you made. (which clearly has a long history outside the internet as one of many speech mediums)

RFC-Garak1 is basically about forcing the automation to happen, ultimately with homosapiens in official judicial settings being the ultimate bottom line of the automated system to separate legal Free Speech from criminal Free Speech (death threats, etc).

I want the cake to not be a lie.

Security quotes of the week

Posted Oct 18, 2016 18:44 UTC (Tue) by farnz (subscriber, #17727) [Link] (2 responses)

Sure, and both Google and Facebook would agree with you - but right now, automation of "abuse" detection is an active area of research, and is somewhere that ends up being seen as a competitive advantage (because, in general, it is - it's hard AI, since it needs to correctly predict the outcome of any court case that would be raised over a given bit of speech).

Security quotes of the week

Posted Oct 18, 2016 19:38 UTC (Tue) by Garak (guest, #99377) [Link] (1 responses)

Both Google and Facebook seem to profit from the overall situation. They seem to have become defacto Gatekeepers of speech on the internet. RFC-Garak1 is about empowering all internet users in the way the internet was evangelized early on. The real problem is that, in a Trump-43% world I foresee Google and Facebook's attempt to do precisely what you stated as further entrenching their status as "too big to fail". If I could compete with GMail, starting with linux and squirrelmail and a home server, combined with the ability for that solution to be distributed and used by any other internet user, without some 'business class / server allowed' lexus lane tax... Maybe someday.

Security quotes of the week

Posted Oct 19, 2016 8:20 UTC (Wed) by farnz (subscriber, #17727) [Link]

Facebook and Google are defacto gatekeepers because (a) the cost of handling abuse, even with automation on their scale, is high, and (b) people prefer an Internet free of other people's abuse (although not their own).

I run my own mailserver on a cheap VPS, and I've run my own blog before now. The issue is that you get three grades of "abuse":

The obvious and easy to block - "BUY ILLEGAL DRUGS NOW FROM https://not-the-fbi.example.com/". This level of abuse is easy to fix in an automated fashion - simple pattern matching does it.
The hidden pattern abuse; the text itself looks reasonable, as do the links at first glance (because they'll be changed later to redirect to somewhere malicious). However, the clue is visible when you see large numbers of comments or mails, as there's a concerted campaign of similar human-like text pointing to the same set of links.
The semi-intelligent abuse; there's no obvious pattern here, beyond the fact that the text is not "an advance in the state of knowledge" but a rehash of what you should already know if you got to this point on the page. Sometimes there are links, but if there are, they're randomly selected between dangerous links under attacker control, and reasonable links like Wikipedia. This one needs AI to detect - it's very much a "I'll know it when I see it" situation.
Sites that currently post good and valuable content that people link to, that later get changed to point to junk. This covers both things like "a nasty unexpected situation means that lwn.net is taken over by a spammer", and "I'm paying people to produce interesting articles that I can later redirect".

Large scale, like Facebook or Google, makes the second type of abuse trivial to automatically detect - they see so much data that the hidden pattern is obvious. It also makes the third type of abuse easier to spot - you can pull out common "non-human" mistakes across a very large corpus, and thus find accounts that never engage in "human" content creation, only "non-human". The fourth type is actively researched, and a reason for both Google and Facebook to invest in AI.

And you can cheaply compete with GMail - VPSes good enough for mail use start at about $5 per month; that this is not a commonly taken option suggests that people aren't willing to pay for mail service. Further, my ISP in the UK has no restrictions on servers, and yet lots of their customers use Office 365, GMail etc for mail, suggesting that the "server allowed" term isn't a big influencer in people's mail system choice.

Security quotes of the week

Posted Oct 19, 2016 10:10 UTC (Wed) by micka (subscriber, #38720) [Link] (4 responses)

Automation in this case is absolutely excluded. You want humans to be in the discussion before any decision is taken.
You want a human to make sure this is not a false positive (or you end up with the equivalent of DMCA take down on your own video/audio/text).

Do you want your ISP to do DPI on all your traffic? I don't, so they can't cut access for only one device, they must cut access for all the traffic for the user.
I don't know how it is where you live but I think in most of the place the ISP can't decide to cut access without first trying to solve the problem with the user (except in urgent cases, which _this is not_).
And I think I remember ECHR lean towards considering internet access is a right (as a consequence of more fundamental rights). So mandating this kind of thing would be awkward.

Then you have the question that this problem will be _not actionable_ for a majority of the population. How do I secure my device? What "device", what do you call a device? Ah that thing? It goes on Google? Ah you call it internet...

I don't think anybody would want to go that way.

Security quotes of the week

Posted Oct 19, 2016 10:31 UTC (Wed) by farnz (subscriber, #17727) [Link]

But if you don't have automation, your ISP's abuse desk is overloaded, and is best off ignoring abuse unless it affects their own customers, by and large - in other words, the status quo.

Automation can act as a simple pre-filter; an automaton with high precision (precision is the ratio of true positives to total positive flags, so high precision means a very low rate of false positives, but says nothing about false negatives) triggers an automatic cut-off with the user having the right to refer the situation to a human. You can also use a high recall (recall is the ratio of true positives to the sum of false negatives and true positives, so a high recall automaton has a very low rate of false negatives, but says nothing about false positives) automaton to determine what gets put in front of the humans. Between the two, the human doesn't deal with the obvious cases (the high precision automaton has dealt with those), nor do they deal with false triggers (the high recall automaton has dealt with those), leaving them with the difficult cases to handle only.

Security quotes of the week

Posted Oct 19, 2016 19:52 UTC (Wed) by Garak (guest, #99377) [Link] (2 responses)

Automation in this case is absolutely excluded. You want humans to be in the discussion before any decision is taken.

For important pedantic reasons I'll reiterate that when I've used the word 'automation' I've been implying that humans are part of that system, and in fact, the primary 'judgement' agents. The idea of Google or Facebook having an algorithm that in any way judges the legitimacy (versus criminality) of my speech is unacceptable to me. Pretty much what you are saying. Clearly Google and Facebook are welcome to cease allowing me to use their service if they disagree with me politically. If however they excercise that liberty, that is precisely why I need Real Free Speech on the internet in the form of hosting/operating my own server, such that Google and Facebook have no power of censorship over me.

Security quotes of the week

Posted Oct 19, 2016 20:06 UTC (Wed) by Garak (guest, #99377) [Link]

and to clarify, I doubt that unless I went out of my way, I could get Facebook or Google to censor me for political or illegitimate legal reasons. However I still feel that the overall situation has effectively censored a(n estimated) majority of Free Speech on the internet. I believe that Google and Facebook and other Gatekeeper's dangling of broad censorship powers in their Terms Of Service, prevent a vast amount of speech because of the psychological effect of the presence of the Gatekeepers, including their long-winded mandatory finely printed legal contracts (Terms Of Service / Acceptable Use Policy / etc).

Not to mention the more technical aspects of presentation of text-string speech. Clearly Facebook and Google box you in to expressing yourself in the visual formats that they offer to their users. Wheras the FOSS home server operator has no such limitations on forming the wider aesthetics of their expressions (to the extent their software development and artistic skills allow)

Security quotes of the week

Posted Oct 19, 2016 20:25 UTC (Wed) by farnz (subscriber, #17727) [Link]

You absolutely do not want humans to be the primary judgement agents for the majority of cases; final arbiters, yes, but the error rate of a human is relatively high compared to a system designed to have high precision. Indeed, a good spam filter tuned for high precision has an error rate lower than a 5 human chain can manage.

In the ideal world, you have a system with 100% precision handle the obvious cases (no human involvement). You then have a system with 100% recall decide which of the remaining cases get put before a human; these are the hard ones. A system with 100% precision cannot have a false positive (by definition); it has a mix of false negatives, true negatives, and true positives. Similarly, a system with 100% recall cannot have a false negative - it throws out a mix of true positives, false positives and true negatives. The pairing isn't perfect, because something that a 100% precision system correctly classifies as a negative can be misclassifed by a 100% recall system as a false positive - there's then no way to tell which of the two systems is correct, bar bringing in human judgement.