LWN: Comments on "Living with the surveillance state"

Living with the surveillance state

Jandar — Sun, 08 Dec 2013 17:43:35 +0000

Another case of "obviously" correct but actually buggy: http://lwn.net/Articles/575460/

Living with the surveillance state

jospoortvliet — Fri, 29 Nov 2013 09:13:04 +0000

Yeah, isn't it the other way around in the US, politics being owned by the (big) businesses?

Living with the surveillance state

filteredperception — Tue, 12 Nov 2013 21:29:15 +0000

"In this last case you could say that this would mean that the cryptography in use should be strong enough to withstand mass cracking, but weak enough to allow case-by-case cracking. Which is a hard problem too, of course."

I was going to respond "not so hard, just traditional spying with picked locks and video or other bug capturing keys as and when they are used by the user". But that works onlysomuch when you have mathematically unbreakable crypto available, which is not a 100% for all time assumption one can make. So you are right, it is a hard problem. Because the first thought that comes to mind is that powers-that-be can (and I suspect do) try to solve it by making the methods of breaking the crypto a kind of orwellian 'unknowledge', that they will establish as such by truly any means necessary.

It's a jungle out there kids...

Living with the surveillance state

glaesera — Sat, 09 Nov 2013 05:57:22 +0000

The article does not mention the complementary view of the surveillance in progress. This is in my opinion, I said it several times already and want to repeat it in public now, that world-dominating companies like Google, Microsoft and Facebook need to be watched by the NSA actually.
They are pursuing extremely aggressive expansive policies and marketing-strategies, and because of this there would be an enormous inflation in the US. There is an enormous inflation of data already, because low-quality-data is cheap, as stated correctly in the article. But there would also be an enormous inflation of money, because this is what the whole big-data business-model is essentially about: turning data into money.
No idea about the rest of Europe, but here in Germany there are quite a lot of people who would like to offer asylum to Snowden actually, but the current government is against it, quite obviously because of the Snowden-documents and the NSA-affair they lost their majority and cannot continue with their coalition. The liberals are for the first time not represented in the next national parliament, because they missed the 5% hurdle. This is a historic precendence.
I hope there will be a center-left coalition.

Living with the surveillance state

naptastic — Sat, 09 Nov 2013 00:19:30 +0000

+1 for referring to Chelsea by her correct name. <3 !

Living with the surveillance state

Jannes — Fri, 08 Nov 2013 09:09:07 +0000

Sorry.... this one:

http://www.youtube.com/watch?v=9CqVYUOjHLw

Living with the surveillance state

Jannes — Fri, 08 Nov 2013 09:07:37 +0000

For anyone interested, this sounds like almost the same speech, minus the technical bits and the enthousiastic audience.

Living with the surveillance state

Wol — Fri, 08 Nov 2013 00:55:33 +0000

> That's a good point I often fail to remember - at the end of the day, you're just trying to prove some form of equivalence between one model of your program and another.

And this is a perfect example of the trap I rail at quite often - THE MODEL IS NOT REALITY.

Just because it is proven that your software (a mathematical construct) is mathematically correct doesn't mean that it will actually work. I'll just quote two luminaries:

Knuth: "Beware of bugs in the above code; I have only proved it correct, not tried it."

Einstein: "As far as the laws of mathematics refer to reality, they are not certain, as far as they are certain, they do not refer to reality."

Cheers,
Wol

Missing video

rmayr — Wed, 06 Nov 2013 18:22:51 +0000

That made me grin - at least we can keep some of our humor ;-)

Living with the surveillance state

k8to — Tue, 05 Nov 2013 08:27:14 +0000

Yeah, maybe I, as a purported software engineer, should learn more about this arena. When I last looked it seemed like a very large amount of effort for a fairly narrow improvement in reliability.

Of course we also put a lot of time and effort trying to make our code coverity-clean, and that seems to be also a fairly narrow band of improvement. I guess I suspect that for hundreds of thousands of lines of code that trying to make a provably correct model isn't likely to be worth the effort.

Chelsea Manning?

Jessica_Lily — Tue, 05 Nov 2013 08:15:30 +0000

No, Bradley is now Chelsea, she changed her gender.

Living with the surveillance state

Jandar — Mon, 04 Nov 2013 23:04:43 +0000

> You strive for a formal description that is "obviously" correct to a human,

Unfortunately '"obviously" correct' is in no way the same as really correct. '"obviously" correct' is akin to a secure implementation of cryptography: not yet broken.

Living with the surveillance state

ibukanov — Mon, 04 Nov 2013 21:25:37 +0000

Although the storage became cheap the bandwidth is not. So the total surveillance comes to the end the moment everybody starts to send 3d video messages instead of emails.

Living with the surveillance state

rnp — Mon, 04 Nov 2013 14:52:32 +0000

What is a terrorist ? And who defines who/what is a terrorist ?

These are very tricky questions. To me, the terrorists are the governments and the very small powerful group that controls them.

Living with the surveillance state

bakterie — Mon, 04 Nov 2013 11:31:11 +0000

> Yea, there are a lot of things where you can formally show that your code conforms to some formal description, but I know of no way of showing that the formal description is correct provably.

Typically the formal description lacks a lot of implementation details, and is on a more conceptual level. You strive for a formal description that is "obviously" correct to a human, and then prove the equivalence between the implementation and the specification.

You are correct in that you still don't know if the specification is provably correct (for some definition of correctness), but at least you have reduced the problem from convincing someone that the implementation (with all its gory details) is correct, to convincing a human being that a much simpler specification is correct.

Living with the surveillance state

dlang — Sun, 03 Nov 2013 14:51:54 +0000

> That said, I'm not entirely sure about the US. They have a serious problem at the political level and it's not clear they look far enough ahead to make the necessary adjustments for a smooth transition.

the government has surprisingly little influence on business in the US, especially on the direction of what businesses do.

Living with the surveillance state

kleptog — Sun, 03 Nov 2013 11:37:08 +0000

Personally I think saying that we're in for something worse than the Great Depression really diminishes how bad the Great Depression really was. There world trade was cut in half and unemployment was 20-30% or more. Right now world trade is back where it was and unemployment is higher but not hugely so. If you didn't pay attention to the news you might not have noticed a recession going on at all.

However, I think your point is more to the long term. The thing is, our ability to produce things is indeed limited by a finite planet, but most of the economy (80%) is in services, not goods and there no particular limit to the number of services that can be provided. I can see production of goods stabilising (if it hasn't happened already).

That's not to say there aren't challenges. Fossil fuels will run out and we need to replace them with some other energy source and drastically improve efficiency. But I'm a glass half full kinda guy and there are signs of movement. Our economy is 20 years will look radically different, but hey it looked radically different 20 years ago too.

That said, I'm not entirely sure about the US. They have a serious problem at the political level and it's not clear they look far enough ahead to make the necessary adjustments for a smooth transition.

Living with the surveillance state

raven667 — Sat, 02 Nov 2013 20:05:59 +0000

> you can still prove how dumb you are

Thanks man, I love you too. 8-)

> why did you post a pointer to some data

Because I know that information is out there if you have two brain cells to rub together to find it, you can also find out where I work, how much I am paid and what my house is worth among other things. I know that I'm not truly anonymous when I speak online unless I have gone to significant effort to create an anonymous identity separate from my "normal" identity which I have not done.

I think the root of the disagreement is in the perception of risk. You seem to believe that my risk of a home invasion, or something bad happening to me, has been materially changed in some way and I disagree with that assessment. I also don't think you are actually going to jump on a plane and steal my toaster, or that our local drug addled poor are just waiting to read the lwn.net comment section to figure out which houses to rob. You could of course try and pull some juvenile prank which might change my risk assessment slightly but that would also say more about you than me and I am presuming that you are an adult.

A risk assessment which includes means, impact, and most importantly likelihood is useful for everyday living and as humans we are naturally bad at it. All risks seem highly likely and greatly harmful when they are not.

Living with the surveillance state

HIGHGuY — Sat, 02 Nov 2013 08:05:54 +0000

____Usually, a technical solution is superior to any social solution.

Well, maybe this statement missed some necessary nuances to make it acceptable for most of you.

The first would presumably be that any technical solution must be backed by a supportive social "contract". If really everybody is fine with the NSA spying on them, then you should not instate cyptography that makes it hard(er).
If people have legitimate reasons for doing something, there can be no social contract and thus such a technical solution should be optional at best.

The second would be that ultimately the social solution (when followed by everyone) and the technical solution have the same effect.
If in the ideal world of the social solution nobody cracks cryptography, then the technical solution of using cryptography everywhere is superior because it actively enforces the social solution and makes offenders 'impossible'. (With the notion of course that cryptography is merely delaying it's cracking rather than outright preventing it).

This statement actually has its roots on the workfloor. When you worked out a procedure that people should follow to prevent breaking things for everyone then applying technical measures to guide/force them into that procedure is better than relying on education only.
Of course, some users should still be allowed to force other behavior, considering they know what they're doing in these very special cases.

My opinion is that the same thoughts can apply to society as well, in some cases.
When we're all in favor of banning spying, it's better to prevent it altogether through technical measures than to rely on the goodwill of the spooks. Of course, some users should still be allowed to "spy" (think og law enforcement with a warrant), considering they have a legitimate reason to do so in these very special cases.

In this last case you could say that this would mean that the cryptography in use should be strong enough to withstand mass cracking, but weak enough to allow case-by-case cracking. Which is a hard problem too, of course.

Living with the surveillance state

khim — Sat, 02 Nov 2013 00:50:39 +0000

Do you have any evidence for this peculiar statement?

Do you need theory or evidence? Evidence is there if you look for it, situation with theory is much harder because last century was spent in building nice mathematical models which explained how you can achieve infinite growth on a finite planet. They apparently don't work, but we have no new ones just yet.

As for evidence… it's there if you know where to look.

The US in particular is barely in recession at all any more, and many metrics (housebuilding starts, household debt ratios, etc) are rapidly improving.

These are all smokes and mirrors. They are supposed to be “early indicators” for the future employment rates, but they no longer work that way. If you'll take a look on the the actual situation with the labor force then there are no improvement. Official explanation of difference between this rosy picture and the sad reality which non-easily-falsifiable metrics gives us is “oh, that's all about baby boomers, you know they are retiring and there are fewer young workers”, but if you'll visit the appropriate site you'll find out that number of workers above 65 was 64.54 million five years ago, 78.78 million year ago and 81.97 year today. IOW: these pesky baby boomers are not retiring, instead they work till they drop! What goes down instead are workers between 35 and 44 years. This basically means that this actually-not-so-rosy picture is completely artificial: government just writes off millions of people (they apparently like to live on subsidies). This four years after the end of recession, remember?

Even Europe is out of crisis, though hardly in ideal state yet.

Europe? Don't make me laugh. The only country which is in good shape is Germany and they don't have resources to bail everyone else out.

Living with the surveillance state

nix — Fri, 01 Nov 2013 23:11:44 +0000

i stated already that i do *not* believe in black&white measures (only this or only that), but in a mixture of them, so keeping information secret is perfectly fine for me, as is using locks.

In that case, please stop posting until you have the ability to express yourself in a fashion that does not cause complete misunderstanding by everyone involved. Your initial response in this thread strongly implied that you agreed with the grandparent poster, that

Usually, a technical solution is superior to any social solution.

This is the arrant insanity I disagree with. From your post, I thought you agreed with it. From other responses to you it seems that I am not the only person to think so.

Living with the surveillance state

PaXTeam — Fri, 01 Nov 2013 22:56:36 +0000

see, you just proved my point once again: why did you post a pointer to some data (that number seems to be disconnected, is it obsolete/fake?) instead of the data itself? because you are actually afraid of it showing up on search engines forever (and i have the courtesy of not helping it myself exactly because unlike you, i understand that some information doesn't belong on the net, social measures and your beliefs in them notwithstanding). that said, you can still prove how dumb you are by actually posting the data ;).

Living with the surveillance state

PaXTeam — Fri, 01 Nov 2013 22:48:38 +0000

> you publish your home address and your schedule.

why would i want to contradict myself?

Living with the surveillance state

PaXTeam — Fri, 01 Nov 2013 22:46:49 +0000

so much nasty ad hominem, i'm hurt! more seriously, why don't you get familiar with the dictionary and look up what a hypocrite is. then quote me back where you think i said something that makes me one ;). asking for your address while not publishing mine isn't it: i stated already that i do *not* believe in black&white measures (only this or only that), but in a mixture of them, so keeping information secret is perfectly fine for me, as is using locks. but if someone believes that technical measures are superflous because he lives in such a nice neighbourhood, go ahead and prove it. you have yet to back up your statement with actual action. IOW, you're just trolling as usual.

Living with the surveillance state

PaXTeam — Fri, 01 Nov 2013 22:35:54 +0000

> > state that a subset doesn't have the properties of the set

> Did you mean to talk about *members* of the sets in question here?

yes i was being sloppy but thought it would be clear from the context, sorry if that made you misunderstand me. as for what i pointed out, it's really not hard: if you disagree with the elements of a set, you also disagree with the elements of any subsets of the set, unlike what you stated.

Living with the surveillance state

nix — Fri, 01 Nov 2013 22:02:21 +0000

we are in the first stages of extremely large depression (thing Great Depression… only bigger)

Do you have any evidence for this peculiar statement? I've never heard it anywhere else outside the sort of website that tells you to turn all your money into gold and beat it into gold-lined tinfoil hats to keep the chemtrails off. The US in particular is barely in recession at all any more, and many metrics (housebuilding starts, household debt ratios, etc) are rapidly improving. Even Europe is out of crisis, though hardly in ideal state yet.

Living with the surveillance state

nix — Fri, 01 Nov 2013 21:54:53 +0000

Let me repeat once more: in a world with reliable locks (where technical measures dominate) this information will be absolutely worthless. Lock can not be picked up anyway, so why not publish it's location? In our world where lock is just a side-show and social aspect is the primary one… of course one will not give up their primary form of protection so easily!

Again you were clearer than I. Exactly so.

Living with the surveillance state

nix — Fri, 01 Nov 2013 21:52:13 +0000

Quite. I trust that the set of local burglars is small enough that the low probability of any one of them attacking a close-knit community like mine is sufficient to ensure my safety. Posting my address here is tantamount to offering a challenge to the entire world of burglars, which has quite different effects: among other things, if something is hard to burgle it will then become *more* likely to be attacked.

I am not a moron and will not compromise my safety to prove something to an anonymous blowhard like PaXTeam. (I note that PaXTeam is trying to get me to post my address when his name and indeed number remains opaque. Hypocrite.)

Living with the surveillance state

nix — Fri, 01 Nov 2013 21:49:16 +0000

It's nice to know you can't read. I explained quite clearly why posting addresses is foolish.

Living with the surveillance state

mathstuf — Fri, 01 Nov 2013 16:50:43 +0000

You might be interested in the project[1] that the Lavabit and Silent Circle people are working on. It looks like they want to replace SMTP (IMAP would presumably stay).

[1]http://arstechnica.com/business/2013/10/silent-circle-and...

Living with the surveillance state

khim — Fri, 01 Nov 2013 09:50:47 +0000

Of course. Was there any doubt? When Google just started effectiveness of ads on it's search pages was off-the-charts. It was ten or maybe hundred times more effective then TV ads (per dollar spent). Of course such thing brought marketing guys in droves, ads filled less and less relevant pages and effectiveness of ads went down. Guess what exactly limits said process? Right: other forms of advertisement. Internet spending grows till it starts wasting more or less the same percentage as other mediums.

This, again, shows how wrong drag is: short-term cheaters win, but medium-term mediums with better metrics win (and long-term we are all dead which makes this case not very interesting).

Living with the surveillance state

khim — Fri, 01 Nov 2013 09:43:21 +0000

It seems likely to me that there is a widespread and epidemic practice of generating false metrics in order to drive up prices for advertisers. Not just by people like Google or whatever, although they are part of it, but all the people that get kick-backs from google.

Google is not part of it. Not because they are all that “altruistic” or “fair”, but because all such shenanigans can only ever provide temporary boost and Google does not need temporary boost: it makes more then enough money short-term and it's goal is to convince advertisers to continue to spend money on them long-term. That means that when Google discover some large cheats it usually cracks on them and “miss the expectations” that quarter. Small cheaters can get away with their schemes for awhile, alas.

Once the advertising agencies, or the companies that spend the money on the advertising agencies, figure out how to accurately gauge the effect of those advertisements on the buying habits of the public then I figure there will be a significant constriction in the online service industries.

LOL. Nope. The effect will be the exact opposite. You think Google business is big? TV ads business dwarfs it by a huge margin. It's budgets are slowly moving to the Internet because it already easier to gauge the effect of the ads on the Internet. If someone will find even better way to more accurately measure effects of the ads on the Internet then Internet will get bigger slice of the advertisement fee.

Especially if at around the same time we enter into a new stage of 'recession' in the economy. As long as people have big budgets then sometimes the main problem is just figuring out how to spend it. However that can change if corporations start having to penny pinch.

Wrong again. We are not in the 'recession', we are in the first stages of extremely large depression (thing Great Depression… only bigger). All the corporations are hurting because buyers are just not there (and buyers are not there because they don't have money). What does it mean? If you'll start to “penny pinch” then you'll go under even faster. Which will probably mean that medium-term ads will become even more important. Long-term, yes, situation will be different (if all your competitors go bankrupt and you are left alone then you don't really need more ads, right?), but this stage is many years removed from today.

Living with the surveillance state

klbrun — Fri, 01 Nov 2013 07:54:03 +0000

Traditionally, marketing departments always knew half of their expenditures were wasted; the problem was, they didn't know which half. It appears that the internet has not changed that aspect of the business.

Chelsea Manning?

Cyberax — Fri, 01 Nov 2013 05:46:14 +0000

No, it's Bradley - he has changed his gender.

Chelsea Manning?

alison — Fri, 01 Nov 2013 05:20:54 +0000

Bradley's sister, perhaps?

Living with the surveillance state

drag — Fri, 01 Nov 2013 04:48:30 +0000

Just thought of another thing. Another difference this imaginary distributed user/tracking and discovery protocol of mine from email is that it probably needs to be a 'pull' model rather than a 'push' model.

Email is all about 'push'. You don't know what you are getting until you get it.

If instead it's subscription services then you won't have all the same problems with spam and whatnot. A user will actually need to subscribe to companies or services in order to get information from them... that is have their server actively subscribe and pull the data from them. I figure this will go a long way to cut down on the shenanigans and be more in line with the way web services work.

maybe a more elaborate system based on something like:

https://bitmessage.org/wiki/Main_Page

I donno.

Living with the surveillance state

drag — Fri, 01 Nov 2013 04:42:32 +0000

> I guess this implies lots of data upload which doesn't work that well with current asymmetric wired connections and would "needlessly" drain the battery of mobile devices.

The data is already being uploaded, no?

Also it does not need to be a all or nothing situation. If you don't care about controlling your information then you can use whatever service. Right now all the social media stuff is 'walled gardens'. If you do things P2P and open protocols then anybody can provide any service they like and users can use whatever software they like.

Also the amount of data that people like Facebook save in their 'big data' clusters is a hell of a lot more than people actually care about or want shared. If all you want shared is your posts or pictures or links to this or that then that really isn't a whole lot.

> For a distributed community network, not only friends are required, but enough well-connected (in this case, technically) friends. That's an additional hurdle to clear.

Yes. This is the big problem.

Needs to be something like Email, that is very distributed, but have a built in way to make sure the communication is always coming from the same person/persons.

The actual identity of the person controlling the account can be confirmed or discovered through side channels if that really matters to you and the person you are communicating with. Just have to make sure that the messages are unadulterated and whatnot.

> An other problem is that if we accept that some surveillance is reasonable, the government will want to have a backdoor and then we're back to square one - what if the three letter agencies abuse the backdoor?

Screw them. I don't think that surveillance is reasonable, but I do think it's unavoidable. As long as governments continue to give these bozos money they will continue to use it to undermine our security. But that's their problem. So let them figure out how to do their job. They don't need our or anybody else's help.

Living with the surveillance state

drag — Fri, 01 Nov 2013 04:26:40 +0000

> Care to elaborate on this? Calling all the metrics "a complete fabrication" is kind of incompatible (IMHO) with "businesses that depend on these advertisements"... or I didn't parse it right.

Hrm.

'businesses that depend on these advertisements'. I mean like toilet paper companies, vacuum cleaner salesmen, car companies, movie producers, and other people that purchase ads online and provide the money that 'social' websites need to thrive off of. They depend on advertisements to sell their products. They give money to advertising agencies that then buy space on popular websites.

That's the money that pays for all the bandwidth, servers, etc that companies like facebook use to attract the demographics that the advertisers want.

One thing to always keep in mind with these companies is that the primary business of companies like Google or Facebook or Twitter or whatever isn't the online services they provide you. Their primary business is selling you, the user and every bit of personal info they can get their hands on, to the advertisers. Bundling you up and creating packages that the advertisers can pick and choose from.

I used to work for a company that did this sorts of stuff successfully pre-internet. They depended on mortgage companies selling your personal data. State governments selling your personal data. Drivers license info, credit card spending habits, and all that stuff for tracking people and carving them up into demographics and worked with the Post Office to make sure that they had accurate information on people living at various addresses. Used it for junk mail.

Now that information combined with your online habits and email history they can paint a much more complete picture of you and figure out how to bundle you with other people and sell you.

It seems likely to me that there is a widespread and epidemic practice of generating false metrics in order to drive up prices for advertisers. Not just by people like Google or whatever, although they are part of it, but all the people that get kick-backs from google. Youtube users, people advertising crap on facebook, people trying to drive traffic to their blogs, etc etc. It goes top to bottom. Ranging from small time BS, to organized crime and botnets.

Once the advertising agencies, or the companies that spend the money on the advertising agencies, figure out how to accurately gauge the effect of those advertisements on the buying habits of the public then I figure there will be a significant constriction in the online service industries.

Especially if at around the same time we enter into a new stage of 'recession' in the economy. As long as people have big budgets then sometimes the main problem is just figuring out how to spend it. However that can change if corporations start having to penny pinch.

Living with the surveillance state

k8to — Fri, 01 Nov 2013 02:53:02 +0000

I tend to encounter an attitude not so much as "the US is the best part of the world, and that's as it should be". It's typically more an ill considered blend of two ideas.

Idea 1 is "the US is the best", which gets expressed in various ways. For example in school (ages 6-12) we were repeatedly told that our country was special because we are Free, as if personal freedom was an extremely rare thing in the world overall, with no clarification on what other parts of the world might have similar properties was really ever communicated. This idea that the US is "the best" is usually stated without any specific comparison to any other thing.

Idea 2 is "the US is separate/apart from the world". This kind of thing has cropped up in other powerful cultures from time to time, the most obvious being China's historical concept of being 'the Middle Kingdom', halfway between the earth and heaven. There is here, the US, and then vaguely.. there is everywhere else. This comes from size, from water boundaries, from historical political priorities and a lack of regional nearby powers.

Together they kind of thoughtlessly blend into a position of unconsidered privilege.

Missing video

tglx — Thu, 31 Oct 2013 22:33:15 +0000

Tried that, but my personal Non Sensical Agent just told me: There is No Such Audio.