Reading through this made me nod more often than I probably should:
A key reason for the continued effectiveness of DDoS attacks lies in organizational structures. Systems are often put into operation under time pressure, as temporary solutions or pilot projects. Security aspects take a back seat as long as functionality is guaranteed. Such temporary installations are rarely dismantled or revised if they remain inconspicuous in everyday use. Over the years, this results in unsupervised components that are neither monitored nor updated.
As I’m running various pieces of infrastructure on my own, I also happen to then and now see which software does connect to my environments. And as I’m interested in this kind of stuff, I then and now tend to listen to podcasts or read through articles dealing with self-hosting of more or less complex pieces of infrastructure, most of them just all too often boiling down to the idea that it’s all “trivial” and “just” takes will and a bit of dedication to do it - and even in some of these podcasts once in a while I’m negatively impressed to hear how little real experience in managing infrastructure is shining through and how much of this is more or less happy-path about initially installing a piece of software on a VPS or a shared hoster. And then I’m painfully reminded of the early 2000s and trying to keep our corporate mail server and other pieces of infrastructure safe from numerous more or less distributed DoS attacks mostly conducted by poorly maintained, unpatched, vulnerable installations of typo3, wordpress and similar pieces of software one “just” used to install at some point and left at this state for a random amount of time. This feels quite concerning, over and over again.
Reading through this made me nod more often than I probably should:
A key reason for the continued effectiveness of DDoS attacks lies in organizational structures. Systems are often put into operation under time pressure, as temporary solutions or pilot projects. Security aspects take a back seat as long as functionality is guaranteed. Such temporary installations are rarely dismantled or revised if they remain inconspicuous in everyday use. Over the years, this results in unsupervised components that are neither monitored nor updated.
As I’m running various pieces of infrastructure on my own, I also happen to then and now see which software does connect to my environments. And as I’m interested in this kind of stuff, I then and now tend to listen to podcasts or read through articles dealing with self-hosting of more or less complex pieces of infrastructure, most of them just all too often boiling down to the idea that it’s all “trivial” and “just” takes will and a bit of dedication to do it - and even in some of these podcasts once in a while I’m negatively impressed to hear how little real experience in managing infrastructure is shining through and how much of this is more or less happy-path about initially installing a piece of software on a VPS or a shared hoster. And then I’m painfully reminded of the early 2000s and trying to keep our corporate mail server and other pieces of infrastructure safe from numerous more or less distributed DoS attacks mostly conducted by poorly maintained, unpatched, vulnerable installations of typo3, wordpress and similar pieces of software one “just” used to install at some point and left at this state for a random amount of time. This feels quite concerning, over and over again.
As part of the development of our Custom Usability Index, which can be used to measure the degree of usability of a software project, we as Usability Team took a closer look at those principles and extended them to 13 top categories, which contain multiple usability aspects each. In this article those categories and aspects are explained in more detail and illustrated with examples.
All along with other non-functional requirements to run into, usability, in its various aspects, is something both relevant and ignored just too often, with issues hard to fix afterwards.
As part of the development of our Custom Usability Index, which can be used to measure the degree of usability of a software project, we as Usability Team took a closer look at those principles and extended them to 13 top categories, which contain multiple usability aspects each. In this article those categories and aspects are explained in more detail and illustrated with examples.
All along with other non-functional requirements to run into, usability, in its various aspects, is something both relevant and ignored just too often, with issues hard to fix afterwards.
Bottom line, again; There are more than just a few aspects that justify reconsidering the usage of this particular platform. There are alternatives on par with them or better. And this is quite a good writeup on how to get there.
#readings #new age technology #linkdump #streaming cleanup
Every now and again, I reach the end of the week with more stray links that I’ve been able to squeeze into the newsletter, and when that happens it’s time for a linkdump. This is linkdump number 31; here’s 1-30:
It’s been five years (to the day!) since Wired killed off “Beyond the Beyond,” Bruce Sterling’s excellent blog, a wanton act of online vandalism that, among other things, made it much harder to figure out what was on Bruce’s mind, a subject I find endlessly fascinating:
Sterling’s got a Medium that he almost never updates. I follow it through RSS, the best way to keep up with both things that update frequently and also hardly ever:
This week, he posted a long, thoughtful, and seriously intriguing review of Cafe Europa Revisited, Slavenka Drakulic’s followup to her 1996 international blockbuster Cafe Europa:
I confess that I had never heard of Drakulic, though, as I read Sterling’s review, it became clear why he dotes on the acerbic Croatian essayist, a keen observer of the material world and theorizer of political upheaval:
Drakulic is well-known for an essay collection called “How We Survived Communism and Even Laughed,” and the subtitle of this volume is “How to Survive Post-Communism,” which just about says it all. Sterling characterizes it as the start of a new hot genre, “Old books directly written for old people by old people.”
“The West” (whatever that is) is getting old. For more than a decade, Bruce Sterling’s been predicting a future of “old people, in big cities, afraid of the sky.” Original Sin, a new heavily reported book on the 2024 election makes a good case that Biden was indeed in a state of advanced senescence through much of his presidency and the entire election campaign, and had no business occupying the White House, much less running for another four years:
Biden’s unwillingness to confront his age and frailty, along with Trump’s obvious mental and physical decline, has many terrified American political thinkers talking about the gerontocracy that’s running the country:
“Oldest democracy” as in, “the democracy with the oldest leaders.” The Democrats are gearing up for the midterms with such repeat offenders as Maxine Waters (86), Rosa DeLauro (82), John Garamendi (80), Doris Matsui (80) and Bonnie Watson Coleman (80). Also running: David Scott (79) who had to step down as ranking House Ag Committee member over health concerns. And: Dwight Evans (70), who missed most of last year’s votes after suffering a stroke.
[[MORE]]
Meanwhile, Nancy Pelosi (85), Steny Hoyer (85), Danny Davis (83), Frederica Wilson (82), Emanuel Cleaver (80) and Alma Adams (78) won’t say whether they’re running in 2026:
At 53, I can tell that I’ve lost a step. Sure, I have the benefits of wisdom, but man, I am so tired. Maybe the reason our Democratic leaders have sat idly by and watched as Trump dismantled democracy and installed fascism is that they’re too tired to scale the fences like their South Korean counterparts did?
I’m not saying everyone over 65 in Congress should retire. I’m saying that a caucus that skewed younger might be more, you know, vigorous. I’m minded of my favorite John Ciardi poem, “About Crows”:
The young crow flies above, below, and rings around the slow old crow. What does the fast young crow not know? WHERE TO GO.
Meanwhile, young people might just be getting something out of the regulatory apparatus. Thanks to a smashing court loss in the USA and regulation in the EU, Apple is now required to allow app makers to use their own payment processors, skipping the 30% App Tax Apple levies on every in-app purchase, to the tune of $100b/year.
Among other things, this means that every Fortnite skin and upgrade could suddenly get 25% cheaper without costing Epic Games a dime. The only problem is that Apple refuses to obey the regulation or the court order:
Apple’s in a lot of trouble in the USA (Apple execs who lied to a federal judge about this stuff now face criminal sanctions), and it looks like they’re spoiling for a fight with the EU. After all Trump flew to Davos and threatened to destroy any country that tried to regulate US Big Tech. The rest of the world doesn’t seem scared – or at least, they’re more scared of the risk of trusting US cloud technology that can be cut off to kneecap a rival economy, or used to spy on government and industry, or both. In the EU, Cryptpad – a free, open cloud based document collaboration platform – is luring away Google Docs and Office 365 users at speed:
Meanwhile, back in the USA, things are looking grim for Meta, as the FTC’s case against the company moves into the end-game. The stakes are high: Meta could be forced to sell off Whatsapp and Instagram:
That is, if Mad King Trump doesn’t step in. Seems like nothing is too petty for the Trump admin. How petty are they? This week, Trump’s CBP seized a load of t-shirts from the subversive design studio Cola Corporation:
Why did CBP seize Cola’s tees? Apparently, it was design that featured a cop being attacked by a swarm of bees. Cola knows good publicity when he sees it: he’s printing up more of the tees and selling them in a new line he calls “the confiscated collection”:
If you’d like an essay-formatted version of this post to read or share, here’s a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:
I’ve got a really good excuse for finishing this week with a folder full of links that didn’t make it into the newsletter – I’m on a crazy book tour and I’ve been in four cities this week alone. Time for another linkdump! Here’s the previous 28 ‘dumps:
I like to start these 'dumps off on an upbeat note, and this week, I’ve got something gratifyingly cool and wondrous. Stars Reach is a “living galaxy sandbox MMORPG” led by Raph Koster, the legendary designer of games like Ultima Online and Star Wars Galaxy. It’s kickstarting right now:
Whether it’s water turning dirt to mud or forests growing back after a devastating fire, every action leaves a mark. This isn’t a static world built by developers – it’s a living, breathing galaxy shaped by you. Resculpt landscapes, build entire cities, and yeah, ruin more planets just like humanity ruined their original eight homeworlds. That’s okay – there are always more worlds in our endless galaxy.
I’ve seen demos of this coming together for years and it is mind-boggling. You can play it like a galactic trade-empire builder, a shoot 'em up, a first person shooter, a resource management game, a MUD, and more. There are thousands of procedurally generated planets with realistic geology, geography and ecosystems. It’s like something out of a Neal Stephenson novel. They’re mostly done and just raising money to finish and launch. I gave 'em $100. They’re projecting delivery in January. I can’t wait!
It’s pretty wonderful to see accomplished creators like Koster, who have gone from strength to strength, making a series of ever-cooler things as technological advancements let him realize the vision he’d been chasing since the 8-bit days. It’s quite a contrast with HP, a company that was once world-renowned for making the highest quality, most reliable instruments and machines, and is now synonymous with the scuzzy inkjet rip-off.
[[MORE]]
I love a good dig at HP. This week, The Register’s Paul Kunert scored a direct hit with a short news squib about the executive compensation package announced for HP CEO Enrique Lores: “261,658 toner cartridges” (that is, $19.36m):
I would like to live in a world in which all unreasonable expenses were denominated in HP printer cartridges (much as the BBC compares ever extremely large or massy thing to a London double-decker bus). Anything to make it easier to grasp the vast forces that shape our world and bring them into focus so we can understand them – and destroy or change them.
One economic school that does this extraordinarily well is “Capital as Power,” which concerns itself with the “social power of capital” – that is, how capital shapes our behavior and outcomes. It’s a complicated but extraordinarily clear and useful framework for making sense of the world. This week, Naked Capitalism published a long colloquoy on Capital as Power, featuring Michael Hudson (a great economist and historian of debt), political economist Tim Di Muzio, and two of CasP’s top proponents, Jonathan Nitzan and Blair Fix (whose work I have featured in this newsletter many times). It’s a long, fascinating discussion – just the thing to relax with over a weekend:
Capital as Power grapples with power, the force that neoclassical economists could never figure out how to fit into a neat mathematical model and thus decided to discard. Refusing to think about power gets you into all kinds of trouble, from deciding that markets for human kidneys are “voluntary” to the denaturing of political parties into institutionalist weaklings like the Democrats, who are completely overwhelmed by the power-focused MAGA GOP as it dismantles the nation.
Writing for The American Prospect, Nick Tagliaferro rounds up “Ten Democrats Who Need to Be Primaried”:
For years, Tagliaferro was the loudest voice on the Primary School newsletter, which covered primary races. In this guillotine-inspiring listicle, he presents such swamp creatures as Levi Strauss failson Dan Goldman (NY-10), who spent $5m of his inherited wealth to win his seat, from which perch he has done everything he can to undermine his more militant anti-Trump colleagues in the House. More familiar names like Josh Gottheimer (NJ-05) – whom Tagliaferro calls “single most needlessly antagonistic centrist in Congress” – and the ardent homophobe Stephen Lynch (MA-08).
OK, I’ve got to get into my rental car now and make the 3h drive from State College, PA, where I just did a talk at Penn State, to Doylestown, PA, where I’m speaking this afternoon:
As well as Wellington and Auckland, NZ; and Manchester and London, UK.
Before I go, one last wonderful link to be getting on with. Framework – who make the repairable, modifiable laptop that I love more than any hardware I’ve ever owned – just announced a bunch of fantastic new machines, including a rugged new, 12" touchscreen laptop with a 180’ hinge:
I spend so much time on the road, I have no conceivable use for a desktop PC, but man, this is tempting. What a sweet rig!
If you’d like an essay-formatted version of this post to read or share, here’s a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:
me trying to understand poverty in america vs other global north vs global south countries and wading through koch brother propadanga while im at it linkdump PT 2
me trying to understand poverty in america vs other global north vs global south countries and wading through koch brother propadanga while im at it linkdump PT 1
If you’ve followed my work for a long time, you’ve watched me transition from a “linkblogger” who posts 5–15 short hits every day to an “essay-blogger” who posts 5–7 long articles/week. I’m loving the new mode of working, but returning to linkblogging is also intensely, unexpectedly gratifying:
If you’d like an essay-formatted version of this post to read or share, here’s a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:
[Image ID XKCD #2775: Siphon. Man: ‘Wow, it’s true — the water doesn’t flow up the
tube anymore.’ Woman: ‘Honestly, it’s weird that it ever did. Why did
we ever think it was normal?’ Caption: ‘Physics news: the 2023 update to
the universe finally fixed the ‘siphon’ bug.’]
My last foray into linkblogging was so great — and my backlog of links is already so large — that I’m doing another one.
Link the first: “Siphon,” XKCD’s delightful, whimsical “physics-how-the-fuck-does-it-work” one-shot (visit the link, the tooltip is great):
[Image ID: A Dutch safety poster by Herman Heyenbrock, warning about the hazards of
careless table-saw use, featuring a hand with two amputated fingers.]
Next is “Hoogspanning,” 50 Watts’s collection of vintage Dutch workplace safety posters, which exhibit that admirable Dutch frankness to a degree that one could mistake for parody, but they’re 100% real, and amazing:
While some come from the 1970s, others date back to the 1920s and are likely public domain. I’ve salted several away in my stock art folder for use in future collages.
All right, now that the fun stuff is out of the way, let’s get down to some crunch tech-policy. To ease us in, I’ve got a game for you to play: “Moderator Mayhem,” the latest edu-game from Techdirt:
Moderator Mayhem started life as a card-game that Mike Masnick used to teach policy wonks about the real-world issues with content moderation. You play a mod who has to evaluate content moderation flags from users while a timer ticks down. As you race to evaluate users’ posts for policy compliance, you’re continuously interrupted. Sometimes, it’s “helpful” suggestions from the company’s AI that wants you to look at the posts it flagged. Sometimes, it’s your boss who wants you to do a trendy “visioning” exercise or warning you about a “sensitivity.” Often, it’s angry ref-working from users who want you to re-consider your calls.
The card-game version is legendary but required a lot of organization to play, and the web version (which is better in a mobile browser, thanks to a swipe-left/right mechanic) is something you can pick up in seconds. This isn’t merely highly recommended; I think that one could legitimately refuse to discuss content moderation policies and critiques with anyone who hasn’t played it;
Or maybe that’s too harsh. After all, tech policy is a game that everyone can play — and more importantly, it’s a game everyone should play. The contours of tech regulation and implementation touch rub up against nearly every aspect of our lives, and part of the reason it’s such a mess is that the field has been gatekept to shit, turned into a three-way fight between technologists, policy wonks and economists.
Without other voices in the debate, we’re doomed to end up with solutions that satisfy the rarified needs and views of those three groups, a situation that is likely to dissatisfy everyone else.
However. However. The problem is that our technology is nowhere near advanced enough to be indistinguishable from magic (RIP, Sir Arthur). There’s plenty of things everyone wishes tech could do, but it can’t, and wanting it badly isnlt enough. Merely shouting “nerd harder!” at technologists won’t actually get you what you want. And while I’m rattling off cliches: a little knowledge is a dangerous thing.
Which brings me to Ashton Kutcher. Yes, that Ashton Kutcher. No, really. Kutcher has taken up the admirable, essential cause of fighting Child Sex Abuse Material (CSAM, which is better known as child pornography) online. This is a very, very important and noble cause, and it deserves all our support.
But there’s a problem, which is that Kutcher’s technical foundations are poor, and he has not improved them. Instead, he cites technologies that he has a demonstrably poor grasp upon to call for policies that turn out to be both ineffective at fighting exploitation and to inflict catastrophic collateral damage on vulnerable internet users.
Take sex trafficking. Kutcher and his organization, Thorn, were key to securing the passage of SESTA/FOSTA, a law that was supposed to fight online trafficking by making platforms jointly liable when they were used to facilitate trafficking:
At the time, Kutcher argued that deputizing platforms to understand and remove which user posts were part of a sex crime in progress would not inflict collateral damage. Somehow, if the platforms just nerded hard enough, they’d be able to remove sex trafficking posts without kicking off all consensual sex-workers.
Five years later, the verdict is in, and Kutcher was wrong. Sex workers have been deplatformed nearly everywhere, including from the places where workers traded “bad date” lists of abusive customers, which kept them safe from sexual violence, up to and including the risk of death. Street prostitution is way up, making the lives of sex workers far more dangerous, which has led to a resurgence of the odious institution of pimping, a “trade” that was on its way to vanishing altogether thanks to the power of the internet to let sex workers organize among themselves for protection:
On top of all that, SESTA/FOSTA has made it much harder for cops to hunt down and bust actual sex-traffickers, by forcing an activity that could once be found with a search-engine into underground forums that can’t be easily monitored:
Wanting it badly isn’t enough. Technology is not indistinguishable from magic.
A little knowledge is a dangerous thing.
Kutcher, it seems, has learned nothing from SESTA/FOSTA. Now he’s campaigning to ban working cryptography, in the name of ending the spread of CSAM. In March, Kutcher addressed the EU over the “Chat Control” proposal, which, broadly speaking, is a ban on end-to-end encrypter messaging (E2EE):
Now, banning E2EE would be a catastrophe. Not only is E2EE necessary to protect people from griefers, stalkers, corporate snoops, mafiosi, etc, but E2EE is the only thing standing between the world’s dictators and total surveillance of every digital communication. Even tiny flaws in E2EE can have grave human rights concerns. For example, a subtle bug in Whatsapp was used by NSO Group to create a cyberweapon called Pegasus that the Saudi royals used to lure Jamal Khashoggi to his grisly murder:
Because the collateral damage from an E2EE ban would be so far-ranging (beyond harms to sex workers, whose safety is routinely disregarded by policy-makers), people like Kutcher can’t propose an outright ban on E2EE. Instead, they have to offer some explanation for how the privacy, safety and human rights benefits of E2EE can be respected even as encryption is broken to hunt for CSAM.
Kutcher’s answer is something called “fully homomorphic encryption” (FHE) which is a theoretical — and enormously cool — way to allow for computing work to be done on encrypted data without decrypting it. When and if FHE are ready for primetime, it will be a revolution in our ability to securely collaborate with one another.
But FHE is nowhere near the state where it could do what Kutcher claims. It just isn’t, and once again, wanting it badly is not enough. Writing on his blog, the eminent cryptographer Matt Green delivers a master-class in what FHE is, what it could do, and what it can’t do (yet):
As it happens, Green also gave testimony to the EU, but he doesn’t confine his public advocacy work to august parliamentarians. Green wants all of us to understand cryptography (“I think cryptography is amazing and I want everyone talking about it all the time”). Rather than barking “stay in your lane” at the likes of Kutcher, Green has produced an outstanding, easily grasped explanation of FHE and the closely related concept of multi-party communication (MPC).
This is important work, and it exemplifies the difference between simplifying and being simplistic. Good science communicators do the former. Bad science communicators do the latter.
While Kutcher is presumably being simplistic because he lacks the technical depth to understand what he doesn’t understand, technically skilled people are perfectly capable of being simplistic, when it suits their economic, political or ideological goals.
One such person is Geoffrey Hinton, the so-called “father of AI,” who resigned from Google last week, citing the existential risks of “runaway AI” becoming superintelligent and turning on its human inventors. Hinton joins a group of powerful, wealthy people who have made a lot of noise about the existential risk of AI, while saying little or nothing about the ongoing risks of AI to people with disabilities, poor people, prisoners, workers, and other groups who are already being abused by automated decision-making and oversight systems.
Hinton’s nonsense is superbly stripped bare by Meredith Whittaker, the former Google worker organizer turned president of Signal, in a Fast Company interview with Wilfred Chan:
The whole thing is incredible, but there’s a few sections I want to call to your attention here, quoting Whittaker verbatim, because she expresses herself so beautifully (sci-comms done right is a joy to behold):
I think it’s stunning that someone would say that the harms [from AI] that are happening now — which are felt most acutely by people who have been historically minoritized: Black people, women, disabled people, precarious workers, et cetera — that those harms aren’t existential.
What I hear in that is, “Those aren’t existential to me. I have millions of dollars, I am invested in many, many AI startups, and none of this affects my existence. But what could affect my existence is if a sci-fi fantasy came to life and AI were actually super intelligent, and suddenly men like me would not be the most powerful entities in the world, and that would affect my business.”
I think we need to dig into what is happening here, which is that, when faced with a system that presents itself as a listening, eager interlocutor that’s hearing us and responding to us, that we seem to fall into a kind of trance in relation to these systems, and almost counterfactually engage in some kind of wish fulfillment: thinking that they’re human, and there’s someone there listening to us. It’s like when you’re a kid, and you’re telling ghost stories, something with a lot of emotional weight, and suddenly everybody is terrified and reacting to it. And it becomes hard to disbelieve.
Whittaker sets such a high bar for tech criticism. I had her clarity in mind in 2021, when I collaborated with EFF’s Bennett Cyphers on “Privacy Without Monopoly,” our white-paper addressing the claim that we need giant tech platforms to protect us from the privacy invasions of smaller “rogue” operators:
This is a claim that is most often raised in relation to Apple and its App Store model, which is claimed to be a bulwark against commercial surveillance. That claim has some validity: after all, when Apple added a one-click surveillance opt-out to Ios, its mobile OS. 96% of users clicked the “don’t spy on me” button. Those clicks cost Facebook $10b in just the following year. You love to see it.
But Apple is a gamekeeper-turned-poacher. Even as it was blocking Facebook’s surveillance, it was conducting its own, nearly identical, horrifyingly intrusive surveillance of every Ios user, for the same purpose as Facebook (ad targeting) and lying about it:
Bennett and I couldn’t have asked for a better example of the point we make in “Privacy Without Monopoly”: the thing that stops companies from spying on you isn’t their moral character, it’s the threat of competition and/or regulation. If you can modify your device in ways that cost its manufacturer money (say, by installing an alternative app store), then the manufacturer has to earn your business every day.
That might actually make them better — and if it doesn’t, you can switch. The right way to make sure the stuff you install on your devices respects your privacy is by passing privacy laws — not by hoping that Tim Apple decides you deserve a private life.
Bennett and I followed up “Privacy Without Monopoly” with an appendix that focused on a territory where there is a privacy law: the EU, whose (patchily enforced) General Data Protection Regulation (GDPR) is the kind of privacy law that we call for in the original paper. In that appendix, we addressed the issues of GDPR enforcement:
More importantly, we addressed the claim that the GDPR crushed competition, by making it harder for smaller (and even sleazier) ad-tech platforms to compete with Google and Facebook. It’s true, but that’s OK: we want competition to see who can respect technology users’ rights — not competition to see who can violate those rights most efficiently:
Around the time Bennett and I published the EU appendix to our paper, I was contacted by the Indian Journal of Law and Technology to see whether I could write something on similar lines, focused on the situation in India. Well, it took two years, but we’ve finally published it: “Securing Privacy Without Monopoly In India: Juxtaposing Interoperability With Indian Data Protection”:
The Indian case for interop incorporates the US and EU case, but with some fascinating wrinkles. First, there are the broad benefits of allowing technology adaptation by people who are often left out of the frame when tools and systems are designed. As the saying goes, “nothing about us without us” — the users of technology know more about their needs than any designer can hope to understand. That’s doubly true when designers are wealthy geeks in Silicon Valley and the users are poor people in the global south.
India, of course, has its own highly advanced domestic tech sector, who could be a source of extensive expertise in adapting technologies from US and other offshore tech giants for local needs. India also has a complex and highly contested privacy regime, which is in extreme flux between high court decisions, regulatory interventions, and legislation, both passed and pending.
Finally, there’s India’s long tradition of ingenious technological adaptations, locally called jugaad, roughly equivalent to the English “mend and make do.” While every culture has its own way of celebrating clever hacks, this kind of ingenuity is elevated to an art form in the global south: think of jua kali (Swahili), gambiarra (Brazilian Portuguese) and bricolage (France and its former colonies).
It took a long time to get this out, but I’m really happy with it, and I’m extremely grateful to my brilliant and hardworking research assistants from National Law School of India University: Dhruv Jain, Kshitij Goyal and Sarthak Wadhwa.
I don’t claim that any of the incarnations of the “Privacy Without Monopoly” paper rise to the clarity of the works of Green or Whittaker, but that’s okay, because I have another arrow in my quiver: fiction. For more than 20 years, I’ve written science fiction that tries to make legible and urgent the often dry and abstract concepts I address in my nonfiction.
One issue I’ve been grappling with for literally decades is the implications of “trusted computing,” a security model that uses a second, secure computer, embedded in your device, to observe and report on what your main computer is doing. There are lots of implications for this, both horrifying and amazing.
For example, having a second computer inside your device that watches it is a theoretically unbeatable way of catching malicious software, resolving the conundrum of malware: if you think your computer is infected and can’t be trusted, then how can you trust the antivirus software running on that computer.
Back in 2016, Andrew “bunnie” Huang and Edward Snowden released the “Introspection Engine,” a separate computer that you could install in an Iphone, which would tell you whether it was infected with spyware:
But while there are some really interesting positive applications for this kind of software, the negative ones — unbeatable DRM and tamper-proof bossware — are genuinely horrifying. My novella “Unauthorized Bread” digs into this, putting blood and sinew into an otherwise dry abstract and skeletal argument:
Then there are applications that are somewhere in between, like “remote attestation” (when the secure computer signs a computer-readable description of what your computer is doing so that you can prove things about your computer and its operation to people who don’t trust you, but do trust that secure computer).
Remote attestation is the McGuffin of Red Team Blues, my latest novel, a crime-thriller about a cryptocurrency heist. The novel opens with the keys to a secure enclave — the gadget that signs the attestations in remote attestation — going missing.
When Matt Green reviewed Red Team Blues (his first book review!), he singled this out as a technically rigorous and significant plot point, because secure enclaves are designed so that they can’t be updated (if you can update an enclave, then you can update it with malicious software):
This means that bugs in secure enclaves can last forever. Worse, if the keys for a secure enclave ever leak, then there’s no way to update all the secure enclaves out there in the world — millions or billions of them — to fix it.
Well, it’s happened.
The keys for the secure enclaves in Micro-Star International (AKA MSI) computers, a massive manufacturer of work and gaming PCs — have leaked and shown up on the “extortion portal” of a notorious crime gang:
As a security expert quoted by Ars Technica explains, this is a “doomsday scenario.” That’s more or less how it plays in my novel. The big difference between the MSI leak and the hack in my book is that the MSI keys were just sitting on a server, connected to the internet, which wasn’t well-secured.
In Red Team Blues, I went to enormous lengths to imagine a fiendishly complex, incredibly secure scheme for hosting these keys, and then dreamt up a way that the bad guys could defeat it. I toyed with the idea of having the keys leak due to rank incompetence, but I decided that would be an “idiot plot” (“a plot that only works if the characters are idiots”). Turns out, idiot plots may make for bad fiction, but they’re happening around us all the time.
In my real life, I cross a lot of disciplinary boundaries — law, politics, economics, human rights, security, technology. I’m not the world’s leading expert in any of these domains, but I am well-enough informed about each that I’m able to find interesting ways that they fit together in a manner that is relatively rare, and is also (I think) useful.
I admit to sometimes feeling insecure about this — being “one inch deep and ten miles wide” has its virtues, but there’s no avoiding that, say, I know less about the law than a real lawyer, and less about computer science than a real computer scientist.
That insecurity is partly why I’m so honored when I get to talk to experts across multiple disciplines. 2023 was a very good year for this, thanks to University College London. Back in Feb, I was invited to speak as part of UCL Institute of Brand and Innovation Law’s annual series on technology law:
Getting to speak to both the law school and the computer science school within a space of months is hugely gratifying, a real vindication of my theory that the virtues of my breadth make up for the shortcomings in my depth.
I’m getting a similar thrill from the domain experts who’ve been reviewing Red Team Blues. This week, Maria Farrell posted her Crooked Timber review, “When crypto meant cryptography”:
So her review means a lot to me in general, but I was overwhelmed to read her describe how Red Team Blues taught her to “read again for joy” after long covid “completely scrambled [her] brain.”
That meant a lot personally, but her review is even more gratifying when it gets into craft questions, like when she praises the descriptions as “so interesting and sociologically textured.” I love her description of the book as “Dickensian”: “it shoots up and down the snakes and ladders of San Francisco’s gamified dystopia of income inequality, one moment whizzing up the ear-poppingly fast elevator to a billionaire’s hardened fortress, the next sleeping under a bridge in a homeless encampment.”
And then, this kicker: “it’s a gorgeous rejection of the idea that long-form fiction is about individual subjectivity and the interior life. It’s about people as pinballs. They don’t just reveal things about the other objects they hit; their constant action and reaction reveals the walls that hold them all in.”
Likewise, I was thrilled with Peter Watts’s review on his “No Moods, Ads or Cutesy Fucking Icons” blog::
Peter is a brilliant sf writer and worldbuilder, an accomplished scientist, and one of the world’s most accomplished ranters. He’s had more amazing ideas than I’ve had hot breakfasts:
His review says some very nice and flattering things about me and my previous work, which is always great to read, especially for anyone with a chronic case of impostor syndrome. But what really mattered was the way he framed how I write villains: “The villains of Cory’s books aren’t really people; they’re systems. They wear punchable Human faces but those tend to be avatars, mere sock-puppets operated by the institutions that comprise the real baddies.”
One could read that as a critique, but coming from Peter, it’s praise — and it’s praise that gets to the heart of my worldview, which is that our biggest problems are systemic, not individual. The problem of corporate greed isn’t just that CEOs are monsters who don’t care who they hurt — it’s that our system is designed to let them get away with it. Worse, system design is such that the CEOs who aren’t monsters are generally clobbered by the ones who are.
So much of our outlook is grounded in the moral failings or virtues of individuals. Tim Apple will keep our data safe, so we should each individually decide to reward him by buying his phones. If Tim Apple betrays us, we should “vote with our wallets” by buying something else. If you care about the climate, you should just stop driving. If there’s no public transit, well, then maybe you should, uh, dig a subway?
[Image ID: Matt Bors’s classic Mr Gotcha panel, in which a medieval peasant says
‘We should improve society somewhat,’ and Mr Gotcha replies, ‘Yet you
participate in society. Curious! I am very smart.’]
This is the mindset Matt Bors skewers so expertly with his iconic Mr Gotcha character: “Yet you participate in society. Curious! I am very smart”:
(Which reminds me, I am halfway through Bors’s unbelievably, fantastically, screamingly awesome graphic novel “Justice Warriors,” which turns the neoliberal caveat-emptor/personal-responsibility brain-worm into the basis for possibly the greatest superhero comic of all time:)
I’ve never fully come to terms with the general decency of Cory’s characters. Doctorow the activist lives in the trenches, fighting those who make their billions trading the details of our private lives, telling us that they own what we’ve bought, surveilling us for the greater good and even greater profits. He’s spent more time facing off against the world’s powerful assholes than I ever will. He knows how ruthless they are. He knows, first-hand, how much of the world is clenched in their fists. By rights, his stories should make mine look like Broadway musicals.
And yet, Doctorow the Author is — hopeful. The little guys win against overwhelming odds. Dystopias are held at bay. Even the bad guys, in defeat, are less likely to scorch the earth than simply resign with a show of grudging respect for a worthy opponent.
I often get asked by readers — especially readers of Pluralistic, which is heavy on awful scandals and corruption — how I keep going. Watts has the answer:
Maybe it’s a fundamental difference in outlook. I’ve always regarded humans as self-glorified mammals, fighting endless and ineffective rearguard against their own brain stems; Cory seems to see us as more influenced by the angels of our better natures. Or maybe — maybe it’s not just his plots that are meant to be instructional. Maybe he’s deliberately showing us how we could behave as a species, in the same way he shows us how to fuck with DRM or foil face-recognition tech. Maybe it’s not that he subscribes to some Pollyanna vision of what we are; maybe he’s showing us what we could be.
Got it in one, Peter.
And…
It’s also about what happens if we don’t get better.
Writing on his “Economics From the Top Down” blog, Blair Fix — a heterodox economist and sharp critic of oligarchy — publishes a Red Team Blues review that nails the “or else” in my books, and does it with graphs:
Fix surfaces the latent point in my work that inequality is destabilizing — that spectacular violence is downstream of making a society that has nothing to offer for the majority of us. As Marty Hench, the 67 year old forensic accountant protagonist of Red Team Blues says,
Finance crime is a necessary component of violent crime. Even the most devoted sadist needs a business model, or he will have to get a real job.
[Image ID: A chart labeled, ‘With more plutocracy comes more murder. As countries
become more unequal (horizontal axis), their murder rates go up
(vertical axis).’]
Fix agrees, and shows us that murders go up with inequality.
Which is why, while the average private eye is a kind of “cop who gets to bend the rules of policing”; Hench is “a kind of uber IRS agent who gets to work in ‘sneaky ways that aren’t available to the taxman.’”
[Image ID: A chart labeled, ‘Was the US prison state the inspiration for cyberpunk?
The term ‘cyberpunk’ (which describes a genre of dystopian science
fiction) became popular in tandem with mass incarceration in the US.
It’s probably not a coincidence.’]
This observation segues into a fascinating, data-informed look at the way that science fiction reflects our fears and aspirations about wider social phenomenon — for example, the popularity of the word “cyberpunk” closely tracks rising incarceration rates.
I hope you’ll come along! I’ve been meeting a lot of people on this tour who confess that while they’ve read my blogs and essays for years, they’ve never picked up one of my books. If you’re one of those readers, let me assure you, it is not too late!
As you’ve read above, my fiction is very much a continuation of my nonfiction by other means — but it’s also the place where I bring my hope as well as my dismay and anger. I’m told it makes for a very good combination.
If you’re still wavering, maybe this will sway you: the blogging and essays are either free or very low-paid, and they’re heavily subsidized by my fiction. If you enjoy my nonfiction, buying my novels is the best way to say thank you and to ensure a continuing supply of both.
But novels are by no means a dreary duty — fiction is a delight, and after a couple decades at it, I’ve come to grudgingly concede — impostor syndrome notwithstanding — that I’m pretty good at it.
Und wieder ist ein Jahr rum und wieder hab ich endlose Links gesammelt. Und immer noch gibts was Interessantes, was ich mir hiermit gerne merke oder was auch andere interessiert. Viel Spaß. Open Source design und prototyping platform: https://penpot.app/ musikalische Zeitmaschine: https://radiooooo.com/ Tastatursimulator Design: https://keyboardsimulator.xyz/ Thema Backup und Partition clonen…
🦤 Twitter is still, technically, there. Y’know, functioning. You can go post a tweet, other people can still see it, etc. But… probably not for much longer? Musk activated Hardcore Mode on Twitter yesterday at 5pm on the West Coast and it seems like most of the remaining employees bowed out, leaving Musk with something that, by all reports, barely qualifies as a skeleton crew. The World Cup…
“In our Twitter-driven world, I believe we’re over-optimized for moral judgment and under-optimized for forgiveness. Moral judgment comes easy and is rewarded with retweets and clicks. Forgiveness is difficult and doesn’t go viral.”
A certain sorceror’s prideful boast - unable to find - my longhouse is perfectly constructed “a certain sorcerer’s prideful boast just went majorly viral” longhouse perfectly - Google Search
