> Whatever policy you implement, end result must be that stuff costs more and people live with less: virtually no personal cars, no for-fun-flights (vacation), force people to wear same pants for years and repair them when they get damaged.
> That is hard pill to swallow for many, even for somewhat environmentally-aware beings.
You’re not wrong but I think adding some context would be helpful here.
That appears to be the situation now but it didn’t necessarily have to be this way. If effort in earnest was started earlier to develop the technologies necessary for transitioning off hydrocarbons, develop renewable energy generation, and so on the transition may not necessarily be so severe. And the policy which enabled this delay did cost consumers any way due to the active funding of a pro hydrocarbon influence campaign. Though I would guess the total cost of that policy is still much lower than actually trying to transition.
I think transitioning is a much easier pill to swallow if you realize that the decision will be made one way or another eventually and that it’s better to be proactive rather than reactive when trying to solve such an existential issue. That is, if one believes the science and cares about the future beyond just one’s self. Unfortunately that influence campaign I was mentioning earlier did a good job of denying the issue, used bad science to deceive, delayed climate action, degraded efforts of those fighting against it, etc. However I do acknowledge the ability to care beyond just one’s self is, to a certain extent, a financial privilege.
Incentivizing having less children is also another long term approach to limit emissions as technology becomes more efficient. Though it seems this has already been accomplished unintentionally in many places.
I’ve gone on kind of a rant but my point is yes the necessary policy decisions are more severe today but it absolutely did not have to be this way. And that is important to keep in mind because that campaign is still actively at play today.
Documents and testimony show that this “man-in-the-middle” approach—which relied on technology known as a server-side SSL bump performed on Facebook’s Onavo servers—was in fact implemented, at scale, between June 2016 and early 2019.
Facebook’s SSL bump technology was deployed against Snapchat starting in 2016, then against YouTube in 2017-2018, and eventually against Amazon in 2018.
The goal of Facebook’s SSL bump technology was the company’s acquisition, decryption, transfer, and use in competitive decision making of private, encrypted in-app analytics from the Snapchat, YouTube, and Amazon apps, which were supposed to be transmitted over a secure connection between those respective apps and secure servers (sc-analytics.appspot.com for Snapchat, s.youtube.com and youtubei.googleapis.com for YouTube, and *.amazon.com for Amazon).
This code, which included a client-side “kit” that installed a “root” certificate on Snapchat users’ (and later, YouTube and Amazon users’) mobile devices, see PX 414 at 6, PX 26 (PALM-011683732)(“we install a root CA on the device and MITM all SSL traffic”), also included custom server-side code based on “squid” (an open-source web proxy) through which Facebook’s servers created fake digital certificates to impersonate trusted Snapchat, YouTube, and Amazon analytics servers to redirect and decrypt secure traffic from those apps for Facebook’s strategic analysis, see PX 26 at 3-4 (Sep. 12, 2018: “Today we are using the Onavo vpn-proxy stack to deploy squid with ssl bump the stack runs in edge on our own hosts (onavopp and onavolb) with a really old version of squid (3.1).”); see generally http://wiki.squid-cache.org/Features/SslBump
That is insane and I would be inclined to not believe it if someone had told me this. This is such an immense breach of trust that even for me, who has a very low opinion of Meta, it is unexpected. I hope this will blow up as much as it should
I'm somewhat surprised it's taken this long to come out. It was something of a open secret that onavo was spying somehow on snapchat traffic within atleast the infra/release org back in 2016 era
So this one time, I had a bug report at a client site. The business was largely a member of _______ religion. Our images wouldn't load in the app, but did on the website. How odd I thought, that doesn't make sense! Luckily I was able to be physically present, so I hopped down with laptop in tow, ssh'd into the server and started tailing logs....
Sure enough all the API requests for data were coming through, but whenever a request for image happened - nothing would hit the servers.
What the heck I thought to myself?
I said to the client 'that can't be, that's almost impossible....the only way that's possible is if the SSL traffic is decrypted, inspected, and images blocked from being requested, which, is a MITM attack".
He redirected me to his IT provider. I phoned them up, and explained the situation.
"Ahh so they're _____"
Me: "So what does that have to do with the price of fish?"
Them : "Content filtering..., you need to talk to ____"
Sure as the day is long, the content filter was a VPN all members of ____ had to have on their mobile devices (I don't know how widespread this is, whether it was just this business, or the entire ____ )
I applied to have our system approved, it was, and just like magic the next day photos started coming through.
I'm guessing basically it detected any .jpg/.mp4 etc URL's in https requests and flagged it up and blocked them from being requested. You can be sure on those devices the VPN would have been somehow locked in with device management, and there's no way on gods green earth they were getting at Facebook/insta etc.
So, it's not just meta. That really hammered home how seamless it can be to end users that they really can't trust what's actually happening on their devices.
Not that I'm a fan of it, but in corps it's pretty standard praxis to have a custom root cert installed on all devices and enforce VPN connections on devices outside the network to be able to MITM all requests and do stuff like content filtering (e.g. NSFW, swearwords and obviously malware). It's the company's device and they give it to you for work specific purpose, you shouldn't use it for personal stuff. I don't think it compares to an app that shadily installs its own root cert on an end user's device to spy on them.
It's not corporate level it was/is religious group level (of which this particular org I'm guessing largely employed staff from that religion). They are well known within our country to be quite insular.
It certainly seemed for all intents and purposes if you were a member of _____ group (wider than the company) you had the vpn on your device, and it was filtering content. I've found other reports in other countries of that happening with the same group.
So it's not corporate content filtering, it's personal content filtering and our app got caught up in it (and approved).
It certainly made my skin crawl for anyone in that religion. That means the central filtering service could be reading messages. Not sure if they're that sophisticated but certainly they didn't want people to see random images/videos.
Is it like required from their religious leadership to install this? That is incredible, and I only now understand your comment to its full extent. That is brutal.
This is one reason I think ECH is probably on net a bad idea. Content filtering is a legitimate use-case for lots of users/networks, and if traffic is completely opaque to all networks, you end up needing things like root level processes or full MITM or laws requiring ID for websites instead of more privacy-preserving inspection of basic metadata (like SNI) at the network level.
You could imagine a standard for a network to signal to a client that it does not allow certain privacy features like ECH, and then clients can accept that or not. Instead I expect browsers will eventually mandate ECH, so people will have to MITM instead.
Yes, this exists. There's more than one company you can choose. It's not 'forced' but strongly recommended. Also, my love for hacking started with getting around it...
From the inference of the commenter, I think they were referring to an app on a mobile device and not the device itself.
It also sounds like their issue was at the ISP provider level, as well, which takes the business out of the loop of being the data controller/owner (of the collected data) at that point.
Note: I'm not saying that your comment doesn't have merit, I just don't think that the points that you made apply - specifically - in this case?
After re-reasing the comment I think you're right. I had a hard time grokking it it seems. But since the issue was apparently a VPN app installed on the phone, I don't know whether this was the ISP or maybe their IT service provider that did content filtering on behalf of the company (like an outsourced IT department?)
The VPN (much like Meta's) is doing some root cert trickery to filter content that is deemed inappropriate or potentially inappropriate. This appeared to be controlled by a Company A in another country that undoubtedly contracted to Y religion to be their central point of content filtering globally.
So, member of the church? you get this VPN on your phone, (not sure whether phone was supplied by the church, but certainly this VPN was on it)
VPN is effectively content filtering and blocking content.
I had our app whitelisted by that central company (literally raised a ticket with them, next day magically fixed).
I also hope that any ethically minded engineers inside Meta take a stand against this BS. The only way stuff like this happens is because engineers working on these projects decide that they can set aside whatever morals they may have had for the price of a big fat FAANG pay cheque. It's about time our profession adopted a code of ethics, like that of the ACM[1]. To the engineers who _have_ walked away despite the obvious pressures, I salute you.
This was news … 5 years ago, I think, I don’t know why it blew up again. But context matters:
Onavo provided a compression + VPN service for people traveling; they let users use little or no data while roaming, and still get internet access. I do not know what their original business plan was, but Facebook bought them for the ability to spy on users.
Their MITM was, in fact, the raison d’etre of Onavo. And then, they were bought by Facebook. And then there was just some more analytics added. At no point, as I understand it, was it built explicitly for evil - and I suspect very few employees were in on the real reasons.
Nah, I've met enough amoral people over the course of my career to know that's not the case. However, the overwhelming majority of people I've worked with are people who do have morals and do care about the outcomes they're creating, and that gives me great hope.
I am happy to answer any questions you have about questioning or ethics at the time. Assuming that people's reaction to this was wrong, while not knowing what that reaction was, or having less than 5% of the context, isn’t going to help much.
Short answer: No, there were strong arguments for it. I reached out for institutional support to answer some questions, groups that I expected to be a lot more supportive than the ACM, but I found the reaction seriously lacking. Your intuition that groups like the ACM should offer assistance is sensible but completely overlooks many problems: geopolitics, different types of security, and individual capacities, among others. Each institution has its priorities; those are not always compatible, and it’s unclear who should have precedence. The ACM won’t help you if the argument is the kind of compromise with the devil that spy agencies often make or if problematic tools are used in efforts to dismantle large criminal groups.
I understand that things are often more nuanced than they may appear, and in questions of moral judgement there will always be room for fuzziness. Personally I think the idea of compromising security for everyone in order to make life a little easier for the TLA's is not something I'd feel comfortable doing. I consider an individuals right to privacy paramount, something without which we risk unbounded tyrannical rule. Others will probably feel differently when presented with 'think of the children' style arguments. I'm glad to hear though that you were at least conflicted enough to be asking questions.
You simply legislate that if a company is building anything that will be used regularly by more than eg. a few thousand people, then the work must be designed and/or signed off by a licensed engineer, who will a) be subject to a code of ethics and b) be professionally liable for any failures causing loss or damage to the public.
We seem to be able to manage this with bridges, planes, electrical & hydro installations etc. No reason it shouldn't be the same for critical software infrastructure.
I mean with a thing like a plane you can say "that's not allowed in our state/country", with software that starts to get a whole lot more problematic. Soon you'll see people starting to push laws that say things like "because people are running dangerous software from outside the country we demand that only signed software can run on our phones/computers and that devices here must enforce it" coming out of our politicians that seemingly get a pile of cash from groups like Microsoft and META.
It's perhaps not 'critical' in the sense that losing it would matter much, but it is worth caring about because of the number of people who are affected if/when things go wrong.
Why do you trust it ? Do you think that others (Google, Microsoft, Apple) are not doing/would not do such a thing ? SSL is as secure as its certificates.
1. Nobody will care in 10 days.
2. They will get a slap on the wrist at best.
Reminds me of Google driving around in StreetView cars, hacking and capturing all wifi traffic they could get their hands on. Did anything happen? Of course not!
The guardian says "open" networks, apart from the fact that in 2010 networks were not secured by default in many cases. I think WEP 1 was a thing and easily hacked, and I would not be surprised if they were actually Wardriving, on the largest scale ever.
I did not really need a reminder that this website is filled with morons, just like Reddit. But I get it anyway every time I post something negative.
Remind me when anything more than a slap in the wrist happens. And my definition of slap on the wrist is adjusted to how big Meta actually is, they make more than some countries!
You just hate facts, just like the idiots on Reddit, I am supposed to praise big tech criminals and just make positive stuff up, then I get all the upvotes.
That's appalling to say at least. But Snapchat implemented certificate-pinning since 2015. Does that mean either the analytics endpoint was not covered or somehow the certificate-pinning is circumvented in this case?
By using mitm, basically "pretending" you're the site the victim wants to connect to and trasparently connecting to the actual upstream site. Basically decrypting the traffic locally for inspection before sending it back out. https://en.wikipedia.org/wiki/Man-in-the-middle_attack. You don't need a root CA, you just need to poison the DNS to point to the mitm server and just present any old valid cert for the domain so it doesn't trigger a self-signed warning or whatever.
How can you take any old valid cert though? I presume they have some sort of private key you don't have access to and it would still trigger an expired cert warning?
Just speculating here but isn’t jumping out a window in Russia usually an implication it was ordered by the Russian state (ex: FSB) while in the US a framed suicides are assumed to be done by numerous non-associated actors. So in one place a single entity is responsible and in another it’s multiple entities.
It doesn’t seem surprising to me that there would be an affinity towards a particular method within entities.
Or a poisoning with a ludicrously rare poison, a strange car crash, a plane falling out the sky, dying at a gulag when you were fine a few days earlier etc etc.
It’s a very unsafe place when you don’t toe the line.
> It’s a very unsafe place when you don’t toe the line.
This one seems less like "it's a very unsafe place" and more like Prigozhin was trying to be killed. He went into open armed rebellion and negotiated a deal where he was exiled to Belarus. Then he went back to Russia, where he experienced a fatal plane crash. He would have to have been a total idiot not to see that coming.† What happened?
† My favorite story in this general vein is what happened with the Mitanni king Tushratta, whose brother the king was killed by a usurper when Tushratta was young. Tushratta inherited the throne, and the usurper, Tuhi, held power as regent until Tushratta came of age.
At which point Tushratta had Tuhi and his coconspirators executed. This was 3400 years ago, but somehow I suspect that even then this wouldn't have been hard to predict.
> He would have to have been a total idiot not to see that coming
The confusing bit for me is why did it go on for so long? It’s one thing to kill him, but seemingly letting him back into Putin’s circle before killing him is surprising. I hope to hear the story one day.
Russian ballistic missiles just hit residential area in Odessa, killing at least 16 and injuring 70. It was a double-tap attack. The second missile hit the same place 15 minutes later to kill first responders that had arrived: one paramedic and one firefighter died on the scene.
That's 2 civilians as contrasted to 118 from a massacre that is part of a genocide fully endorsed (using its veto power at the UN) and supported (with weapons deliveries) by the United States:
However there are lots of services which are in-fact inherent monopolies.
Take electricity transmission or your ISP for example. They have a common set of infrastructure which is hard to share among many competing interests. Who gets to decide what should be upgraded, to what, and when? How does one divvy up costs infrastructure changes which did not benefit a significant set of participants because they are individually in the minority and unable to cooperate? If you prioritize minority participants then what about the majority participant? What about a super majority participant?
Lots of times cities will try to regulate these services tightly because past behavior has necessitated it. Though ISPs are perhaps a bad example here.
I read an article somewhere talking about a study where privatized healthcare resulted in increased profits but patient services suffered. Is profit above all else a good objective for government services?
I've learned to be careful about this "natural monopoly" term because it turns out to be very debatable. Recently with fiber deployments is a good example...see London/UK experience.
I feel like if people realized the benefits to having many companies compete for everything, then they would choose services that did not act like monopolies and to create barriers of entry.
The consumer ultimately dictates how companies should do business. The problem is a lot of the time they are choosing the price that is in front of them, and not considering the price in the future.
If consumers were smarter they could break monopolies without government intervention necessary.
Like if there were two companies building out some critical infra...if one promised they would do it in a way that others could compete easily, and consumers valued that, then they would win the contract.
> profit above all else a good objective for government services
This doesn't need to be the case.
People already work for government without profit incentive. It's personal prestige mostly I think.
Interesting to think about what would happen if we introduced duplication and competition within government departments. It seems extremely counter-intuitive because of duplication, but its how the entire capitalist sector deliver efficiencies. Same as how open source works. People compete for prestige.
Corporates sometimes do this too. Google might have multiple teams working on the same goal.
Interesting to think about what would happen if you hired two people to do one job and made them compete against each other on every task.
I still think some services are more prone to being naturally competitive while others are more prone to being naturally centralized. Everything is on a spectrum. Good government regulation tries to balance these natural tendencies.
I’d be curious to hear more about your thoughts on “natural monopolies”. I’ll have to look up the fiber deployment as I am not familiar with that.
> If consumers were smarter they could break monopolies without government intervention necessary.
True but that is the nature of being human. We have evolved to use heuristics and biases due to fundamental time and energy budgets with bounded computational abilities. If one looks at the assumptions made in the efficient market hypothesis it’s pretty easy to see that many of those assumptions are simply not fully true. Though they are useful simplifications for modeling at times.
> Interesting to think about what would happen if you hired two people to do one job and made them compete against each other on every task.
Oh man I’d hate to think what office politics/drama would turn into. Still would be an interesting experiment.
- https://bounties.fulu.org/
- https://consumerrights.wiki/w/How_to_help