On the Twitter Hack

> "ownership of your own social graph"

What would that mean?

> If these platforms were forced to act more like email

Who decides who's "following" who?

Say I decide to use a competitor. Do I then get to "take" my Twitter followers and can still broadcast to them on Twitter from a different app? Under what conditions can Twitter block your activity? Either they will have to let a lot of spam in or they'll have to ban most non-Twitter activity from coming in.

How do we define interoperability? Do we make Twitter as it is right now a government mandated standard? How do we introduce new features?

I just don't see how you can do all this or how it makes sense at all.

Although email does certain things well it's not without issues. Running your own server is tough. Even many fairly mainstream services have deliverability issues. Spam is rife. And it's especially a big problem when running your own or using a small provider. Email is terrible for initiating unsolicited interactions (in some places might even be illegal).

What you're basically proposing is a model of spam where only the content of the message is considered. I do not think that would be very effective in practice, in the modern world.

Email spam filtering is already a lot more powerful, since it can consider things such as IP reputation. (IP reputation would be a non-starter for a federated social network, since it would require passing raw IPs along with messages in the federation protocol. And that is just unthinkable from a privacy perspective).

When all entities posting messages on a social network are managed by the same identity provider, and the identity provider can share information about the account with the social network, you get yet another layer of increase in power. You can, for example, tell whether the account is newly created or not. Or whether it was bulk-created along with 10 other accounts posting similar spam. Or a dozen other account reputation signals which let you classify accounts into organic vs. abusive, and use that to inform the classification of messages from those accounts. And again, the only way this happens is if the identity provider and the social network are one and the same. If they were separate companies, it'd be inexcusable for either party to share detailed information with the other.

Core argument is for "building codes" for software that is effectively mission critical infrastructure. Data and identify security--and privacy--concerns may drive a fair amount of regulation in the next five to ten years. Here is Schneier's core thesis:

"There are many security technologies companies like Twitter can implement to better protect themselves and their users; that's not the issue. The problem is economic, and fixing it requires doing two things. One is regulating these companies, and requiring them to spend more money on security. The second is reducing their monopoly power.

The security regulations for banks are complex and detailed. If a low-level banking employee were caught messing around with people's accounts, or if she mistakenly gave her log-in credentials to someone else, the bank would be severely fined. Depending on the details of the incident, senior banking executives could be held personally liable. The threat of these actions helps keep our money safe. Yes, it costs banks money; sometimes it severely cuts into their profits. But the banks have no choice.

The opposite is true for these tech giants. They get to decide what level of security you have on your accounts, and you have no say in the matter. If you are offered security and privacy options, it's because they decided you can have them. There is no regulation. There is no accountability. There isn't even any transparency. Do you know how secure your data is on Facebook, or in Apple's iCloud, or anywhere? You don't. No one except those companies do. Yet they're crucial to the country's national security. And they're the rare consumer product or service allowed to operate without significant government oversight."

There's one element of the tragedy of the commons. Honest Bob's Social Media Emporium might not be entirely motivated to mark their users as untrusted, when most of the pain of the spam is felt by the other thousands of providers they federate with.

"Hey, doing SMS verification of new accounts is expensive, but required by the other nodes on the network. How about we don't, but say we did?"

Imagine a solution to email spam that replaced looking at IP address reputation with looking at the sender's claim about their own reputation. Laughable idea, right?

The other problem with your suggestion is that you can't do abuse prevention with a single signal, even if it's not Boolean. I even gave an example in the previous post, with checking whether accounts doing similar abuse were clustered together at account creation time.

De facto monopoly is not a monopoly. It is a dominant player. But a monopoly really is exclusive.