Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Goodbye, and Thanks for All the Bikesheds

queue.acm.org

Post reply on HN
Print view View original

221–230 of 285 posts

Re: Goodbye, and Thanks for All the Bikesheds

#221

Post by ETH_start »

busterarm wrote: post #215
ETH_start wrote: post #189

Earlier quoted context omitted.

He's very clearly arguing against absolute privacy on the Internet and is saying that the people who advocated for it, which he besmirches as "tech bros", are responsible for the governments going too far now, instead of a happy compromise having been set out at the beginning, which by the way totally mischaracterizes the history of the Internet, where the governments were trying to impose total surveillance from the…

He’s not exactly wrong either. The founders/executives of a tech startup I worked for spun off a completely unrelated E2EE chat app as a separate startup and didn’t market it to anyone. It’s only used by them and their buddies and basically only for OTR conversations related to their publicly traded company that would have put them in prison. Totally the “let’s defraud these investors and do industrial espionage” typ…

We can agree to disagree on this. Even on this example you gave, I'm not entirely sure it's harmful to society. Having worked in the corporate world, there are just so many regulations that — from what I've seen — there is pervasive non-compliance and the covering up of the non-compliance. I suspect that if every single corporate regulation was effectively enforced, a significant fraction of economic activity would grind to a halt.

Re: Goodbye, and Thanks for All the Bikesheds

#222

Post by sam_lowry_ »

NooneAtAll3 wrote: post #213
lysace wrote: post #115

Earlier quoted context omitted.

To clarify: not MD5 itself. It was created in 1991 by Ron Rivest. (It is my experience that knowledge of these things isn't as widely distributed as one might hope.) I first came across it in 1995/1996: Wow, what a magical tool for backend web stuff! I used it for everything.

is the difference between MD5 and MD5crypt the same as between Java and Javascript or are they actually related somehow?

related

Re: Goodbye, and Thanks for All the Bikesheds

#223

Post by crabbone »

hinkley wrote: post #146

A bit of an aside, but after someone introduced me to the notion of Reversible Decisions, it quickly became apparent to me that the solution to the bikeshed problem is to throw money at it before the roosters can start preening about which color the shed should be. Decisions that are reversible should just go with the instinctive answer of whoever volunteers to work on it. I've been in many meeting rooms where, becau…

This is what usually happens if you let incompetent people make design decision: they stay with the first and worst version forever.

Right now I'm in the process of leaving a company where this happened over and over again. The company's product and design aspects were always neglected in this specific way: whenever a problem was discovered its solution was assigned to whoever would write the code to solve it. That's it. The QA would be notified a week or two before the release and after the solution was "finished". The QA would then not be allowed to even comment on the overall design, only the superficial bug reports were allowed to go through.

Needless to say the product's code-base is a dumpster. The morale is low because it's a daunting task to deal with this dumpster on a daily basis. Now, even if you wanted to, you wouldn't have a budget to fix the previous design mistakes because of the layers of more mistakes that were added on top of them due to the low morale and lack of budget / lack of procedure for making better design decisions. The only thing that keeps the product afloat is its uniqueness in a rather niche field and the backing of a large company that acquired it, but doesn't really depend on it and has no time for a thorough audit.

Re: Goodbye, and Thanks for All the Bikesheds

#224

Post by [deleted] »

simoncion wrote: post #166
inigyou wrote: post #164

Earlier quoted context omitted.

It requires you to enter a birth date which is not required to be your birth date. In case of a conflict between the age verification birth date and any other birth date, only the age verification birth date may be used for age appropriateness checks.

Okay? That is not parental controls that are [L]egally require[d] ... to be effective and easy-to-use-if-you-take-a-few-minutes-to-read-the-instructions. Additionally, I expect that -due to kids lying about their ages- within five or ten years, the regs will have "graduated" from self-attestation to ID and biometrics collection. It's likely that other states will require that sort of collection much sooner, causing e…

[deleted]

Re: Goodbye, and Thanks for All the Bikesheds

#225

Post by inkysigma »

simoncion wrote: post #166
inigyou wrote: post #164

Earlier quoted context omitted.

It requires you to enter a birth date which is not required to be your birth date. In case of a conflict between the age verification birth date and any other birth date, only the age verification birth date may be used for age appropriateness checks.

Okay? That is not parental controls that are [L]egally require[d] ... to be effective and easy-to-use-if-you-take-a-few-minutes-to-read-the-instructions. Additionally, I expect that -due to kids lying about their ages- within five or ten years, the regs will have "graduated" from self-attestation to ID and biometrics collection. It's likely that other states will require that sort of collection much sooner, causing e…

I'm not the biggest fan of the current age verification schemes, but I don't think the idea kids can lie about their age differs in the threat model posed under either system. Presumably, under the law, parents would be the ones to create a child account with a non-editable-by-the-child-account age fields which would then be used as a legal source of reference. If you assume the child can create an account without such features or can edit the age themselves, then I don't see why the equivalent threat model in the parental control system would be giving the child control over the parental control toggles rendering it meaningless by simply disabling it.

That being said, age based restrictions isn't a fine grained control over the system as perhaps one would like but that also would be inherently more complicated to think about from a legislative perspective (e.g. how fine grained and how to categorize possible dangers) and user control perspective when it looks like a lot of parents are looking for a blunt generic button that basically goes "this is agreeable with general practices". This seems more or less how real systems are gated.

The other issue is that both present privacy challenges but this just a little more so from a fingerprinting perspective. Presumably you need quite a few bits to completely specify the filter whereas age is only a ~1.58 bit field in the CA model. Not really sure how much this matters when there are so many other signals for fingerprinting and we should probably make fingerprinting from it illegal but just some thought.

> Instead, what we get proposed is a system that cares very much about how old you are, and not one bit about the things that one's guardian understands one needs to be protected from.

Regarding your linked comment, I think it's a bit strange to say that if legislators really did care about child safety they would mandate fine grained controls instead. I'm not sure what additional fine grained factors you may be thinking of precisely, but we already use age as a gate in real life for many things we consider dangerous so it's quite natural for legislators to transpose those. Our laws already very much care about how old you are.

Re: Goodbye, and Thanks for All the Bikesheds

#226

Post by ponector »

busterarm wrote: post #169
hinkley wrote: post #146

A bit of an aside, but after someone introduced me to the notion of Reversible Decisions, it quickly became apparent to me that the solution to the bikeshed problem is to throw money at it before the roosters can start preening about which color the shed should be. Decisions that are reversible should just go with the instinctive answer of whoever volunteers to work on it. I've been in many meeting rooms where, becau…

This often massively discounts the cost of reversing decisions. People often work to build things without any thought given to those who have to maintain it afterwards. Especially when it's not them. I worked at a large, publicly-traded multinational where decades prior and they were still just a 4 man startup they decided the database server and all timestamps should be in the local timezone. They are still using ES…

>> People often work to build things without any thought given to those who have to maintain it afterwards. Especially when it's not them

Because for maintenance there is a different team and budget. Same goes about the meetings. Recent example: it's okay to blow $1000 in man-hours to discuss and reject an increase of the compute capacity of my virtual workstation. I bet the cost associated with request was ~$25 of increase to the monthly bill. But it is from the other budget, so it was refused.

Re: Goodbye, and Thanks for All the Bikesheds

#227

Post by manwe150 »

regularfry wrote: post #217
dash2 wrote: post #83

Earlier quoted context omitted.

Obviously if the government knew that you had no kids, they wouldn't need to check it. How do you propose they find out, without asking you to prove it?

Backwards. The government knows who has kids because they do things like issue birth certificates and operate state schools. In a lot of places it's legally very difficult not to be listed as a parent on government records. So why should I have to prove I don't have kids when the government can know I'm not on any of those lists?

The government departments know those things because the parents registered on those lists. It doesn’t automatically just “know”, and that info is historically not usually shared between government departments

Re: Goodbye, and Thanks for All the Bikesheds

#228

Post by weltensturm »

andrekandre wrote: post #204
dzonga wrote: post #140

I think the author is missing a layer of abstraction. yeah - once regulators come into play - the private ecosystems take over. discord is already a precursor to this. the era of mass public social networks will come to the end. next it will be just private networks of individuals. likely the won't interact. how the dynamics play out - I don't know - but if you study history - you will know what behaviors will happen…

> the era of mass public social networks will come to the end. its just my unsubstantiated guess, but i feel like this is the end-goal of these age-verification laws... but if that were true, what i don't understand is why don't they just go after the business model itself legal-wise instead of indirectly with age-verification...

I assume it's because age verification is something the attention slop merchants can work with, and they'd rather lobby for that instead of letting their entire business model be uprooted.

I'm sure "child friendly content" is part of their calculations, and I'm sure they'll try to interpret the rules in a way that maximizes their profit.

Re: Goodbye, and Thanks for All the Bikesheds

#230

Post by ukoki »

hinkley wrote: post #146

A bit of an aside, but after someone introduced me to the notion of Reversible Decisions, it quickly became apparent to me that the solution to the bikeshed problem is to throw money at it before the roosters can start preening about which color the shed should be. Decisions that are reversible should just go with the instinctive answer of whoever volunteers to work on it. I've been in many meeting rooms where, becau…

This reminds me of my experience as a senior contractor joining teams that seem to enjoy endless discussion. For example, when implementing a new feature using an open-source library or framework they will want to make a prototype of all possible libraries, make a report about each of them, have some big discussions about which to choose, and only _then_ start the real implementation. My advice is always to just pick the one your gut tells you is the right one -- if the prototype works, then that _is_ the implementation and we can stop considering alternatives unless we have a good reason to reconsider them.

If a decision is hard to make, its often because the differences are small, and therefore it doesn't matter much and you might as well decide by dice-roll.

Post reply on HN