Hacker News new | ask | show | jobs
by petjuh 1865 days ago
And the drive to HTTPS was initiated by "evil" Google (like free email with >2GB which was unheard of at the time).
3 comments

Companies always act in their best interests. Occasionally those interests will align with those of the end users.
More usage of HTTPS helps Google's business.

1.) ISPs can not change the content of websites their users are watching to modify or add additional advertisements. Companies have to buy advertisements at Google.

2.) It is harder for ISP to analyze the web traffic of their customers to build profiles which they can sell. Only Google has these information.

3.) When people feel safer in the Internet they buy more stuff on the Internet. Business will buy more advertisements on the Internet, probably at Google.

>2.) It is harder for ISP to analyze the web traffic of their customers to build profiles which they can sell. Only Google has these information.

Using DPI to view the SNI (which is still in plaintext... for now, anyway) of all connections is very easy.

Even once that's patched, most users still use the DNS servers provided by their ISP, which can easily log queries. Even if you created junk queries to add noise, it's child's play to correlate DNS query with the TCP SYN (or UDP datagram for QUIC etc) to the IP returned by the query.

> like free email with >2GB which was unheard of at the time

If its free, you're the product. Yet people don't know. Call me old fashioned but I rather pay for my e-mail services.

> Yet people don’t know.

I’m not sure that’s true. Many people know and simply don’t care.

Using hypothetical me as an example, why does it matter to me that Google can read my emails? Why does it matter to me that Google is improving their searches by tracking my activity? I’ve got nothing to hide.

And before you say “I’ve got nothing to hide” isn’t a good reason to give up privacy and freedom... well that fight isn’t here on HN. It’s a fight with the hundreds of millions of privacy apathetic people who are winning the fight by a landslide.

We can hate on FANG as much as we want, but if 2/3 of the population can validate their business model, does it even matter?

I think that most people implicitly assume that their communications are private.

Mass surveillance is an open secret that is easier on the senses to ignore.

Ignorance can be combatted with information. But now there's a "war on information" with companies like facebook (in true comedic fashion) being the arbiter of "truth". Facebook, one of the biggest players in the mass surveillance game.

The business model is validated because of ignorance. Most people have no idea what pixel tags are, for instance, yet the web is oozing with them. When given the option, people prefer not to be surveilled. It is more or less inhuman to want to be watched surrepticiously. We call that stalking.

> If its free, you're the product.

I'm not sure this is even useful as a rule of thumb, let alone generally true.

Let's Encrypt certificates and Debian are both "free" in the sense you mean, are you somehow "the product" for those?

Everywhere I'm aware of in the world, COVID-19 vaccines are free, are you "the product" when immunised against a deadly disease? How so?

Air is free, am I the product for like... trees? How does this work?

And in contrast it's pretty clear that many expensive things Americans buy treat them as the product anyway, because it's free revenue. So the rule of thumb doesn't even help you to avoid being scammed, it just means you're more willing to pay for the chance.

>I'm not sure this is even useful as a rule of thumb, let alone generally true.

Because free is a limited word. Which is why we have free as in beer / free as in freedom / libre vs free, the list goes on and on.

"If its free, you're the product" is a perfectly fine statement to help average folks navigate the modern tech consumer world outside of opensource efforts.

>Everywhere I'm aware of in the world, COVID-19 vaccines are free, are you "the product" when immunised against a deadly disease? How so?

For this you do actually provide data back to the providers of the vaccine (depending on country and agreements signed of course). Most of the free vaccine sites near me (USA) have a lot of obvious data collection along with the provided vaccine which I'm fine with.

> Everywhere I'm aware of in the world, COVID-19 vaccines are free, are you "the product" when immunised against a deadly disease? How so?

The people making the vaccines are getting paid, although the vaccine is the product. The people sticking the vaccine in my arm are getting paid, my arm is the product. (Sort of)

The US government is compelling insurance companies to pay for it, and paying for it in absence of insurance, because excess death is a drag on the economy.

LE and Debian, two projects I use and appreciate, are free as in beer, but you're allowed to donate [1] [2]. Mirrors run for example on a university. In the end, it is all paid somehow. Perhaps by altruistic people, perhaps by public funding, perhaps by government funding, perhaps by donations (with a nice mention, aka advertising), perhaps by private money... but its paid for somehow.

You mention air and trees. If we don't pump money into the quality of our air and in trees (to offset Co2 production) we are doomed. You mention COVID-19 vaccines. Who do you think pays for it if its free? All of us who pay our taxes do ie. society.

If you pay for something, you have in some circumstances a stronger legal ground than when its free. I have all too often witnessed free products where, when I give feedback/criticism, I get the reply "..its free /care don't moan". If I pay for it, this argument doesn't hold, and you can hold them legally accountable in some situations. Its also not as if e-mail is expensive. I pay my ISP for it, and I get to pick a domain (all included with my sub, but guess what it isn't free...). I can move from that domain if I desire. There's also something like Posteo which costs 1 EUR a month or so, and then there's Protonmail (which I personally don't like cause of JavaScript webmail but YMMV).

The reference "if its free, you're the product" is a great rule of thumb on the WWW, as it raises awareness on an important issue. I wish more people realize it because all too many people have no idea what exactly is being harvested about them. Which is a shame. It also makes it more difficult for commercial products to compete. And, if I take for example two local research news sources which I like (De Correspondent and Follow The Money) then these are paid for; not free as in beer. Yet, they compete with free as in beer. Which isn't free as in beer. Every time you use YouTube or Facebook you pay, with your privacy. What I foresaw long before it got the standard quo was that we get a divide in world-wide society: those who pay with money, and those who pay with privacy. You can already see it very clearly in the mobile world of iOS and Android.

[1] https://www.debian.org/donations

[2] https://letsencrypt.org/donate/

If you have an idea to communicate, try to make it without burying it in sarcasm.