278 posts • joined 10 May 2011
US told to quit sharing data with human rights-violating surveillance regime. Which one, you ask? That'd be the UK
Re: ECHR is not part of EU
Quite, but the former is required to be in the latter.
Re: Re; Moral
>I strongly suggest to get out while you still can.
Indeed: a border wall paid for by the Mexicans is starting to look increasingly likely. Not on the US side of the border though.
It seems that an alternative to Brexit would have been England and Wales leaving the UK while Scotland and NI would have remained thereby remaining in the EU as well (I seem to recall this was what the voters in the respective parts wanted). Actually, I think there would have been precedent for an even better trick: if memory serves Greenland left the EU while remaining a part of Denmark.
Re: Wah wah waaaaah!
>And the NHS will get an extra £350 million a week, remember.
With the £'s exchange rate and with that its purchasing power falling like it is currently does this could actually come to pass (if the NHS is to be funded at the current level in inflation adjusted terms, that is).
>UK cases being detained Chinah? really?
You are right, of course, this seems far too lenient. How about Saudi Arabia though?
While the fine is indeed of no consequence to Facebook as such, their prior infringements should weight against them when* the GDPR is applied to their misdeeds in the future, resulting in higher fines. As it happens there is an explicit provision for that in Section 3 Article 83 (e) (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679).
* I have little doubt that "when" not "if" is appropriate here.
Re: Time to ban Google outside of America?
> ... charity to countries ... to directly milk money out of schools ...
Google's involvement in education with Chrome OS and/or a package of services such as Google docs / gmail etc. would seem just such a thing. While there may be no money from this directly, the rationale of herding children into the system be exploited later is obvious enough.
This is just exploiting their dominating market position in a different way i.e. placing an extortionist price on a key bit of Android infrastructure (Play Store) Google has managed to monopolize* while pushing their other wares and services on the side, and, moreover, making that so expensive that it is still really a non-option. An indication of how perverted the market** here has become is that Google can even contemplate to ask for an extra fee for including something that is actually their biggest direct source of income from Android: under any sort of normal circumstances *they* would be paying to make sure that sort of thing got as wide distribution as possible.
* in general an app store is a natural monopoly waiting to fall to some monopolist because of the self-amplifying feedback loop of: more users -> more developers -> more apps -> more users ... this time it didn't take much effort on Google's part as they got to ship theirs as the only option with every Android phone and competition never emerged before it was too late
** not really a market, at least not in the sense that a market is supposed to be something where vendors compete for the favor of customers, instead a complex tangle of cross-subsidied products and services where competition has no realistic change of emerging
Re: I trust Google more than the EC
>At least Google are honest about their data collection intentions
I have to disagree: they have consistently been pretending to be entirely benign while hiding behind vague T&Cs and only admitting to their slurpy ways after having been caught with their hand in the cookie jar (if then).
>They cant. Simply people buy what people want to buy.
Not really: Google already has a dominating market position and people can only buy what is available.
In retrospect the current situation was inevitable as it was with Microsoft and Windows: a natural monopoly tends to emerge around an OS because something akin to the 'network effect*': there is a self-amplifying feedback loop where more application software for an OS attracts more users which in turn attracts more developers to the platform which means more applications which means more users which means more developers which means more applications which ... Only this time the situation is more complex and hence worse, because Android is "free" (and even nominally "open"**) i.e. Google pays for it with its ad revenues which means that a competitor with anything resembling a level playing field cannot emerge unless it somehow manages to put together a similar tangled web of mutually supporting services and revenue sources from the ground up which might be nominally possible, but isn't going to happen in practice.
The trillion dollar question - an elegant answer to which would also guarantee a Nobel price in economics - is how to tackle a market failure like this.
* originally - I seem to recall - from telephone networks where the value of such a network to the user depends on the number of other users (to talk to) and so one network will end up as a monopoly for which it is practically impossible to create competition from scratch
** in reality it is neither free or open any more: ultimately it is paid by consumers with both loss of privacy and the price of advertising baked in the price of products and services, also Google has actively perverted the original concept of an open platform by making apps depend on their proprietary SW components and services (most importantly the Google Play app store which even in isolation tends towards a natural monopoly, again, because of the network effect: more apps in Google Play (exclusively) -> more users of Google Play -> more developers using Google Play (exclusively) -> more apps in Google Play (exclusively) -> ... )
I'm not entirely convinced that forcing the use of https everywhere is such a good idea. Right now this means that I can't check out bus schedules on titsa.com without passing the gauntlet of adding a security exception to Firefox. While this seems like a miscofiguration on TITSA's part (or, indeed, maybe them using one of these dodgy certificates) protecting my browsing of bus schedules doesn't seem to merit the added complexity and overhead to me: this should be a user choice i.e. typing http/https as desired (and maybe a browser setting for the default, which could be https out of the box by all means), not something that is forced on me whether I want it or not, or indeed, whether it works or not.
I suppose there is more of a point to https everywhere in the US where the ISPs can sell their customers out; this is probably why Google has been a proponent as they'd rather not have the competition.
Re: GDPR ?
>Using it for analytics to help improve their business is also allowed.
If personal information is processed with the justification of carrying out a contract then it may only be processed for that purpose. Doing anything else with it - such as "improve their business" - needs a separate justification, usually consent. The legitimate interest justification could apply, but there is apparently a high bar to using it* - as there should be lest this becomes a general purpose loophole that'd make GDPR internally inconsistent and effectively null and void.
On a related note
The defaults on all browsers to ought to be: session cookies only, no 3rd party cookies.
Facebook insists it has 'no plans' to exploit your personal banking info for ads – just as we have 'no plans' to trust it
This reminds me of Facebook's lying about what they were going to do with WhatsApp's data after the merger (the EU even fined Facebook for this: https://www.theregister.co.uk/2017/05/18/ec_fines_facebook_110m_for_wrong_info/ )
re: Spies Denmark
For a second I was wondering what the local Google affiliate was doing in a list of travel agencies.
While the fine in itself is of no consequence to Facebook this may still come back to bite them down the line: I'd imagine a legal argument against, say, Facebook like / share buttons all over the place would be bolstered by pointing out repeated prior violations.
The default should be no slurp whatsoever. Moreover, no active measures on the part of the would-be slurper to induce the end-user to change that i.e. a facility to opt-in may exist, but the end-user must find and use it on their own.
Re: None of them does
>You opt-in by using the service.
Under the GDPR it doesn't work like that: making the provision of a service conditional on consent to process personal data invalidates the consent (Article 7(4), recitals 42-43 : https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679 )
Re: Washington Post
I saw this too: no 3rd party tracking is promised only as a part of the most expensive subscription. This is in breach of GDPR as giving consent may not be a precondition to providing a service, nor can there be any other disadvantage to those who decline to give consent. (Article 7 point 4, also see recitals 42-43 : https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679, see also: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=623051 )
It also occurred to me that this sort of thing requires using location information which supposedly required explicit consent even before the GDPR.
Also, Facebook is in a business, which is a natural monopoly due to the network effect i.e. a service like it is more valuable to its users the more users it has (like a telephone network where the one with more subscribers is the more useful one): there is a positive feedback loop luring more users (from other similar services) to the biggest one until there is no competition to speak of. This not only means that the first provider to get beyond some critical size is likely to become a de facto monopoly, but also that it is practically impossible to outcompete the monopolist after this. Also the monopolist, as in here, tends to be in a position to buy out or otherwise neutralize anyone who might try, just in case.
> ... too many users who just don't seem to care.
Because they have no idea there is an issue, never mind knowing what it might be (?).
Re: It goes from bad to worse.
>A user in China or Africa cannot claim EU GDPR rules, just because their data is held in Europe.
Actually, I'm not sure of that: as long as the 'processing' in the sense of GDPR (including merely storing it) physically happens in EU it would seem that an EU country has jurisdiction, while the user's country outside the EU would have jurisdiction as well as there in an effect on a user in their jurisdiction - these are not mutually exclusive, but Facebook must abide by both legal regimes. Usually this means going by what is more restrictive for Facebook. If, however, there is no way operate in two jurisdictions without breaking the law in one, then it would seem that Facebook needs to make a choice as to where it wants to do business.
Moreover, regardless where the data is 'processed', the users outside the EU who currently have a contract with Facebook Ireland would seem to have a right to be treated in a way compliant with the GDPR (or the pre-existing data EU data protection regime) on the basis of Facebook Ireland being an legal entity within the EU. Actually, since this effectively means moving vast amounts of data from the EU I'm not so sure this legal as moving data outside of the EU is restricted under the current rules. As the data is going to the US I suppose Facebook could point to Privacy Shield for now, but then it would seem that this will eventually unravel as it is not substantially better than Safe Harbour was.
>The basis of Android is open source ...
Nominally, yes, Android is open source, but actually Google has a monopoly* on it akin to Microsoft's on PC OS: Google has perverted the openness of the system by creating/moving APIs that many apps depend on into proprietary components outside of the AOSP proper, moreover, Google has the only viable app store for Android.
Microsoft's becoming monopoly on PC operating systems depended on the "network effect" where a product or service becomes more valuable the more users it has, which happens because of the closed feedback loop: more/better software available for Windows -> more Windows users -> writing Windows software becomes a better proposition for developers (than writing for competing platforms) -> more/better software available for Windows ... This soon results in a natural monopoly which is practically impossible for a competitor to challenge.
With Android Google not only has an OS monopoly akin to Microsoft's as such, but this is reinforced by its app store monopoly (Microsoft is working on the latter for Windows as well, but not quite there yet). Google's paying for Android and the related services from its advertising revenue makes it even more infeasible for a competitor to succeed and therefore one is unlikely to even emerge: for Google Android is good business as it helps them to rake in advertising revenue, for a potential competitor not so much as it would have to sell the OS as such or embed the cost into price a physical product thereby making those more expensive which means they cannot really compete (as Android is "free"**).
* technically, an overwhelmingly controlling market position, colloquially a monopoly (which is close enough as it is equivalent to an absolute monopoly for most intents and purposes)
** not really free, of course: 1) the consumers ultimately pay for it in higher costs of advertised products and services (only they pay more as there are middlemen) 2) they also pay with their information / loss of privacy and 3) with having to put up with commercial propaganda (=advertising) i.e. getting actively manipulated and misled, which 4) is a systemic problem in a market economy depending on well-informed parties to work efficiently (hence, again, resulting in actual monetary cost because of less efficient economy due to a group of market parties actively working on consumers to be less than well-informed in their decisions)
Re: And that's exactly why...
> ... an amendment to the GDPR such that ...
I don't think an amendment is needed, except maybe for extra clarity. With GDPR and even with the old EU data protection regime consent is required to process an individual's data, which there can't be if the data is purloined from friends' address books and such or, in general, not from the individual him/herself.
An implicit admission ...
... of the extensive communications and data snooping the US government is involved in: the obvious use unique identifiers like social media ids, phone numbers, email addresses is as a selectors for queries into databases containing the snooped stuff.
Re: So what if they don't ?
> Well seize their EU assets ...
I seem to recall that because of Facebook's tax shenanigans their global, non-US revenues go via Ireland (in the EU). I suppose this helps collecting fines and seizing considerable assets. Ultimately I suppose Facebook's Irish subsidiaries through which the global revenue goes could be seized with the effect that said revenue gets permanently seized (the contractual arrangements between Facebook and the subsidiaries created for tax avoidance would surely stay in effect after the seizure?).
Re: NoScript no work
It seems updating to 57 also broke Request Policy (continued). :( This is why I dread updating Firefox. While any apparent change tends be just some rearrangement of the UI (usually pointless and annoying as such) you can be pretty sure that they have somehow managed to make existing addons incompatible and I'm at least forced to update those as well - if I'm lucky - if not, there is no compatible version.
Re: Facebook et al
> ... because I use protection.
Good for you (so do I). However, not everyone does, knows about it or even why it should be used. And, actually, there should be no need, instead collecting, using and transferring personal data (i.e. any data about a person) should be all opt-in (which is pretty much the idea of data protection in a nutshell), such that there is prior, explicit, retractable consent, freely given (i.e. consent is actively given, the default is 'no consent'; consent can't be required to use a product or service).
I suppose it is also relevant that Uber sets the rates the customer pays (thereby controlling what the driver gets after Uber's cut as well); if Uber were merely a real-time market with an app for access matching customers seeking to go from A to B with drivers willing to make that happen for a price agreed between a customer and a driver (or maybe set by a regulator) it would be a different matter.
If we can't have a corporate death penalty (i.e. fines large enough to bankrupt a corporation) for even the most serious misdeeds, could we at least have a penalty where a corporation was forced to issue new shares up to, say, hundred times of its current stock to be sold on a public stock exchange over time with the proceeds going in the public purse. To clarify: the intent is to allow regulators / courts to punish the shareholders of a corporation by wiping out the value of their holdings to a degree proportional to the offense thereby creating an incentive to force proper behavior on the board and top management.
Re: What about...
Thanks, I tried to be very careful with them; a joke of a sort (to a retired (C-)programmer sometimes struggling to balance his parentheses to the satisfaction of (g)cc, anyways) seemed to be emerging as I was writing my short missive, which seemed to ((((perhaps) almost) reasonably) legitimately) call ever more nested parentheses. [Per above I can confirm that unbalanced braces are jarring. :/ (Although I'm not sure if it is (undiagnosed) OCD or merely a result of decades of nagging by cc and her relatives; these may amount to the same thing (or close enough) in practice (?).)]
Re: What about...
Indeed. No third party cookies. In fact, no cookies other than session cookies. These should be the default settings of any browser (by law (with draconian punishment for violations (and something even worse for anything that could be construed as an attempt to circumvent (the letter or (especially) the intent of) the law))).
I'm having mixed feelings as to whether I would like to try some of what those responsible for the EU side of this 'deal' have been smoking.
Oh dear, oh dear
Too bad. (not)
Session cookies only. Separate session for each tab.
Re: 15 years of history?
This could be meant to be impossibly onerous in practice without being strictly impossible in theory i.e. a de facto travel ban (v 3). As a bonus, if someone still manages to get visa approval, they have most likely left something out in the application and this can be used as a pretext to jail and/or deport them at will (neatly working around pesky legal constraints that might apply to a person physically in the US with a valid visa).
> In fact, any country can ...
I suppose any country can also put anyone against the wall when there, or have someone assassinated while in another country. That something can be done doesn't make it right. For this reason most countries have chosen to limit what they can do by domestic law and by signing international treaties. In this context the US used be an ardent proponent of human rights; sadly, this has given way to seeking legalistic loopholes to work around them* in the sense that human rights apply simply because one is a human being.
* e.g. Gitmo, drone strikes, entirely unfettered mass surveillance of foreigners
Re: Noob question
I suppose args has a similar purpose to argc and argv in C main(): the program gets the arguments it is invoked with (if any) trough this. In your example they are not used for anything, but they could be so they are part of the interface / function signature of Kotlin's main().
Re: EU Competition Commissioner said:
Indeed. 110 M € in this context is too small by two to three orders of magnitude. In general, I suppose fines to companies should be such that getting several within a few years would result in bankruptcy. If they are meant to have an effect, that is.
weaken Privacy Shield?
Fear not, for Privacy Shield is about shielding US corps from having to give a hoot about the privacy of us EU plebs.
>I'm curious to know how this was argued.
"Now Mr Congressman, about that campaign contribution ..."
I'll have to object to the idea (a tautology, really) that being a spy organization legitimizes spying: in civilized countries this is illegal without a warrant (for a good reason). Moreover, a spy organization operating outside its native country / jurisdiction cannot legitimately have such a warrant.
Re: WhatsApp / Signal
I don't think any app is safe against local root access, never mind an exploit that allows running code in kernel mode i.e. unfettered access to the hardware: with these the attacker has access to everything the user has (and more).
The only place that mentions "cookie" in 2009/136/EC* is (66):
"Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities."
From this I'd gather that cookies needed for shopping carts and such are ok, as are session cookies in general as they are not (permanently) stored on user equipment. "Analytics cookies", if they mean 3rd party tracking cookies, would seem to fall foul of this as they are stored on user equipment and are a privacy menace amounting to spyware. If anything, the latter should be more clearly and categorically banned (at least without explicit consent and a right to refuse without affecting the service).
Unless they have radically changed their ways recently Apple's claimed "26% tax rate on its worldwide earnings" doesn't seem credible or at least it is very much at odds with the findings of the 2013 US Senate investigation which found that Apple had managed to arrange to be tax resident nowhere for its earnings outside the US.
Re: I'm not sure how he thinks this will work on an iPhone 6
@Steve Todd: Well, I'd be delighted to be wrong about this if it means that things are better documented or at least better known by now (or always were). Last time what information was around (using an hour or three to look for it with the benefit of a background as a seasoned embedded systems SW engineer) left me with the above impression (admittedly with some of my own speculation having most likely blurred to the info by now). I wouldn't mind seeing a quote from the above link attesting to the secure enclave's nature as a physically separate, tamperproof* subsystem, in particular it having its own persistent, but mutable storage, physically separate from the general purpose flash (without which it is still vulnerable to this sort of attack); this is the main point where I had to rely on speculation (i.e. Apple very likely minding the BOM / extra size / complexity from an extra chip / ... too much to implement a feature the finer points of which the general public would be unlikely to appreciate).
* one aspect of this would be whether the secure enclave's firmware is immutable (failing which makes the kind of hack FBI was demanding of Apple possible)
Re: I'm not sure how he thinks this will work on an iPhone 6
Um ... as I seem to recall (from the time this was last an issue), the A6 already has the arrangement where a 256-bit constant is baked in the SoC only wired to the internal AES circuits (i.e. no direct software access). This means that cloning the flash and running the firmware in a VM won't work, but cloning the flash and running that with the actual hardware does (assuming that the only mutable storage in the device is the flash): this way at least the retry counter can be defeated by restoring the flash contents.
Unlike the A6, the A7 (and later) has the 'secure enclave'. However, rather than a physically separate processor with a dedicated mutable storage this appears* to be a virtual one sharing the system's flash chips as its only mutable storage. This is primarily geared at keeping someone with remote access (say, an exploit delivered via browser) at bay rather than someone with physical access (i.e. it keeps the iOS user and even kernel space isolated from the key storage, which is a worthy thing to have, of course). It seems Apple has not actually managed the latter; this would take your assumed separate tamperproof security processor with its dedicated mutable storage to keep the keys. This - afaik - Apple don't currently have. Hence, my impression is that there is no fundamental reason the technique (i.e. using a cloned flash with the original HW) wouldn't work on a iPhone 6 (or later).
* Apple seems to rely on obscurity for security here, afaik this is not properly (that is, publicly) documented
A no-brainer ?
I wonder if Apple's lawyers and accountants knew full well that this could happen, but went ahead anyway: it seemed likely to work and the worst that could happen was that they'd have to pay the tax they owed in the first place.