Posts by Pseu Donyme 404 publicly visible posts • joined 10 May 2011
> Well seize their EU assets ...
I seem to recall that because of Facebook's tax shenanigans their global, non-US revenues go via Ireland (in the EU). I suppose this helps collecting fines and seizing considerable assets. Ultimately I suppose Facebook's Irish subsidiaries through which the global revenue goes could be seized with the effect that said revenue gets permanently seized (the contractual arrangements between Facebook and the subsidiaries created for tax avoidance would surely stay in effect after the seizure?).
It seems updating to 57 also broke Request Policy (continued). :( This is why I dread updating Firefox. While any apparent change tends be just some rearrangement of the UI (usually pointless and annoying as such) you can be pretty sure that they have somehow managed to make existing addons incompatible and I'm at least forced to update those as well - if I'm lucky - if not, there is no compatible version.
> ... because I use protection.
Good for you (so do I). However, not everyone does, knows about it or even why it should be used. And, actually, there should be no need, instead collecting, using and transferring personal data (i.e. any data about a person) should be all opt-in (which is pretty much the idea of data protection in a nutshell), such that there is prior, explicit, retractable consent, freely given (i.e. consent is actively given, the default is 'no consent'; consent can't be required to use a product or service).
I suppose it is also relevant that Uber sets the rates the customer pays (thereby controlling what the driver gets after Uber's cut as well); if Uber were merely a real-time market with an app for access matching customers seeking to go from A to B with drivers willing to make that happen for a price agreed between a customer and a driver (or maybe set by a regulator) it would be a different matter.
If we can't have a corporate death penalty (i.e. fines large enough to bankrupt a corporation) for even the most serious misdeeds, could we at least have a penalty where a corporation was forced to issue new shares up to, say, hundred times of its current stock to be sold on a public stock exchange over time with the proceeds going in the public purse. To clarify: the intent is to allow regulators / courts to punish the shareholders of a corporation by wiping out the value of their holdings to a degree proportional to the offense thereby creating an incentive to force proper behavior on the board and top management.
Thanks, I tried to be very careful with them; a joke of a sort (to a retired (C-)programmer sometimes struggling to balance his parentheses to the satisfaction of (g)cc, anyways) seemed to be emerging as I was writing my short missive, which seemed to ((((perhaps) almost) reasonably) legitimately) call ever more nested parentheses. [Per above I can confirm that unbalanced braces are jarring. :/ (Although I'm not sure if it is (undiagnosed) OCD or merely a result of decades of nagging by cc and her relatives; these may amount to the same thing (or close enough) in practice (?).)]
Indeed. No third party cookies. In fact, no cookies other than session cookies. These should be the default settings of any browser (by law (with draconian punishment for violations (and something even worse for anything that could be construed as an attempt to circumvent (the letter or (especially) the intent of) the law))).
This could be meant to be impossibly onerous in practice without being strictly impossible in theory i.e. a de facto travel ban (v 3). As a bonus, if someone still manages to get visa approval, they have most likely left something out in the application and this can be used as a pretext to jail and/or deport them at will (neatly working around pesky legal constraints that might apply to a person physically in the US with a valid visa).
> In fact, any country can ...
I suppose any country can also put anyone against the wall when there, or have someone assassinated while in another country. That something can be done doesn't make it right. For this reason most countries have chosen to limit what they can do by domestic law and by signing international treaties. In this context the US used be an ardent proponent of human rights; sadly, this has given way to seeking legalistic loopholes to work around them* in the sense that human rights apply simply because one is a human being.
* e.g. Gitmo, drone strikes, entirely unfettered mass surveillance of foreigners
I suppose args has a similar purpose to argc and argv in C main(): the program gets the arguments it is invoked with (if any) trough this. In your example they are not used for anything, but they could be so they are part of the interface / function signature of Kotlin's main().
I'll have to object to the idea (a tautology, really) that being a spy organization legitimizes spying: in civilized countries this is illegal without a warrant (for a good reason). Moreover, a spy organization operating outside its native country / jurisdiction cannot legitimately have such a warrant.
The only place that mentions "cookie" in 2009/136/EC* is (66):
"Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user’s consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities."
From this I'd gather that cookies needed for shopping carts and such are ok, as are session cookies in general as they are not (permanently) stored on user equipment. "Analytics cookies", if they mean 3rd party tracking cookies, would seem to fall foul of this as they are stored on user equipment and are a privacy menace amounting to spyware. If anything, the latter should be more clearly and categorically banned (at least without explicit consent and a right to refuse without affecting the service).
* http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32009L0136
Unless they have radically changed their ways recently Apple's claimed "26% tax rate on its worldwide earnings" doesn't seem credible or at least it is very much at odds with the findings of the 2013 US Senate investigation which found that Apple had managed to arrange to be tax resident nowhere for its earnings outside the US.
@Steve Todd: Well, I'd be delighted to be wrong about this if it means that things are better documented or at least better known by now (or always were). Last time what information was around (using an hour or three to look for it with the benefit of a background as a seasoned embedded systems SW engineer) left me with the above impression (admittedly with some of my own speculation having most likely blurred to the info by now). I wouldn't mind seeing a quote from the above link attesting to the secure enclave's nature as a physically separate, tamperproof* subsystem, in particular it having its own persistent, but mutable storage, physically separate from the general purpose flash (without which it is still vulnerable to this sort of attack); this is the main point where I had to rely on speculation (i.e. Apple very likely minding the BOM / extra size / complexity from an extra chip / ... too much to implement a feature the finer points of which the general public would be unlikely to appreciate).
* one aspect of this would be whether the secure enclave's firmware is immutable (failing which makes the kind of hack FBI was demanding of Apple possible)
Um ... as I seem to recall (from the time this was last an issue), the A6 already has the arrangement where a 256-bit constant is baked in the SoC only wired to the internal AES circuits (i.e. no direct software access). This means that cloning the flash and running the firmware in a VM won't work, but cloning the flash and running that with the actual hardware does (assuming that the only mutable storage in the device is the flash): this way at least the retry counter can be defeated by restoring the flash contents.
Unlike the A6, the A7 (and later) has the 'secure enclave'. However, rather than a physically separate processor with a dedicated mutable storage this appears* to be a virtual one sharing the system's flash chips as its only mutable storage. This is primarily geared at keeping someone with remote access (say, an exploit delivered via browser) at bay rather than someone with physical access (i.e. it keeps the iOS user and even kernel space isolated from the key storage, which is a worthy thing to have, of course). It seems Apple has not actually managed the latter; this would take your assumed separate tamperproof security processor with its dedicated mutable storage to keep the keys. This - afaik - Apple don't currently have. Hence, my impression is that there is no fundamental reason the technique (i.e. using a cloned flash with the original HW) wouldn't work on a iPhone 6 (or later).
* Apple seems to rely on obscurity for security here, afaik this is not properly (that is, publicly) documented
There should be none, really. Instead, corporations pay tax on their profits at the non-negotiable corporate tax rate, same for any and all, where the bookkeeping rules for calculating the profit are likewise non-negotiable, same for any and all. As far as I can see this is what EU Commission is after here so that competition is not distorted due to company specific deals amounting to state aid.
What I'd recall was that von Neumann got involved in the US war time computer programs (most importantly EDVAC as far as the eponymous computer architecture is considered) and put together an excellent memo of what he learned as a result. As the memo got somewhat wide distribution despite being about a secret wartime program and was about the only source of such quality right after the war, von Neumann got pretty much all the credit, much of which should have gone to John Mauchly and J. Presper Eckert, at least. (Actually, for a long time, the Americans got all the credit, despite Konrad Zuse's earlier work and that in the UK on the Colossus. Sadly, these are still rather poorly known.)
re: "Modern data protection legislation which assumes that metadata is anonymous would need to be rewritten."
Re-writing would be ideal, of course. Then again what there is in the EU already covers this if interpreted with the law's purpose (privacy, self-determination) in mind. In this sense the the Schrems decision is very encouraging: the ECJ actually considers privacy and data protection fundamental rights to be protected as such.
While I wouldn't (at all) mind the wall around Apple's walled garden to suffer a fate akin to the structure that once circled West Berlin there is a crucial difference between Google and Apple: Google has a dominant market position in the EU (with Android, search, ...) while Apple doesn't (of course, Apple has monopolies within its own ecosystem, but then that isn't the dominant one within the general market(s), so, while I wish this could be acted upon it might not be possible under EU law ?).
... because GMS is. Most importantly Google's stranglehold is cemented by GooglePlay, which at this points enjoys an unsurmountable advantage due to network effect*. (Not that coming up with the other components (browser, maps, ...) would be trivial, never mind something phone manufacturers on razor thin margins were likely to pull off or even try.)
* i.e. the value of a product or service to an user increases as the number of users increase, which in this case happens because of the feedback loop of: more GooglePlay users -> more developers using GooglePlay (exclusively) -> more GooglePlay users -> ...
"It is vital that people should realise Google's potential (or actual) power." Quite. I don't think Google is actually under an obligation to be evenhanded and changing this would require something quite drastic. One such thing could be having the only permissible business model for search to be fully paid by its end users by micropayments, the idea being that a straightforward buyer-seller market* with competing vendors would keep search providers honest.
* instead of Google's constellation of interlocking, cross-subsidized markets amounting to the mother of all multi-sided markets (where a viable competitor in the combined market ought somehow to scale multiple barriers of entry at once)
>Some might argue...
There is that. At the same time ads are commercial propaganda (i.e. designed not to inform, but to manipulate). At any rate there is a better way on-line: search paid by its users (with, say, micropayments).
>"Google-dominated ad market"
DoubleClick's (=Google) ad servers market share of 69 % * seems dominant to me; this seems the most relevant single figure to the freedom of speech -angle mentioned above - maybe along with a global search market share of 71 % / 95 % (desktop / mobile) **.
* https://www.datanyze.com/market-share/ad-servers (as of 26MAY2016)
** https://www.netmarketshare.com/search-engine-market-share.aspx?qprid=4&qpcustomd=0 / https://www.netmarketshare.com/search-engine-market-share.aspx?qprid=4&qpcustomd=1 (April 2016)
Micropayments or some other scheme amounting roughly to what sites get from adverts would be vastly preferable for a number of reasons:
- the current ad business model is a privacy disaster (for a typical user, at least)
- ads are commercial propaganda designed to manipulate and mislead; they undermine the key premise of an efficient market economy i.e. that of transactions between well-informed parties
- the Google-dominated ad market is a market failure / disaster in its in its own right: this is essentially not a market, but a set of interlocking multi-sided markets (search, Android, Google Analytics, Google Maps, ... and the ad distribution itself) where even some of the component markets are practically uncontestable monopolies due to the network effect
- a single company's de facto control of funding for news and other content is a freedom of speech disaster waiting to happen
- ad funded is not really free: the cost is added to the price of products and services; content providers could actually be paid somewhat more if the admen in the middle were cut out
I quite agree, although instead of mere barriers I would insist on insurmountable bulwarks against any commercial use of personal information* without freely given, informed consent, revocable at any time; business models must be compatible with data protection (i.e. privacy), not the other way around.
* any data about a natural person, unless it is strictly impossible ever, under any circumstances for the holder of the data or a third party to identify the person to whom the data is related
While this is a worthy pursuit in its own right - Google has a dominant market position* which it is busy abusing - the really big deal is Google's business model of, essentially, privacy violation for profit on massive, unprecedented scale. For the latter I wouldn't, at all, mind seeing them driven out of the EU (if not existence) by humongous fines (or whatever means, really)**. It is worth noting that the issues are intertwined: ignoring EU privacy / data protection law has given Google a substantial and rather unfair competitive advantage to EU-based outfits having to abide by the same.
* not only with search, but with Android and web advertising, at least
** sadly, the likely outcome is that current arrogance and foot-dragging is replaced with enthusiastic bootlicking once it dawns to Google that serious monies are at stake and with this they emerge relatively unscathed, just a couple of $ billion poorer
From a privacy point of view the idea of using national id cards for logging on to the likes of Google (=Youtube) or Facebook is remarkably clueless. Instead there ought to be an explicit ban against letting them anywhere near the real identity of their users, or, actually, any information which could possibly be used to deduce the same by them or a third party (possibly with a narrow exception to enable investigation of serious crime by allowing IPs to be kept for a limited time for that sole purpose, only to be disclosed by a court order).
>Sell them all naked, and make a pile of OS disks available.
Or maybe have Windows pre-installed, but have it ask for an activation code on the first run that'd be on a separate scratch card or somesuch, which could be left at the store for a refund in the amount the OEM pays Microsoft. (I don't see any compelling reason to keep OEM prices secret, on the contrary, requiring all Microsoft-OEM contracts to be public in their entirety would help to keep Microsoft - a de facto monopolist - (a bit more) honest and hence be in the public interest (in particular if the price of Win 10 is supposed to be zero)).
> ... ALL information ...
Indeed. While in the US the concern may be only PII in the sense of information sufficient in itself to identify a person (such as name, phone number, ...), the EU data protection regime deals with any and all information about a person even when that information doesn't directly identify a particular person. In practice I'd think it is enough if a such information could be tied to a person by a third party for it to become 'personal information', the collection, distribution or even 'processing' in the most general sense of which is subject to restrictions, a key one among them being that this requires consent of the person about whom the the information is. Hence, e.g. collecting IP addresses so that they can associated with other information such as pages visited is verboten - or at least this is the German data protection authority's stance (with which I quite agree).
The real problem is that the US (govt and companies) ought to take the issue - right to privacy in general and its modern aspect data protection in particular - seriously, but obviously they don't; ultimately the solution is for the US to adopt proper data protection legislation like just about any other advanced country, for US companies operating in the EU the solution is simply making a sincere effort to abide by the law there.
>does Google enforce this in some way?
The beauty of it (from Google's point of view) is that it doesn't need to: at this point the network effect* alone results in a practically unsurmountable competitive disadvantage for other app stores.
* i.e. the value of a product or service (to a user) gets higher the more other users there are (which happens because of the self-amplifying cycle of: more Google Play end users -> more apps distributed via Google Play -> more Google Play end users -> ... )
>The West could make its own alternatives...
In theory yes, but in practice not really. The linchpin is the app store, which affords Google a stranglehold on the mobile market akin to what Microsoft has with PCs*. This is because of the network effect, where the value of a product or service is dependent on the number of others using it; in practice this means that once a player in a market gains some advantage to competition this will snowball into a self-amplifying cycle of increasing advantage resulting in a (de facto) monopoly, which also tends to be persistent because of the massive advantage from the network effect is also results in a practically insurmountable barrier of entry.
* the more people use Windows software [Google Play], the more sense it makes to develop software for Windows instead of other platforms [distribute via Google Play instead of other app stores], which results in more people using Windows software, which results in more Windows software being developed, which results in more people using Windows software, ...
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
