Microsoft, Facebook, trust and privacy

I’ve been reminded of this ancient history a lot in the last year or two as I’ve looked at news around abuse and hostile state activity on Facebook, YouTube and other social platforms, because much like the Microsoft macro viruses, the ‘bad actors’ on Facebook did things that were in the manual. They didn’t prise open a locked window at the back of the building – they knocked on the front door and walked in. They did things that you were supposed to be able to do, but combined them in an order and with malign intent that hadn’t really been anticipated.

It’s also interesting to compare the public discussion of Microsoft and of Facebook before these events. In the  1990s, Microsoft was the ‘evil empire’, and a lot of the narrative within tech focused on how it should be more open, make it easier for people to develop software that worked with the Office monopoly, and make it easier to move information in and out of its products. Microsoft was ‘evil’ if it did anything to make life harder for developers. Unfortunately, whatever you thought of this narrative, it pointed in the wrong direction when it came to this use case. Here, Microsoft was too open, not too closed.

Equally, in the last 10 years   – that is is too hard to get your information out and too hard for researchers to pull information from across the platform. People have argued that Facebook was too restrictive on how third party developers could use the platform. And people have objected to Facebook’s attempts to enforce the single real identities of accounts. As for Microsoft, there may well have been justice in all of these arguments, but also as for Microsoft, they pointed in the wrong direction when it came to this particular scenario. For the Internet Research Agency, it was too easy to develop for Facebook, too easy to get data out, and too easy to change your identity. The walled garden wasn’t walled enough.

.. Conceptually, this is almost exactly what Facebook has done: try to remove existing opportunities for abuse and avoid creating new ones, and scan for bad actors.

Microsoft Facebook
Remove openings for abuse Close down APIs and look for vulnerabilities Close down APIs and look for vulnerabilities
Scan for bad behavior Virus and malware scanners Human moderation

(It’s worth noting that these steps were precisely what people had previously insisted was evil – Microsoft deciding what code you can run on your own computer and what APIs developers can use, and Facebook deciding (people demanding that Facebook decide) who and what it distributes.)

  • .. If there is no data stored on your computer then compromising the computer doesn’t get an attacker much.
  • An application can’t steal your data if it’s sandboxed and can’t read other applications’ data.
  • An application can’t run in the background and steal your passwords if applications can’t run in the background.
  • And you can’t trick a user into installing a bad app if there are no apps.

Of course, human ingenuity is infinite, and this change just led to the creation of new attack models, most obviously phishing, but either way, none of this had much to do with Microsoft. We ‘solved’ viruses by moving to new architectures that removed the mechanics that viruses need, and where Microsoft wasn’t present.

.. In other words, where Microsoft put better locks and a motion sensor on the windows, the world is moving to a model where the windows are 200 feet off the ground and don’t open.

.. Much like moving from Windows to cloud and ChromeOS, you could see this as an attempt to remove the problem rather than patch it.

  • Russians can’t go viral in your newsfeed if there is no newsfeed.
  • ‘Researchers’ can’t scrape your data if Facebook doesn’t have your data. You solve the problem by making it irrelevant.

This is one way to solve the problem by changing the core mechanics, but there are others. For example, Instagram does have a one-to-many feed but does not suggest content from people you don’t yourself follow in the main feed and does not allow you to repost into your friends’ feeds. There might be anti-vax content in your feed, but one of your actual friends has to have decided to share it with you. Meanwhile, problems such as the spread of dangerous rumours in India rely on messaging rather than sharing – messaging isn’t a panacea. 

Indeed, as it stands Mr Zuckerberg’s memo raises as many questions as it answers – most obviously, how does advertising work? Is there advertising in messaging, and if so, how is it targeted? Encryption means Facebook doesn’t know what you’re talking about, but the Facebook apps on your phone necessarily would know (before they encrypt it), so does targeting happen locally? Meanwhile, encryption in particular poses problems for tackling other kinds of abuse: how do you help law enforcement deal with child exploitation if you can’t read the exploiters’ messages (the memo explicitly talks about this as a challenge)? Where does Facebook’s Blockchain project sit in all of this?

There are lots of big questions, though of course there would also have been lots of questions if in 2002 you’d said that all enterprise software would go to the cloud. But the difference here is that Facebook is trying (or talking about trying) to do the judo move itself, and to make a fundamental architectural change that Microsoft could not.

Brutalism Is Back

Brutalism was an
attempt to create
an architectural
ethic, rather than
an aesthetic. It
had less to do with
materials and more
to do with honesty:
an uncompromising
desire to tell it
like it is,
architecturally speaking.

 

.. The Modern movement in architecture had supposedly been predicated on truthfulness in materials and forms, as well. But as a dreary stroll down Park Avenue will remind you, Modernism swiftly became a gutless orthodoxy, its high ideals devolving into the rote features of the International Style, a repetitive and predictable series of gestures (curtain walls or ribbon windows, recessed plinths, decorative piloti, windswept plazas, ornamental lawns and flat shimmering pools).

What was and still is appealing about Brutalism is that it had a kind of purity to it.

.. The Modern movement in architecture had supposedly been predicated on truthfulness in materials and forms, as well. But as a dreary stroll down Park Avenue will remind you, Modernism swiftly became a gutless orthodoxy, its high ideals devolving into the rote features of the International Style, a repetitive and predictable series of gestures (curtain walls or ribbon windows, recessed plinths, decorative piloti, windswept plazas, ornamental lawns and flat shimmering pools).

What was and still is appealing about Brutalism is that it had a kind of purity to it.

How Gallaudet University’s Architects Are Redefining Deaf Space

To operate it, you would stand in the hallway and pull a chain. Then, inside, a lead weight would drop to the floor. Vibrations from that thunk alerted residents that someone was calling. A standard doorbell wouldn’t have worked because residents wouldn’t have heard it: Gallaudet is a university for the Deaf.

.. For many at Gallaudet, including people who can communicate through speech, deafness is not an impairment or even an inconvenience. Deaf (with a capital D) is a cultural identity that stems from pride in signed language and what Deaf Studies professors call “Deaf ways of being,” or shared sensory experiences and cultural traditions.

.. The DeafSpace philosophy rests on five basic principles. The first is space and proximity. Deaf individuals often initiate communication with eye contact and need to maintain it over the course of a conversation. Facial expressions are important in ASL. So are body movements; to be able to sign comfortably, a person needs adequate space—more than is typically required for someone engaged in spoken conversation.

.. The least Deaf-supportive space Bauman could think of, when I asked him what it might be, was the traditional classroom with straight rows of desks; that layout breaks up lines of communication, except between student and teacher.