Subject: Why we really can't use Facebook for technical discussion.

From: Dean Willis <[email-masked]>
Date: Sat, 05 Jun 2021 22:34:24 +0000

Today, Emil Ivov posted a humorous note about how the various SIP-related network traversal RFC efforts like STUn, etc. reflect a tension between realism and pragmatism.

I responded with my usual argument, that I'm in the "kill them all and let TCP sort it out" camp.

That earned me a 24 ban from Facebook for promoting violence.

I hereby propose we censor Facebook engineers in IETF meetings for promoting stupidity.

--
Dean

---

From: Fred Baker <[email-masked]>
Date: Sat, 5 Jun 2021 16:20:04 -0700

I’d suggest that we do so for cause, if it happens. It’s not the engineers making the silly calls.

Sent from my iPad

> On Jun 5, 2021, at 3:35 PM, Dean Willis <[email-masked]> wrote:
> 
> 
> 
> 
>

---

From: Töma Gavrichenkov <[email-masked]>
Date: Sun, 6 Jun 2021 02:27:06 +0300

Peace,

> I hereby propose we censor Facebook engineers in IETF meetings for

The thing is, I don't think we've seen a lot of Facebook engineers on the
IETF meetings even before COVID.  I'm pretty sure there was someone from
Facebook doing some work around the rtg area, but I fail to recall anyone
else.

Fun fact: I've once seen a Facebook engineer who advocated the STONITH
failover technique.  That happened around 2019, not sure they can still use
that technique in 2021!

--
Töma

---

From: Dean Willis <[email-masked]>
Date: Sun, 06 Jun 2021 00:01:29 +0000

Töma Gavrichenkov < [email-masked]> wrote:
Peace,

The thing is, I don't think we've seen a lot of Facebook engineers on the IETF meetings even before COVID. I'm pretty sure there was someone from Facebook doing some work around the rtg area, but I fail to recall anyone else.

------

Ok, you are probably right.

But just a few weeks ago, we had a "tools" survey circulating, and several of the questions related to using assorted social media platforms for IETF work.

If you can get banned for a kill -9 comment -- well, we really can't be using that platform for IETF stuff. Even for jokes, apparently.

---

From: Jared Mauch <[email-masked]>
Date: Sat, 5 Jun 2021 22:30:38 -0400

The language we decide to use to communicate does matter. Often things like comedy, sarcasm or hyperbole does not translate well or may miss the mark. 

Sent from my TI-99/4a

> On Jun 5, 2021, at 6:35 PM, Dean Willis <[email-masked]> wrote:
>

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 5 Jun 2021 23:17:08 -0400

There are multiple problems going on here.

One problem that needs urgent attention is a phenomenon I am calling a
profile poisoning attack. Facebook does not allow people to say 'this
content is garbage, do not show this type of content again'. The only
feedback allowed is positive. YouTube and Twitter suffer from the same
basic problem but to a lesser degree. Not being able to tell your racist
uncle that you have no interest in his bullshit is core to the Facebook
brand. It is why it was able to do so much damage.

Limiting people to positive feedback sets the stage for a profile poisoning
attack. The attacker bombards the target with propaganda knowing that any
response from the target will result in the algorithm sending even more
propaganda. There is no escape, there is no way to shut the propaganda off.
The needs of Facebook advertisers means that the product must not be
allowed to say 'stop'.

A colleague pointed out that the QAnon slogan is 'do your research' is in
effect a clever trap to cause the target to be deluged by more nonsensical
conspiracy mongering.

It is time to stop this. Dean points out one of the major problems with
Facebook - there is only one authority. Only King Zuck gets to decide who
can and who cannot speak. His house, his rules. So it is time to make it
our house.

I have given a lot of thought to this problem over the past two years. I
hope folk didn't think I was only thinking about how t do s aslightly
better password vault, secure data at rest and do end to end secure
messaging. The Mesh was always about an end-to-end secure social media
platform.

The absolute bare minimum for a social media platform that gives users full
control is a name that belongs to them, does not come with an artificial
rent, is life-long (except in exceptional circumstances) and can be bound
to the service provider(s) of their choice for messaging, social media etc.

Mathematical Mesh 3.0 Part VII: Mesh Callsign Service (ietf.org)
<https://www.ietf.org/archive/id/draft-hallambaker-mesh-callsign-00.html>

There is also a blockchain in there that does not rely on proof of work for
stability. The ultimate source of authority and trust for every user is
that user themselves. It is kindof a zen thing.

The basic code for phase one is passing all relevant unit tests. Just got
to write the server config interface.

On Sat, Jun 5, 2021 at 8:02 PM Dean Willis <[email-masked]>
wrote:

> But just a few weeks ago, we had a "tools" survey circulating, and several
> of the questions related to using assorted social media platforms for IETF
> work.
>
> If you can get banned for a kill -9 comment -- well, we really can't be
> using that platform for IETF stuff. Even for jokes, apparently.
>
>
>
>
>

---

From: Dean Willis <[email-masked]>
Date: Sun, 06 Jun 2021 03:48:32 +0000

-------- Original Message --------
On Jun 5, 2021, 10:17 PM, Phillip Hallam-Baker <[email-masked]> wrote:

----

This is exactly where I was trying to go with P2P-SIP/RELOAD but didn't get to, and it seems quite clever. The key is in using the distributed tree to store ephemeral but still relatively long-lived registrations, not massive or rapidly changing data.

--
Dean

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 6 Jun 2021 00:41:50 -0400

On Sat, Jun 5, 2021 at 11:48 PM Dean Willis <[email-masked]>
wrote:

> This is exactly where I was trying to go with P2P-SIP/RELOAD but didn't
> get to, and it seems quite clever. The key is in using the distributed tree
> to store ephemeral but still relatively long-lived registrations, not
> massive or rapidly changing data.
>

Thanks,

The key is stripping out all the expensive parts of running DNS. Query is
pushed onto the Mesh Service Providers. So all the registry does is to
receive registration requests, validate the signatures on them and publish
them if correct. The registry log is broadcast in real time to the service
providers subscribing to it and is signed at regular intervals. Unlike the
DNS, there is no single point of failure, the most an attacker can hope for
is to take out one Service Provider, not 'the Internet' as would be the
case if .com went down. Even taking out the callsign registry merely
prevents updates reaching the service providers for a short while.

Cross notarization of the user and their Mesh Service Providers and the
Mesh Service Providers and the callsign registry is sufficient to mesh all
the signed notarized logs into a single entity. No party can defect
undetected without the collusion of every other party. So Alice would have
to be party to her own bamboozlement.

Once Alice has registered @alice, it is hers forever, it is bound to her
public key credential. If she misbehaves, curation services can mark her
account as being abusive. But they only have the power to describe, the
power to accept or reject her content lies with Alice herself.

---

From: Larry Masinter <[email-masked]>
Date: Sat, 5 Jun 2021 22:44:29 -0700

This is the argument about Postel's principle (conservative in what you send, liberal in what you accept) in layer 9.
It seems to me that Facebook is doing just fine slowing down (24 hours) the possible propagation of violence incitement without requiring a lot of judgement on what does or does not constitute thoughtful vs. inciteful speech.

"Kill them all and let TCP sort it out" can readily be expressed in other terms. A content moderation policy that slowed down frequent postings (by 24 hours) might temper heated conversations and lead to calmer considerations of the actual requirements. 

> I hereby propose we censor Facebook engineers in IETF meetings for promoting stupidity.

Can public forums improve the quality of discussion by delaying frequent, divisive posters?
Is trying to do so really  "promoting stupidity"? (Obligatory 😊)

--
https://LarryMasinter.net https://interlisp.org

---

From: Emil Ivov <[email-masked]>
Date: Sun, 6 Jun 2021 02:13:14 -0500

Ironically, advising *others* how *they* should follow Postel’s principle
is exactly the opposite of the principle.

On Sun, Jun 6, 2021 at 00:44 Larry Masinter <[email-masked]> wrote:

> This is the argument about Postel's principle (conservative in what you
> send, liberal in what you accept) in layer 9.
> It seems to me that Facebook is doing just fine slowing down (24 hours)
> the possible propagation of violence incitement without requiring a lot of
> judgement on what does or does not constitute thoughtful vs. inciteful
> speech.
>
> "Kill them all and let TCP sort it out" can readily be expressed in other
> terms. A content moderation policy that slowed down frequent postings (by
> 24 hours) might temper heated conversations and lead to calmer
> considerations of the actual requirements.
>
sent from my mobile

---

From: Christian Hopps <[email-masked]>
Date: Sun, 06 Jun 2021 06:42:00 -0400

Emil Ivov <[email-masked]> writes:

> Ironically, advising *others* how *they* should follow Postel’s
> principle is exactly the opposite of the principle.

Really it's not. The exact opposite would be

"Be conservative in what you accept, liberal in what you send".

There's nothing in Postel's Principle that keeps people from explaining the principle to others or how it might map to their situation. It would be a fairly useless principle if that were the case.

Thanks,
Chris.

>     This is the argument about Postel's principle (conservative in
>     what you send, liberal in what you accept) in layer 9.
>     It seems to me that Facebook is doing just fine slowing down (24
>     hours) the possible propagation of violence incitement without
>     requiring a lot of judgement on what does or does not constitute
>     thoughtful vs. inciteful speech.
>
>     "Kill them all and let TCP sort it out" can readily be expressed
>     in other terms. A content moderation policy that slowed down
>     frequent postings (by 24 hours) might temper heated conversations
>     and lead to calmer considerations of the actual requirements.
>

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 6 Jun 2021 13:58:10 +0000

>    "Kill them all and let TCP sort it out" can readily be expressed in other terms. A content moderation policy that slowed down frequent postings (by 24 hours) might temper heated conversations an…

For those who don't know, it is worth doing a web search on the original phrase. It comes from a history of extreme violence, and apparently even today is used by the US elite forces.  Not a good look.

---

From: Dean Willis <[email-masked]>
Date: Sun, 06 Jun 2021 17:11:54 +0000

-------- Original Message --------

----

Tell me, Rich -- do you cringe and demand that Apple and the Linux community rename the "kill" command every time you have to terminate a rogue process from the command line? Or do you campaign for the rogue process's right to live, despite the fact that it is sucking up memory and making your system unstable?

It amazes me how postmodern thinking has
left us entirely without a sense of humor and induced an oversized sense of groupthink.

And for those who invoke Postel's maxim as a justification for censorship -- I don't think you would have tolerated its outspoken author, at all.

--
Dean

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 6 Jun 2021 17:15:59 +0000

Thanks for writing.  Not going to argue by analogies.  Not even going to argue this one at all. I will assume your “ban FB engineers” was similarly hyperbolic.

---

From: Olivier MJ Crépin-Leblond <[email-masked]>
Date: Sun, 6 Jun 2021 20:01:33 +0200

On 06/06/2021 05:17, Phillip Hallam-Baker wrote:
> It is time to stop this. Dean points out one of the major problems 
> with Facebook - there is only one authority. Only King Zuck gets to 
> decide who can and who cannot speak. His house, his rules. So it is 
> time to make it our house.

As you know, it's all about algorithms that filter content and with the 
pressure from some groups to have tighter and tighter algorithms, this 
is nothing new. I remember many years ago, even the ISOC mailing list 
mailers having problems with the British town Sc*nthorpe.

Get ready for a world full of false positives where you are guilty until 
proven innocent.
Kindest regards,

Olivier

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 6 Jun 2021 14:26:57 -0400

On Sun, Jun 6, 2021 at 2:01 PM Olivier MJ Crépin-Leblond <[email-masked]>
wrote:

> pressure from some groups to have tighter and tighter algorithms, this is
> nothing new. I remember many years ago, even the ISOC mailing list mailers
> having problems with the British town Sc*nthorpe.
>

Quite, and the trolls always have the advantage. They create accounts with
legends by the hundred. Use ten of them to attack a target, lose all of
them but the target is also taken out. The 30 day ban means that this is a
big win for the troll.

There is no cost to creating troll accounts because there is no negative
feedback. A brand new account has the same prominence as an established one.

More importantly if ones's fascist uncle is posting bigotted crap and sees
only thumbs up, they are encouraged to do more of it. Their epistemic
bubble is reinforced. If they see thumbs down from ten of their close
relatives, then maybe they realize that they are not the voice of the
silent majority.

Maybe it would be easier for people to understand the fact that Biden
received 8 million votes more than pants-on-backwards if they had been
receiving that negative feedback. Maybe the QAnon LARP wouldn't be as much
fun if the response to posting nonsense theories outside
8chan/16chan/64chan was 50 thumbs down and five thumbs up rather than just
one thumbs up.

Of course, not puncturing said racist uncle's bubble is more profitable
because it discourages further venting.

---

From: Larry Masinter <[email-masked]>
Date: Sun, 6 Jun 2021 14:43:46 -0700

PHB:

Quite, and the trolls always have the advantage. They create accounts with legends by the hundred. Use ten of them to attack a target, lose all of them but the target is also taken out. The 30 day ban means that this is a big win for the troll. There is no cost to creating troll accounts because there is no negative feedback. A brand new account has the same prominence as an established one.

That seem like a poor design for a recommender system, but I’m not sure trolling from fake accounts is an issue in Dean’s case. Nor does it seem to apply to IETF’s possible use of the Facebook for anything. 

I’ve made the case in the past that there might be a “sock puppet” kind of thing on IETF email lists, partly because I couldn’t believe the posters were real. One thing Facebook has is 

Can I create multiple Facebook accounts? | Facebook Help Center <https://www.facebook.com/help/975828035803295> 

I’m sorry you have a troublesome uncle.

---

From: Fred Baker <[email-masked]>
Date: Sun, 6 Jun 2021 15:11:18 -0700

> On Jun 5, 2021, at 10:45 PM, Larry Masinter <[email-masked]> wrote:
> 

If we were to test such a policy, I think I would want to change it to “between postings by the same individual”. Otherwise, we probably need to budget a few thousand posts on the topic before we decide what constitutes a “divisive poster”… :-)

---

From: Larry Masinter <[email-masked]>
Date: Sun, 6 Jun 2021 15:25:48 -0700

X
> If we were to test such a policy, I think I would want to change it to “between
> postings by the same individual”. Otherwise, we probably need to budget a
> few thousand posts on the topic before we decide what constitutes a
> “divisive poster”… :-)

It's a test.
https://rapidapi.com/blog/sentiment-analysis-apis/
 Try all 8.

---

From: Lloyd W <[email-masked]>
Date: Mon, 7 Jun 2021 09:23:34 +1000

https://en.wikipedia.org/wiki/STONITH

if you're not a vegetarian, know how your meat is produced, and how cows are killed in industrial abattoirs, or injured horses are killed on the racetrack.

There's a reason we talk of server farms; farming metaphors are well understood.

Lloyd Wood
[email-masked]

Orwell's Animal Farm is a metaphor, and meat is murder.

> On 6 Jun 2021, at 09:28, Töma Gavrichenkov <[email-masked]> wrote:
> 
> Fun fact: I've once seen a Facebook engineer who advocated the STONITH failover technique.  That happened around 2019, not sure they can still use that technique in 2021!

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Sun, 6 Jun 2021 19:59:00 -0500

Umm ...

> Facebook doing some work around the rtg area, but I fail to recall anyone

Unless https://www.ietf.org/about/groups/iesg/members/ is lying to me, I
can name at least one Facebook engineer who I've met at IETF meetings 😀

(Assuming "engineering manager" has at least some connection to
"engineering", although I know mileage may differ)

Best,

Spencer

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 6 Jun 2021 21:58:04 -0400

a person (or organization) with a hundred trolls to burn can easily find a
way to make a post in support of a violent insurrection. While we were
having this discussion, I just got a three day ban for responding to such
suggesting that the authorities would be fully justified in using lethal
force against any armed insurrectionists.

---

From: "[email-masked]" <[email-masked]>
Date: Mon, 7 Jun 2021 04:31:55 +0000 (UTC)

Perhaps, if you're all proud of getting banned from Facebook, you might want to consider how you communicate more generally?

https://hackcur.io/whats-wrong-with-loud-men-talking-loudly-the-ietfs-culture-wars/

Lloyd Wood 
[email-masked]

On Monday, 7 June 2021, 11:59:12 GMT+10, Phillip Hallam-Baker <[email-masked]> wrote: 

a person (or organization) with a hundred trolls to burn can easily find a way to make a post in support of a violent insurrection. While we were having this discussion, I just got a three day ban for responding to such suggesting that the authorities would be fully justified in using lethal force against any armed insurrectionists.

On Sun, Jun 6, 2021 at 2:01 PM Olivier MJ Crépin-Leblond <[email-masked]> wrote:
>> It is time to stop this. Dean points out one of the major problems with Facebook - there is only one authority. Only King Zuck gets to decide who can and who cannot speak. His house, his rules. So it is time to make it our house.
> 
> As you know, it's all about algorithms that filter content and with the pressure from some groups to have tighter and tighter algorithms, this is nothing new. I remember many years ago, even the ISOC mailing list mailers having problems with the British town Sc*nthorpe.
> 
> Get ready for a world full of false positives where you are guilty until proven innocent.
> Kindest regards,
> 
> Olivier
> 
>

---

From: "Bron Gondwana" <[email-masked]>
Date: Mon, 07 Jun 2021 15:55:33 +1000

> I hereby propose we censor Facebook engineers in IETF meetings for promoting stupidity.

While this is clearly ridiculous, it does raise a better deep question about using central identities which treat you as a single entity and can take an off-colour joke that you made in the relative privacy of a group of friends, mis-categorise it as dangerous or hateful, and use that to stop you doing anything in any context.

This comes up more often with Google's massively federated set of properties than with Facebook, e.g.
https://www.businessinsider.com.au/google-users-locked-out-after-years-2020-10

But it's something to consider if we make Github more central to our workflow.  Right now I believe Github accounts are completely separate from the rest of Microsoft, but over time I could imagine them being integrated with Microsoft's trust and safety systems such that an issue on a totally unrelated service caused somebody's Github account to be locked out along with all the repositories that they own/have created.  Less of an issue for git repositories themselves because they're more likely to be mirrored and at worst you can rebuild from the last draft uploaded to the datatracker - but if we are keeping significant state in the issue tracker, losing the issues for a draft could significantly hamper the work of a group.

Bron.

P.S. back on censorship - there's rarely need to censor anybody permanently, if just locking them out for the duration of a meeting in which consensus is declared on something they disagree with gets the job done.

--
  Bron Gondwana, CEO, Fastmail Pty Ltd
  [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Mon, 7 Jun 2021 07:59:41 -0400

> https://hackcur.io/whats-wrong-with-loud-men-talking-loudly-the-ietfs-culture-wars/

Because misandry in the service of inclusion is no vice?

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 7 Jun 2021 08:16:34 -0400

On Mon, Jun 7, 2021 at 12:32 AM [email-masked] <
[email-masked]> wrote:

> Perhaps, if you're all proud of getting banned from Facebook, you might
> want to consider how you communicate more generally?
>

The OP in question was a newspaper report that a group of seditionists are
planning an armed occupation of a federal property. It is my opinion that
if someone is carrying an AK47 and is threatening to use it to shoot
police, they should be treated as terrorists and lethal force is justified.

I really don't consider calling an armed uprising 'terrorism' to be hate
speech or consider suggesting that people threatening to murder police and
the military should be shot without remorse is hate speech.

Dean says a lot that is hyberbolic. I was merely pointing out that the US
should respond to an armed protest in the exact same way that I would
expect the UK police to deal with a similar situation.

I will also note that this process board that Facebook is now hiding behind
has only been called to decide the case of one white male bigot and that
after he was allowed to spew hate for over four years. Other people have
been banned for life with absolutely no process. There was a purge of left
wing accounts before the 2020 November election which attracted little
comment. Only when a racist bigot was banned was a board invented to hide
behind.

What we have here is the predictable result of a company that failed to
take moderation seriously and is now desperately throwing technology at a
problem rather than fixing the core problem that they designed their
environment to maximize conflict because that was most profitable for them.

---

From: Keith Moore <[email-masked]>
Date: Mon, 7 Jun 2021 10:30:46 -0400

On 6/7/21 8:16 AM, Phillip Hallam-Baker wrote:

> What we have here is the predictable result of a company that failed 
> to take moderation seriously and is now desperately throwing 
> technology at a problem rather than fixing the core problem that they 
> designed their environment to maximize conflict because that was most 
> profitable for them.

As much as I hate FB (I left the platform in 2016 and have never looked 
back) I think "failed to take moderation seriously" glosses over a 
number of inherent problems with social media, particularly when done on 
a large scale.

One is of course that human moderation is time-consuming and therefore 
expensive if the moderators are paid.  It's also hard for a large number 
of human moderators (required to deal with large volumes of users and 
traffic) act uniformly.   On another widely used platform the moderators 
are almost completely arbitrary, despite supposedly enforcing a common 
set of clear standards.   So it's not surprising if social media 
platforms resort to algorithms.   And of course the algorithms are 
flawed because AI is a long way from understanding the many subtleties 
of human interaction.

Unpaid human moderators can be even more capricious than paid humans, 
because the desire to impose one's own prejudices on others is a strong 
motivator of volunteers.

Even under the best of conditions moderation (whether done by humans or 
machines) is dangerous both because it can easily squelch valuable 
input, and because it's often easily gamed for that purpose by people 
for whom such input is inconvenient.     No matter how noble the intent, 
the effect of moderation is often to favor established prejudices, or 
worse, to enable bullying.

I don't claim to know the solution, but I don't think it's a simple 
matter of "taking moderation seriously".

Keith

---

From: Andy Ringsmuth <[email-masked]>
Date: Mon, 7 Jun 2021 09:58:42 -0500

> On Jun 7, 2021, at 9:30 AM, Keith Moore <[email-masked]> wrote:
> 
>> What we have here is the predictable result of a company that failed to take moderation seriously and is now desperately throwing technology at a problem rather than fixing the core problem that they designed their environment to maximize conflict because that was most profitable for them.
> As much as I hate FB (I left the platform in 2016 and have never looked back) I think "failed to take moderation seriously" glosses over a number of inherent problems with social media, particularly when done on a large scale.   
> 
> One is of course that human moderation is time-consuming and therefore expensive if the moderators are paid.  It's also hard for a large number of human moderators (required to deal with large volumes of users and traffic) act uniformly.   On another widely used platform the moderators are almost completely arbitrary, despite supposedly enforcing a common set of clear standards.   So it's not surprising if social media platforms resort to algorithms.   And of course the algorithms are flawed because AI is a long way from understanding the many subtleties of human interaction.
> 
> Unpaid human moderators can be even more capricious than paid humans, because the desire to impose one's own prejudices on others is a strong motivator of volunteers.
> 
> Even under the best of conditions moderation (whether done by humans or machines) is dangerous both because it can easily squelch valuable input, and because it's often easily gamed for that purpose by people for whom such input is inconvenient.     No matter how noble the intent, the effect of moderation is often to favor established prejudices, or worse, to enable bullying.
> 
> I don't claim to know the solution, but I don't think it's a simple matter of "taking moderation seriously"

Not to mention - I assume many of us have read of what life is like for many of those moderators. Imagine sitting at a screen for 8 or 9 hours a day, staring at endless photos ranging from child abuse to child porn, BDSM, violence, blood, gore, and that is barely, barely scratching the surface. Having to make flash decisions about the worst of the worst of the worst of humanity. All day. Every day. For not much pay. And minimal psychological/mental health support.

https://www.theguardian.com/news/2017/may/25/facebook-moderator-underpaid-overburdened-extreme-content

https://www.theverge.com/2019/2/25/18229714/cognizant-facebook-content-moderator-interviews-trauma-working-conditions-arizona

https://gizmodo.com/the-life-of-a-facebook-moderator-sounds-even-worse-than-1835656998

----
Andy Ringsmuth
5609 Harding Drive
Lincoln, NE 68521-5831
(402) 304-0083
[email-masked]

“Better even die free, than to live slaves.” - Frederick Douglas, 1863

---

From: Lloyd W <[email-masked]>
Date: Tue, 8 Jun 2021 01:02:48 +1000

Censorship is fine when it produces results!

Lloyd Wood
[email-masked]

> On 7 Jun 2021, at 15:56, Bron Gondwana <[email-masked]> wrote:
>

---

From: Keith Moore <[email-masked]>
Date: Mon, 7 Jun 2021 11:18:21 -0400

> https://gizmodo.com/the-life-of-a-facebook-moderator-sounds-even-worse-than-1835656998

I can also imagine that it would be extremely difficult for moderators 
constantly subjected to extreme content, to then turn around and make 
wise judgments about subtle shades of meaning from, say, satirical material.

Keith

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 7 Jun 2021 11:31:49 -0400

On Mon, Jun 7, 2021 at 10:31 AM Keith Moore <[email-masked]>
wrote:

> back) I think "failed to take moderation seriously" glosses over a number
> of inherent problems with social media, particularly when done on a large
> scale.
>
> expensive if the moderators are paid.  It's also hard for a large number of
> human moderators (required to deal with large volumes of users and traffic)
> act uniformly.   On another widely used platform the moderators are almost
> completely arbitrary, despite supposedly enforcing a common set of clear
> standards.   So it's not surprising if social media platforms resort to
> algorithms.   And of course the algorithms are flawed because AI is a long
> way from understanding the many subtleties of human interaction.
>
> machines) is dangerous both because it can easily squelch valuable input,
> and because it's often easily gamed for that purpose by people for whom
> such input is inconvenient.     No matter how noble the intent, the effect
> of moderation is often to favor established prejudices, or worse, to enable
> bullying.
>
> I don't claim to know the solution, but I don't think it's a simple matter
> of "taking moderation seriously".
>

The main reason I am on the platform is to try and understand which
approaches work and which do not.

Slashdot has a rather less respectful audience yet their karma system
produces vastly better results. But the biggest takeaway for me is that one
size fits all does not work for curation or moderation.

Yes, this is a hard problem, that is why there should be more than one
person who is the sole decider. I have never said anything on Facebook that
would not pass in an Oxford Union debate[1]. We have known that content
inspection is a failing strategy for spam filtering for over 15 years, why
apply it to enforce automatic bans on individuals?

PHB

[1] OK that might be considered a low bar since I once heard Jacob
Rees-Mogg addressed as 'Greased Frogg' but who is to say such sobriquet is
truly undeserved?

---

From: Keith Moore <[email-masked]>
Date: Mon, 7 Jun 2021 12:42:15 -0400

On 6/7/21 11:31 AM, Phillip Hallam-Baker wrote:

> produces vastly better results. But the biggest takeaway for me is 
> that one size fits all does not work for curation or moderation.

Indeed, different communities have different standards for behavior, and 
necessarily so.   I've seen newcomers to a community struggle to fit in, 
only slowly realizing that the jokes that are well-received elsewhere 
are not considered appropriate in their new setting, and slowly grasping 
the new boundaries.   But the idea that there is or should be one 
universal standard for speech strikes me as ridiculous.   A subject that 
is taboo in one setting almost inherently is in need of examination 
somewhere.  (note that I did say "almost")

> We have known that content inspection is a failing strategy for spam 
> filtering for over 15 years, why apply it to enforce automatic bans on 
> individuals?
Indeed, part of the problem with that strategy is that it assumes that 
one size fits all.

Keith

---

From: Randy Presuhn <[email-masked]>
Date: Mon, 7 Jun 2021 09:42:24 -0700

Hi -

On 2021-06-07 4:59 AM, Keith Moore wrote:
>> Perhaps, if you're all proud of getting banned from Facebook, you 
>> might want to consider how you communicate more generally?
>>
>>

When (male) privilege is threatened, the reactions often look
like (male) fragility.  One would hope to avoid zero-sum games,
but I think one must admit the possibility that some stereotypical
(but hardly inherent!) behaviors are at odds with inclusiveness.
Having a particular genital configuration is not an issue.
Interrupting and talking over others (for example) can be.

Randy

---

From: Dean Willis <[email-masked]>
Date: Mon, 07 Jun 2021 18:43:54 +0000

-------- Original Message --------
On Jun 6, 2021, 11:31 PM, [email-masked] < [email-masked]> wrote:
Perhaps, if you're all proud of getting banned from Facebook, you might want to consider how you communicate more generally?
https://hackcur.io/whats-wrong-with-loud-men-talking-loudly-the-ietfs-culture-wars/

Lloyd Wood

Amazing how the people who preach inclusivity sometimes go out of their way to make me feel unwelcome and excluded. Their vernacular is to be welcomed, and mine is to be punished and excluded.

Hmm...

Okay. If I'm not welcome, I'll leave now.

--
Dean

---

From: Andy Ringsmuth <[email-masked]>
Date: Mon, 7 Jun 2021 14:26:54 -0500

> On Jun 7, 2021, at 1:43 PM, Dean Willis <[email-masked]> wrote:
> 
> 
> —

Ahh yeah. The ‘ol “I’m an open-minded, tolerant and welcoming person. As long as you agree with me.” scenario.

I avoid echo chambers. Personally I find far more value in deliberately engaging cordially with those with those who disagree with me.

-Andy

---

From: Keith Moore <[email-masked]>
Date: Mon, 7 Jun 2021 16:13:26 -0400

> Interrupting and talking over others (for example) can be.

IMO the argument would be much more convincing without the cheap (and 
almost obligatory) shot of insulting people for their gender.  The 
hypocrisy of such arguments completely rids them of any credibility and 
also often distracts from the real nature of the problem.   (And it's 
certainly a violation of the IETF Guidelines for Conduct.)

Why do people sometimes talk loudly in IETF discussions?  Because 
they're frustrated, probably because they're not being heard!   At least 
half of the time this is because of other participants who are having a 
hard time seeing past their own preconceptions.   But the popular 
fashion is to blame the speaker nearly 100% of the time, even when the 
speaker is speaking clearly.   This tactic is especially common among 
those for whom the speaker's input is inconvenient.

It follows that if we want less talking loudly in IETF discussions, we 
might do well to improve the ability of IETF participants to listen.  Or 
at least we could realize that communication is a cooperative endeavor 
that requires investment on the part of both the speaker and the listeners.

Keith

---

From: "John Levine" <[email-masked]>
Date: 7 Jun 2021 16:17:26 -0400

>size fits all does not work for curation or moderation.

Sure, but differences in scale have qualitatitive as well as quantitative effects.

Facebook has 2 billion users who send about a million messages a
second. Slashdot has 4 million users who send about a three messages
per minute. (These are numbers from their web sites. Slashdot also
owns the much larger Sourceforge which I'm not counting here.)

FB is big enough that there are entire businesses and political
campaigns that live on it, with large financial consequences depending
on who sees what. The stakes are much higher, and the scale is so huge
that no matter how large their farm of human moderators, the humans
will never see more than a miniscule slice of the traffic.

Large platforms know that their moderation software sometimes guesses
wrong, and they deliberately make it fail safe -- compare the effects
of taking down your snarky message or Dean's vs. leaving up actual
death threats.  Is that really surprising?  Perhaps the message here is
that Facebook is not the ideal venue for nuanced political debate.
Once again, on a free service, you often get what you pay for.

For some interesting insights into moderation at scale, this blog
post about a suit challenging the new Florida anti-moderation law
has links to declarations from people involved in moderation at
large online providers including Youtube, Facebook, and Etsy.

https://blog.ericgoldman.org/archives/2021/06/plaintiffs-request-preliminary-injunction-against-floridas-censorship-law-sb-7072-netchoice-v-moody.htm

R's,
John

---

From: Emil Ivov <[email-masked]>
Date: Mon, 7 Jun 2021 15:45:14 -0500

Hey John,

> will never see more than a miniscule slice of the traffic.

True. And I am sure most people on this list understand the challenges of
running things at scale. The point of the initial thread, however, was to
discuss whether it is a good idea for us (i.e., IETF) to place ourselves in
a situation where we are surrendering the ability to address such
challenges according to our established values and practices. Dean's
example provides one good demonstration of how this could be annoying or
even harmful.

Now, I could easily argue that Facebook (and most social networks really)
should themselves be looking into how they could be enabling their users to
apply the principles of subsidiarity but that would indeed be out of scope
for this list.

Cheers,
Emil

-- 
Emil Ivov, Ph.D.               Austin, TX
Project Lead,                  USA
Jitsi                          MOBILE:+1-512-420-6968
https://jitsi.org              [email-masked]

---

From: Richard Shockey <[email-masked]>
Date: Tue, 08 Jun 2021 12:11:24 -0400

+1 Dean

And they wonder why some of us will not take new work to the IETF.  

From: ietf <[email-masked]> on behalf of Dean Willis <[email-masked]>
Reply-To: Dean Willis <[email-masked]>
Date: Monday, June 7, 2021 at 2:43 PM
To: <[email-masked]>, <[email-masked]>, <[email-masked]>
Cc: <[email-masked]>
Subject: Re: Why we really can't use Facebook for technical discussion.

-------- Original Message --------

Lloyd Wood 

Hmm...

--
Dean

---

From: Aqua Q Glass <[email-masked]>
Date: Tue, 8 Jun 2021 11:19:32 -0700

More apropos, if such content was simply not discovered, by choice.  +1 on
diversity of identities, perhaps by #hashtag selections... unbuilt over
time, ability to jettison oneself from streams is paramount for untracking
of self and self actualization

More on and about:
https://www.publish0x.com/ethense/emotive-concurrency-of-ethense-xomxeql
<https://www.publish0x.com/ethense/emotive-concurrency-of-ethense-xomxeql>

#aQ

On Tue, Jun 8, 2021 at 9:12 AM Richard Shockey <[email-masked]> wrote:

> *From: *ietf <[email-masked]> on behalf of Dean Willis <
> [email-masked]>
> *Reply-To: *Dean Willis <[email-masked]>
> *Date: *Monday, June 7, 2021 at 2:43 PM
> *To: *<[email-masked]>, <[email-masked]>, <
> [email-masked]>
> *Cc: *<[email-masked]>
> *Subject: *Re: Why we really can't use Facebook for technical discussion.
>
>
>
>
> Amazing how the people who preach inclusivity sometimes go out of their
> way to make me feel unwelcome and excluded. Their vernacular is to be
> welcomed, and mine is to be punished and excluded.
>
> Hmm...
>

---

From: Aqua Q Glass <[email-masked]>
Date: Tue, 8 Jun 2021 11:22:34 -0700

Re-abridged with podcast audio and the like

https://twitter.com/aquaqlabs/status/1402327786342084609?s=21

#aQ

---

From: Lloyd W <[email-masked]>
Date: Wed, 9 Jun 2021 13:52:56 +1000

It's worth pointing out that, as the IETF increases its reliance on Microsoft-owned github, and discussion moves more and more from IETF-managed mailing lists to git pull requests, IETF discussions become subject to Microsoft's own underlying social media rules. Git has now morphed from a complex command-line tool into a social network with, like, the worst interface ever, which makes it a natural fit with the computing vistas of Redmond.

https://microsoft.github.io/codeofconduct/

Still, good to know who runs things around here.

Lloyd Wood
[email-masked]

now I really miss Myspace.

> On 6 Jun 2021, at 10:02, Dean Willis <[email-masked]> wrote:
> 
>

---

From: Lloyd W <[email-masked]>
Date: Wed, 9 Jun 2021 14:05:13 +1000

Talking over others is why I top-post.

Lloyd Wood
[email-masked]

> On 8 Jun 2021, at 02:44, Randy Presuhn <[email-masked]> wrote:
> 
> Hi -
>

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Wed, 9 Jun 2021 10:28:46 +0000

Hi Lloyd,

My reading of that code of conduct is that it only applies to Microsoft run open-source projects rather than all open-source projects hosted on Github.  I.e., I would not regard IETF work hosted on github as coming under the scope of that code of conduct.

I’ve not read the policy closely, but at a quick glance it also looks reasonable to me.

Regards,
Rob

From: ietf <[email-masked]> On Behalf Of Lloyd W
Sent: 09 June 2021 04:53
To: Dean Willis <[email-masked]>
Cc: [email-masked]
Subject: Re: Why we really can't use Facebook for technical discussion.

Still, good to know who runs things around here.
Lloyd Wood
[email-masked]<mailto:[email-masked]>

On 6 Jun 2021, at 10:02, Dean Willis <[email-masked]<mailto:[email-masked]>> wrote:

---

From: Lloyd W <[email-masked]>
Date: Wed, 9 Jun 2021 21:24:37 +1000

Rob,

simply put, that's the short version - based on, but often not needing to repeat, the more expansive GitHub policy version at

https://docs.github.com/en/github/site-policy/github-community-guidelines

-- which Microsoft manages, since Microsoft owns GitHub, so IETF use of GitHub falls under all of those Microsoft rules.

Lloyd Wood
[email-masked]

and you haven't read that one either.

> On 9 Jun 2021, at 20:29, Rob Wilton (rwilton) <rwilton=[email-masked]> wrote:
> 
> 
> Hi Lloyd,
>

---

From: "Rob Wilton (rwilton)" <[email-masked]>
Date: Wed, 9 Jun 2021 12:24:02 +0000

Hi Lloyd,

Okay, I agree that all contributions to public github repositories are likely to come under the github community guidelines that you link to below, but I still disagree that IETF contributions are bound by the first Microsoft open-source specific policy that you linked to – since I do not regard the IETF (or Github) as a “Microsoft-managed open source community”.

Perhaps it would be helpful for someone to do an offline check on whether there is anything in the github-community-guidelines policy that conflicts with the IETF community guidelines – I’ll check with Jay and the IESG.  But at a high level, it scans as “be nice to your fellow humans” and seems reasonable to me.  Specifically, nothing in those guidelines jumps out at me as prohibiting or hindering our ability to have courteous technical discussions about Internet standards.

Regards,
Rob

From: Lloyd W <lloyd.wood=[email-masked]>
Sent: 09 June 2021 12:25
To: Rob Wilton (rwilton) <[email-masked]>
Cc: Lloyd W <[email-masked]>; Dean Willis <[email-masked]>; [email-masked]
Subject: Re: Why we really can't use Facebook for technical discussion.

Rob,

Lloyd Wood

On 9 Jun 2021, at 20:29, Rob Wilton (rwilton) <rwilton=[email-masked]<mailto:rwilton=[email-masked]>> wrote:

Hi Lloyd,

Regards,
Rob

From: ietf <[email-masked]<mailto:[email-masked]>> On Behalf Of Lloyd W
Sent: 09 June 2021 04:53
To: Dean Willis <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: Why we really can't use Facebook for technical discussion.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 9 Jun 2021 11:22:37 -0400

On Wed, Jun 9, 2021 at 6:29 AM Rob Wilton (rwilton) <rwilton=
[email-masked]> wrote:

> Hi Lloyd,
>
>
>
> My reading of that code of conduct is that it only applies to Microsoft
> run open-source projects rather than all open-source projects hosted on
> Github.  I.e., I would not regard IETF work hosted on github as coming
> under the scope of that code of conduct.
>
>
>

That is my understanding, GitHub is a platform which allows multiple
communities with distinct admission policies to be created. Facebook is a
single platform with a single admissions policy

Most of the concern has been about people being unfairly excluded, I have a
concern about unreasonable inclusion. I do not wish to hear any more about
how the COVID vaccine causes people to be magnetized so that spoons stick
to their foreheads. I have been vaccinated and have utterly failed to get
so much as a teaspoon to stick. I have also failed to establish any
connection to a 5G tower. That is not a hypothetical, I have been watching
that crazy as it has been emerging for months. A group of lawmakers thought
it important to air such stupidities in a hearing and thanked the
perpetrator after.

Sherri Tenpenny tells Ohio legislators that coronavirus vaccines can leave
people ‘magnetized’ - The Washington Post
<https://www.washingtonpost.com/nation/2021/06/09/sherri-tenpenny-magnetized-vaccine-ohio/?utm_campaign=wp_main&utm_medium=social&utm_source=facebook&fbclid=IwAR2doVsda38Ctkt5CR9dsc9nv9IdDbg8ArA9tFzlJtNfSzkY6sjCdkXHZns>

Github isn't perfect but it is the best tool out there right now for IETF
work. It is rather obviously not the right long term solution as we are
using at most 20% of GitHub functionality and GitHub provides less than a
quarter of the functionality I think we need.

I have tried to get people to discuss what features they would want but
they turn into editor wars of the 'what makes you think that you have the
skills to design something better than a Web front end to a source code
manager Linus threw together in a week, besides the fact you have been
working on Web collaboration technologies since 1993 and your colleagues at
MIT put the OpenMeeting together for Vice President Al Gore in 1994?' sort.

---

From: "John Levine" <[email-masked]>
Date: 9 Jun 2021 12:38:21 -0400

It appears that Rob Wilton (rwilton) <[email-masked]> said:
>-=-=-=-=-=-
>Perhaps it would be helpful for someone to do an offline check on whether there is anything in the github-community-guidelines policy
>that conflicts with the IETF community guidelines – I’ll check with Jay and the IESG.  But at a high level, it scans as “be nice to
>your fellow humans” and seems reasonable to me.  Specifically, nothing in those guidelines jumps out at me as prohibiting or hindering
>our ability to have courteous technical discussions about Internet standards.

I took a look at github's community guidelines:

and at their AUP:

https://docs.github.com/en/github/site-policy/github-acceptable-use-policies

They are really generic, with nothing surprising or unusual.  If we insist on doing stuff that
breaches those rules, I think that says something really unfortunate about us.

To reinforce Phill's point, github is not facebook, and I am not worried that bots will
kick people out due to mentioning a kill -9 command.

R's,
John

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 9 Jun 2021 16:05:49 -0400

So we endlessly discuss problems we don't actually have much influence on.
Hope about authentication and authorization. Aren't we supposed to know
something about those?

Two IoT experiences today

1) Connecting to Ring doorbell on my phone

1) Cannot log into the App, because it thinks my password might have been
compromised. My doorbell sits outside my trusted perimeter and thus has the
same password as every other asset that I do not care about because it
isn't me who suffers the loss.

2) App directs me to reset password, sends a challenge message to my email.

3) I can't respond to the email because I don't have my email access on the
phone at the moment. So put the task off until I am at my desktop.

4) Log into Ring Web site, get fresh challenge,

5) Respond in my Gmail account

6) Try to log in to the Ring Web site, can't because I need a verification
code that can only come from a device running the app.

7) Give up because it is just too much hassle.

Second experience,

Log into my Nest account on the Web, get bounced to Google accounts to log
in. Can now view the status of my thermostat but not the status of my
doorbell because the whole point here is making people dependent on
subscription services.

Back in the Watson days, the IBM motto was 'Think!'. What seems to pass the
designers of these systems by is that absolutely the only reason to buy IoT
stuff is to make one's life easier. The Nest devices are going to have to
go because my wife is close to 'the Nest goes or I go' mode.

Looking at the Ring situation from a security point of view, it is of
course utterly absurd that they are relying on my gmail account to secure
their service but require four separate interactions just for one log in.
So compromise of the gmail account would utterly dominate anything they are
attempting to do but...

Lets face it, passwords aren't working and OAUTH is not the solution and
adding it into the mix most often just makes things worse.

Obviously, a transition to public key authentication can't happen overnight
but we could do it in stages:

1) Develop an infrastructure that makes it really easy to manage private
keys across multiple devices so that enabling a device to authenticate
itself as '@alice' or '@bob' is really easy.

2) Use the output of (1) to provide a public key based authentication
scheme that any social media or IoT or other service can use to replace
passwords. For important actions like financial transactions etc. we can
gate the action on provision of an additional factor (PIN, Biometric, etc.)
and for really important operations we can have confirmation.

3) Since the initial support for (2) will be near zero on day 1, also
develop a kick ass password manager that can be made ubiquitous, does not
require a subscription, copes with failures like lost devices etc. This
allows users to transition to using strong passwords that are different
everywhere.

Instead what we end up doing every single time is deciding that we can't
change the legacy infrastructure so we will do a botch job that has to work
round the constraints of the legacy infrastructure.

Oh and yes, I have specifications and running code. I am just writing the
shell for the host and the administration tool.

---

From: "John R. Levine" <[email-masked]>
Date: 9 Jun 2021 16:27:23 -0400

> 1) Connecting to Ring doorbell on my phone ...

> subscription services. ...

I have a dandy thermostat powered by two AA batteries that makes it warmer 
in the morning and cooler in the evening.  (We don't have central A/C.) 
It cost under $20.  My father's house had a Nest which I found to be worse 
in every way, harder to program, didn't do what I wanted, cost ten times 
as much.  Fortunately, I do not live the kind of life in which it would be 
imoportant to change the heat schedule when I am not in the house.

I suppose for people who like this stuff it would make more sense to take 
a tip from wifi and arrange for pairing by pushing a button when you are 
physically next to the device.  There is probably some standards work we 
could do, something like a physical proximity profile for SASL.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

---

From: John C Klensin <[email-masked]>
Date: Wed, 09 Jun 2021 17:22:15 -0400

--On Wednesday, June 9, 2021 16:27 -0400 "John R. Levine"
<[email-masked]> wrote:

>> Log into my Nest account on the Web, get bounced to Google
>> accounts to log in. Can now view the status of my thermostat
>> but not the status of my doorbell because the whole point
>> here is making people dependent on subscription services. ...
> 
> I have a dandy thermostat powered by two AA batteries that
> makes it warmer in the morning and cooler in the evening.  (We
> don't have central A/C.) It cost under $20.  My father's house
> had a Nest which I found to be worse in every way, harder to
> program, didn't do what I wanted, cost ten times as much.
> Fortunately, I do not live the kind of life in which it would
> be imoportant to change the heat schedule when I am not in the
> house.

So, probably because my circumstances are different, I've got a
few Internet-connected thermostats.  They are connected over
wired Internet, not WiFi, and with PoE, eliminating the need for
AA batteries.  The company that sells them, well, sells them --
without a business model that depends on selling subscriptions
or tracking my behavior to either target me with ads or selling
data about to others.

So, there are choices.

And I have a question: What does this rather long thread
actually have to do with the IETF other than demonstrating that
it would be dumb for our discussions to depend on a providers
who intended to support those discussions by selling
subscriptions and/or tracking user behavior and/or comments?
"Dumb" if only because separating those who would be comfortable
with such arrangements from those who would not would almost
certainly reduce our range of perspectives and participants.

And that distinction ignores whether I should be banned from a
list for some period of time because I suggested that a proposal
--one that I don't think anyone has really made-- would be dumb.

   john

---

From: Michael Richardson <[email-masked]>
Date: Wed, 09 Jun 2021 17:39:48 -0400

Phillip Hallam-Baker <[email-masked]> wrote:
    > Obviously, a transition to public key authentication can't happen
    > overnight but we could do it in stages:

    > itself as '@alice' or '@bob' is really easy.

You know that I sure like this.

    > allows users to transition to using strong passwords that are different

I thought that keepassx was one such system.
I admit that I tried to use it, but the UI was terrible, and my hand-rolled
solution was just easier, so I never transitioned.

Also keybase.io has "kvstore".
My impression is that the system uses the service only because NAT,
and can otherwise be told to go peer to peer.

I think that this is an xkcd 927 problem.

    > change the legacy infrastructure so we will do a botch job that has to
    > work round the constraints of the legacy infrastructure.

Yes, you are right.
Stephen Ferrel did some interesting work on generating and using client keys
in javascript (but not for HTTP level authentication).  I think that was
during the JOSE WG.  The idea was that at least losing a database of public
keys on the server was way better than a database of password hashes.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Michael Richardson <[email-masked]>
Date: Wed, 09 Jun 2021 17:42:19 -0400

John R. Levine <[email-masked]> wrote:
    > I suppose for people who like this stuff it would make more sense to
    > take a tip from wifi and arrange for pairing by pushing a button when
    > you are

MATTER (CHIP) already has a way to encode the 27,000<*> different ways you could
push a button into a QRcode or SRV record so that (I think) your phone can
show you a movie explaining how to get it into pairing mode.

<*>- may be slightly exagerated.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 9 Jun 2021 17:48:30 -0400

> subscriptions and/or tracking user behavior and/or comments?

The reason I tried to bring it back to stuff that is in IETF scope was
because I see all of these
issues as being aspects of the same broken approach to Internet accounts.

Traditionally, we view an Internet account as being a thing that it LENT by
the service provider
to the user. And the design of DNS reflects this in that DNS is a naming
system for hosts and
services, it is not a naming system for people. It is ludicrously expensive
for a start, $10/yr for
a DNS name is not actually an unreasonable charge for running DNS
authoritative services but
it is an absurd amount for a user name. When WhatsApp was a paid service,
it was $1/yr. So
$10/yr for the user name is ridiculous.

I think we need to have a reconsideration of the role of naming and
authentication and authorization.
And this is something a lot of service providers need to think through as
tales of people losing
all the Amazon digital goods they purchased because their Amazon account
was revoked proves.

For me, usernames and authentication are something that should
intrinsically belong to the user
and be theirs for life. I don't think people should lose their Internet
names under any circumstances.
An Internet name should be just like a traditional common name, just unique
to the holder.

Authorization is a different matter, that is something that is entirely in
the power of the person who
owns the resource in question. The IETF is an open forum, the Trilateral
Commission is not, The
Work is not, The Oxford Union Society is not. There are times when it is
fun to participate in a
completely open forum and there are times when you don't want to hear yet
more stupidity from the
woman claiming that vaccination causes people to become magnetized.

Every one of the HVAC systems in my house is close to a wired ethernet
drop. The system I am
planning to move to would connect the furnaces and the AC units directly to
the net and these would
then in turn take temperatures from multiple sense points in the house for
control purposes. A smart
furnace makes infinitely more sense than a smart thermostat connected to a
furnace so stupid that it
can't tell me when it is over pressure, when filters need replacing, etc.
etc.

The reason we have smart thermostats and stupid furnaces is path
dependence. And we are stuck with
the Internet account provider model for the same reason.

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 10 Jun 2021 13:24:05 +0200

On Wed 09/Jun/2021 23:48:30 +0200 Phillip Hallam-Baker wrote:
>> And I have a question: What does this rather long thread actually have to
>> do with the IETF other than demonstrating that it would be dumb for our
>> discussions to depend on a providers who intended to support those
>> discussions by selling subscriptions and/or tracking user behavior and/or
>> comments? >
> because I see all of these issues as being aspects of the same broken
> approach to Internet accounts.

There's a field in my Datatracker account linking to my GitHub account.  GitHub 
has a field for linking Twitter accounts but not IETF ones.  In practice, I 
sent the account name to the WG chair via an unsigned email message.  Is that 
vulnerable to social engineering attacks?

> the service provider to the user. And the design of DNS reflects this in
> that DNS is a naming system for hosts and services, it is not a naming
> system for people. It is ludicrously expensive for a start, $10/yr for a DNS
> name is not actually an unreasonable charge for running DNS authoritative
> services but it is an absurd amount for a user name. When WhatsApp was a
> paid service, it was $1/yr. So $10/yr for the user name is ridiculous.

One could find names at less that 1$, but then shouldn't expect to deliver much 
of the mail sent from such domains.  The price we pay is for globalness and 
some kind of moderation.

By design, the DNS lets us fake whatever authority we fancy, perhaps using RFC 
2606 names if we care about possible future overlaps.  Or use .onion.

> For me, usernames and authentication are something that should intrinsically
> belong to the user and be theirs for life.

Agreed.  We can hardcode our credentials and upload them to NodeMCU with 
Arduino.  The difficulty is sharing resources with (some) other people or 
devices without necessarily getting at a global visibility level.

Best
Ale
--

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 10 Jun 2021 09:24:40 -0400

> vulnerable to social engineering attacks?

What we need is a mechanism that allows us to link everything to a
permanent identifier that belongs to the user and is thus immutable.

One option is a public key fingerprint. But that has user acceptance issues
and PGP fingerprints have developed as an identifier that is subordinate to
an email address which is the opposite of what we want.

We have to have names that look like 'alice', not a string of base32
characters.

One could find names at less that 1$, but then shouldn't expect to deliver
> much

I spent 25 years working out how to validate keys that a user has attached
to a name and it is near impossible without a national identity card level
of effort and even then the result is limited. It gets us strong binding to
the name holder which is rarely what we want for Internet stuff.

Then I flipped the problem round, what if instead of validating a key, we
have a person use that key to claim a name to serve as an alias for that
key on a first come first served basis. That is entirely tractable and
doesn't require trusted third party, a Merkle Tree over an append only log
is sufficient.

If every message was signed and mail messaging subject to access control,
Alice is going to receive every message from Bob if shed decides to
authorize him to send her mail.

SMTP is not going to be replaced overnight but I think that there might be
a market for an email messaging service for important messages that is
open, end-to-end encrypted and does not allow unauthorized parties to spam.

PHB