TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

VPNs are not the solution to a policy problem

298 pointsby staticsafeabout 8 years ago

37 comments

nikcubabout 8 years ago
There are a few schools of thought on where responsibility should lie in protecting user privacy. The first that it is a role of government and policy - in the same way the government sets standards for automobile and road safety they can set and enforce policies for user privacy.<p>The second school of thought is individual responsibility. Users should take steps to protect their own privacy on a case-by-case basis, in the same way they look after their own home security or personal safety.<p>The third would be a hybrid approach - that there is a role for the government to play in setting up a universal minimum level of privacy protection while users also have a role to play in their own protection. This is most akin to how healthcare works - i&#x27;m guaranteed treatment in an emergency room but I also might choose to keep myself healthy with diet, exercise etc.<p>I personally believe in user responsibility for personal privacy and security, where you can&#x27;t and shouldn&#x27;t depend on policy to protect you and that all users should be aware of the issues and actively educated on how to protect themselves. For a few reasons:<p>1. Policy is not universal. Some countries may have extensive and rigorous user privacy protections but that doesn&#x27;t apply to users everywhere. While user privacy protections are strong in Europe, and consumers have access to recourse if they&#x27;re privacy rights have been violated, that same advice doesn&#x27;t apply to the majority of internet users, most of whom are residents of a nation or jurisdiction where there is no strong protection or user recourse.<p>2. Governments are a major party in privacy violations and are conflicted, so they can&#x27;t be expected to behave in the interest of users. The most recent campaigns to roll out encrypted communications and connections in apps was prompted by the US government intercepting internal Google data. The government will almost always be incentivized to lower barriers to ease intelligence gathering and in most of the world government surveillance trumps individual rights.<p>3. Similarly, government can&#x27;t be trusted. This is the point Ed Snowden made when he argued for individual and tech solutions to privacy over government policy[0]. Snowden cites the difference in Obama&#x27;s campaign promises and what he delivered[1], and this isn&#x27;t unique to Obama - the FCC ISP privacy rules being blocked this week is yet another example of how easily and quickly policy can be undone, while the mass surveillance Snowden disclosed is an example of how public policy and private actions can be different.<p>4. Tech solutions to privacy doesn&#x27;t imply individual responsibility. We can, and do have, tech solutions that are universal - such as the campaign to roll out encrypted communications and connections with Whisper and LetsEncrypt.<p>5. Policing government policy is labour intensive and difficult. It relies on privacy researchers - usually individuals - to track what companies are doing with user data. With more data being shared between companies it is even more difficult to apply individual oversight to how policies are being enforced. See Natasha Singer&#x27;s reporting in the NYTimes on data brokers[2]<p>6. There are usually very minor enforcement penalties for companies that violate user privacy policy. The FCC tracking opt-in rules were prompted by some ISPs adding tracking headers or cookies to user traffic. AT&amp;T and Verizon were adding tracking cookies to user traffic and it took two years to notice, and there were zero implications for both companies[3] other than the new FCC rules which are now dead.<p>7. Even in the perfect world of good policy, good application of policy and good enforcement you still have more data than ever being stolen and leaked online. You only have to look yourself up on haveibeenpwnd or a similar database to find that for a lot of people, all of their PII has already leaked[4]<p>It is very clear to me that technology solutions have the primary role in protecting user privacy. Policy isn&#x27;t a waste of time but it can&#x27;t be relied upon. The question is how user privacy protection is packaged for a mass-audience. User privacy requires an equivalent of what &#x27;use WhatsApp, use Signal&#x27; is for user security, what &#x27;install antivirus, don&#x27;t click on attachments&#x27; used to be for user security and the growing popularity and awareness of ad blockers.<p>I&#x27;m not sure what that will be or what it will look like, but warning people away from VPN&#x27;s probably isn&#x27;t going to help. Chances are that some form of VPN connection will become part of the standard solution (along with HTTPS&#x2F;encrypted comms everywhere) now that the reality of ISPs and users not sharing privacy interests is here and many are aware of it.<p>Theres a great market opportunity here - perhaps not for VPNs as a product but VPN as a technology.<p>[0] <a href="https:&#x2F;&#x2F;www.wired.com&#x2F;2016&#x2F;11&#x2F;despite-trump-fears-snowden-sees-hopeful-future&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.wired.com&#x2F;2016&#x2F;11&#x2F;despite-trump-fears-snowden-se...</a><p>[1] <a href="https:&#x2F;&#x2F;www.forbes.com&#x2F;sites&#x2F;thomasbrewster&#x2F;2016&#x2F;11&#x2F;10&#x2F;edward-snowden-pardon-president-donald-trump-pardon&#x2F;#a6ea4b21357f" rel="nofollow">https:&#x2F;&#x2F;www.forbes.com&#x2F;sites&#x2F;thomasbrewster&#x2F;2016&#x2F;11&#x2F;10&#x2F;edwar...</a><p>[2] <a href="http:&#x2F;&#x2F;www.nytimes.com&#x2F;2013&#x2F;09&#x2F;01&#x2F;business&#x2F;a-data-broker-offers-a-peek-behind-the-curtain.html" rel="nofollow">http:&#x2F;&#x2F;www.nytimes.com&#x2F;2013&#x2F;09&#x2F;01&#x2F;business&#x2F;a-data-broker-off...</a><p>[3] <a href="https:&#x2F;&#x2F;www.techdirt.com&#x2F;articles&#x2F;20150115&#x2F;07074929705&#x2F;remember-that-undeletable-super-cookie-verizon-claimed-wouldnt-be-abused-yeah-well-funny-story.shtml" rel="nofollow">https:&#x2F;&#x2F;www.techdirt.com&#x2F;articles&#x2F;20150115&#x2F;07074929705&#x2F;remem...</a><p>[4] <a href="https:&#x2F;&#x2F;haveibeenpwned.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;haveibeenpwned.com&#x2F;</a>
评论 #13984797 未加载
评论 #13984286 未加载
评论 #13984666 未加载
评论 #13983103 未加载
评论 #13986932 未加载
评论 #13985131 未加载
评论 #13983068 未加载
评论 #13983255 未加载
评论 #13987036 未加载
jfoutzabout 8 years ago
Lots of people seem to think the right answer is selling improved security. I disagree. It would be much more exiting to get the data coming from politicians homes, and the homes of their staff. It would be a fantastic way to generate news. Why is senator X&#x27;s household researching cancer treatment? Will they step down this year? I can&#x27;t help but think military bases would google their next deployment, that&#x27;s another set of huge news articles.<p>If you&#x27;re more into the finance side of things, CXO&#x27;s home clickstreams would probably be enlightening. Or hedge fund managers. Some will be fully encrypted and secure, but just the dns would be a strong signal about what companies they&#x27;re researching.<p><i>That</i> is the kind of business that will drive privacy legislation.
评论 #13982903 未加载
评论 #13982829 未加载
评论 #13984468 未加载
评论 #13982776 未加载
Goopplesoftabout 8 years ago
A heads up: theres a really nice project called Streisand[1] which provides a multi-protocol VPN with very little effort. You can launch one on a cheap cloud provider (like DO, if their policy allows).<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;jlund&#x2F;streisand" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jlund&#x2F;streisand</a>
评论 #13982633 未加载
评论 #13986299 未加载
评论 #13982622 未加载
评论 #13982632 未加载
FridgeSealabout 8 years ago
No, they&#x27;re not.<p>The solution is getting strong, enforced laws that protect our privacy and punish those who break them.<p>But for the moment, with advertisers viewing themselves as gods gift to the internet who think that all your information belongs to them simply by virtue of existing, and who will go to great lengths to acquire and store it all (for perpetuity), a solution is needed, and part of that is VPN&#x27;s.
评论 #13982601 未加载
评论 #13986573 未加载
评论 #13982685 未加载
评论 #13982709 未加载
评论 #13982591 未加载
dfcabout 8 years ago
It&#x27;s strange to see the evolution of the technology versus policy debate. We started out with &quot;the Internet views censorship as damage and routes around it.&quot; A little later we had Lessig saying &quot;code is law.&quot; And now the refrain is &quot;VPNs are not the solution to a policy problem.&quot;<p>I miss the idealism and optimism of the past. The only hopeful thing I can find in the new &quot;quote&quot; is that it seems that the tech world is finally aware of the need to work with policy makers and the public in addition to building new systems.
评论 #13984480 未加载
评论 #13987925 未加载
byuuabout 8 years ago
Another thing often overlooked with VPNs is that they&#x27;re just not that fast. I have a 600&#x2F;40 connection, and I&#x27;ve tried at least six for-pay VPN providers. The fastest one I found (won&#x27;t mention as my goal isn&#x27;t to advertise for them) hits, at best, 100&#x2F;30. And even then, only over L2TP. For whatever reason, OpenVPN is <i>always</i> slower on every PC I&#x27;ve tried this with.<p>And obviously, you gain a good deal of latency, especially if you use an overseas exit point.<p>And now we get to deal with shitty services like Netflix punishing privacy-conscious users and blocking access to paid accounts while your VPN is up.
评论 #13982872 未加载
评论 #13982942 未加载
评论 #13982959 未加载
评论 #13982703 未加载
评论 #13982788 未加载
评论 #13982694 未加载
评论 #13984347 未加载
评论 #13985178 未加载
sjwrightabout 8 years ago
Perhaps one solution might be to poison the data and have your router&#x2F;device make spurious random DNS lookups and HTTPS connections. Ensure the list of random websites includes the top few hundred companies likely to be in the market for usage data. If enough people did this it would make the data useless.
评论 #13982785 未加载
评论 #13982733 未加载
评论 #13986777 未加载
jdolinerabout 8 years ago
Why aren&#x27;t VPNs, and more broadly encryption, a solution to this problem? &quot;Waving the wand of a technical solution,&quot; as the post pejoratively calls it, isn&#x27;t such an unreasonable thing to do with an inherently technical problem. This problem only exists because of other technical wands we waved. Why solve this problem with policy? Policy is hard to get passed, hard to keep passed and even when it is passed often times it means nothing. Remember this is the same government that contains multiple organizations surveilling your every move, not because they legally can, because they illegally can. The point is, it&#x27;s foolish to count on USG to give you a right to privacy, just look at the history on this, it&#x27;s not going to happen. But it&#x27;s especially foolish when this is a right that you can enforce for yourself. If you actually care about your privacy use a VPN, or Tor, don&#x27;t sit around waiting for the government to do it for you.
评论 #13982998 未加载
评论 #13982877 未加载
gueloabout 8 years ago
One thing I was wondering, beyond your own personal ISP, does this mean that the backbone providers, the Level 3&#x27;s of the world, are going to get into selling data to advertisers? I was feeling personally ok because I use an ISP with a strong privacy pledge, but I wonder if their uplink is going to be selling my data. Though I guess it&#x27;s less of a concern since the backbones don&#x27;t have the complete personally identifying info that the customer ISPs have.
评论 #13982915 未加载
评论 #13982605 未加载
评论 #13982587 未加载
libeclipseabout 8 years ago
I understand the viewpoint of the article, but it assumes that the person waving the wand particularly cares about everyone else.<p>Personally, with the Investigatory Powers Bill in the UK, I will &quot;wave the wand of a technology solution&quot; to conserve and protect my own privacy.<p>Sure, if the policy was changed upstream then a lot more people would benefit than the technically inclined folks, but if there&#x27;s a bug upstream we don&#x27;t all sit with it and wait, we fix it locally and vendor.
评论 #13986716 未加载
WhitneyLandabout 8 years ago
What would be wrong with selling preconfigured routers to solve the problem?<p>The router could talk to a standard web api to get information to configure itself. The web service behind the scenes could set up and teardown digital ocean droplets as necessary running streisand. The web service IP&#x27;s wouldn&#x27;t be blocked because they&#x27;d only be used to periodiy get configuration.<p>So then you buy a non technical person this router, they create an account on the configuration website and as Ron Popeil would say, set it and forget it.
philip1209about 8 years ago
I think the bigger hole is DNS. Full-tunnel VPNs to primarily TLS-encrypted sites seems like overkill. Encrypted DNS plus an &quot;HTTPS Everywhere&quot; plugin should obfuscate enough info for most people without significantly affecting latency.
评论 #13982560 未加载
评论 #13982636 未加载
评论 #13982564 未加载
评论 #13982575 未加载
joveianabout 8 years ago
One nice although limited alternative to openvpn is sshuttle: <a href="https:&#x2F;&#x2F;github.com&#x2F;sshuttle&#x2F;sshuttle" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;sshuttle&#x2F;sshuttle</a><p>The limitations are: no ipv6 support :(, sometimes leaks dns, and always crashes shortly after it is first started (then works fine when you start it again). There seems to be little active development.<p>To work around the limitations, I mostly use SOCKS (curl also supports SOCKS), plus run sshuttle to try to catch any additional traffic. For that matter, SOCKS alone would at least catch the most sensitive traffic for most people (and would make it easy to have another browser profile for watching netflix).<p>I get a $15&#x2F;year OpenVZ account from ramnode.com, which supports VPN usage. I haven&#x27;t had an issue with bandwith (it seems to undercount quite a lot) but don&#x27;t watch netflix or otherwise use that much bandwidth.<p>The main issue I&#x27;ve had is that some websites (google, amazon, gog) will default to various other languages that I assume other people who are doing the same thing speak. Fixed by logging in to the site and they then seem to remember for a while even if you don&#x27;t log in, but eventually they switch again.<p>The nice thing is that the remote server can be configured to just have an SSH server on port 80 (in case you ever want to use it from restrictive public wifi; I first stated to do this after seeing SSL downgrade errors on public wifi) with public key authentication, so there is much less to worry about in terms of being responsible for a system open to the internet all the time. In SSH, I set:<p><pre><code> KexAlgorithms=curve25519-sha256@libssh.org HostKeyAlgorithms=ssh-ed25519-cert-v01@openssh.com,ssh-ed25519 Ciphers=chacha20-poly1305@openssh.com MACs=hmac-sha2-256,hmac-sha2-512 </code></pre> So still not a super easy option but a somewhat easier option than OpenVPN. It would be quite easy with an automated way to set up the remote ssh server correctly.<p>Edit: Speed is quite good with this setup and while I haven&#x27;t done extensive comparisons, it does not seem to lower the connection speed by much.
评论 #13982760 未加载
andrenotgiantabout 8 years ago
Until a better solution is found, I think the way the recent IOT botnet stuff + this ISP privacy deregulation is portrayed in the media opens the opportunity for a startup that sells a secure, smart home router + VPN subscription plan.
评论 #13982531 未加载
评论 #13987506 未加载
评论 #13982528 未加载
nine_kabout 8 years ago
Technology used to trump policy, in an unstable but stubborn way. Napsters and piratebays die, but file sharing lives. It&#x27;s less intense now nit because of policies, but because legal ways to buy most music and videos became reasonably convenient for the mass user.<p>How well might connectivity limitation work? It took China immense centralization and a lot of technical effort to build the great firewall, which is not exactly impenetrable, though.
quantumfoamabout 8 years ago
I&#x27;ll just leave this here: <a href="https:&#x2F;&#x2F;github.com&#x2F;trailofbits&#x2F;algo&#x2F;blob&#x2F;master&#x2F;README.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;trailofbits&#x2F;algo&#x2F;blob&#x2F;master&#x2F;README.md</a><p>I used a droplet on DigitalOcean to configure an Algo server. Very seamless setup, highly recommend. There&#x27;s a $10 promo floating around: DROPLET10. You can self host too.
评论 #13984520 未加载
sicularsabout 8 years ago
Ya, this sucks... a lot. VPNs are a start with existing tech. I firmly believe new technology will solve this problem. Encryption everywhere. Overlay networks. New fully encrypted and annonymized DNS systems. Digital currency incentivizations. Policy helps but in the absence of policy technology will find a solution.
frebordabout 8 years ago
This whole damn thing spawns from the lack of competition with ISPs. If consumers had more than 1 or 2 options, we could choose with our money. I don&#x27;t think the solution is to regulate the industry, but our privacy should certainly be protected by our fucking useless government.
pryelluwabout 8 years ago
Ok, so which vpn providers are good?
评论 #13982533 未加载
评论 #13982548 未加载
评论 #13982558 未加载
评论 #13983491 未加载
评论 #13982497 未加载
评论 #13982555 未加载
评论 #13983776 未加载
vxxzyabout 8 years ago
At the end of the day, it is obvious that policy is the right direction to stop this bleed of infringement. However; be it noted: those who have the capability to circumvent, or ethically &quot;get around&quot; such enchroachment; have a responsibilty to free those who may be entagled by that which is &quot;freedom limiting&quot;. The argugment could be had, however; is it really freedom limiting for others to know your web history? Obviously, there are second, and third abilities to be held when a dominant party knows of the lesser&#x27;s behavior. Still a great bit to parse. As for me and my house, we will tunnel safely through VPN.
评论 #13982933 未加载
BatFastardabout 8 years ago
Does anyone sell a router for the home that has a VPN built in?<p>So that I dont have to have every computer in my home hook into the VPN when I start it up. Just one account for my whole house?<p>I imagine you could setup a linux box to do that for you, but I am lazy...
评论 #13984991 未加载
评论 #13987124 未加载
评论 #13983238 未加载
评论 #13987481 未加载
评论 #13983267 未加载
评论 #13983320 未加载
cottsakabout 8 years ago
VPN providers can totally scale. They will cease to be semi-dark-web services and turn first class. Services that test them will emerge verifying the security and encryption of tunnels.<p>Additionally there will be some who take an extreme view to this &quot;zero knowledge&quot; approach offering all forms of payment and workarounds to preventing down-stream ISPs&#x2F;backhaul from tracking&#x2F;identifying&#x2F;classifying user traffic.<p>Maybe VPNs &quot;are not the solution&quot; but they still can do a lot of good in the mean time yet.
bayouborneabout 8 years ago
Look to Comcast and TW to buy a few of the mid-tier established VPN providers, and then play both sides of the table.
herbstabout 8 years ago
After reading digital ocean the 10th time on here. What makes people think that using a american company that complies with american laws and regularly gives out data is a much better option than renting a VPN in a country that still has privacy in place?
评论 #13986372 未加载
godzillabrennusabout 8 years ago
The solution to all of this is educating the population.<p>VPN tech is cheaper and more likely to succeed.
评论 #13982537 未加载
chxabout 8 years ago
I had all sorts of VPN problems over the years with various Linux desktops OS. What I do instead is that I have a proxy server with just an OpenSSH daemon on port 443 -- if there&#x27;s web traffic, add sslh to taste -- and then use the SOCKS v5 proxy built into OpenSSH client and then <a href="http:&#x2F;&#x2F;darkk.net.ru&#x2F;redsocks&#x2F;" rel="nofollow">http:&#x2F;&#x2F;darkk.net.ru&#x2F;redsocks&#x2F;</a> I might be the weird case here but I found this infinitely easier to set up than any VPN.
评论 #13982667 未加载
olliecoabout 8 years ago
PrivacyTools.io [1] has a great list of resources (not just VPNs but also email clients, email providers, browsers, OSs) that can be used.<p>If you are using Firefox, be sure to follow everything mentioned in the &quot;about:config&quot; hacks section.<p><a href="https:&#x2F;&#x2F;privacytoolsio.github.io&#x2F;privacytools.io" rel="nofollow">https:&#x2F;&#x2F;privacytoolsio.github.io&#x2F;privacytools.io</a>
chlordaneabout 8 years ago
I&#x27;m sure you all remember this read from 6&#x2F;1&#x2F;2016:<p>The impossible task of creating a “Best VPNs” list today <a href="https:&#x2F;&#x2F;arstechnica.com&#x2F;security&#x2F;2016&#x2F;06&#x2F;aiming-for-anonymity-ars-assesses-the-state-of-vpns-in-2016&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arstechnica.com&#x2F;security&#x2F;2016&#x2F;06&#x2F;aiming-for-anonymit...</a>
7HNajAHabout 8 years ago
So which VPSs are good for privacy? We all know DigitalOcean, AWS and Linode as simple to set up and use VPSs, but does anyone have any recomendations of VPSs based on their terms? I currently use DO for my VPS&#x2F;VPN, but i&#x27;ve seen people voice concerns about them in the past. Is there a list of &#x27;most free&#x27; providers?
jmclnxabout 8 years ago
Well a quick google came up with this:<p><a href="http:&#x2F;&#x2F;www.pcmag.com&#x2F;article2&#x2F;0,2817,2495932,00.asp" rel="nofollow">http:&#x2F;&#x2F;www.pcmag.com&#x2F;article2&#x2F;0,2817,2495932,00.asp</a><p><a href="https:&#x2F;&#x2F;www.bestvpn.com&#x2F;best-linux-vpn&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.bestvpn.com&#x2F;best-linux-vpn&#x2F;</a>
评论 #13982853 未加载
pnutjamabout 8 years ago
I run x2go on a linux server that I connect to remotely for browsing. It&#x27;s at my house currently and configured to use a vpn, but I used to have one in the cloud.<p>I wonder if people would be interested in dedicated browsing VM. Unfortunately there is no good mobile client.
Proofabout 8 years ago
I swear this 98 percent of this article was from the Policy Change HN read yesterday.<p>I think the market for VPNs that have a policy for not keeping logs and easy-to-use will grow exponentially in the common days or weeks. For the more technically inclined, VPS providers.
johanneskanybalabout 8 years ago
Not the solution perhaps but the next natural move of a cat and mouse game that predates the current policy change. It boils down to: Keep the internet lawless because there&#x27;s no global entity that has my best interests at heart.
logicalleeabout 8 years ago
Although it would not be a solution, see my request for Google to do this posted a few hours ago:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13983468" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13983468</a>
awqrreabout 8 years ago
if I can buy your browsing history, I should also be able to buy your tax returns...
gshakirabout 8 years ago
How about Apple provide a VPN as part of the device? Remember Apple was the one that broke the telecom&#x27;s dominance on the mobile market. I wouldn&#x27;t mind paying Apple for the privacy.
dredmorbiusabout 8 years ago
The (presently) top-rated comment on this thread by nikcub is not only wrong, but fractally wrong in every particular. I&#x27;m offering this as a possible counterpoint.<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13982966" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=13982966</a><p>* False dichotomy: that the solution lies in only one sphere. (Lessig, <i>Code</i>). This is lightly moderated, but resurfaces at several later points in the argument.<p>* Personal responsibility. Check. Never mind that the source article states concisely and specifically why this doesn&#x27;t work or scale.<p>* Hybrid system. Or as I prefer, <i>the worst of both worlds</i>. In the healthcare example, a <i>guarantee of emergency room services</i> is posited as a sufficient mitigation for mandating individual responsibility <i>in all other areas</i>. Disregarding the fact beneficial health outcomes comes from public or preventive measures, not acute (read: late, expensive, heroic measures) interventions:<p>&quot;In all, 86 per cent of the increased life expectancy was due to decreases in infectious diseases. And the bulk of the decline in infectious disease deaths occurred prior to the age of antibiotics. Less than 4 per cent of the total improvement in life expectancy since 1700s can be credited to twentieth-century advances in medical care.&quot;<p>― Laurie Garrett, <i>Betrayal of Trust: The Collapse of Global Public Health</i><p>* As with all good Techno-Libertarians, nikcub &quot;personally believe[s] in user responsibility&quot;. Despite some 50+ years of experience that <i>user responsibility for security simply does not work or scale</i>.<p>Nikcub continues with specifics:<p>* Universality of policy. Which seems to boil down to &quot;since <i>every</i> jurisdiction cannot offer the same high levels of protection, <i>no</i> jurisdiction should&quot;. What ever happened to the concept of a competitive marketplace for ideas, including legal and moral frameworks? Isn&#x27;t the very idea of liberal democracy that its principles, premises, and protections <i>are so manifestly self evident</i> that <i>all</i> people everywhere would want them? (And hence: why it&#x27;s such a major pain in the ass of tinpot despots everywhere.)<p>* Some governments are bad ... so <i>no</i> governments can be trusted. Again: a slope so slippery nikcub loses his footing instantly. We can apply the same argument to ... anything. Including his proposed technological solutions: <i>Software is a major party in privacy violations and is conflicted (and buggy), so it cannot be expected to behave in the interest of users.</i> In government as with software, <i>the proper response to buggy implementations is to fix the bugs, not burn the house down and abandon the domain completely.</i><p>* Government trust. Where do I even start (the concept and questions of trust are ... a whole &#x27;nother essay). <i>If liberal democratic government, the agent </i>and agency* of The People, cannot be trusted, then what can?* Private, <i>self-interested</i> business? Which, I&#x27;ll hasten to add, <i>has landed us in the present kettle of fish</i>? If you&#x27;re finding that your government (or parts of it) aren&#x27;t trustworthy, <i>then you have two problems</i>. But the one doesn&#x27;t invalidate proper approaches to the other, <i>and fixing the problem of government trust gives you an exceptionally powerful tool to apply in remedying privacy and other policy failures</i>. Say, such as single-payer, universal, socialised medicine.<p>* Tech solutions that are universal ... are called <i>policy</i>. And, to add to that, <i>a primary reason for approaching such policies through government is that governments have the clout and scale to make policies stick.</i> Keep in mind that this need not be at national or international scales. Policies at the sub-national scale -- say, Northern Ireland or Scotland within the UK, or California or New York within the United States, could have major impacts. Given the option of adopting <i>multiple and conflicting regulatory standards</i>, or <i>a unified and coordinated</i> standard, companies will often prefer the latter. The case of US EPA and California EPA emissions standards would be an excellent study in same.<p>* Good policy is hard work. Yes, well, hard problems are hard. This doesn&#x27;t make them not worth pursuing. And remedying the specific problems highlighted would be a key goal of any privacy regulatory overhaul.<p>* Penalties are small. Well, duh: <i>embiggen them.</i> I thought <i>yuuuuge!!!</i> was in now, anyways....<p>* On information disclosure: yes, <i>it&#x27;s very hard to un-leak data</i>. On the other hand, comprehensive and pervasive regulations <i>against</i> the storing <i>or</i> transmission of personal data, <i>stiff penalties</i> for doing so, and <i>sufficient rewards</i> for reporting on such violations, will tremendously decrease the incentives for doing so. Given that the value of vast troves of personal information to firms such as Facebook is ... roughly $12&#x2F;year per person, those penalties need not be tremendous, though they do need to be sufficient <i>given scales of detection</i>. This isn&#x27;t dissimilar to present approaches against counterfeiting of money or goods: the fundamental capability to violate norms exists, but with appropriate penalties, and incentives, against transacting in such money or goods, it can generally be tamped down to an acceptable level. The more so <i>if technology and other means are applied in concert with policy</i>.<p>The argument continues spewing the additional canards of <i>perfect worlds</i> (no policy world is perfect, at best it is <i>sufficient</i>), <i>sole reliance</i>, and of mis-casting the argument as <i>warning people away</i> from VPNs (it doesn&#x27;t, it merely points out that <i>VPNs alone are grossly insufficient</i>).<p>And for the capper, we have <i>free-market it harder</i>. As if it wasn&#x27;t free-market interests, and failures, which haven&#x27;t landed us precisely in the present situation.