"At Least 500 Million Yahoo Accounts Hacked in Late 2014" via Macrumors.

Yahoo today confirmed that "at least" 500 million Yahoo accounts were compromised in an attack in late 2014, leaking customer information like names, email addresses, telephone numbers, birthdates, hashed passwords, and both encrypted and unencrypted security questions and answers.

Does this surprise anyone at this point?

You know, I think if I had a huge cloud company with hundreds of millions of users, I'd consider having at least three sets of teams writing at least the fascade of the software -- the server-side controller methods -- so I could rotate from one to another every sprint or so to throw off would-be hackers. As soon as they made progress hacking one, it'd be replaced by Team 2. By the time we got back around to Team 1, they'd have iterated once or twice, and the hackers would have to, if not start over, pivot. Or maybe any user would have an X% chance of bringing up Team 1, Y% 2, Z% 3 each time they started a session.

I'd likely do the same for the users' data, splitting them into into several different databases, and maybe rotating users back and forth. Several different architectures using several different databases, all pitching to a consistent UI and user experience. If you interface well, it's no problem.

I realize there are obvious downsides. Maybe Team 2 has a horrible design, and it's easily cracked. That is, I'm in some sense three times as likely to get hacked as before, even if it's a much smaller set of users that's compromised.

But even more importantly would seem to be to sniff your network traffic like heck to see when 500 million sets of birthdays had left the network. Bizarre.

Ultimately, though, RMS (hrm, apparently not Stallman) is on point: If it's on a computer, in a network, given enough time, it'll eventually be free to anyone else on that network. Networked zeroes and ones want to be free.

Labels: encryption, free, rms, security, yahoo

A quote from a blog I'm reading a lot more regularly now, Baldur Bjarnason's:

It's almost as if open source has become a system for transforming people's leisure time into free labour for corporations—eating up people's lives while driving them on with promises of future employment. (E.g. "GitHub is your resume".)

15 years ago, I had a long conversation with Bob Hughes (of Dust or Magic fame) about Free Software and open source. I was gushing about it

I talked about how it was going to change the world for the better, make software more egalitarian & democratic -- I was a bit of an idealist[.]

He then explained to me what was going to happen, how corporations and capitalism in general would twist the system to their benefit.

And then a follow-up here:

Instead of empowering the people and regular computer users, we've empowered VCs and tech billionaires.

OSS is still there for the rest of us to take advantage of, if we have the will and the skill, but it isn't doing much for your regular computer user.

I suppose that was Stallman's point about OSS versus Free Software in the first place.

I'm not sure what the angle Bjarnason's ascribing to RMS, but I bet I'll repeat it here accidentally.

Look, here's the problem with OSS... Well, here's the problem with indie-garage software coders (the toymakers) in general: As RMS says, software [sic] wants to be free. That's in large part why the App Store prices raced to the smallest possible (imagine if Apple had let you set any price! How many 12¢ apps would there be?). The marginal cost of distributing software, once written, quickly approaches nil.

What's neat is what you can do with software. If you make software that enables people in real time to do something interesting, you can sell that service. Software naturally enables. If your hours of github wrangling is worth 98¢ in actual cashola, but enables you (and others) to perform thousands of dollars of services, well, yes, github is your resume.

That is, if you chose to write server-side code, you've already boxed yourself into a use that'll never be customer facing. The flip side is -- your faceless, nearly designless software is barely worth anything on its own. There are so many replacements for what you've done. If you charge so much as 99¢, folks will go elsewhere. It stinks, but it's the hard truth. Sellable software requires design, serious design. Otherwise you'll never hit that group of end-users willing to give you real cash (the "market").

So it's better to give your services-focused software (your jQuery plugins and SQL profilers) away for free. At least then the barrier to entry of licensing and price is gone, and you have what's at worst an even playing field with your like-minded competitors. You probably still won't build the next Bootstrap, but now you at least have a shot. Hard truth time? Even those folks that try to eek a living out of customer-facing apps, and who are good at it, have a really hard time making ends meet.

And there's nothing wrong with writing code for a job. Server-side programming pays well. You will love your salary for doing brainteasers.

But you're not overtly using open source to be political in this case. You're following the market's natural direction. That is, these "resume" projects you're making are likely the easiest worthless projects (insert a smilie and remember that my assertion is that all software wants to be free and is, eventually, essentially worthless) you could make. And, again, good for you. Most people never share excellent worthless work. ;^)

Free Software's alternative

If Bjarnason's point is that non-GPL licenses are too lenient, I've agreed for years. You have to use a protective license if you want to create a privileged space that competes with capitalism. You must use capitalism to create this Free haven. The most brilliant, Deluezo-Guattarian move GNU ever made was to copyleft software. Use copyright to fight copyright. Use capitalism to fight capitalism. Inhabit, reassemble, and redirect. Don't fight head-on.

And it's the lack of inhabitation that's killing the dream of OSS (and GNU) idealists. Where are OSS' best wins on the client? LibreOffice, which is still a big win. Firefox, less important now that there's mobile, as Bjarnason points out. Even The Gimp or Audacity were good apps.

But none of these are best in class designs. Where is the better mail client, the better word processor, the better personal finance software? Where is the better desktop OS? Where is my hoverboard?

Cutting closer to the bone, how much Free software do you use "at home"? How about that phone in your pocket? Is it Free software? Look man, it's not. You're happy to use OSS at work, but you're not using it at home. How do you expect work software to make your home life better? How is Free software going to improve your life if you don't use it?

Better yet, WHY AREN'T MORE OF YOU CONTRIBUTING TO REPLICANT, the truly Free Android fork? In other words...

Why aren't we putting our time into game-changing software?

If you want to create that idealistic society that Free software enables, you have to work on projects that society cares about. As long as Free software remains derivative, it's going to be playing catch-up. And if Free clients are only as good as paid clients from ten years ago, platform-jumping (like the one from PC to mobile) will keep catching it by surprise.

Until we concentrate on the client -- that is, servicing the needs of people, dammit -- Free software will continue to gain a foothold only in those spaces where the software experience is completely fungible, like we see on servers today. It's not OSS' fault (I realize I'm conflating OSS and Free software too much) that we haven't created the ideal. It's ours.

(This is where, if I allowed myself more time, I'd start into suggestions about how to make this happen. Use Free software "at home" (and in your pocket). Learn the apps' foibles. Learn the languages used to create them, or figure out how best to recreate them. Find the pain points its users would have, and make the apps truly citizen-usable. And help folks figure out how to make Replicant work. There's like one dude plying away at the most important Free software project going, and that's simply not enough.)

Labels: app store, business, F/free, indie, OSS, rms

"Somebody is saying this is inevitable – and whenever you hear somebody saying that, it's very likely to be a set of businesses campaigning to make it true."

Labels: rms, SaaS

And I'm a big fan of open source software and we use a lot of it at Apple (wrapped up in our own proprietary code and sold for big money, of course -- thanks, suckas!)

Labels: apple, lgpl, licensing, rms