Sure, but the OP was an anecdote about an individual that requested Amazon to cease rendering services to a third party. No government was involved.

> In the meantime, Google and Amazon simply ignore all complaints about spam originating from their networks

How did we get to equating selling tools for murdering journalists to spam in just three comments?

This is complicated when you see how non-ethical companies like Lyft are messing with competition I wouldn't be surprised they would flood provider with spam-reports...

I don't know if it's a contradiction, but my understanding is that the stuff that actually leaked, we have a good handle on where it came from.

To me, a negative response says "We have evaluated our policy and decided that we will not stop this." A non-response says "A frontline agent didn't know how to make a call on a non-downtime ticket from a non-customer so now it's in a bureaucratic black hole and nobody has actually read your email and probably never will." Which is still crappy, but not really malicious in the same way.

I was curious, not being cynical toward sloshnmosh. Much can be inferred from Amazon's choice of reply.

i.e. "differed success"

> arguing that NSO Group have had a bigger impact on innocent people, suppression of speech, etc. than the NSA?

I'm not the OP, but maybe a way to put it is that impacts are more variable or chaotic?

Generally speaking, the "impact" of a US government entity is reasonably predictable based on US policy and interests. Something like NSO, where tools are sold on the market to many entities are probably less predictable and thus more impactful. I'd expect a lower level of operational discipline from <random mideast state> than from the US military.

The other factor is who are NSO Group's masters, and what do they know? If <random mideast state 1> compromises <random mideast state 2>, does <third party> get intel?

The people decide what is legitimate opposition by elections.

NSO was used to tap the democratically elected leader of opposition in India. Doesn't get any clearer than that. [1]

I don't know how to compare between hot pan and the fire on who is worse

[1] with Watergate and more recent (unproven) accusations on wiretapping of politicians, the US is no stranger do this type of monitoring either

If there is no escalation path, that's a big problem, and nobody here is pretending otherwise.

It's always the other way around. A company can never do anything right. HN will always find an ulterior motive.

Thanks for this. I needed a chuckle.

no, its customers are foreign governments. its world governments against world people, not nation vs nation.

> Something isn't adding up

It's bullshit at best.

If we assume they aren't lying, which is generous given their track record, it could be that they provide the tools and infrastructure to collect the data, but don't instruct the software to collect the data. Sort of like if I had a loaded gun and told you I would point and shoot it where you told me to, and then argued that I didn't technically make the decision. It's technically true and complete bullshit.

They could be lying, or they could just be trying to use weasel words. "Data" could be referring to collected data, and they consider phone numbers "metadata". I haven't been following the story though, so I don't know which is more likely.

> Take security a lot more serious than they currently do.

That statement doesn't mean much. How do you know they're not taking it seriously enough and still struggling with the enormity of the problem regardless? You could always claim any entity isn't taking security serious enough.

The alternative explanation makes a lot more sense: security is extremely difficult at Apple's scale, serving a billion consumers with complex and essentially always-connected electronic devices (not to mention their huge services business now). Devices that also happen to be one of the single most important attack points that there is.

Apple takes security more seriously than almost any other vendor in the entire world. It's in a small club of vendors that operates at the literal frontier of what computer science knows about building security into commercial products. No reasonable argument about what Apple can do start from the premise that they don't take the problem seriously.

They aren't above criticism. They do some things well that Google doesn't do as well, and vice versa; it would be good if everyone could level up to highest standards set by any in the club. It's totally fine to point these things out.

As for the bounty payout thing, I highly recommend you track down a talk from someone that has run a vulnerability/exploit market; there are a couple. The economics of selling vulnerabilities to the grey market are nowhere nearly as simple as they appear in ordinary message board threads. In particular: Apple offers a fixed, lump sum payment, where every market I'm aware of offers tranched payments that end when a vulnerability is burned.

How do you feel about "scuba" or "laser?" Acronyms that are pronounced like they're spelled (eg, Nasa, gif, taser) tend to end up being spelled like words sooner or later instead of being in all caps.

It's a British/American English difference.

>I don't understand the line where lots of people

You're going to have to be more specific than a handwave-y "lots of people" to have good online discussions. You also need to be specific in your terminology. You need to actually address the specific people and their arguments, or else do a much better job of phrasing an inquiry into theoretical tradeoffs. Ie., from your other reply:

>What I don't understand is why AWS is justified to shut them down; but Google or Facebook is not justified in preventing their platforms from being propaganda distribution channels?

So I do in fact think Google and Facebook at 100% "justified" to shut them down, and I think Amazon is too. I do have lines where I think morally, if not legally, a service can start to drift into quasi-governmental (or perhaps should be that way) territory. An example for me would be core physical infrastructure companies, not just at Tier 3 but also at Tiers 2 and 1. I think those should operate as common carriers. But I don't think social media fits. Not using it at all (as I don't) may have "costs" in terms of social opportunities but alternatives are trivial.

So for me there isn't any dissonance here, I generally support "Big Tech" (and everyone down the ladder) associating as they see fit when it comes to ongoing online service relationships within existing jurisprudence. The initial legal tweaks I'd like would be aimed at things like expanding user power in a purely additive way (like giving people the option to access root hardware/software key stores), or internalizing costs some companies are shifting onto the public, rather then beating down what some people don't like.

Hacker News (and every other forum) aren't hive mind and it's silly and tiresome to have them treated that way. What you did in your first post here was essentially throw up a big silly strawman.

Of course, some people might choose to reply "Oh I see you worked on DigitalOcean! Funny people care about something like that, but given another human does, I'll respect that!" Some might chose to reply "I can do whatever I want, I don't really care what you think" - people can choose how they react. It's always very interesting to me who choses what, it's very telling regarding personality. I am well aware people are welcome to do as they please, nevertheless, the name of the company is "DigitalOcean" not "Digital Ocean".

Why would you post an article from Jan 2020 as a rebuttal to an article from May 2021?

Is that more of a notification form or an actual collaborator process with a tribunal?

Never assume malice where ignorance and incompetence would suffice instead. Those two things are actually not the same thing at all, depending on how you define “willful.”

They can be very different things.

Poor communication channels happen even when folks don't want it to. Humans are bad at doing such things.

>Corporations aren't humans; they don't have free speech rights.

As a matter of law in the United States you are objectively wrong. This has been settled in a series of SCOTUS decisions starting with Buckley v. Valeo (1976). Corporations are legal persons, and further the individual humans that make them up do not somehow lose the free speech rights just because they decide to take collective action.

And in turn: as a matter of morality, common sense and the point of free speech you're also wrong. It's important that people be able to speak to power, and a core part of that for humanity is socializing, being able to form groups to support each other and pool ideas, skills and resources to have a greater effect than what any individual alone could accomplish. Seriously, you say "corporations don't have free speech rights"? Exactly what form of combined effort do you imagine most, say, NEWSPAPERS are organized under? So what, you think individuals should be able to investigate something all by themselves, but the government should be free to put the boot down on newspapers because they're corporations? You think that jives with free speech?

Oh maybe you only meant "the bad ones". That makes it very easy, but no reason to limit it to corps in this case, just stop "the bad humans" too and everything is great. Nothing could possibly go wrong with that plan, since everyone agrees who "the bad ones" are.....

they absolutely do have free speech rights in the United States. Also, if NSO was hosting malware on AWS resources, it's almost certainly against their terms of service..

In this discussion context. NSO is a company which does not have a freedom of speech right. It has a business relationship with Amazon.

There are many options between incompetence and being actually 'in bed with', which I read to mean 'knowingly cooperating with', the criminals.

The first example is that it's simply more profitable for them to turn a blind eye unless one of the relationships becomes a public problem. They wouldn't be actively aiding and abetting the crime, but neither are they stepping up to ensure that it isn't happening on their systems. It's being complicit several steps beyond incompetence, but not the same level as active cooperation.

And, considering that Amazon has no shortage whatsoever of funds and skilled people to prioritize anything they want to prioritize, I'd say more than sufficient time has passed that they're at least at something resembling this sort of willfully ignorant stage.

Not to worry, they'll replace their overworked human staff with sentiment analysis bots which will do an equally uneven job of sorting the wheat from the chaff, with even less hope of appeal.

Obviously I am not in favour of that either.

Making takedowns automatic on any user report means the dictators take down the apps of the dissidents.

In the absence of AI that would necessarily have to be good enough to also radically change society and the economy, the only solution I can even think of is a big increase in funding for the policing of apps. Who exactly would fund that? Governments would want to use such powers to pursue their own agendas, while Big Tech taking a proportion of App Store income is already being called “[Apple|Google] tax”.

I guess your founder and CEO being victim of something similar helps in these decisions. Or not.

I wish we could just go back to the pre amazon days where we didn't have problems in the middle east

Given two sides of a spectrum, one will take that one that aids their argument most. We need a healthy middle, like most cases.

> Isn't the line due process of law, though?

For state actions, yes. For private actors, if I suspect someone is using my services to break the law or engage in terrorism, "but your honor, I didn't have a court order confirming they were terrorists" won't cut my liability.

Parler was a free speech question because it was almost purely speech. NSO Group isn't just speaking. It's doing, and it's doing things that will bring liability for people around it.

AWS ain't a law agency. They just decided to boot this organization out of their infra. Fair enough. AWS simply decided they don't want to benefit financially from this organization's operations.

>"The press" isn't some special legal entity, there's no licensing for it or anything

This is one of those things that's plausible and common enough to read on the internet that it makes me worry about alternate universes intersecting.

If you type "credentialed members of the media" into Google, do you see any results, or is it just me?

Another key phrase I find is "reporter's privilege" relating to state laws to shield the press, which, as you might imagine, requires defining what a reporter is.

"Some privilege schemes are narrow and apply only to full-time employees of professional news outlets, while others are broad and extend to bloggers, filmmakers, freelancers, book authors, and student journalists. In other words, some are inclusive and others are exclusive."

https://www.cjr.org/united_states_project/journalists_privil...

I’m confused. Do you support corporations having this kind of unchecked power or do you support the neo-colonial strategies that have left places like the Middle East in turmoil for the past century?

People keep asking that. Seems like every few weeks for however long it's been, I see a comment like yours.

I haven't seen anyone mention what news source meets the standard of never having published an article with insufficient evidence according to one or more people on the internet.

I mean, obviously not the NY Times, for instance, right?

When you changed it. To use your own words, if you "suspect someone is using my services to break the law or engage in terrorism" and you then delete all evidence then you are absolutely tampering with evidence. If AWS was used to DDoS all hospitals in the US and people died, would you see a move by Amazon to delete all trace as just fine and dandy "because the US isn't a police state"? I doubt that. It doesn't matter if it is a small or big crime; knowingly deleting evidence is a crime too.

Cloudflare has taken voluntary action on sites 2 (or 3?) times now. They can no longer claim complete neutrality. I don't know about Cloudfront.

clouflare stopped being like that long ago. they publicly posted that they will take down stuff they makes the ceo worry, and they will inspect what your users are reading/sharing - and notify agencies with powers and guns when they find stuff from now/then on.

- no longer a dumb pipe, no longer neutral, actually active in directing law enforcement to take you down and possibly take people out.

>Sure, and it "seems like" the extremist propaganda that Big Tech shut down was violating all sorts of other laws like incitement.

Most of it actually wasn't FWIW, hateful extremist content is generally perfectly legal free speech. "Incitement" gets used way, way too often on the internet, almost nothing that gets posted online is legal incitement. But neither "Big Tech" (such a dumb term) nor Hacker News nor a random forum on birds needs any violation of law or anything else to moderate what gets posted on their sites. It doesn't have to be "negative" or whatever at all even. There is nothing illegal or objectionable about someone who likes discussing trains for example. But if you post lots just about trains on a birder forum they may delete all your posts and ask you to stop because they want to focus on birds, and if you continue to do so they can delete everything and ban you. Why would there be anything wrong with that?

Private society looking at extremist content and saying "we're not going to shoot you over it but we do strongly object and we're going to socially ostracize you and deny you business and our support in any way we can" is free speech working as intended.

>Is "seems like" enough of a reason now for private companies to choose not to contract with other private companies?

Uh, yeah? People can refuse to do business with each other for nearly any reason at all, and definitely for anything other people merely say or do (at least, within the bounds defined by any existing contracts, but Amazon has covered its bases pretty well there to put it mildly).

Exactly. Language is for all its users. I can insist that my name be rendered only in 14.5 pt Comic Sans colored with Pantone 19-3336 ("Sparkling Grape"). But people get to decide for themselves how they're going to speak and write. Corporate branding guidelines constrain only their employees and people who want to curry favor with them. Everybody else can do as they please.

The media in Sweden use both by the looks of it. They do that for IKEA as well but it doesn't really make sense imo since it's an abbreviation of names. Both are made up language constraints anyway so I don't really see why the typographic rules of a language are more important than the equally artificial typographic rules of a company name.

> There is another point if view, and that is that corporate marketing should not take precedence over correct use of language.

There is no such thing as correct use of language. That being said, you should spell proper names as they are registered. It's iPhone, not Iphone.

> It can definitely be argued fairly that the writer does not have to break language conventions just because a company says they have to.

Language convention is to spell the name as the company as it is registered. You wouldn't change someone's last name because it didn't follow some other, slightly related convention...

https://english.stackexchange.com/questions/38827/how-to-wri...

In English,

Also, Marty McFly is not Marty Mc Fly or McFly. Internal capital letters are OK.

Another point of view: DigitalOcean.com works but Digital Ocean.com does not.

reason for "no longer a dumb pipe," - is that I believe that was the 'defense' aka reason being used for a while to push back against different groups that were accusing and then trying to public shame cloudflare; for protecting alt-right(?) I know there were a few PR pieces pushed in the UK or Euro press about some things - maybe hookers or something.. anyway for a while cloudflare was all like, we are just a really big pipe that pushes data and can absorb ddos.. we don't get into content moderation or opposite-net-neautrality.. there were complaints that some groups 'on the right side of history (or whatever)' - were trying to take down the stormer site I think it was and that their co-ordinated takedown attempts were failing as cloudflare was protecting the send/receive, being a pipe, not a judge.. This is what I believe ATT was using as a defense some time ago; they don't stop drug dealers from making calls they just provide the 'pipe' There was also some groups complaining about cloudflare making it hard to find servers - to find jurisdiction, again uk /euro I think - I have those articles saved on one of my systems.. and may be linked to a HN comment long ago - where I said chipping away at this pipe thine will lead to a bifurcated internet - where we will have internet place X internet place Y - and companies like cloudflare may have to turn into a dozen different companies to keep up with the changing 'this speech is not okay' rules for various places..

funny how fast things can change.

I believe many of cloudflare's early customers especially felt protected and safe because of the stances - and I bet most don't know about the 180..

I also think most average web people would think if you set 'whatever' for your DNS - that the dns routing is basically a dumb pipe - it's not spying on you and sending copies of your data to gun agencies.

Just as I think most people would not expect their cell phone company or internet provider to spy on data and send snippets of your communications to agents. I would not expect my web server co to deep packet inspect all comms looking for bad things. (not without a warrant and being directed to look at a specific line, now a whole data center / cell co, etc.)

I think it was a terrible choice to make for cloudflare, but I know not an easy one either way.

So 'pipe' is a term that has been used in this way for a while now in similar fashion I thought - and it's not meant literally like a copper water line.

Also in some ways cloudflare has been a pipe - a pipe for flowing data that would be choked by ddos attack if were to try to send/receive across the net in most other ways kinda of.

> "innate to their personhood"

Religion is not innate, nationality is not innate (cf. the discriminatory "Help Wanted. No Irish Need Apply" signs of the 19th century), and while sexual preference may be innate, expression of it can be consciously restrained as demonstrated by all those people who suffered from being "being in the closet". Does not being innate mean these protected classes should not exist? Clearly not, so appealing to innateness does not rescue your argument.

So should we consider the NSA a terrorism-aiding organization?

edit: the tone is lost via internet; my own opinion on this: yes, it is.

1. There are many, many more Western countries other than the US.

2. Even if they develop their own tools and research their exploits, using NSO provides a layer of plausible deniability and hiding behind someone else's fingerprint (think about the command and control servers, for example).

3. Even if they develop their own stuff, most governments have multiple arms which can use these tools (think about FBI, CIA, NSA, various military intelligence branches), and they tend not to share between them. This makes smaller government branches which don't have the resources and expertise of the others (think DEA, ATF...) buy from 3rd parties.

4. Zero days are a scarce resource, if I ran an agency I'd rather use someone else's every day and keep my own just for the special stuff.

In summary, it's exceedingly appealing for bodies like the Dutch police to use NSO tools and NSO's association with the Saudis and other provides a convenient masking to their operations.

> Malware/phishing/etc. is still removed, since it's illegal.

They are known for protecting DDoS-for-hire and Cryptolocker services.

I think we're drifting away from the original point, which is about not letting corporate marketing departments decide how the written language should work. I used Swedish as an example of a language where this is a more firm rule than English, but Swedish is certainly not alone. It just happens to be the language I know best.

But, I do find the topic of Swedish writing standard to be interesting, so I'll be happy to do my best in responding to your questions, even though I'm not formally a linguist (although I was raised among them)

With regards to your question, I'd write Ios, because it's not an acronym and I do believe that I'm not alone in this. About the version number, I find at least one case of the use of Ios 10 at Svenska Dagbladet: https://www.svd.se/apple-har-atgardat-problem-med-ios-10/om/...

However, it seems to be highly inconsistent, and this is probably caused by these organisations saving money on proof readers.

> “terrorism” originally exclusively denoted action by the State against its own subjects

Correct, in the French Revolution, I believe. There are a variety of definitions of terrorism. The common elements seem to be the (a) peacetime use (b) of violence (c) against non-combatants (d) as a political tool. There also seems to be an unspoken requirement that it occurred after the formation of modern states (otherwise almost all of the preceding human history was terrorism and the word gets normalized); the French Revolution is a useful line.

The NSA targets non-combatants (c) in peacetime (a). It does not use violence (b), though it does enable it (⅓b). It does not do so for domestic political aims (to any proven degree); the degree to which it does so abroad depends on where one draws the line between politics and geopolitics. (The CIA, in contrast, engages in all four overseas.)

When an organization that has done terrorism becomes a terrorist organization is another question.

Okay that settles it, the word terrorism has so many conflicting and overlapping contexts that it is useless

How quickly we forget the massive warrantless wiretapping that occurred under the umbrella of the patriot act.

There comes good out of the NSA, at least good for the US like stealing IP and patents for American companies [0]

[0] https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial...

Ummm, stopping terror attacks is pretty good.

What a cringe reply. I'd love to introduce you to a new word: https://www.merriam-webster.com/dictionary/hyperbole

It requires indoctrination to believe the US as an aggregate sovereign brand functions with the interest of US people in mind.

Nothing about US foreign policy suggests that. Very little about the Federal government’s domestic policy does.