Skip to main content
 

The war on encryption is dangerous

[Meredith Whittaker in the Financial Times]

A great op-ed from Meredith Whittaker, President of Signal on the ludicrous demands by the British government for Apple to backdoor its encryption:

"Imagine a government telling a car company to secretly weaken the effectiveness of the brakes on all the cars it sells, recklessly endangering the safety of millions. It would be an unthinkable undermining of public safety. 

Sadly, this is what’s happening in the UK in cyber security, where Apple was forced to strip the vital privacy and security protection of end-to-end encryption from its backups storage service — exposing people and infrastructure to significant vulnerabilities."

Meredith is (as usual) right. She points out that not only is this a wildly dangerous thing to do in general, but it undermines the technology industry that the British government sometimes says it wants to support.

Americans shouldn't be complacent. This may be a battle that's heading our way next - and one that was already fought in the nineties. We can't let these erosions of civil liberties take place here; they should not happen anywhere.

[Link]

· Links · Share this post

 

You’re Not a Criminal, But You’re Going to Jail: My ICE Detention Story as a Canadian Citizen

[Jasmine Mooney]

A nightmare account from a Canadian citizen detained by ICE:

"I was taken to a tiny, freezing cement cell with bright fluorescent lights and a toilet. There were five other women lying on their mats with the aluminum sheets wrapped over them like dead bodies. The guard locked the door behind me.

[...] After some research, the reality became clear — ICE detention isn’t just a bureaucratic nightmare. It’s a business. These facilities are privately owned and run for profit.

Companies like CoreCivic and GEO Group receive government funding based on the number of people they detain. The more prisoners, the more money they make. They don’t lobby for stricter immigration policies in the name of national security — they do it to protect their bottom line."

There is so much to fix here, but perhaps this is the crux: people are making a profit from tightened immigration rules that keep people detained for months or years without due process. That shouldn't be allowed to happen.

[Link]

· Links · Share this post

 

Forcing people back to the office was a choice. I'm making mine.

Remote work

I cleaned out my desk a little over five years ago. It feels like last week.

I was leading engineering at ForUsAll, a fintech company that seeks to make it easier for small businesses to offer retirement plans for their employees. The co-founder, David, had been wearing a mask around the office for a month; he was following the growth of COVID-19 closely. The then-CEO agreed to close the office if the number of cases in San Francisco went beyond some small threshold; when it did, we picked up our laptops and left.

Of course, we all know what happened next: lockdowns, sourdough starters, and remote working on a scale never seen before.

I prefer remote working and always have. My first startup was mostly remote: my co-founder was in Edinburgh for a while, and spent some time in Vancouver, while I was in Oxford with occasional long stretches in California. I worked at my kitchen table, drank my own coffee, and set my own hours. It was flexible depending on what was going on at the time, and undoubtedly productive. When I joined a startup based in Austin but worked from Edinburgh and Berkeley, it felt like a natural progression.

When the pandemic hit, I couldn’t wait to return to that mode of working. I had another reason to feel like working from home was a silver lining: my mother’s health had been up and down following her double lung transplant, and now I could spend more time with her. What had been a regular Sunday visit became a much longer weekly stay. My dad was the primary carer, but I could help out. Many nights, I would help her up the short flight of stairs to her bedroom, help situate her in her bed, with brushing her teeth, and so on. Working from home gave me extra time with her, and I treasured that.

More recently, it allowed me to buy a house. There was no way I could buy in the San Francisco Bay Area. For literally half the price of a two-bedroom house in a troubled part of Oakland, I could get a house that would fit my family in Pennsylvania. We walk our child to and from daycare every day, have a garden and a driveway, and, although there’s no doubt that the house needs work, generally feel safe and secure.

I’m far from alone. Working from home has been a boon for carers, parents, and anyone who felt like they weren’t able to get on the property ladder in major business hubs like San Francisco and New York. It’s spread wealth from industries like tech to neighborhoods across the country, and in turn allowed tech companies to hire from anywhere, giving them access to talent that would previously have been out of reach. According to official figures from the US Bureau of Labor Statistics, productivity rose.

For remote work to be successful, communication, internal processes, and norms need to be explicit. Companies that had never spent much time thinking about culture now found that they were forced to, which was a positive outcome for their employees, many of whom had been suffering in silence. A renewed focus on employee power — in conjunction with the rise of social movements like Black Lives Matter — also led to a rise in unionization efforts, which also aimed to improve worker quality of life. Despite the overhead of the pandemic itself, these changes felt like they were part of a cohesive, positive movement.

So I read stories like this one in the San Francisco Standard with something like a sense of dread:

“Two years ago, I could not get anybody to go into the office a couple days a week,” said Jaimie Feliz, principal at San Francisco recruiting firm The Hire Standard. “Now, across the board, it’s pretty standard for companies to ask for a minimum of three days in office — it’s very rare to see any less than that.”

Many tech companies are suspending hiring and promotions for workers outside of their hub cities, and there’s an assumption that, over time, employees who remain outside of those hubs will be laid off.

Given the negative impacts on carers, parents, people who have bought homes outside of those hub cities, and on the productivity of those companies, this feels like a regression.

This is doubly true when you look at the underlying statistics. One of the big reasons for calls back to the office is to perform backdoor layoffs: management understands that a substantial percentage will quit. Research also suggests that it’s about control:

RTO mandates may reflect a desire among certain leaders to reassert control and authority within the organization […] This perspective highlights the role of organizational power dynamics and the potential for RTO policies to serve as instruments for reinforcing traditional hierarchical structures, at odds with the trend towards greater autonomy and flexibility facilitated by remote work.

The perceived gains aren’t evidence-based or in the best interests of company productivity; they’re more about CEO peace of mind. For companies that never stuck the landing on building intentional cultures, returning to the pre-pandemic status quo may feel reassuring.

Frustratingly, I now feel like these changes are inevitable.

Not everywhere, of course. There are some companies that have always been remote, and others have managed to establish strong hybrid cultures. But the majority will choose to simply snap back to the world as it was in 2019.

This is to their detriment: adding perspectives from across the country, and from people who would have been shut out of a traditional office job, was clearly valuable. A workforce made up only of people who can afford San Francisco’s $3,400 average rent is inherently less diverse — and less representative of the company’s customers — than one that is geographically diverse. Regardless, it is happening.

For companies that choose to stay remote, there are benefits to be made. There will be an ever-increasing workforce of potential employees who don’t want to move back to those hubs, with experience at tech companies like Google and Meta, who will be looking for new positions. That’s a competitive advantage.

On the other hand, for people who want to stay with their current employers, there are hard choices ahead. Do you move away from your comfortable house, or find ways to offload some of your caring or parental duties, in order to stay on the payroll? Depending on your salary, stock options, or tenure, there might be reasons for doing so.

But it’s not a choice I would make. I have a toddler these days, and I want to be more present, not less. I get a lot of value from in-person collaboration, but I prefer a hybrid model: I’ll gladly travel into the office for a few intense days to advance some specific goals and then go home. I’ve got little interest in doing so to make management feel at ease, but there really are some kinds of time-limited collaboration that are better in person.

I also know that some people can’t travel — for health reasons, because their caring commitments are too great, or these days, because they’re worried about their documents being stripped or suffering violence because of their identity. So even though I’m willing to travel, I don’t expect everyone else to. Even in specific, time-limited collaborations, hybrid accommodations must be made.

For these reasons, I’ve made the decision that I won’t work for a company that requires everyone to come back to the office. Should I start another company, I will not mandate that people work from the office, although I might provide one as an optional collaboration space. This is to protect my quality of life, and to ensure that I can hire the best people for each role, regardless of where they might live or what the rest of their life might look like.

It’s not a decision I take lightly. It’s limiting: it means, should I leave my current job, that there will be fewer places I can go and work. It might limit my salary and future prospects, or even the investment I can raise for a future venture. But I care about being home and present, and I care about building representative workforces.

The bottom line is this: forcing people back into offices isn’t a neutral decision. It’s a choice to exclude and disadvantage anyone who doesn’t fit a narrow definition of what a “worker” looks like. I’m not willing to join in that discrimination.

· Posts · Share this post

 

Wired is dropping paywalls for FOIA-based reporting. Others should follow

[Freedom of the Press Foundation]

Wired is going to stop paywalling articles that are primarily based on public records obtained through the Freedom of Information Act.

This approach makes a ton of sense:

"They’re called public records for a reason, after all. And access to public documents is more important than ever at this moment, with government websites and records disappearing, Elon Musk’s Department of Government Efficiency doing its best to operate outside the public’s view, and the National Archives in disarray."

Paywalls have long presented a challenge for service-based journalism: stories make the most impact when they're available to everybody, but newsrooms also need to cover their bills and make enough money to continue operations. When stories are based on public data, like FOIA requests, another level of public responsibility is added to the equation: these are public documents that belong to all of us.

I wish more online newsrooms would move to a patronage model (see The Guardian), but this isn't always possible. Someone always brings up micropayments in these conversations, but they do not work and have never worked. This hybrid model - public service articles for free, the rest behind the paywall - may point to a way forward.

[Link]

· Links · Share this post

 

Everything you say to your Echo will be sent to Amazon starting on March 28

[Scharon Harding at Ars Technica]

Don't keep an Amazon Echo (or any smart speaker) in a room where you'll be having sensitive conversations, either with your family or on a work call. Particularly if you're a journalist or activist - but privacy is something everybody should be guarded about.

"Amazon said that Echo users will no longer be able to set their devices to process Alexa requests locally and, therefore, avoid sending voice recordings to Amazon’s cloud."

As the author points out, even if you trust Amazon (and, to be clear, you shouldn't trust any vendor with your private conversations), there's reason to worry:

"In 2023, Amazon agreed to pay $25 million in civil penalties over the revelation that it stored recordings of children’s interactions with Alexa forever. Adults also didn’t feel properly informed of Amazon’s inclination to keep Alexa recordings unless prompted not to until 2019—five years after the first Echo came out."

It was a nice idea, but it's time to give them a rest. There are plenty of use cases for smart agents, but they don't need to be listening to you all the time like you live in some kind of science fiction movie. You don't know who else is listening with them.

[Link]

· Links · Share this post

 

The social web beta is here

[Ghost]

Ghost has released its ActivityPub social web integration in beta:

"Today we're opening a public beta for our social web integration in Ghost. For the first time, any site on Ghost Pro can now try out ActivityPub."

Those of you who are, should. And everyone in the space should take a look. This is a really big deal. Congratulations to everyone involved on the Ghost team - and everyone in the Fediverse, who will see the benefit.

[Link]

· Links · Share this post

 

EU tech companies push for digital sovereignty, reducing reliance on US and others

[Benedict Collins at TechRadar]

This was always inevitable, but in the current environment it makes sense that it's accelerating:

"Several major European tech companies are pushing for greater action from the European Union to reduce the bloc’s reliance on foreign-owned infrastructure by buying and building locally.

[...] Essentially, the European Union has become overly reliant on foreign-owned infrastructure - especially US Big Tech - and if nothing is done soon, EU countries will become subservient to foreign tech companies. The solution therefore is to foster growth at home."

The implication is that there's already a market here. Hosting in the US puts you at risk of certain kinds of subpoenas and other actions by the state, and the current political environment makes that even less desirable. (I've certainly personally had plenty of advice from security experts this year to not host in the US.) But if the only really great cloud hosting providers are US-based, that's a problem (even if they offer non-US hosting zones).

To be competitive here, the EU needs to consider privacy and freedom from surveillance as paramount values. That's not always been the case for it: there have always been voices who have pushed for things like backdoors in encryption and greater monitoring from police and security services. Those things will kill any EU effort to provide alternatives. The EU's great strengths in comparison to the US are greater openness and stronger protections of human rights; it should lean into those.

[Link]

· Links · Share this post

 

My (New) Daily Blog

[Om Malik]

This is an ongoing trend. Om Malik has now moved to sharing on his blog first rather than posting directly to social media:

"The inspiration for the newly rebooted “daily blog” comes from Dave Winer, who maintains a “Links” blog. I’ve been using his new project, Wordland, for publishing to the “links” blog, in addition to using MarsEdit. I have also taken a cue from Marc Weidenbaum. The plan is to use this as a permanent archive for everything I share on social media. From here, I’ll route information to relevant channels — mobile apps, social networks and RSS feeds. The experiment continues."

This is, of course, very much in line with indie web sensibilities. The more social media fragments and turns into a toxic place to be, the more people will carve out spaces that they truly own on the web. As well they should. I'm excited to see this; if you haven't made the leap to posting on your own site first yet, the best time to start is now.

[Link]

· Links · Share this post

 

How to hide a painting

[Mike Monteiro]

On whether it's always been this bad in America:

"America was born in blood, genocide, kidnapping, and death. Behind every story we were told about America’s greatness, there is a secret second painting. A thing America doesn’t want you to see. Behind every “from sea to shining sea” there is a Trail of Tears. Behind every first pitch at Dodger Stadium there’s the destruction of Chavez Ravine. Behind every moonshot there’s a Nazi V2 rocket. Behind every “liberation of the camps” there’s a Nakba. Behind every interstate highway system there’s the destruction of a thousand Black and immigrant neighborhoods."

Although it's front and center, much of what we're experiencing isn't actually new for lots of communities across America. Treating the current moment as completely new doesn't serve us: it erases those struggles and historic injustices. That's not to say that everything is good right now - it's obviously not - but the road that led us here is clearly marked throughout American history.

[Link]

· Links · Share this post

 

New German, Swiss, And Austrian Guidelines Recommend Trans Youth Care, Slam Cass Review

[Erin In The Morning]

While America is destroying the ability for trans people to participate in public life, over in Europe they're (rightly) improving care for trans people.

"In recent years, U.S. politicians have selectively framed European healthcare policies to justify restrictions on transgender care, seizing on a handful of conservative policies to claim that “Europe is pulling back.” The most extreme example, the United Kingdom’s Cass Review, has been wielded to justify a near-total ban on puberty blockers and even cited in U.S. Supreme Court arguments. But new medical guidelines from Germany, Austria, and Switzerland tell a different story. These countries have reaffirmed the importance of gender-affirming care for transgender youth and issued sharp critiques of the Cass Review, calling out its severe methodological flaws and misrepresentations."

They contain this specific recommendation:

“If, in individual cases, the progressive pubertal maturation development creates a time pressure in which health damage would be expected due to longer waiting times to avert irreversible bodily changes (e.g. male voice change), access to child and adolescent psychiatric or psychotherapeutic clarification and medical treatment options should be granted as quickly as possible.”

Once again, a rejection of the Cass Review is good news here: the widely debunked study was essentially propaganda for anti-trans interests and didn't represent broader healthcare perspectives.

But the bigger good news is that Europe is a safer place for trans people to live and be supported. I hope, one day soon, America comes to its senses and puts itself on a more supportive path.

[Link]

· Links · Share this post

 

Leader of student protests at Columbia facing deportation

[Jake Offenhartz, Cedar Attanasio and Philip Marcelo at The Associated Press]

This seems completely in line with the First Amendment's protections against restrictions on speech and assembly by the US government:

"President Donald Trump warned Monday that the arrest and possible deportation of a Palestinian activist who helped lead protests at Columbia University will be the first “of many to come” as his administration cracks down on campus demonstrations against Israel and the war in Gaza."

Protesting Israel's right-wing government is not in itself anti-semitic. And Mahmoud Khalil's status as a resident student rather than an American citizen does not make him any less subject to constitutional protections.

"Khalil, who was born in Syria to Palestinian parents and has an American citizen wife who is eight months pregnant, emerged as one of the most visible activists in the protests at Columbia.

[...] “The Department of Homeland Security’s lawless decision to arrest him solely because of his peaceful anti-genocide activism represents a blatant attack on the First Amendment’s guarantee of free speech, immigration laws, and the very humanity of Palestinians,” said the Council on American-Islamic Relations, a national Muslim civil rights advocacy group."

This seems like the very opposite of what America is supposed to be (or at least purports itself to be). Hopefully applied pressure will work - for this particular person, and as a precedent for American civil rights into the future.

[Link]

· Links · Share this post

 

How Terrorgram Collective Influencers Groomed a Killer

[A.C. Thompson, ProPublica and FRONTLINE, James Bandler, ProPublica, and Lukáš Diko, Investigative Center of Jan Kuciak]

A tragic story of a teenager recruited by a network of extremists, who ultimately murdered multiple people before taking his own life. It's also an example of why moderation and safety processes on social platforms are so important.

"And so in August 2019, Juraj Krajčík, then a soft-faced 16-year-old with a dense pile of brown hair, immersed himself in a loose collection of extremist chat groups and channels on the massive social media and messaging platform Telegram. This online community, which was dubbed Terrorgram, had a singular focus: inciting acts of white supremacist terrorism."

This is particularly relevant in a world where companies like X and Meta are cutting back on their safety teams and policies. It's not as easy as waving your hands and saying that it should be a matter for the courts; real lives are at stake. And at the same time, there is, of course, a real danger of falling into the trap of building a surveillance network.

The police at the time thought this was the work of a lone gunman rather than the international community of extremists it actually was. Uncovering this is also the kind of story that only investigative newsrooms can do really well:

"ProPublica and the PBS series FRONTLINE, along with the Slovakian newsroom Investigative Center of Jan Kuciak, pieced together the story behind Krajčík’s evolution from a troubled teenager to mass shooter. We identified his user name on Telegram, which allowed us to sift through tens of thousands of now-deleted Telegram posts that had not previously been linked to him."

Hopefully this work can help prevent this and similar networks from operating in the future. Likely a more holistic approach is needed, and if law enforcement, educators, and social workers are more aware of the potential risks and playbooks, hopefully they can be more sophisticated about prevention.

[Link]

· Links · Share this post

 

The 2025 journalist’s digital security checklist

[Davis Erin Anderson and Dr. Martin Shelton at the Freedom of the Press Foundation]

These security tips are designed for journalists but are good ideas for everyone (and particularly activists or anyone working in a sensitive field):

"In tumultuous times, we believe in being prepared, not scared. Sound digital security practice often involves forming and relying on good habits. Building these reflexes now will help keep you better protected. This is why we’ve distilled advice our trainers have shared with thousands of journalists over the years into the actionable, concrete steps below."

The Freedom of the Press Foundation does great work, and this guide is no exception.

[Link]

· Links · Share this post

 

Feedback loops

[Joe Woods]

This is good, actionable advice:

"As an engineering leader, you should be constantly working to reduce the amount of time it takes to complete one cycle of a feedback loop.

What do I mean by feedback loop? This is anything where you do work, and then you need to await a result in order to be able to do more work."

Some of these will be easier than others to obtain: for example, any engineering team can tune up their test suite without the permission of an outside party. What they might have more trouble with is getting an outside stakeholder to commit to just-in-time availability; I imagine that a weekly touch-base meeting might be the norm in many non-engineering-centric organizations. But they're all important, and all very concrete ways to both improve performance on an engineering team and improve the experience of working on one.

[Link]

· Links · Share this post

 

Fediverse House

1 min read

If you're in Austin, visiting Fediverse House at 412 Congress Ave today and tomorrow is what you need to be doing.

You don’t need a SXSW ticket - just show up and meet some of the key people building and thinking about the most important thing happening on the web right now.

Unfortunately, I’m preparing for a team summit in New York this week, so I’m unable to attend. The good news for me (and you, if you’re also not able to make it there) is that I hear the conversations are going to make it to the Dot Social podcast. I can’t wait to hear them.

· Asides · Share this post

 

World's first 'body in a box' biological computer uses human brain cells with silicon-based computing

[Kunal Khullar at Tom's Hardware]

Straight into my nightmares:

"Australian biotech company Cortical Labs has introduced what it claims to be "the world’s first code deployable biological computer," which combines human brain cells with traditional silicon-based computing. The system, known as CL1, was presented at the Mobile World Congress in Barcelona and is being explored for its potential applications in artificial intelligence (AI) and machine learning."

Oddly, while it theoretically is suited for certain kinds of novel computing tasks, it just screams and screams.

[Link]

· Links · Share this post

 

Why Techdirt Is Now A Democracy Blog (Whether We Like It Or Not)

[Mike Masnick at Techdirt]

Mike Masnick on why tech journalism has a huge part to play in decoding current events right now:

"We’ve spent decades documenting how technology and entrepreneurship can either strengthen or undermine democratic institutions. We understand the dangers of concentrated power in the digital age. And we’ve watched in real-time as tech leaders who once championed innovation and openness now actively work to consolidate control and dismantle the very systems that enabled their success.

[...] What we’re witnessing isn’t just another political cycle or policy debate — it’s an organized effort to destroy the very systems that have made American innovation possible. Whether this is by design, or by incompetence, doesn’t much matter (though it’s likely a combination of both). Unlike typical policy fights where we can disagree on the details while working within the system, this attack aims to demolish the system itself."

I, for one, am grateful for the coverage in places like TechDirt and Wired (which has been killing it lately). I have to say I'm also proud of my journalist colleagues at ProPublica for going deep. I wish most of the rest of the press would take their lead.

[Link]

· Links · Share this post

 

Trump’s USCIS wants to review all prospective citizens’ social media accounts

[Gaby Del Valle at The Verge]

This is dystopian:

"The Trump administration may soon demand the social media accounts of people applying for green cards, US citizenship, and asylum or refugee status. US Citizenship and Immigration Services (USCIS) — the federal agency that oversees legal migration, proposed the new policy in the Federal Register this week — calling this information “necessary for a rigorous vetting and screening” of all people applying for “immigration-related benefits.”"

I'm truly interested to learn how this squares with the First Amendment of the United States Constitution, which constrains government's ability to restrict speech of anyone on US soil, including immigrants and visitors.

I agree with Beatriz Lopez, the executive director of Catalyze/Citizens, who said:

“Trump is turning online spaces into surveillance traps, where immigrants are forced to watch their every move and censor their speech or risk their futures in this country. Today it’s immigrants, tomorrow it’s U.S. citizens who dissent with Trump and his administration.”

[Link]

· Links · Share this post

 

About my Tesla

3 min read

So, yes, hi, I have a Tesla. It’s a long range Model 3 which I bought in 2021.

After a career spent working on open source and mission-drive projects — right now I work for a non-profit newsroom; once upon a time I built a social networking platform for education — it might shock you to learn that I am not rich. I have never had a significant tech company equity package; I have never seen the benefit of a significant exit. I own my own home but needed to move far away from the Bay Area to do it. I’ve done okay and I’m grateful for the opportunities that I’ve had, but I am not very wealthy. It would be really meaningful for me to bolster my income by another $2K a month and I’ve been thinking a lot about how to do that lately.

The Tesla has put me in a bit of a weird situation. Even before Elon Musk threw three Hitler salutes on-stage, I couldn’t really afford to own it: the monthly cost is really high for a car that I maybe drive two to three times a week. But selling it is also hard: it’s depreciated really fast, and I’ll barely be able to pay off the loan I have on it. (A lease would have been a better deal.) It actually won’t be that easy for me to get a replacement car, even with a trade-in deal. I’d prefer to keep an electric car — they’re both better environmentally and just as a car to run and own — but we’ll see if that’s possible.

But I will sell it. Hopefully this month. I don’t want to even tacitly be associated with promoting that man or bolstering his wealth. Until then, I’ve become one of those people who has disclaimered his car, so anyone who sees it is under no impression that I am in favor of anything that’s happening in this country right now.

One sticker I don’t have: the one that says I bought this before Elon went crazy. There’s no such thing. The warning signs were always there; my car situation is a prime example of how ignoring these kinds of ethical red flags lead to real losses in the long run. I brought this on myself.

I know I’m not alone. Not everyone who owns one of these things is a wealthy Musk supporter. That doesn’t mean we should be absolved — we should have seen what we were getting into, and owning a Tesla does mean continuing to pay Musk, who is clearly a fascist, money through connectivity plans and so on — but it’s worth acknowledging that, for many people, it’s not a no-brainer to take this kind of financial hit.

Anyway, that’s the deal. I guess I’m posting this out of a sense of transparency, and a little bit out of a sense of exasperation at my own past purchasing decisions and the overwhelmingly bad present situation. Many of you will be judging me for this, and I both accept and deserve that. But here I am.

· Asides · Share this post

 

How DOGE’s IRS Cuts Could Cost More Than DOGE Will Ever Save

[Andy Kroll at ProPublica]

Cutting the IRS has nothing to do with government efficiency:

"Unlike with other federal agencies, cutting the IRS means the government collects less money and finds fewer tax abuses. Economic studies have shown that for every dollar spent by the IRS, the agency returns between $5 and $12, depending on how much income the taxpayer declared. A 2024 report by the nonpartisan Government Accountability Office found that the IRS found savings of $13,000 for every additional hour spent auditing the tax returns of very wealthy taxpayers — a return on investment that “would leave Wall Street hedge fund managers drooling,” in the words of the Institute on Taxation and Economic Policy."

These cuts will particularly curtail audits of wealthy individuals: people who are more likely to be avoiding paying tax to begin with.

As the article points out:

"“When you hamstring the IRS,” Koskinen added. “it’s just a tax cut for tax cheats.”"

So let's not do that?

[Link]

· Links · Share this post

 

Okay, You Try Thinking of a Better Way to Protest President Nyarlathotep’s Terror Telecast

[Andrew Paul at McSweeney's]

"I gotta be honest with you, though. I think the Outer God got the message loud and clear. Our tasteful combination of fashionably coordinated clothes, tiny paper fans with BAD! printed on them, and some of our sternest looks of disapproval to date really drove home the fact that we aren’t jazzed by all this cosmic cruelty. I can’t think of anything we could have done differently to inspire our petrified constituents to rise up and take a stand against Nyarlathotep’s unholy resummoning. Sure, the Dungeon Lich-at-Arms tossed that representative from Texas into a Torment Portal after they booed the President, but there’s no way that will play well to anyone beyond his most devout minions."

It's funny because it's true.

[Link]

· Links · Share this post

 

Decentralizing the cloud: separating software from infrastructure

Ladders to the cloud

Much of the last decade or two of the tech industry has been dominated by the idea of the cloud: the simple, powerful idea that all of your applications and data can be accessed from any device with an internet connection. Enterprise businesses around the world have decommissioned server rooms in favor of subscribing to services maintained by other people, reducing overheads of all kinds. Even companies that once built and operated vast datacenters now rely on cloud providers. At the same time, cloud services have helped individuals save money upfront (even if subscriptions often cost more in the long run) and have taken the need for installation and troubleshooting out of the picture. Overall, cloud services have saved lots of people huge amounts of time and money.

But this convenience comes with trade-offs, some of which have become more apparent over time.

  • You only ever rent: There’s no real ownership, and vendors can modify, discontinue, or increase prices at will.
  • Privacy concerns: Because your data and activity pass through the provider’s infrastructure, they can be easily monitored, tracked, or even resold.
  • Jurisdictional constraints: Your data often resides in the provider’s chosen region, subjecting it to local laws, which may not align with your needs.
  • Downtime and dependence: If your cloud provider goes down, so does your access — sometimes across multiple services.
  • Vendor lock-in: Moving away from a cloud provider can be complex and expensive, discouraging competition and user control.

These trade-offs become even riskier when your work involves sensitive information. When software and infrastructure are controlled by the same entity, it not only enables easy monitoring and resale of your data but also makes it a prime target for subpoenas. Courts can compel a cloud service provider to produce your data, often without your involvement.

If your work involves sensitive personal information, for example of patients or sources, that could put their privacy and safety at risk. That might be particularly problematic in a situation where, for example, you work on reproductive health issues, and your software is hosted in a jurisdiction that has abortion bans. This risk extends across professions: journalists protecting sources, lawyers safeguarding client data, and healthcare providers managing patient records all face heightened exposure when their software, data, and infrastructure are all controlled by the same party.

At the same time, moving away from the convenience of the cloud is not really an option for most organizations. To date, most have opted to pay for more expensive enterprise contracts, which promise greater data protections alongside features like stronger audit logs and SSO. These provide some legal protections, but still amount to little more than an enforced promise: the vendor physically can inspect your data in most cases, you’re just paying them extra so that they’ll promise not to. These contracts also don’t address jurisdictional issues: if the vendor is based in Texas, your use of their platform is still subject to Texan law. The power dynamics at play remain unaddressed.

This is also problematic when you consider the increasing popularity of LLMs. If you’re dealing with sensitive or proprietary information, you probably don’t want an AI model to be trained on your data. You can pay vendors like OpenAI to promise that they won’t look at your data or train their models on it — but, again, you need to take their word for it.

If we want to retain the benefits of cloud software without its fundamental risks, we need a different model: one that restores control to users and organizations rather than vendors.

  • Retain the ease of deployment, access, and collaboration that makes cloud software so appealing.
  • De-couple software and infrastructure so that the company making the software is not the company that hosts the software.
  • Allow customers to pick an infrastructure host in the jurisdiction of their choice.
  • Ensure that data is encrypted at rest and in transit, so that even the hosting provider cannot access it.

Self-hosted cloud software is, of course, absolutely a thing that already exists. Some of it is even end-to-end encrypted. But it’s also largely free and open source, and requires a fair amount of configuration and maintenance from an organization’s IT department. There’s nothing wrong with open source software (I ran two open source startups!), but the complexity of configuration and lack of clear business model can introduce problems for both the customer and the vendor. Vendors like Cloudron are making this easier for open source software — and they should serve as a model for what could come next.

Some cloud infrastructure providers, like AWS, already host marketplaces of software you can install. The trick is, you usually have to decide which kinds of virtual servers to use — are you going to go for an m3.medium or a t2.xlarge? — and then consider how your private cloud will be configured. AWS also offers self-hosting for LLM models through Amazon Bedrock, but the same problems present themselves. There’s a lot of technical overhead which many organizations can’t easily address — and in stark contrast to a cloud offering like Google Workspace, which is completely turn-key.

But this doesn’t have to be the case. What if we could combine the ease of cloud-based software with the control and flexibility of locally managed applications?

Consider an iPhone: here, your software runs on your device, wherever it might be, but is seamlessly downloaded from an App Store on demand. Some of that software is free; some of it is paid-for, either as a one-off or on a subscription basis. The underlying operating system is a variant of the FreeBSD UNIX system with significant proprietary additions, including some sophisticated sandboxing, but you wouldn’t know it, and you certainly don’t need to configure anything: you request an app, and zip!, there it is on your phone.

Consider this user journey:

  • The customer signs up to a certified provider in the jurisdiction of their choice. There are providers tailored for different levels of customer and different industries.
  • They add their payment information.
  • They choose the software they want to provide to their organization from an App Store accessed through the provider. As soon as they install it, it is near-instantly available to them.
  • They can make it available to every user in their organization or a subset of users.
  • For every user for whom it is available, the app shows up on a web-based dashboard. It can also be configured to automatically show up in providers like Okta.
  • They never have to care about the speed or capacity of the underlying hardware: they just pay for a recurring license to the software.
  • They never have to care about configuring or upgrading the software: as soon as they select it, it’s available. Customers can opt for updates to be pushed out automatically, or they can hold back non-security updates for more testing.

The App Store distributes revenue to the vendor and the hosting provider, and takes a cut for itself. Apps are charged for on a predictable, monthly, per-seat basis, with each app able to set its own prices. As is the case with a phone App Store, the store itself does some vetting of each application, certifying it for security and a set of core rules that each app must abide by. Unlike a phone App Store, it also does vetting and certification of the hosting provider itself, reducing the customer’s need to undertake security auditing.

Because every hosting provider associated with an App Store would necessarily need to adhere to the same open standards, the customer could move providers easily. They’d just sign up to another hosting provider associated with the App Store and migrate their apps. The App Store itself would handle the rest, dealing with migrating block storage, databases, and so on behind the scenes.

This model isn’t just about redistributing power from giant cloud vendors to customers. It’s about enabling organizations that deal with sensitive data to more easily use the cloud to begin with. It makes it easier to know that there is an enforced separation between an LLM and its training infrastructure. And it creates new opportunities for vendors that might not be in a position to offer their own cloud infrastructure, too. It lowers the barrier to both privacy and innovation for everyone involved.

Existing cloud providers aren’t incentivized to build this. It’ll take a new entrant or someone willing to make a big bet. The technology to do this already exists. The only question is: who will build it first?

If it’s you, I’d love to hear from you.

· Posts · Share this post

 

Minimum Viable Startup Operations

[Jean Hsu and Jen Dennard]

This is a good inaugural post from two people who really have lived the startup operations life many times over:

"We think of the operations part of a startup like getting dinner on the table. Sure, some days, you might try a new and involved recipe, but most days, you just need to get something good enough on the table FAST, so that you can devote more time to other family and life priorities.

This is where the concept of minimum viable operations comes in. It’s about finding the right balance: creating systems and practices that are just enough to support the team."

I've seen both the "minimum, but not viable" and "overdoing it" versions of this. Stuff like creating a whole new leveling system for a five person team, or spending months getting to the perfect OKRs, are easy traps for people who don't know the pitfalls to fall into.

And at the same time, winging it with no process and no goals is unbelievably common too. Every startup needs to consider process / people / ops - and most of all, culture - if it wants to succees. These things aren't optional.

I'm excited for future posts.

[Link]

· Links · Share this post

 

Please see Soundtrack to a Coup d'Etat

1 min read

It’s Oscars day! I haven’t seen very many of the nominees this year, but of the ones I have, I need to make this recommendation:

Soundtrack to a Coup d’Etat, nominated for best documentary picture, is brilliant. It’s an under-told part of American history, still highly relevant and ongoing today, told through the lens of its surprising intersection with the jazz musicians of the time. One of those films that I think everyone should see in order to educate themselves. It doesn’t make for a cheerful evening, but it’s all wonderfully done.

It’s available to rent on streaming services right now, and is worth it. If you don’t want to pay to rent, it will hopefully be a part of someone’s streaming library later on.

· Asides · Share this post

 

Warp factor 5, Mr. Sulu

[Ghost]

Another really great update from the Ghost team about their progress implementing ActivityPub:

"In our logs, that looks like our average request time dropping from 5+ seconds, to ~50ms:

[...] There are still a few places where we're using the old database architecture that remain slow. We're not out of the woods just yet. Within the next couple of weeks, though, the beta will be open to everyone on Ghost Pro to try out.

[...] Importantly, Ghost's ActivityPub service is already out in the wild, open source, and released under the MIT license. We build in public, and all our work is up on GitHub for anyone to download, fork, run or deploy if they want to."

Exactly the right approach, and so exciting to see. Onwards!

[Link]

· Links · Share this post

Email me: ben@werd.io

Signal me: benwerd.01

Werd I/O © Ben Werdmuller. The text (without images) of this site is licensed under CC BY-NC-SA 4.0.