https://ploum.net/2025-03-28-geeks-naivety.html

Blog Livres Software A Propos

The candid naivety of geeks

by Ploum on 2025-03-28

I mean, come on!

Amazon recently announced that, from now on, everything you say to
Alexa will be sent to their server.

  * Pluralistic: Amazon annihilates Alexa privacy settings, turns on
    continuous, nonconsensual audio uploading (15 Mar 2025)
    (pluralistic.net)

What surprised me the most with this announcement is how it was met
with surprise and harsh reactions. People felt betrayed.

I mean, come on!

Did you really think that Amazon was not listening to you before
that? Did you really buy an Alexa trusting Amazon to "protect your
privacy"?

Recently, I came across a comment on Hacker News where the poster
defended Apple as protecting privacy of its users because "They
market their product as protecting our privacy".

I mean, once again, come on!

Did you really think that "marketing" is telling the truth? Are you a
freshly debarked Thermian? (In case you missed it, this is a Galaxy
Quest reference.)

The whole point of marketing is to lie, lie and lie again.

What is the purpose of that gadget?

The whole point of the whole Amazon Alexa tech stack is to send
information to Amazon. That's the main goal of the thing. The fact
that it is sometimes useful to you is a direct consequence of the
thing sending information to Amazon. Just like Facebook linking you
with friends is a consequence of you giving your information to Meta.
Usefulness is only a byproduct of privacy invasion.

Having a fine-grained setting enabling "do not send all information
to Amazon please" is, at best, wishful thinking. We had the same in
the browser ("do-not-track"). It didn't work.

I've always been convinced that the tech geeks who bought an Amazon
Alexa perfectly knew what they were doing. One of my friends has a
Google Echo and justify it with "Google already knows everything
about our family through our phones, so I'm trading only a bit more
of our privacy for convenience". I don't agree with him but, at the
very least, it's a logical opinion.

We all know that what can be done with a tool will be done
eventually. And you should prepare for it. On a side note, I also
postulate that the reason Amazon removed that setting is because they
were already gathering too much data to justify its existence in case
there's a complaint or an investigation in the future."How did you
manage to get those data while your product says it will not send
data?".

But, once again, any tech person knows that pushing a button in an
interface is not a proof of anything in the underlying software.

Please stop being naive about Apple

That's also the point with Apple: Apple is such a big company that
the right hand has no idea about what the left hand is doing. Some
privacy people are working at Apple and doing good job. But their
work is continuously diluted through the interests of quick and cheap
production, marketing, release, new features, gathering data for
advertising purpose. Apple is not a privacy company and has never
been: it is an opportunistic company which advertise privacy when it
feels it could help sell more iPhones. But deeply inside, they
absolutely don't care and they will absolutely trade the (very
little) privacy they have if it means selling more.

Sometimes, geek naivety is embarrassingly stupid. Like "brand
loyalty". Marketing lies to you. As a rule of thumb, the bigger the
company, the bigger the lie. In tech, there's no way for a big
company to not lie because marketers have no real understanding of
they are selling. Do you really think that people who chose to
advertise "privacy" at Apple have any strong knowledge about
"privacy"? That they could simply give you a definition of "privacy"?

I know that intelligent people go to great intellectual contortions
to justify buying the latest overpriced spying shiny coloured screen
with an apple logo. It looks like most humans actively look to see
their freedom restricted. Seirdy calls it "the domestication of
users".

  * WhatsApp and the domestication of users (seirdy.one)

And that's why I see Apple as a cult: most tech people cannot be
reasoned about it.

  * The Cost of Being Convinced (ploum.net)

You can't find a technical solution to a lie

Bill Cole, contributor to Spamassassin, recently posted on Mastodon
that the whole DNS stack to protect spammers was not working.

    spammers are more consistent at making SPF, DKIM, and DMARC
    correct than are legitimate senders.

  * Bill Cole : "@jwz@mastodon.social The stats we collect for
    the..." (toad.social)

It is, once again, a naive approach to spam. The whole stack was
designed with the mindset "bad spammers will try to hide themselves".
But was is happening in your inbox, really?

Most spam is not "black hat spam". It is what I call "white-collar
spam": perfectly legitimate company, sending you emails from
legitimate address. You slept in a hotel during a business trip? Now
you will receive weekly emails about our hotel for the rest of your
life. And it is the same for any shop, any outlet, anything you have
done. Your inbox is filled with "white-collar" junk. And they know
this perfectly well.

In Europe, we have a rule, the RGPD, which forbid businesses to keep
your data without your express consent. I did the experiment for
several months to send a legal threat to every single white-collar
spam I received. Guess what: they always replied that it was a
mistake, that I was now removed, that it should not have happened,
that I checked the box (which was false but how could I prove it?) or
even, on one occasion, that they restored a backup containing my
email before I unsubscribed (I unsubscribed from that one 10 years
before, which makes it very unlikely).

In short, they lied. All of them. All of them are spammers and they
lie pretending that "they thought you were interested".

In one notable case, they told me that they had erased all my data
while, still having the cookie on my laptop, I could see and use my
account. Thirty days later, I was still connected and I figured that
they simply managed to change my user id from "ploum" to
"deleted_ploum" in the database. While answering me straight in the
face that they had no information about me in their database.

Corporations are lying. You must treat every corporate word as a
straight lie until proved otherwise.

But Ploum, if all marketing is a lie, why trusting Signal?

If you can't trust marketing, why do I use Signal and Protonmail?

First of all, Signal is open source. And, yes, I've read some of the
source code for some feature I was interested in. I've also read
through some very deep audit of Signal source code.

  * Reviewing the Cryptography Used by Signal (soatok.blog)

I'm also trusting the people behind Signal. I'm trusting people who
recommend Signal. I'm trusting the way Signal is built.

But most importantly, Signal sole existence is to protect privacy of
its users. It's not even a corporation and, yes, this is important.

Yes, they could lie in their marketing. Like Telegram did (and still
does AFAIK). But this would undermine their sole reason to exist.

I don't say that Signal is perfect: I say I trust them to believe
themselves what they announce. For now.

What about Protonmail?

For the same reasons, Protonmail can, to some extent, be trusted.
Technically, they can access most of the emails of their customers
(because those emails arrive unencrypted to PM's servers). But I
trust Protonmail not to sell any data because if there's any doubt
that they do it, the whole business will crumble. They have a strong
commercial incentive to do everything they can to protect my data. I
pay them for that. It's not a "checkbox" they could remove, it's
their whole raison d'etre.

This is also why I pay for Kagi as my search engine: their business
incentive is to provide me the best search results with less slop,
less advertising. As soon as they start doing some kind of
advertising, I will stop paying them and they know it. Or if Kagi
starts becoming to AI centric for my taste, like they did for Lori:

  * Why I Lost Faith in Kagi (d-shoot.net)

I don't blindly trust companies. Paying them is not a commitment to
obey them, au contraire. Every relation with a commercial entity is,
by essence, temporary. I pay for a service with strings attached. If
the service degrade, if my conditions are not respected, I stop
paying. If I'm not convinced they can be trusted, I stop paying them.
I know I can pay and still be the product. If I have any doubt, I
don't pay. I try to find an alternative and migrate to it. Email
being critical to me, I always have two accounts on two different
trustable providers with an easy migrating path (which boils down to
changing my DNS config).

Fighting the Androidification

Cory Doctorow speaks a lot about enshitification. Where users are
more and more exploited. But one key component of a good
enshitification is what I call "Androidification".

Androidification is not about degrading the user experience. It's
about closing doors, removing special use cases, being less and less
transparent. It's about taking open source software and frog boiling
it to a full closed proprietary state while killing all the
competition in the process.

Android was, at first, an Open Source project. With each release, it
became more closed, more proprietary. As I explain in my "20 years of
Linux on the Desktop" essay, I believe it has always been part of the
plan. Besides the Linux kernel, Google was always wary not to include
any GPL or LGPL licensed library in Android.

  * 20 years of Linux on the Desktop (part 3) (ploum.net)

It took them 15 years but they finally achieved killing the Android
Open Source Project:

  * Google will develop the Android OS fully in private, here's why
    (www.androidauthority.com)

This is why I'm deeply concerned by the motivation of Canonical to
switch Ubuntu's coreutils to an MIT licensed version.

  * Ubuntu 25.10 plans to swap GNU coreutils for Rust
    (go.theregister.com)

This is why I'm deeply concerned that Protonmail quietly removed the
issue tracker from its Protonmail Bridge Github page (making the
development completely opaque for what is an essential tool for
technical Protonmail users).

I mean, commons!

This whole naivety is also why I'm deeply concerned by very
intelligent and smart tech people not understanding what "copyleft"
is, why it is different from "open source" and why they should care.

  * We need more of Richard Stallman, not less (ploum.net)

Corporations are not your friend. They never were. They lie. The only
possible relationship with them is an opportunistic one. And if you
want to build commons that they cannot steal, you need strong
copyleft.

  * On Open Source and the Sustainability of the Commons (ploum.net)

But firstly, my fellow geeks, you need to lose your candid naivety.

I mean, come on, let's build the commons!

I'm Ploum, a writer and an engineer. I like to explore how technology
impacts society. You can subscribe by email or by rss. I value
privacy and never share your adress.

I write science-fiction novels in French. For Bikepunk, my new
post-apocalyptic-cyclist book, my publisher is looking for contacts
in other countries to distribute it in languages other than French.
If you can help, contact me!

---------------------------------------------------------------------

Permalinks:
https://ploum.net/2025-03-28-geeks-naivety.html
gemini://ploum.net/2025-03-28-geeks-naivety.gmi