diff --git a/src/routes/_posts/why-the-internet-is-terrible.svx b/src/routes/_posts/why-the-internet-is-terrible.svx new file mode 100644 index 0000000..1e5c473 --- /dev/null +++ b/src/routes/_posts/why-the-internet-is-terrible.svx @@ -0,0 +1,61 @@ +--- +title: Why the Internet is Terrible +date: 2024-11-09 +draft: true +--- + + + +I just got done deleting ~30 bogus user accounts from my [personal Gitea insteance](https://git.jfmonty2.com). They all had reasonable-ish-sounding names, one empty repository, and profiles that looked like [this](/bogus_user_profile.jpg). Note the exceedingly spammy link to a real site (still up as of writing) and the ad-copy bio. + +Obviously this is just SEO spam. My Gitea instance got found by some automated system that noticed it had open registration,The more fool I. so it registered a bunch of bogus user accounts, added links to whatever sites it was trying to pump, added related text in the bio, and then sat back and waited for search engines to pick up on these new backlinks and improve the reputation of said sites, at least until the search engines catch on and downgrade the reputation of my Gitea instance. + +This particular problem was easy enough to deal with: Just remove the offending users, and all their works, and all their empty promises. But it got me thinking about the general online dynamic that _everybody online is out to get you._ + +## The Internet is terrible, and everyone knows it + +This isn't a news, of course. People go around [saying things like](https://www.stilldrinking.org/programming-sucks): + +>Here are the secret rules of the internet: five minutes after you open a web browser for the first time, a kid in Russia has your social security number. Did you sign up for something? A computer at the NSA now automatically tracks your physical location for the rest of your life. Sent an email? Your email address just went up on a billboard in Nigeria. + +and everyone just smiles and nods, because it fits with their own experiences. I've encountered people who are highly reluctant to pay for anything online via credit card--they would much rather use the phone and give their credit card number to a real person who is presumably capable of stealing it, should they so desire--because the general terribleness of the internet has become so engrained into their psyche that this feels like the better option, and you know what? I can't even blame them. + +Anyone who works on web applications for a living (or a hobby) is _especially_ aware of this, because odds are that they've been burned by it already or at least are familiar with any number of existing examples. The very existence of sites like [Have I Been Pwned](https://haveibeenpwned.com) is predicated on the inescapable terribleness the permeates every nook and cranny of the Internet. + +Of course, people trying to take advantage of the careless and clueless isn't a new phenomenon. The term "snake oil salesman" dates back to the 18th century and refers people who would go around selling _literal snake oil_Probably not harvested from actual snakes, but they sure told people it was. as a miracle cure, hair restorative, and whatever else. I'm fairly confident that as long as money has existed, there have been unscrupulous people making a living off of tricking it out of other people. + +But something about the Internet makes it much more _present_, more in your face, than old-timey snake-oil salesmen. I've seen no hard numbers on this, and I don't know how you would even begin to estimate it, but but I would guess that the incidence rate of this sort of thing is vastly higher online than it's ever been in meatspace. + +So what is it about the Internet that makes deception so much more prevalent? Ultimately, I think it boils down to three things: availability, automation, and anonymity. The Three A's of Awfulness, if you will. + +## Availability + +Have you ever wondered why physical locks are so easy to pick? It takes some know-how, but from what I can tell, most commonly-sold locks [can be bypassed within a minute](https://www.youtube.com/@lockpickinglawyer/videos). I'm just going to say it right here, and I don't think this is a controversial take: For a web application that would be an unacceptably low level of security. If it took an attacker less than a minute to break into a website, I'd consider it just this side of "completely unsecured". + +But! Meatspace is not the internet. The constraints are different. Over the lifetime of a given lock, the number of people who will ever be in a position to attempt to pick it is usually quite low, compared to the number of people who exist in the world.Obviously the circumstances matter a lot too. A lock in a big city is within striking distance of many more potential lock-pickers than the lock on a farm out in corn country somewhere, which is part of why people in cities are frequently much more concerned about keeping their doors locked than people in rural areas. + +By contrast, the number of people who have the opportunity to attempt to break into a poorly secured website is _literally everyone with an Internet connection._ At last count, that number was in the billions and rising, so based on opportunity alone, the average website is _far more_ at risk than the average lock on a door.This is also my main beef with [this xkcd comic](https://xkcd.com/1958/): Sure, most people aren't murderers. But even if there are only a few people in the world who are sufficiently unhinged to want to involve strangers in a fatal traffic accident, _if your self-driving car is Internet-connected then those people might have the opportunity._ And the fact that _every_ website is within _immediate_ reach of every would-be attacker means that there's no "down time" between attacks - you can go from Scam A to Hack B to Scheme C without having to wait longer than it takes to type a URL into the address bar. This alone would make "online scurrilousness" a far more attractive career choice than "cat thief", but it gets even _worse_, because a skilled attacker doesn't even have to be _awake_ to be actively scamming/hacking/etc. + +## Automation + +In meatspace, there are only so many hours in a day. If you're over on Maple Street burglarizing Mr. and Mrs. Holyoke's home, you can't also be selling fake stock certificates on Jefferson Ave, or running a crooked blackjack game in the abandoned warehouse off Stilton. What's an enterprising badperson to do? + +Enter _the Internet_, a magical land of endless opportunity, where everything is done with computers. You know what computers really love doing? _Endlessly repeating the same boring repetitive task forever._ The Internet is a medium uniquely suited to automated consumption. So much so, in fact, that approximately 30% of all internet traffic comes from automated systems, [according to Clouflare](https://radar.cloudflare.com/traffic#bot-vs-human), and they should know. So what does a clever-but-unscrupulous technologist do? That's right, he goes looking for vulnerabilities in widely-used platforms like Wordpress, finds one, then sets up an automated system to identify and exploit vulnerable internet-connected things. Or he uses an open-source large language model like [Llama](https://www.llama.com/) to send phishing emails to every email address he can get his hands on, and maybe even correspond with susceptible people across multiple messages,This is something I'm sure we'll see more and more of as time goes on. I'm sure it's already happening, and it's only going to get worse. or just tricks people into clicking on a link to a fake Log In With Google page where he snarfs up their usernames and passwords, or _whatever_. There are a million and one ways an unethical person can take advantage of people _without ever having to personally interact with them._ This acts as a force-multiplier for evil people, and I think it's a major contributor to the overwhelming frequency with which you encounter this sort of thing online.Astute readers may realize that while you can't automate meatspace in exactly the same way as you can automate computers, you can still do the next-best thing, to _get other people to do it for you._ This is the fundamental insight of the Mafia don, and organized crime more generally. Thing is, though, all of these subsidiary evildoers have to be just as evil as the kingpin string-puller person, so it doesn't quite act as a force-multiplier for evil in the same way. + +## Anonymity + +There's a third contrast with meatspace that makes life easier for people whose moral compass has been replaced by, say, an avocado: _Nobody knows who you are online._ In real life, being physically present at the scene of a crime exposes you to some degree of risk. There might be witnesses or security cameras, your coat might snag on a door and leave some fibers behind for the forensic team to examine, you might drop some sweat somewhere and leave DNA lying around, and of course there are always good ol' fingerprints.Once again, the Mafia model demonstrates how you might insulate yourself from some of these risks, but again, it's not quite as complete because _somebody_ has to be there, and that somebody might talk. And yes, the Mafia [took steps](https://en.wikipedia.org/wiki/Omert%C3%A0?useskin=vector) to remedy that problem as well, but that's why Witness Protection was invented. All of this is much less of an issue online. Yes, it's true that it can be difficult to completely mask yourself from discovery, at least discovery by a sufficiently motivated Three-Letter-Agency, as a series of Silk Road higher-ups [have discovered to their dismay](https://arstechnica.com/tech-policy/2014/11/silk-road-2-0-infiltrated-from-the-start-sold-8m-per-month-in-drugs/). But overall, if you're not a big-time player in the world of online crime, it's _much_ easier to stay hidden online than in person. + +## The economics of evil + +In the end, you can think of this all as a question of economics.Seems like you can think of anything as a question of economics, if you try hard enough. [Even theology](https://en.wikipedia.org/wiki/Economy_of_Salvation?useskin=vector). The Internet is rife with scams, thievery, and general [scum and villainy](https://www.youtube.com/watch?v=Xcb4_QwP6fE) because it brings down the cost of doing such things to the point that it becomes worth it. There's no need to spend time or money moving from place to place, because you can do it all from the comfort of your own home. Instead of spending time on each individual operation you can put in the effort to automate it up-front and then sit back and reap the benefits (or keep finding more things to automate). The risk of doing all of this (which is a form of cost) is significantly lower than it would be to do something equivalent in real life. And all of this you get for the low, low price of your immortal soul! What's not to like? + +## Will it ever change? + +The Internet has often reminded me, alternately, of a) the Industrial Revolution and b) the Wild West. It reminds me of the Industrial Revolution because there are great examples of unscrupulous people taking advantage of a new set of economic realities to make tons of money at the expense of poor everyday folk who are just trying to live their lives. And not just straight-up criminals like we've been discussing, but also exploitative businesses and corporations (adtech, anybody?) that hearken back to the days of e.g. factory owners profiting from the slow destruction of their workers' lives. But the Internet also calls to mind the Wild West of the mid-to-late 1800s. Like the Wild West, it's a huge new swathe of unexplored territory rich with opportunity, if a little uncivilized. + +But eventually, both the Industrial Revolution and the Wild West settled down and got a little more civilized. Eventually people developed things like labor unions and OSHA regulations,Which I never thought I'd be holding up as a _good_ thing, because in my personal experience they've mostly been a source of frustration. But something tells me that if I were a worker in a 19th-century textile factory, I would have been very glad for some basic safety requirements. and the world of heavy industry got a little more equitable. And eventually, the Wild West became civilized enough that you couldn't just walk into a saloon and shoot someone just because you felt like it.Please note, I have no idea if this was ever _really_ possible, I'm basing it mostly on spaghetti Westerns and the like. + +Will the same thing happen to the Internet? I don't know. It might! Already you can start to see a sort of social "immune system" developing with regard to things like phishing emails and calls. For instance, I know several people who have a policy of never answering their phone at all if the call is from a number they don't recognize. Unfortunateloy it's harder to make this work for something like poorly-secured web services, because it isn't easy to tell before you sign up for a service whether it's likely to get breached and leak your personal info in six months. + +Ultimately the only workable solutions will have to a) increase the cost of carrying out these attacks, or b) reduce (on average) the reward. In the end it probably won't be _solved_ completely, much like crime isn't _solved_ today, but we can at least hope that at some point it isn't quite so prevalent. diff --git a/static/bogus_user_profile.jpg b/static/bogus_user_profile.jpg new file mode 100644 index 0000000..2cd19ab Binary files /dev/null and b/static/bogus_user_profile.jpg differ