Thursday, October 16, 2008

Internet Governance

Please forgive me, Lord, for I have sinned. And gravely. Mere minutes ago in the elevator lobby of my office I uttered four horrible words. That's what she said. Though I know this is a terrible offense, God, I hope that you can show mercy. You see, what could I have done? Matt said, "Who cares about explicit consent?"

We had been talking about something funny that happened earlier today on his computer. He was trying to copy and paste some data from one terminal to another, but all that would paste was a URL (I won't mention which, it is a site that doesn't deserve even the meager publicity that a mention on my blog would give it). I guessed that some web site was repeatedly overwriting his clipboard (there was a visual cue that PuTTY's text had been removed from the clipboard), and suggested that he close Firefox and try again. It worked.

If Matt had been asked for permission to overwrite his clipboard, he surely would have said, "No." If you asked most Firefox developers whether scripts on web pages should be allowed to repeatedly overwrite the user's clipboard, they would probably say, "No," my distrust of the Mozilla Foundation notwithstanding. But people don't get asked every time. Web pages are allowed to set the clipboard, and they're allowed to set timers to generate events at short intervals, so there's not much that can stop them from doing both over and over again. Code analysis Just Ain't That Good, and there are too many shady behaviors to guard against. We've dug our grave, now we lie in it. Only an Evil Bit can save us.

In the days of the old West, I'm sure many people questioned whether a land so large could be policed like the cities of the East. They probably said of the West, as many programmers often say of the Internet, that people there must defend themselves, must determine who's trustworthy and who isn't (the favored method of most Web users, including myself, is how nice their pages look). But, you know, today there are red-light cameras in Albuquerque.

In fact, even some laws are enforced on the Internet. Most of the enforcement, such as that against online gambling, seems to be done in ham-fisted and shameful ways. Then again, lots of physical laws are no better. People arrested for taking pictures in public places, for example. That's probably worse than any of the online gambling enforcement.

Online gambling is a bad example of what I'm talking about, though, because it's protecting people from social problems and not technological ones. When we walk down city streets we know there's nothing that can physically stop any random person from gunning us down. But we know it's not very likely, and so we keep doing it. On the Web we know that sites will attempt to get our computers to act against us all the time. And we don't do the logical thing, abandoning Javascript for something with much stricture limits. Why? The companies that make money in the real world don't like street violence. But on the Internet, legitimate companies want just as much control over your computer as shady ones, because the whole business is advertising. You're not the customer, but the product. Because of that, I'm not optimistic. We'll be stuck with a web of detained shareholders and clipboard-hijacking (or their more refined variants) forever.

No comments: