Notes and links from my talk at Texas Linux Fest

Abstract

The story of open source and the Internet is a story of dystopia timelines that didn’t happen. We avoided the Clipper Chip, key escrow. And the Fritz Chip, DRM mandates. Sure, threats to security, and DRM lock-in, are still there, but thanks to a lot of hard work, they’re manageable. Today’s biggest threat, though, isn’t coming from outside forces like governments or big copyright holders. Our ongoing collapse of trust and rise of crime is rooted in some good ideas from open source, gone wrong.

It’s not just social media scams and deepfakes. Dishonest business practices from the sketchier corners of the Internet have gone mainstream. We’re in a rugpull economy now. Let’s figure out where we went wrong and how to get back on track.

Intro

I was going to give my practical privacy tips talk, but then it turned out that they gave me the big room, so I wanted to think about the big picture.

Why are we doing privacy tips in the first place? Why not: How to share more of your personal information with brands you love? Why is privacy even a feature?

Privacy is not about something to hide. In a lot of situations, the reason we have privacy is that it makes a market work. Imagine you go on vacation, and go to an old-fashioned rug market. Are you going to hand every rug merchant your shopping list, budget, and departure date?

The basics of privacy are like the basics of not showing your cards in a card game. When privacy breaks down, a lot of other human activities break down, including markets.

Normie corporate privacy

And, of course, there are a lot of deceptive people out there. So the stuff that we used to do as privacy nerds has gotten all mainstream and corporate.

The Federal Trade Commission says scams are up 3x since 2020.

The Pew Research Center, in Online Scams and Attacks in America Today, says that 73% of U.S. adults have experienced some kind of online scam or attack.

When you give up too much information, you make it too easy to target you.

The kind of privacy advice I used to share with privacy nerds is now mainstream corporate IT best practices. CSO Online recommends

• Push a vetted ad-blocking extension to managed browsers through policy rather than leaving it to users to install it.

• Favor browsers with built-in tracking protection.

• Block ad and tracking domains at the DNS or secure web gateway layer; this reaches in-app ads on managed phones.

• Disable advertising identifiers on corporate mobile devices through mobile device management (MDM) and restrict ad-supported consumer apps on devices holding sensitive data.

Wherefore do the wicked prosper?

How did it get so far?

The prophet Jeremiah asked,

Wherefore doth the way of the wicked prosper? wherefore are all they happy that deal very treacherously?

That’s not what I expected the Internet would get us. The Internet, and free software, were going to be awesome. I started running desktop Linux in 1994, back when you had to exit your own X mode lines, and you could zorch your (tube) monitor if you got it wrong. Yes, that was actually a thing.

Linux and the Internet kept getting better.

Internet 2, dystopia 0

And the open source scene has beaten some powerful dystopia narratives.

• Clipper Chip - government control of cryptography 1993-1996

• Fritz Chip - DRM mandate bill in 2002 – Consumer Broadband and Digital Television Promotion Act (CBDTPA)

Encryption backdoors and DRM are both still around, but last I checked the one remaining device in my house that will play DVDs is one of the Linux boxes. Open source and the Internet won.

Now the dystopia is coming from inside the house

But now we have dystopia at home. Today’s scam and surveillance dystopia has its roots in the open source scene.

We can still beat this one, and this time it’s really on us.

From open source to surveillance dystopia by way of economics

Commoditize the complement was awesome back in the days of “old Google.” Replace expensive single-vendor systems with Linux, plus whatever hardware works best at the time for a reasonable price.

Hardware as a commodity was a good idea. The problem happened when “content” was treated as a commodity. Adtech constantly tries to get the most expensive possible ad into the cheapest possible context.

For adtech, surveillance was never about the surveillance. It was about connecting the reader of some expensive content to some other context where you could show them an ad for cheaper.

A recent paper shows I’m right. A Longitudinal Study of Extended User IDs in the Online Advertising Ecosystem, by Michael Smith, Riley Grossman, Krzysztof Franaszek, Antonio Torres-Agüero, Pritam Sen, Cristian Borcea, and Yi Chen, describes how web trackers are giving “user IDs” to bots. If it were about the surveillance, this would have been a big deal. But it wasn’t. Adtech is a racket against the web publisher.

Why did advertising-supported web sites turn out to be so hard? The old magazine business model was roughly, subscriptions cover the cost of printing and postage, ads pay for the content. Without printing and postage, the ads should pay for things. But it didn’t work.

Walt Mossberg recalled,

[W]e were seated next to the head of this advertising company, who said to me something like, “Well, I really always liked AllThingsD and in your first week I think Recode’s produced some really interesting stuff.” And I said, “Great, so you’re going to advertise there, right? Or place ads there.” And he said, “Well, let me just tell you the truth. We’re going to place ads there for a little bit, we’re going to drop cookies, we’re going to figure out who your readers are, we’re going to find out what other websites they go to that are way cheaper than your website and then we’re gonna pull our ads from your website and move them there.”

That’s the same year Google bought DoubleClick, by the way. The first generation of adtech was all about good ad, bad context.

But it got worse.

The “progress” of online advertising was in ever more sophisticated auction-based markets. And in 2006, Jakob Nielsen pointed out the problem with those, in Search Engines as Leeches on the Web. An auction-based market tends to capture all the advertisers’ profits, as they bid up the price of ads to where the cost of the ad equals the expected profit from additional customer.

As the auction gets more and more efficient, some slots go un-sold. Legit advertisers focus on in-market buyers – free up ad slots. For what?

Why not bad ad, good context?

Why are Big Tech systems deliberately designed to match scammers and victims? Adversarial personalization: surveillance pricing, malware and scam targeting

The biggest example of adversarial personalization is the Big Tech senior fraud situation. Many older people are spending less money on discretionary purchases but are sitting on retirement savings, so Big Tech ML systems automatically “learn” to match them not with legit products and services, but with fraud operators.

Scam bidders don’t just fill in the ad impressions to the people normal advertisers don’t want (or, that Google and Meta ML “learns” not to serve normal ads to). So Meta is earning a fortune on a deluge of fraudulent ads, documents show.

Because the internal ad placement systems are run as auctions, the fraudulent advertisers drive up the prices paid by the legit advertisers.

Number must go up

Advertising revenue globally is about a trillion dollars, hard to estimate, maybe a little more Meta and Google ad revenue, added together, is about half that. 580 billion if you add their Q2 2026 revenue and annualize it.

The only way left to grow is to keep taking a bigger and bigger fraction of every sale.

A majority of a major industry is now controlled by two transnational crime organizations.

Crime is inevitable for Meta and Google now that they control a majority of advertising but must continue to grow at startup-like rates.

Excuses, excuses

But this platform, it’s so big! This is why you don’t hire a Big Tech CEO to manage a Burger King. “There are so many Burger Kings with so many customers! How could we possibly mop all the restrooms?” You just have to hire enough people.

But union busting! No, the required changes are changes to the rules not extra work. The extra work falls on the advertiser and trademark holder, not some contractors who are going to organize.

The problem isn’t scale or labor/management issues. The problem is deliberate decisions to do crime.

• The Google trademark policy is designed to deliver scams and malware in search ads. Google stole a damn sammich

• Meta’s ad system is designed to work for deceptive sellers. but I want to turn people into dinosaurs

What legit brands need from advertising

Advertising works when

content + signal ≥ interruption + resources + risk

Advertising can provide two benefits to the audience: it can support some kind of resource (which technically doesn’t have to be “content,” bus bench ads are a thing, too) and it can send a credible signal of the advertiser’s intentions in the market.

And advertising asks the audience to pay, with some kind of interruption—otherwise it would be not advertising, but content marketing—and spend some kind of resources, such as battery and bandwidth, and often accept some kind of risk.

FIXME add Michael Farmer stats and link (from So much crime, so little pay)

What I was wrong about

I thought that legit brands would want some form of post-creepy advertising, designed for honest sellers. What I did was point out the ad medium/brand mismatch. I did say that today’s surveillance advertising is optimized for the needs of deceptive sellers, and doesn’t carry the signal that legitimate brands need. Right so far.

But here’s where I messed up. As an Internet Optimist, I assumed that the decision-makers for the highest-reputation brands would be dissatisfied enough with the situation to seek out advertising media better suited to costly signaling.

But that’s not what was happening, if I had been paying attention to other trends.

Brand decision-makers did take steps to deal with the problem that a higher-reputation brand doesn’t benefit from an advertising system optimized for lower-quality sellers—but did it the other way around, by cutting quality and/or service and burning brand reputation.

But I was wrong about ad reform. Brands let their quality and reputation slide in order to match the available advertising, not the other way around.

Bernadette Banner, an expert in historic garments and in making and altering clothing in general, did a video on selecting fabrics. But in a rugpull economy, that’s harder than it looks.

The unfortunate reality is that those sorts of recommendations do not stand the test of time The recommendation section will become obsolete especially when shops start going out of business, especially the really highly recommended small businesses. Or with bigger more reliable brands it’s very common that these get bought up by private equity and become enshittified and so their quality degrades.

So what can we do about it?

This is our mess to clean up.

We’re not going to get off the Internet and touch grass. Get to the public library and volunteer to help people get their privacy issues fixed.

Privacy is a collective problem. It’s not personal.

We’re all safer when less money is flowing to scammers and to Big Tech.

And people inside big companies want to do the right thing, you just have to be able to justify it. I still think Google could go legit again.

The jury system can save us again

A December 17, 2002 jury verdict was, in my opinion, the end of the DRM dystopia narrative. In a Not guilty verdict, the jury straight-up jury nullified the anticircumvention section of the DMCA.

Today, juries are handing over some pretty good privacy verdicts. Thanks to the California legislature, we have some good tools to use against surveillance dystopia, and other states do too.

The fight against surveillance and scam dystopia does not have to be prohibitively expensive.