LFGSS: Turning a hobby into a technology startup

Hah, the gym is there to help me stay in shape, not get ill, and be mentally well (as a side effect of being physically well). All things to just ensure I'm able to take on the task at hand (hard work, long hours, few breaks, for a long period of time).

But yeah, as I get fitter I hope I can lift more, go faster, last longer physically.

Slightly off topic, but what's your objection to 3rd parties tracking advertising?

I'm not trying to troll, I'm genuinely interested.

As an IT professional, I have a fairly good understanding how internet advertising works, and have friends in that industry, and I personally have no problem with it from a personal perspective. If I'm going to have adverts on the sites I use, I'd rather have ones which are personalised to me, than things I have no interest in.

I guess I see that functionality as a positive, rather than a negative.

It's about privacy, John...

Sure I get that, but what is your actual concern?

I don't care if some company knows I looked at LED TVs last week, and I would rather see LED TVs this week, than porcelain cats.

Again, not trolling, just curious.

dibs porcelain cats

It's deeply rooted in political beliefs that relate to data retention and the later use of that data against individuals even though the collection of the data was proclaimed as being for individuals.

Can it be said that we live without fear that our actions will have repercussions on us in the future?

I read too many things almost every day about this. Like the article today in Forbes about how Target can identify a pregnant woman before she knows she is pregnant ( http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ ) and last week there was Tom Tom making fine grained driving data available to insurance firms ( http://www.extremetech.com/extreme/117889-tomtom-watches-you-drive-insurance-rate ), or generally how Facebook sell user data directly to advertisers and data brokers.

The problem I have is with the impact that has on liberty and living without fear.

If every activity you partake in (online and offline) is recorded, not deleted and later sold or otherwise mis-used for purposes other than the declared reason for acquiring that data... then the prospect of repercussions is real. Be that on employment, friendships, relationships, or more critically freedom to travel.

We cannot trust that any data that we put out there will not be misused by companies whose sole incentive is to increase shareholder value.

The wider political slant that is a fundamental part of my belief is that we live with proclaimed democratic systems. And I feel that we only have such a thing when people can vote freely. To me, that means anonymously and without fear of repercussions, to be able to express with a vote our beliefs about the world we want to live in, without having those beliefs hurt us.

But if we can be identified by our online data (held by advertising companies such as Google and Facebook and even payment providers like Visa), and there are repercussions to our actions because of that data... then can we honestly say that we remain free to vote anonymously and without fear of repercussions.

XKCD have a great comic on this:

And I feel strongly that I shouldn't create a company that goes against the very core of my own beliefs.

So should I allow, support and be party to the act of third party advertisers and other entities obtaining data on you. Regardless of whether it offers you a benefit today (more appropriate adverts), should I permit those entities to have the ability to track you and amass further data, that is unlikely to ever be deleted and you do not know how that data will be used in the future?

The EU are of the opinion that it would be best to reduce tracking, and to have data retention limitations over the amount of time such data could be held.

I go one further and say that the best control that we can have over our own destiny is not to have allowed the data to have been amassed in the first place.

Hence, should I allow third parties to track you? I end up concluding I should not.

Oh, and it's not to say that "all tracking is bad"... websites couldn't actually function if I didn't know from one page to another who you were. Amazon would lose your basket on every page for example.

This is about third party tracking, and leaking information to others.

Intra-site tracking would obviously exist, it would need to just to make the site work. And I'd need aggregated forms of that ("How many people use this function of the site?") to make decisions and support the business.

This is all just about third party tracking.

And that's fine, I completely understand that you don't want to do it.

And I understand your point of where storing data could potentially lead to, and agree that rentention limits, or even bans, are a good thing.

But I don't accept that them knowing about what TVs I've looked for could ever be a problem in the future (I know that's not your point).

Anyway, just wanted to hear your point of view.

I read too many things almost every day about this. Like the article today in Forbes about how Target can identify a pregnant woman before she knows she is pregnant ( http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/ )

That freaked me out for a moment. Turns out it's only before her father knows, phew. :)

Velocio, you are a fucking hero.

Could you survive on a no-ad-voluntary contribution basis? I for one would happily break out the chequebook for that.

Damn the Man!

Velocio, you are a fucking hero.

Could you survive on a no-ad-voluntary contribution basis? I for one would happily break out the chequebook for that.

Damn the Man!

I have no problem with advertising.

I only have a problem with the collection of data by third parties, the retention of that data, and the many ways it may be used (or misused) in the future.

Providing I can offer users a place in which their activity within a community is just that, and would not affect the rest of their lives, I'd accept advertising.

That basically means... no third party tracking.

I also have no implicit issues with advertising per se (I recognise it as the grease on the wheels) as long as it isn't invasive. The pay-per was just an economic query to one who would presumeably have done the mathematics.

The third party selling bit is however (IMHO) evil, up there with ambulance staff and police selling details to no-win-no-fee shysters.

David, we work with affiliates who get paid on a conversion only basis, and on a lump sum basis. I think there will be plenty of scope for either. I think you were querying this earlier?

But I don't accept that them knowing about what TVs I've looked for could ever be a problem in the future (I know that's not your point).

The problem isn't an isolated data point, it's profiling.

Profiling isn't just used by advertisers, it's used by employers, companies, governments. And the lust for that data by the latter is jeopardising small internet based businesses.

Governments are scary mofos, recently the US government has been taking down websites with user generated content for spurious reasons and working with companies to force the companies to make all data available to the government. The USA is somewhere I don't want to be doing business, it's not safe any more for business, and that's before you consider the widespread wire tapping and other stuff that has happened in the name of the "War on Terror".

This isn't just me saying it, I'm not a tin foil wearing beard stroker... this is actually something that many small companies who have no might or influence are feeling. Only a couple of days ago this debate surfaced on Tech Dirt: http://www.techdirt.com/articles/20120216/17154217785/congrats-us-government-youre-scaring-web-businesses-into-moving-out-us.shtml

And the key part:

Today's sysadmin todo list:

1. Get corporate membership with EFF.

2. Identify all applications with user-generated content.

3. Move all associated domains to a non-US based registrar.

4. Migrate DNS, web serving and other critical services to non-US based servers.

5. Migrate yourself to a non-US controlled country.

I'm sorry for US sites and users. Your government is hell-bent on turning the internet into a read-only device like TV, easily regulated and controlled. The population will be required to sit quietly and keep their eyes glued on the screen so they don't miss the ads, with any infringers deemed terrorists and pedophiles and thus deserving of summary punishment by DHS squads.

Hopefully the internet will route around the damaged segment, and the rest of us can continue to enjoy the amazing interactivity it has brought our society.

The problem being: If you hold user generated content then you're now a risk for the content producing industries in the US, and if you hold data on your customers then you're now a source of profiling data that the government wants to tap with secret (silenced) access rights.

So we can aim just to get out of the USA, but unfortunately all governments seem hell bent on doing this. Even if we were to trust that no company is going to sell data it holds on us, or would lose it through a security breach, or would misuse the data (a whole range of assumptions which in the past have proven to be misplaced as one after another those things have happened), we also need to trust that out our government is not going to use data against us.

I would love to say that it is hyperbole to suggest that what happened under the Stasi could never happen again, but then you wake up on a Sunday morning and read this: http://www.telegraph.co.uk/technology/internet/9090617/Phone-and-email-records-to-be-stored-in-new-spy-plan.html . And you consider something like Facebook, or the other social networks, and reflect that maybe we're grassing our mates up when we tag them in a photo... "John was out drinking that night with this other dude who you're profiling." or post on their wall.

Which all reminds me of a quote I once heard:

...the people can always be brought to the bidding of the leaders. That is easy. All you have to do is tell them they are being attacked, and denounce the peacemakers for lack of patriotism and exposing the country to danger. It works the same in any country.

The UK government is no better than the US. And this applies to most countries, all are walking the same path, some are just further down it.

So if I take a whole load of steps to protect the privacy of the users of my web properties: if I were to encrypt all traffic to and from the web site using SSL, if I were to encrypt all back-ups, if I did everything I could... would you still be fine to have your data held by me?

I think the answer is no, because the data could still have been collected by third parties who aren't applying such standards, or I could be subject to an access warrant forcing me to grant the intelligence services access to everything.

I maintain that the very best way of protecting users from their own actions is to not store any data that isn't required, to not build profiles, to not allow third parties to do so.

Now, obviously you can say, "But if I've done nothing wrong, so I have nothing to hide", but this is such an illogical argument that requires you to ignore all historical precedent and to divorce yourself from reality. Bruce Schneir obviously has something to say on this ( http://www.schneier.com/blog/archives/2006/05/the_value_of_pr.html ) and of course there are many retorts ( http://ask.metafilter.com/39312/Response-to-If-youve-done-nothing-wrong-you-have-nothing-to-worry-about ).

The big problem with data being held, profiles being created, is how the data may be used in the future.

The very definition of the word "wrong" is subject to change over time, and all prior activity which were once "right" will be assessed under the new definition if the data is available.

And yes there are extreme examples, such as taking flying training in Florida, or even to have researched flight training in Florida (that would be an advert preference). You've made yourself fit an obvious post 9/11 profile.

But there are realistic and very private examples too.

In the UK there was a law change a few years ago that re-defined extreme pornography ( [ame]http://en.wikipedia.org/wiki/Extreme_pornography[/ame] ).

So if you were in a long-term consensual BDSM relationship, and everything you got up to you got up to in the privacy of your own home, and you didn't physically hurt each other, but you did take photos or film each other in the privacy of your own bedroom... well, welcome to the new world, you've broken the law. And if you had such photographs from earlier in your marriage (let's assume same partner throughout), then what was once legal is now illegal. The definition of wrong changed.

And profiling of data could very easily and quite accurately identify who is most likely, based on past activity, to have fallen foul of a newly defined definition of wrong.

By allowing data to be recorded, we allow ourselves to be subject to changes in the definitions of our actions, and we've given many entities access to the data that can be used against us.

And why did we do this? Just to have an advert personalised, because we as users feel that it's best to have an advert for Cinelli rather than Create.

You're willing to give up so much, for so little?

I'm not, and I don't feel like I could make such a decision on the behalf of all users: past, present and future.

I don't know on this new platform whether there would be a BDSM site (to cite the example above), but I do know that I will feel that I have been negligent if through an action (or inaction) of mine I've put my users at risk.

I remain convinced that one of the best things I can do for my users, is to hold no data on them that isn't required for the operation of the service. I don't even want your real name, and I would prefer you all to use aliases. I want us both to be responsible for protecting you... you should use a pseudonym, and I shouldn't profile you or record data that could be used to profile you.

And again, I conclude I shouldn't allow any third party to amass data on you either.

from the telegraph article

Rather than the Government holding the information centrally, companies including BT, Sky, Virgin Media, Vodafone and O2 would have to keep the records themselves.

that there alone, is very scary. private companies holding personal data for the government.

Yeah, and then add this: http://www.badphorm.co.uk/page.php?2

So, what's all the fuss about?

Simply put, three of the UK's largest ISPs (Virgin Media, BT and TalkTalk) had decided to sell your private browsing history to an advertising broker. Yes, the entire content of every web page you visit would have been sent to Phorm in real time, as you click. A personal profile would then have been created, allowing Phorm to send you 'targeted advertising'.

So ISPs collect the advertising data to allow third parties to create profiles which they then would have to grant the government access to.

You couldn't make this stuff up.

Best thing to do: Encrypt everything, store no data that isn't required, let no-one else store data on you either.

Which is my plan.

so, time to route everything through a vpn?

(if virgin media reads this - Hello Virgin Media!)

They were blocked on that by user opposition.

But such victories are always temporary.

They ask for a mile, get pushed back. Are half a mile further than where they were originally.

That's how civil liberties and freedoms are eroded. Not by any single act, but through hundreds of small pushes by companies, each of which they only concede a little and we consider it a victory.

You only have to look at Facebook privacy policies over the past 5 years to see this in act. But it happens everywhere.

On the Facebook stuff alone:
http://www.pcworld.com/article/140182/facebooks_beacon_more_intrusive_than_previously_thought.html
http://arstechnica.com/tech-policy/news/2008/05/canadian-group-files-complaint-over-facebook-privacy.ars
http://www.poynter.org/latest-news/media-lab/social-media/147638/with-frictionless-sharing-facebook-and-news-orgs-push-boundaries-of-reader-privacy/
http://consumerist.com/2009/02/facebooks-new-terms-of-service-we-can-do-anything-we-want-with-your-content-forever.html
http://techcrunch.com/2009/12/09/facebook-privacy/
http://online.wsj.com/article/SB10001424052702304772804575558484075236968.html
https://www.eff.org/deeplinks/2010/04/facebook-timeline
http://www.wired.com/epicenter/2010/05/facebook-rogue/

I don't know why anyone is on Facebook any more, have they not proven themselves utterly incapable of being trusted?

This was a great article for web developers: http://dickbrouwer.com/post/16748664071/facebook-perils

I particularly liked the comment and blog post title:

I would rather drink piss like Bear Grylls than log in with Facebook

But then all I hear as a response to "Why are you still on Facebook?" is, "But if everyone is doing this, what's the point in fighting it?".

Piss poor argument. I'd like to say such naive people don't deserve privacy... but everyone deserves privacy, in fact it's one of the human rights listed in the universal declaration of human rights.

Anyhow... no third party data, no third party items on the site, no exposing data to third parties.

It seems that these threats are becoming more and more concrete.

At the risk of jeopardising my future life With this language but that's fucking scary stuff velocio. (Won't use your real name here any more)
On John H point about personalised advertising I have found that since disabling this in google I am much less distracted by advertising since it no longer includes the word bicycle or cyclin and is mainly about automobiles and aeroplanes whatever they are.

Having fun tonight looking at my accounts.

I think I've just shat myself.

As it goes, my expenses are higher than I realised. And my income was lower than I realised.

The personal budget has £12 of disposable income per month. And the business has about £150 but I haven't yet included accountancy fees and tax... so, it's running on vapours.

I think with the money in the bank, I have just over a year of living on vapours before the account is run down.

Nothing like a deadline to focus the mind.

Time for bed, let's see if I manage to sleep.

:s

I shouldn't post late at night or early in the morning, likely to be overcome by panic.

The more things that feel broken, the harder it feels working broke.

Half the day has been spent just getting my internet working again. Does not help.

^ There's a certain beauty to that fragile state of mind

stick to your guns, it'll work out

I think the advertisers have asked too much though, as in: advertising hasn't ended in newspapers, magazines, billboards, TV, etc just because of a lack of tracking.

The best the advertiser gets through those mediums are estimates based on numbers printed, foot fall or passers by for a location, ratings figured guestimated by TV stations, etc.

Those may be third party normalised estimations... but there isn't any tracking.

I know part of the argument is that it has to be that way because they can't track, and yet on the internet they can track. But the tracking is now so pervasive and constant that far more than just advertising impressions and conversions are tracked. To the extent that almost all online activity is now observed by the major advertising platforms and advertising companies (which includes Google and Facebook, as that is where their money comes from).

I strongly believe that the pendulum has swung too far, and that the user should be protected from such a level of intrusive behaviour. I think that advertising has got away with things it shouldn't have done, and that it needs to be corrected.

It doesn't preclude some basic tracking by myself and the methods audited by a third party, but denies them (the advertising platforms) the ability to intrusively track users of this platform.

That's what I'm aiming at, not for no advertising or no tracking, but a very balanced and controlled amount of tracking serving advertisers who value the market offered to them.

The very basic question remains: If I can offer you access to a community of people who are already highly targeted (e.g. fixed gear cyclists in London), then would you accept less intrusive tracking as part of the deal? And would you accept performance based payment structures in which you'd only pay for the conversions and not just for impressions or clicks?
Saw this which reminded me of your thoughts (kind of)

Except that it's from Banksy which made me resent it before I'd even finished reading it.