Thread by @AlecMuffett

Clearly @schneierblog has forgotten ITAR, let alone the moves against PGP in the early 90s, HTTPS in the late 90s, Java crypto in the early 2000s, wire-speed crypto in the late 2000s, & E2E more recently. Sorry Bruce, you're wrong.
nytimes.com/2018/10/11/opi…

The usual excuse at this juncture is "No, not _that_ regulation, of course; that was bad regulation, but this would be _good_ regulation"; regrettably there's a scope-creep associated with all regulation, it rarely pans out that way.

Of course if you want to live in a world where not merely do you have to dismiss value-free "we collect cookies" popups to browse a site, but also where you have to individually check-out software extensions if you want to do so securely, then go ahead and invite regulation:

If you want a world where apps that are provided through the official Apple & Google stores are only those which support cryptography that is equipped with a "golden back-door key" for public safety, then go ahead an invite regulation: eff.org/deeplinks/2014…

If you want a world where software is export-controlled ("The concept was well-meant") because it, like all software, is inherently dual-use and can be used for either bad OR good, then go ahead and invite regulation: sector.ca/what-the-wasse…

Yes, totally, Bruce does make some reasonable observations which are, or should be, already enacted: your app should not kill people; and companies who lose all your data should be spankable:

But Bruce falls flat on his face in the last two paras, because (a) Security should NOT take precedence over everything else - otherwise we would ban skydiving, or eating oysters, or cycling in London.

We take risks. That's how life works. We mitigate them and punish failure.

And anyone who thinks that a regulated market under state definition yields innovation, has not looked at the recent history of the British rail industry.

tl;dr - as ever, do not regulate the form of software or speech; regulate instead the intent & ends for which it is used.

@threadreaderapp unroll, please

/cc @leotanczt who inadvertently pointed me at this.