oss-security

[oss-security]

Should Meta Be Broken Up?

Meta Platforms, Inc., the parent company of Facebook, Instagram, WhatsApp, and Messenger, has undeniably become a central figure in the ongoing debates over digital monopolies and the regulation of Big Tech. Founded by Mark Zuckerberg in 2004 as Facebook, Meta now holds an unprecedented level of control over global social media, boasting a combined user base of over 3.5 billion active users across its various platforms. This vast reach gives the company an unparalleled influence over communication, commerce, news dissemination, and even politics. Its dominance has led to increasing scrutiny from regulators, lawmakers, and the public, fueling ongoing discussions about whether the company should be broken up to restore market competition.

Meta's far-reaching influence in the digital ecosystem cannot be overstated. With Facebook's continued status as the largest social network globally and Instagram's rapid growth, Meta’s platforms have integrated themselves into the daily lives of billions of people worldwide. WhatsApp and Messenger further extend Meta's grasp on messaging, making it a powerful gatekeeper in how individuals communicate and share content across borders. In addition to its core platforms, Meta's aggressive expansion into virtual reality (through its acquisition of Oculus), artificial intelligence, and other emerging technologies only serves to strengthen its presence, raising concerns about the company’s growing control over both consumer behavior and market competition.

The Case for Breaking Up Meta

Monopolistic Practices and Antitrust Lawsuits

The Federal Trade Commission (FTC) and 46 U.S. states have filed an antitrust lawsuit against Meta, alleging that the company engaged in anti-competitive practices by acquiring rivals Instagram and WhatsApp to eliminate competition. The FTC contends that these acquisitions were part of a strategy to maintain a monopoly in the personal social networking market, thereby stifling innovation and consumer choice.​

Senator Josh Hawley has echoed these concerns, arguing that Meta's control over social media platforms infringes on free speech, manipulates public opinion, and mishandles personal data. He supports antitrust actions aimed at dismantling such tech giants to restore power and freedom to American citizens.​

Slow Response to Scam Content

The UK's Financial Conduct Authority (FCA) criticized Meta for being the slowest among social media firms in removing scam content and posts by influencers promoting potentially unlawful financial schemes. The FCA reported that while takedown requests are generally honored, Meta took up to six weeks to respond, significantly longer than other platforms. This delay in addressing harmful content raises concerns about Meta's commitment to user safety and its ability to self-regulate effectively.​

Financial Dominance and Market Power

Meta's financial performance emphasizes its dominant position in the digital advertising market. The company is preparing to report quarterly earnings with projections of $41.36 billion in revenue and $5.21 earnings per share. Despite concerns over CEO Mark Zuckerberg's less optimistic outlook and potential disruptions from new tariffs, Meta's substantial investment in AI infrastructure and expansive reach continue solidifying its market power.​

Arguments Against Breaking Up Meta

Consumer Benefits and Free Services

Meta's platforms are free to users, and the company argues that its services provide significant value without direct monetary cost. The challenge in antitrust cases lies in demonstrating consumer harm when users are not paying for the service. Meta contends that its platforms, including Facebook and Instagram, continue to evolve and compete with other services like TikTok and YouTube, suggesting that the social networking market is dynamic and not monopolistic.​

Innovation and Investment in New Technologies

Meta has invested heavily in emerging technologies, including artificial intelligence and virtual reality. The company plans to invest up to $65 billion in AI infrastructure by 2025 and has launched new AI applications to rival competitors like ChatGPT. These investments indicate Meta's commitment to innovation and its role in advancing technological development, which a forced breakup could hinder.​

Regulatory Challenges and Market Complexity

The European Union's Digital Markets Act (DMA) aims to ensure fair competition by regulating "gatekeeper" platforms like Meta. While the DMA imposes obligations to prevent anti-competitive practices, it also acknowledges the complexity of regulating rapidly evolving digital markets. The act's provisions, such as prohibiting the combining of data across services and ensuring interoperability, are designed to address concerns without resorting to structural changes like breaking up companies.​

Conclusion

Ultimately, the question of whether Meta should be broken up boils down to the need for greater regulatory oversight to curb its monopolistic practices while still fostering innovation and maintaining consumer benefits. While Meta's expansive reach and dominance in the social media and digital advertising spaces undeniably raise concerns about market fairness, breaking up the company may not be the most effective solution. Instead, regulators should focus on enforcing stricter antitrust measures, demanding transparency in its data usage, and holding Meta accountable for its role in spreading misinformation and harmful content.

Meta’s investments in new technologies like AI and virtual reality should not be dismissed, as they contribute to the broader tech landscape and drive progress in fields that benefit society as a whole. However, the company’s market power must be kept in check to prevent further consolidation that could stifle competition. Striking a balance between allowing Meta to innovate and ensuring that it doesn’t monopolize markets or exploit its massive user base is essential.

Rather than an extreme breakup, we need smarter regulatory frameworks that can address the evolving challenges posed by Meta and similar tech giants. The growing influence of Big Tech requires a nuanced approach. One that promotes fair competition, safeguards privacy, and encourages innovation, without allowing companies like Meta to control too much of the digital ecosystem. If regulators fail to act decisively, we risk creating a digital monopoly that prioritizes profit over user welfare and stifles new voices in the tech world.

[oss-security]

Your Boss is Spying On You

AI-Enhanced Surveillance

Employees are getting brought back into the office, and as they flow back in, so is corporate surveillance, now with the help of AI. More and more companies are utilizing AI-enhanced surveillance technology to do things such as record keystrokes, mouse movements, websites visited, and applications accessed. 

Some employees have even tried to find workarounds to these invasive methods of surveillance. One way employees are getting around mouse movements is with devices called mouse jigglers. These devices move your mouse for you to get around AI detecting whether you are still working or not. Some companies have begun to catch on to these methods, Wells Fargo even went as far as to fire over a dozen remote workers for using these mouse jigglers. 

Although this technology can enhance a company's productivity and efficiency, it could also negatively affect employees' morale and mental health. This factor isn't often considered as much as it should be, and this technology might just lead to employees being sneakier about their time theft while increasing their stress.

This technology is also in direct conflict with multiple codes in the Software Engineering Code Of Ethics. By looking at some of these codes more in-depth, we can get to the bottom of how companies should be using these technologies more effectively and how they should be developed in the first place. 

Privacy and Code 1.03

One of the first codes in the SWE Code of Ethics is Code 1.03, and it states that a software engineer shall “Approve software only if they have a well-founded belief that it is safe, meets specifications, passes appropriate tests, and does not diminish quality of life, diminish privacy or harm the environment. The ultimate effect of the work should be to the public good”. The specific part of this code I want to look at is whether the software diminishes privacy and quality of life. 

Although corporate surveillance can increase privacy by ensuring that employees don't share company data, it is also a double-edged sword. The only way to increase the privacy of a company's data through surveillance is to decrease the privacy of the employees. This trade-off might be worth it, depending on the situation, but it still goes against the code of ethics.

When it comes to quality of life, employee surveillance only diminishes the quality of life of the employees and doesn't increase it for anyone else. This aspect of the code is pretty clear-cut: if this new level of surveillance causes employees to be stressed, decreases morale, or harms their mental health in general, then it directly violates the code.

Code 2.05

To keep with the theme of privacy, another code in the code of ethics speaks on the privacy of the employees’ data that may be collected through these surveillance technologies. Code 2.05 states that software engineers shall “Keep private any confidential information gained in their professional work, where such confidentiality is consistent with the public interest and consistent with the law”. 

The data collected on employees through surveillance could be extremely private and confidential. These surveillance mechanisms track everything from emails, text messages, and websites visited, so if this data were to be compromised, it could be extremely harmful to those affected. 

During the process of writing these tools to collect and utilize the data of employees, it is crucial that the correct safety measures are put into place. The safety of this data could be overlooked since companies are often focused on keeping their users' data protected, not the employees'.

Code 3.12

There is another code in the software code of ethics that pertains to the topic of privacy when it comes to how software is being made and used. Code 3.12 says that all software engineers shall “Work to develop software and related documents that respect the privacy of those who will be affected by that software”. This once again is a code this is directly broken by the use of invasive AI-enhanced surveillance techniques. The data being collected and, more importantly, how it is being collected with these tools does not respect the privacy of the employees in any way. 

The fact of the matter is that these new methods of surveillance are inherently unethical. This has clearly been shown through three different codes being broken, and the SWE Code of Ethics cleary states that one should “Help develop an organizational environment favorable to acting ethically”. 

How Companies Can Change

If you are an employer, you might be thinking of new ways to determine the productivity of your workers without invading their privacy in new and enhanced ways. Well, although I am sure there are a lot of ways someone could work their way around these codes, I think the more important thing to wonder is why you're basing an employee's productivity off of how often a mouse is moved and not by how much work they are producing. 

Employees should not be punished for how quickly they finish their work, and a 9-to-5 schedule isn't realistic for jobs that are more task-oriented. I understand that in remote-work, it might be easier for an employee to lie about how quickly they finished a task, causing you to pay them for hours in which no further work has been accomplished. But maybe that's a sign that the traditional hourly model doesn’t fit every role. Instead of relying on activity monitoring tools that track mouse movements or keystrokes, employers should shift their focus to outcome-based evaluations.

If an employee consistently meets or exceeds their goals, delivers high-quality work, and contributes effectively to their team, does it matter if they take breaks between tasks or don’t adhere to rigid working hours? Measuring success by actual output rather than arbitrary activity ensures that employees are rewarded for efficiency rather than punished for finishing tasks too quickly.

Of course, not all jobs can operate this way, some roles require real-time availability. But for task-based jobs, companies should consider performance metrics that emphasize results, such as completed projects, customer satisfaction, or overall impact. This approach not only respects employees' autonomy but also fosters a culture of trust and motivation rather than surveillance and micromanagement.

[oss-security]

Welcome to My Security Blog!

Hello! I am a computer science student at Dickinson College and I am going to be writing blog posts on cybersecurity and open source software. Check out my first blog post "OSS Security, Myth, Or Major Concern?", it talks about whether or not OSS is secure and how the stigma around OSS's security could be hindering innovation and progress in tech and society.

[oss-security]

 OSS Security, Myth, or Major Concern?

Open Source Software (OSS) is inside some of the most essential companies and applications for society worldwide. However, a persistent stigma around OSS security continues to hinder both innovation and widespread adoption. When it came to asking people what their main concern about OSS is, 53% said security.

Many people become worried when they see that the code base is open to anyone or that it could be unmaintained or written by people with bad coding habits. There is also concern that companies may neglect to track updates to the source code, leaving them with outdated versions that pose security risks. But are these concerns truly valid? And if so, does that necessarily make proprietary software safer than OSS? Let's look a little deeper into some of the main security concerns in OSS and then look at why OSS may be a lot safer than people think.

One of the main reasons people feel that OSS is unsafe is because the code base is not proprietary, meaning that anyone can look at all of the code that makes up the application. This worries people because if attackers can look at the code of an application, they believe that it would be very easy to find its vulnerabilities. Another reason people are often worried about the security of OSS is whether or not the code is maintained. Although rare, people fear that the contributors to the software they are using will either stop maintaining certain parts of their software or leave the project entirely. Another worry is that even if the code is being maintained, the company using the software might not update to the latest versions that are being put out. 

Outdated software, whether it is from the contributors not maintaining their software, or the company not acquiring the new updates, can lead to significant security risks. When a new update of software comes out companies will often publicly post the bugs and issues they fixed, which is informing all attackers what was wrong with the older versions. Some people also believe that those contributing to OSS are often immature and have bad developer practices. If the contributors were to have bad coding habits they could cause a lot of vulnerabilities such as hardcoding credentials or improper error handling. 

While these concerns hold some validity, discussions around OSS security often overlook that many of these risks also apply to proprietary software. Let's start with some security risks that don’t apply to proprietary software. An open code base is something unique to OSS, however, I believe that this aspect of OSS benefits its level of security more than it compromises it. 

There is a law called Linus’s Law named after Linus Torvalds (The creator of Linux) that says “Many eyes make any bug shallow”. This law refers to the thought that with enough contributors and coding enthusiasts looking at your code, a small amount of them might try and exploit the vulnerabilities they find, but the majority will alert the developers or fix it themselves. I believe in this law and that with many eyes looking at a codebase, vulnerabilities are more likely to be found but also addressed and remediated quickly. 

Another concern of those who feel that OSS is unsafe fear that companies may not keep up to date with the source code updates. Although this is a valid concern, it is not an issue with OSS, it is a problem with a company's internal processes. This should not be listed as a security concern of OSS because it is up to the individual to regularly update the newest software that is available.

All of these reasons for OSS being unsafe or safe can be debated and argued about, but physical data is much harder to ignore. The Coverity Scan Open Source Report is an annual report that analyzes the quality and security of OSS. This report states that the average OSS is of a higher quality than proprietary software. This data not only proves that contributors to OSS do not have bad coding habits, but it also proves that OSS, even though not perfect, is of a higher standard when it comes to security than proprietary software.

I believe the stigma that OSS is unsafe has limited the level of innovation and progress society has made in all realms of software. Who knows how many beneficial pieces of software could’ve been created if it weren't for this stigma, and how that software would affect the world?

The misconception that OSS is inherently unsafe has discouraged its adoption in many sectors, which limits opportunities for societal progress. This hesitancy has most likely curbed the development of groundbreaking solutions in areas like healthcare, education, and environmental sustainability, where open-source innovation could provide affordable and scalable tools for global challenges.

Addressing these misconceptions opens the door to greater innovation, allowing open-source communities to create secure, high-quality software that meets society's evolving needs.