An Open Letter from a dissident to Microsoft & Silicon Valley
---

Hello,

I am writing this specifically to Microsoft and their compiler development team, but its directly applicable to all of silicon valley. I am purposefully omitting my nationality because some people find it hard to talk honestly about their government and that tends to make redress difficult as a by-product of their own biases, you can substitute any relevant references to a government with the one of your choice because the problem I face and pose is universal.

Before I get to an explanation of my circumstances, I would like to explain why I am specifically addressing this to Microsoft and the MSVC/core compiler team. My background is probably like a lot of people my age and starts in open source and Linux where I learned to program. Over time, I expanded and became probably one of the most vocal advocates of Microsoft's products-- for all the things wrong with it, they're generally much better developed, far more robust and just superior in terms of quality and this extends to the compiler and development environment as well. The code generation from MSVC is simply unmatched, in terms of security enhancements, it is questionable why anyone would use any other compiler to target a Microsoft platform. The problems that come from Microsoft products are often things that are a byproduct of having sophisticated feature sets whose core concepts simply don't even exist on other platforms. I can immediately rattle off a great number of things and arguments contrary to popular view that's firmly rooted in the data to support my views, but the base of it is that I use Microsoft products almost exclusively and for very particular reasons.

However, if current trends continue, I will likely be forced to seek alternative platforms and software to achieve my ends, however before I explain why, I'd like to tell you a little about myself.

I, am a dissident. It's less a matter of choice and more a matter of circumstances that I was propelled into through a series of unfortunate circumstances, but the ultimate reality of this is that I am irrelevant of cause or reason. Which country I speak of is sort of irrelevant, my experiences could equally apply to any number of countries. My network access is always hostile and requires out of band verification for anything important. My home is routinely broken into, so I have to keep important electronics on my person at all times and had to develop pretty involved routines to keep them safe. I have had varying degrees of surveillance for years, so even when I find a network drop that I can trust I generally have a limited window before things seem to start going wrong. I cannot even just buy electronics online like you do because my packages are at least sometimes rerouted to other locations for unexplained reasons and my computers, phones, etc arrive to me compromised.

One of the most common things I've encountered is industrial sabotage with a particular focus on undermining the compiler. For instance, I had a computer I kept offline in my basement that I eventually discovered that the compiler was generating very strange code for in the sense that the optimizer would optimize out key portions of programs for no apparent reason, or the compiler would explicitly told to use a type of one width only to generate code of a different width causing loops to sometimes not be bounded correctly and so on. In other instances, the hardware itself would begin to malfunction or the network would do things like return 300+ SYN-ACKs for every packet my application sent with the SYN flag sent irrelevant of remote destination and so on.

Suffice to say, I exist in a world that many people cannot fathom and this holds especially true in computing and information security.

* My gripe to you and to other similar vendors is this; you've moved to a continuous integration model that is great and works for most people, but enhances oppression where it exists. I am no longer capable of verifying whether a MSVC installation I've received is as the vendor shipped it because ISOs are no longer available and with them went cryptographic checksums. Even after the contortion that is required to do an offline installation is finished, a user is then presented with a product that disables itself unless it is activated online.

In our rush to tailor and personalize everything, we created an internet experience in which no two people can be certain that their internet experience is the same which is something tailored access operations depends upon. By putting everything into the cloud, we've consolidated the choke-points and points of failure under the pretense that there is nothing of concern by doing so even though things like the Lavabit affair demonstrate that there pretty clearly is.

I can get data from Intel for verification of my bios, but I have to get it online in a manner that there is no way for me to verify that what I received is legitimate. I cannot verify that my compiler is as its developers shipped it, that I have to jump through hoops to install and even then only to discover that I have to jump through even more hoops and that the entire offline installation is moot because I then need to put the computer back online in order to use the product for absolutely no reason of function at all. Virtually all of our dispute resolution mechanisms are becoming more and more automated, which if you've ever had a facebook account randomly get suspended for an invalid claim about the real name policy that continued to apply even after you submitted your identification or a twitter account where political content just vanishes or the account gets disappeared under equally bogus claims only to receive automated replies to queries about what the impetus for suspension even was that never lifts the suspension-- then the idea of automating everything becomes terrifying.

In other words, we ship products that cannot be verified as authentic exclusively over networks that cannot be coerced into being safe to provide services that cannot be verified to not be quantum inserted/tampered with because of advertising personalization, so that we can have dispute resolution mechanisms that are easily subverted.

* I strongly urge you, Microsoft, to reconsider your position on providing ISOs and mandating online activation; I urge all providers to provide options to opt-out of history and personalized advertising and finally, where feasible in the business realm, to always make available humans that can be spoken to, ideally in person if necessary (although I understand this isn't always possible due to business realities). It doesn't matter whether we speak of Russia, China, the USA or Cuba-- these are all very real problems for some people and we are making an internet environment that is actively hostile to them and implausible for them to operate upon, which further creates a feedback loop where we continually have to guess what such people need for tools in the first place in order to advance their agendas against such governments-- so here, I'll tell you, I need the ability to make my own tools and your distribution model for your compiler is quickly making that impossible.