31–40 of 101 posts
Credit where credit is due. This is exactly the right approach. If only other governments would follow suit.
It's nice, meanwhile "we" now have a law being debated by government (not sure it will pass) that allows the government to hack individuals if they are suspect, this may even happen via people the suspect may know. It even includes being allowed to install spyware on a webcam. But I guess it is good to leave encryption strong, forget about mass surveillance and focus energy on individuals actually suspected of a crim…
Minister Steur (Security and Justice) this monday said, representing the second chamber, that "laws that prohibit encryption are not desirable at this time". That doesn't retract their early statement, but I think it's an important nuance. Arguably, it might also just be political play to get some douchebag rightwing parties over the line. (dutch source http://tweakers.net/nieuws/107104/kabinet-beperking-van-encr...)
Similarly, in december, a law was passed that allows authorities to hack 'criminals' without a warrant. In many countries, (liberty) activists are criminals too.
That said, I still appreciate where things are going. Privacy is a very tough political climate and I think it's solid that we (the Dutch) take this standpoint. Baby steps.
Wasn't OpenSSL quite vulnerable and not recommended to use few years back and people were phasing it out? Or am I mistaking this with something else?
You're a bit mistaken. A lot of FOSS political warrghble happened, but OpenSSL still remains the most audited and used SSL library out there. Yes, it may have bugs. Yes, the NSA may have tampered with the standards themselves (that everyone else must also implement, else risk compatiblity issues in some areas). But there are no drop in alternatives that aren't based on the same codebase, and almost no one is using an…
This statement was made early December. And I think it does deserve some nuance: Minister Steur (Security and Justice) this monday said, representing the second chamber, that "laws that prohibit encryption are not desirable at this time ". That doesn't retract their early statement, but I think it's an important nuance. Arguably, it might also just be political play to get some douchebag rightwing parties over the li…
Also, the money going to OpenSSL and others is completely unrelated to the current encryption banning talks going on in the Netherlands. This is a great initiative that should be applauded.
I agree with your conclusion though, but I am very weary of the dutch MoD.
It's nice, meanwhile "we" now have a law being debated by government (not sure it will pass) that allows the government to hack individuals if they are suspect, this may even happen via people the suspect may know. It even includes being allowed to install spyware on a webcam. But I guess it is good to leave encryption strong, forget about mass surveillance and focus energy on individuals actually suspected of a crim…
If there is a reasonable suspicion I don't see the problem with giving law enforcement the legal ability to hack their targets. This is something very different from drag-net surveillance and should not be tainted with the same stigma. It's not like the government actually _needs_ or wants to maintain giant botnets of all the targets they've hacked.
Also, one very bothersome side effect of government-sanctioned hacking is that governments have an incentive not to notify software vendors about vulnerabilities.
This statement was made early December. And I think it does deserve some nuance: Minister Steur (Security and Justice) this monday said, representing the second chamber, that "laws that prohibit encryption are not desirable at this time ". That doesn't retract their early statement, but I think it's an important nuance. Arguably, it might also just be political play to get some douchebag rightwing parties over the li…
I think this needs a whole lot more nuance. Minister Steur said that the laws are not desirable at this time, after other cabinet members said it will hurt economic relations. This is not a statement saying we don't want this, this is a statement saying we can't do this right now. Also, the money going to OpenSSL and others is completely unrelated to the current encryption banning talks going on in the Netherlands. T…
Earlier quoted context omitted.
You're a bit mistaken. A lot of FOSS political warrghble happened, but OpenSSL still remains the most audited and used SSL library out there. Yes, it may have bugs. Yes, the NSA may have tampered with the standards themselves (that everyone else must also implement, else risk compatiblity issues in some areas). But there are no drop in alternatives that aren't based on the same codebase, and almost no one is using an…
FWIW, LibreSSL replaced OpenSSL in OpenBSD 5.6 -- over a year ago.
$ /usr/bin/ssh -V
OpenSSH_6.9p1, LibreSSL 2.1.8Earlier quoted context omitted.
Without knowing the details, I think this sounds fine as long as there is reasonable suspicion, it is approved by a court or judge, and a warrant is issued to conduct the surveillance.
Indeed, it is the way to go imo, it is akin to a steak-out, hacking friends and family though... a bit fishy.
This seems to go against the Dutch Constitution, so hopefully people are fighting this.