Live data from Hacker News

Yahoo installed a backdoor for the NSA behind the back of the security team

diracdeltas.github.io

81–90 of 302 posts

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#81

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

For its EECS undergrads, Berkeley requires CS 195: "Social Implications of Computing".

http://inst.eecs.berkeley.edu/~cs195/fa16/about.html

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#82
post #55
post #46

Earlier quoted context omitted.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

All that would accomplish is that you and everyone you sent this letter to would now be subject to another NSL with a gag order, and your fix would be undone.

I don't see how a gag order can scale to hundreds of people without the subject matter becoming common knowledge.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#83
post #62
post #53

Earlier quoted context omitted.

Wow. This is probably the worst comment I've ever seen on HN. You're suggesting that people who follow the law, which you disagree with, get blacklisted, following the model of criminals killing other criminals who follow the law. If you want to change the government, there are far better ways than retaliating against citizens unwilling to risk life and limb for your ideology. I think you need to learn to direct your…

So now, quitting your job (because you're asked to do something unethical) is the equivalent of losing your life and limbs? Let me guess, you believe all government actions are lawful. All lawful actions are righteous and justified. The only permissible way to change the system is through the system. Did I get the gist of your morality? In which case, keep voting and I'm sure you will see the changes you want reflect…

> So now, quitting your job (because you're asked to do something unethical) is the equivalent of losing your life and limbs?

It's an expression. How about "Losing your livelyhood." It's a real thing for some people.

> Let me guess, you believe all government actions are lawful. All lawful actions are righteous and justified. The only permissible way to change the system is through the system. Did I get the gist of your morality?

You're way off on my morality. It's more centered on not causing harm to others, which is what you're suggesting people do, to others that don't fit your sense of morality.

> In which case, keep voting and I'm sure you will see the changes you want reflected in legislation just so they can be ignored in by secret courts and intelligence services. In the real world, people respond to threats (e.g prison). That's what the government uses. Why are we expected to behave differently?

Do you really think voting or threats are the only two methods to enact change? Neither work particularly well. What does work well is changing the opinion of the majority, and until you do that, you must question whether your minority opinion is actually the correct one, and provide reasons for others to change their opinion of you believe it to be so. Taking the low road and suggesting punishing people who aren't the cause will get you nothing but negative comments on hackernews.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#84
post #53
post #50

Earlier quoted context omitted.

This is why we (as a community/industry) need to have the equivalent of a prison/death threat. The government wins by making it personal, by threatening prison and death for your obedience. It's not an abstract threat. It is directed to a specific person not a company or security team. The people who comply can quit those companies but they don't. I'm not referring to the ones down the chain (e.g the security team wh…

Wow. This is probably the worst comment I've ever seen on HN. You're suggesting that people who follow the law, which you disagree with, get blacklisted, following the model of criminals killing other criminals who follow the law. If you want to change the government, there are far better ways than retaliating against citizens unwilling to risk life and limb for your ideology. I think you need to learn to direct your…

While I do think the concept of community ostracision is impractical (because there is never only one tech community to start with) - "I just followed the law" is never a moral free pass. Given that what law means actually is daily debated in courtrooms it's not only morally hollow, it's uncomputable to an individual in the general sense.

"I just did what the authority figure told me to" is one the oldest excuses in the book.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#85
post #46

Earlier quoted context omitted.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

If you want to quit to refuse to help, fine, but I take serious issue with what you're suggesting beyond that. These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable. Further, you don't know what mot…

> You could be impeding the investigation into a deadly plot.

We have warrants for that. Subpoena Yahoo for specific records. I'm not willing to trade the freedom of an entire country for a single investigation. This isn't an episode of 24 and there is no Jack Bauer.

The fourth amendment was sold as follows:

> The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

I'm not a constitutional lawyer. I'm sure the actual amendment can be interpreted to mean whatever George W and Co want it to mean. But that's not how it was sold, and this government is not legitimate as far as I'm concerned. Not as long as it runs dragnet surveillance over the American people. Snowden is a patriot and the U.S gov't is betraying the public.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#86

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

>messing with its AS-adjacency topology in non-free ways at OSI layers 1-3

Can you please explain how this works? I would like to understand.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#87
post #66
post #9

Earlier quoted context omitted.

I think it's irrelevant in practice. (In theory, that's an interesting question) You're not making the decision to make this public. If you're on the security team, you're going to notify the boss, and at that scale of the system compromise this goes all the way to the top. At that point someone who knows about the gag order is in the chain. The only scenario where I think the question matters is if you do something…

Let's say an unaffiliated third party (white-hat hacker) found the exploit and reported it to you under a Bug Bounty program. Let's also say that that third-party was someone who followed "responsible disclosure" rules, and said that they'd publicize the vulnerability if you didn't do so yourself within a short time-frame. You investigate (by asking your team, your boss, looking at the bug tracker, etc.) and figure o…

You talk to your boss. Your boss talks to the NSA. The NSA will find a way to silence the white-hat. Problem solved.

Philosophical dilemmas are fun to talk about, but only as long as you take the premises as granted. People who carry swords tend not to waste time trying to disentangle knots that they can simply cut in half. Most "technical" solutions to "human" problems suffer this vulnerability.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#88

Earlier quoted context omitted.

I don't know how common this is in general, but an ethics course was a required part of the engineering core curricula at my school (Case Western Reserve). Ultimately, though, an ethics course isn't going to make people stand up for their ethics. A professional organization along the lines of the American Medical Association (at least in terms of political strength) that stands up for its members and censures those w…

If you can professionalize a certain set of ethics, you can make it impossible for your employer to find anyone to complete the job. For example, capital punishment is increasingly hard to carry out because anesthesiologists refuse to participate and drug companies won't supply the drug.

I'm not sure the capital punishment part is a good comparison... It's because north american governments are squeamish about solutions that look brutal but efficient. I'm sure that if a state wanted to implement capital punishment via firing squad and advertised for death penalty proponent rifle marksmen they would have no lack of candidates.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#89
post #46

Earlier quoted context omitted.

Options: - Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them. - Announce what is going on anonymously. Plenty of avenues for this. - Announce what is going on, publicly. See if they do indeed want to take you to court. - Quit. - Take down the service. Much easier if the service is only a part of your company. Helps…

If you want to quit to refuse to help, fine, but I take serious issue with what you're suggesting beyond that. These are the legal actions of the United States government, executing the authority given to them to the people's elected representatives, and overseen by a judiciary duly selected according the constitutional procedures. Their legal and democratic authority is unassailable. Further, you don't know what mot…

I'm not so sure of that. For example, it's not clear that Congress has the authority to create NSLs, a sort of not-a-warrant. It's not clear that they can issue gag orders like this. Even if they could do these things with warrants, they're not---and that matters.

The judiciary is not meaningfully overseeing the parts of the state where law enforcement and national security intelligence mix. The FISC is a great example: it pisses off the agents and attorneys who have to deal with it, because it imposes an unholy amount of drag: they're trying to do their jobs, catch bad guys, etc.---and a FISC submission takes weeks of full-time work. But the FISC only exercises drag, not control. It can't steer---we see this because it never refuses a request. I suspect that's all one-sided proceedings can do, given the way we train our lawyers and judges. So it fails the needs of the citizens, and it doesn't protect liberty.

The FISC, and NSLs, will someday be looked at with the same light as Adams' Alien & Sedition Acts: as fundamental betrayals of the American promise by an executive too scared of what might go wrong to trust the country to go right.

Look, there's a lay assault on their legal and democratic authority: NSLs are not obviously a legitimate exercise of Federal authority. And for all that, if I were at the FBI and chasing a terrorist cell on American soil, I'd use one in an instant.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#90

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

>messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 Can you please explain how this works? I would like to understand.

example: all ISPs in Iran are required by law to be downstream of the single government run ASN, which controls all paths for data in and out of the country: https://www.google.com/search?q=DCI+iran+ASN&ie=utf-8&oe=utf...

example: the turkish government orders ISPs to null route IP blocks of things they disagree with (occasionally all of youtube).

Post reply on HN