Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikimedia Foundation v. NSA

blog.wikimedia.org

Post reply on HN
Print view View original

71–80 of 117 posts

Re: Wikimedia Foundation v. NSA

#71

Post by overdunk »

jacquesm wrote: post #39
Markoff wrote: post #4

Earlier quoted context omitted.

you mean making huge profits from donations? https://www.washingtonpost.com/news/the-intersect/wp/2015/12...

I have a hard time choosing what's the best thing to come out of the internet: WikiPedia or the Khan Academy. If you're so intent on smearing WikiPedia it would probably help you if you studied it for a bit before spouting off a bunch of nonsense in this thread. I get it: you don't like WikiPedia because they ask you for a donation. Note that you're under no obligation whatsoever to donate and that the content is you…

Wikipedia isn't camel-cased.

Re: Wikimedia Foundation v. NSA

#72

Post by nickpsecurity »

hutzlibu wrote: post #26
asher wrote: post #11

Seems like it's trendy to hate the NSA. It gets conflated with an anti-authoritarian mindset. I wish smart people would gain some perspective - I got some by reading Bamford's books and a new one by Fred Kaplan - Dark Territories, about NSAs painful move to cyber. Some key points: * All the great powers have NSA equivalents. Meaning they play offence and defense in crypto, RF, and cyber. We (USA) can impose restricti…

"In cyber, offense and defense become the same" More details pls. Because it sounds like bs. It is a difference to secure a network and maybe find out who a attacker is - and then attack back - than to just hack everyone you can and build as much hidden botnets as possible. Which would be "offense" "Gentlemen do not read each other's mail". It is indeed a noble statemt. And I'd like to see claims, how that led to US…

It's an obvious consequence of the action. They're not getting others' secrets. Their enemies are still getting theirs. So, their enemies will know their plans but not vice versa. Definitely not a smart way to wage war.

Re: Wikimedia Foundation v. NSA

#73

Post by JumpCrisscross »

sametmax wrote: post #13
asher wrote: post #11

Seems like it's trendy to hate the NSA. It gets conflated with an anti-authoritarian mindset. I wish smart people would gain some perspective - I got some by reading Bamford's books and a new one by Fred Kaplan - Dark Territories, about NSAs painful move to cyber. Some key points: * All the great powers have NSA equivalents. Meaning they play offence and defense in crypto, RF, and cyber. We (USA) can impose restricti…

It's like saying peace is trendy and we should not try to go weaponless. That makes no sense. We all want peace. We all know that peace is not there yet and that without weapons the other countries would take advantage of it. Yet we all know that the weapon oriented society the US has become is a major issue. It's not contradictory, just being honest with yourself.

> It's like saying peace is trendy and we should not try to go weaponless

In physical warfare, the only way to increase your defensive (i.e. deterring) military advantage, relative to an adversary, is to add better materiel. (The other option is to reduce the adversary's material, i.e go to war, which itself requires a military advantage to make sense.)

In "cyber," that's not the case. A hoarded vulnerability may end up being used against your own country. Adding vulnerabilities to your stockpile increases your offensive capability while simultaneously forcing you to leave an opening in your defenses unrepaired. We don't have a good analogy for this in meatspace, which is why it's hard to debate at the political level.

I don't think all vulnerabilities should be automatically extinguished. At the other end of the spectrum, the NSA hoarding bugs in the software that runs disproportionately American infrastructure systems is patently silly.

Re: Wikimedia Foundation v. NSA

#74

Post by mowenz »

sametmax wrote: post #33
dom0 wrote: post #32

Earlier quoted context omitted.

> We all want peace. I don't think that's true, there are clearly many people bent on fueling conflicts and wars, both in- and outside the US.

*In HN. I don't think many people on this forum are war lords. Anyway "we all" is always false, and is just another form of "most people". You must be really lacking of ideas to nitpick on that.

I don't think he is nitpicking at all. The US has too many conflicts, incl wars. 26,000 bombs dropped last year. Extremist fighters funded by the US Gov't (Syria, Iran Contra, and who knows what else has yet to be proven). We have 7 cities with higher murder rates than any country in Africa or the Middle East, including Afghanistan. Largest prison population, a publicly known torture camp... I could go on. But I think a lot on HN are obviously absorbed in their comfortable occupations--they're challenging, interesting and demanding, and also rewarding. It's easy to get lost in this and forget what less fortunate are dealing with.

Re: Wikimedia Foundation v. NSA

#75

Post by pwdisswordfish »

a3_nm wrote: post #30
Markoff wrote: post #18

Earlier quoted context omitted.

i read they have 300 employees who create zero content on Wikipedia which is created by volunteers for free

Speaking as a Wikipedia "volunteer" (or rather "editor"), I think it is in fact a very good idea that the Foundation takes no editorial responsibilities (except reacting to legal challenges via so-called "office actions"). It means that editors don't have to worry about legal, sysadmin, PR, etc.; and conversely WMF is not directly responsible for Wikipedia content. Believe me, it would be silly for WMF to be involved…

> It means that editors don't have to worry about legal, sysadmin, PR, etc.; and conversely WMF is not directly responsible for Wikipedia content.

What's so unimaginable about having separate editorial and legal deparments within the WMF?

> Believe me, it would be silly for WMF to be involved in all editorial disputes about what should or shouldn't be on Wikipedia, how things should be formatted, etc., in all languages.

Having months-long discussions over how to spell the title of a Star Trek film is what I would call silly. Having long-winded, vague and haphazardly enforced policies regarding accuracy, scope and style is what I would call not just silly, but outright tragic.

At the end of the day these decisions have to be made somehow, and I'd rather have them made by some entity which can do so with some consistency and vision, and is willing to enforce those decisions, instead of having them made by the ever-changing whims of an amorphous mob throwing around thought-terminating clichés like 'consensus can change' and 'ignore all rules'. (Though I'm not confident that the WMF, as it is, is actually capable of being one.)

Re: Wikimedia Foundation v. NSA

#76

Post by asher »

walshemj wrote: post #47
freeflight wrote: post #40

Earlier quoted context omitted.

This isn't meant as an attack on the OP, but I have a hard time taking anybody seriously who's using the word "cyber" in such an inflated way. Always reminds me of this: https://twitter.com/sehnaoui/status/643972826802688000 I also think it's quite troublesome how this very real issue, IT security, is being misused to stage yet another "War on something" even if there isn't anything concrete to wage a war on. If ther…

Like it or not the "cyber" is now the term that is used

Yes, Kaplan's book touches on the silliness of the term (it was consciously borrowed from William Gibson) but policy makers and advocates seem to use it in discussion. Of course there are more impressive terms when needed, like "Information Warfare".

Re: Wikimedia Foundation v. NSA

#77

Post by asher »

AnthonyMouse wrote: post #53
walshemj wrote: post #47

Earlier quoted context omitted.

Like it or not the "cyber" is now the term that is used

People don't just make fun of "cyber" because it sounds stupid, they also make fun of it because it is stupid. The media literally portrays the threat as Tron, when it's actually that critical systems have remotely exploitable vulnerabilities. The only real solution is to find the vulnerabilities before the bad guys do so we can close them before they're exploited. Hoarding vulnerabilities in secret is the exact oppo…

I used to think like that. But consider two things. The capabilities of the state actors are high. They cooperate with chipmakers and OS makers (or subvert or hack them). They compromise routers and hard drive firmware. Second, Kaplan's book documents multiple waves of cyber-fear in the US government; multiple US presidents starting with Reagan have tried and failed to secure our vulnerable systems. Simply put, corporations are not going to let NSA dictate security practices to them, because they need to make money and can't spend all day on security. Similar problems occur in military/government.

Remember how cannons made castles obsolete? We're in a similar era, where offense is outstripping defense.

Consider stuxnet. You have to assume Iran, which is smart enough to make nuclear weapons, took its best shot at securing that air-gapped network.

I think you have to accept that hoarding vulns is the international reality and difficult to change. Maybe a cyber-SALT treaty could change it.

Re: Wikimedia Foundation v. NSA

#78

Post by freneticfox »

dkruger wrote: post #63
orf wrote: post #52

Earlier quoted context omitted.

You've postured a lot in this thread about the number if employees Wikimedia has. So, put your money where your mouth is and defend your position. Which 90% would you cut, and why? Here is a list of their employees: https://wikimediafoundation.org/wiki/Staff_and_contractors Perhaps they could tighten their belt a little bit, but to think that you can run a foundation with the size and scope of Wikimedia with ~30 empl…

> Which 90% would you cut, and why? (Senior) Software Engineers : The site already exists. What could they possibly be engineering? Clearly all these positions can be axed and replaced by a few volunteers or an intern for the occasional maintenance patch. Even that is probably unnecessary - the site generally works fine for me. QA : See above Product : This isn't a product, it's a website. Obviously this entire secti…

SE/QA/Prod/Mobile - No piece of software can see such broad use by millions without constantly evolving to meet the ever-changing needs of users, the ever-changing blend of user agent / browser software, and the ever-changing and hostile environment of the internet itself. If you think you've ever seen a complex internet-based software project simply become perfect and then need no further changes for a decade or more, you clearly don't understand software engineering.

Discovery - This is about discover-ability of the content itself, e.g. search engines both internal and external, and other related matters.

Research - Try branching out a bit from the links and information at https://www.mediawiki.org/wiki/Wikimedia_Research/Research_a... for a more informed opinion

Security - Actually, a lot of people care about hacking an encyclopedia. Just on the server side they care about hacking the ~1000 servers that are servicing or operating on the private data of millions of users.

Traffic - It's a sub-set of Operations that deals specifically with the edge of the foundation's network (e.g. CDN-like things, for which they don't outsource a commercial CDN mostly for privacy reasons: spreading edge caches around the world, low-level performance optimization, SSL encryption, etc).

Cloud Services - This is where the foundation hosts virtual server resources for community volunteers to experiment with and run projects and products of their own that are relevant, e.g. "bot" software that patrols articles for likely vandalism attempts and such.

Re: Wikimedia Foundation v. NSA

#79

Post by KGIII »

orf wrote: post #52
Markoff wrote: post #48

Earlier quoted context omitted.

the issue is, the site itself they could run with 10% of current employees and they would have funds to run it for years without threatening donation banners each year

You've postured a lot in this thread about the number if employees Wikimedia has. So, put your money where your mouth is and defend your position. Which 90% would you cut, and why? Here is a list of their employees: https://wikimediafoundation.org/wiki/Staff_and_contractors Perhaps they could tighten their belt a little bit, but to think that you can run a foundation with the size and scope of Wikimedia with ~30 empl…

I am kinda confused why they are unhappy that people are employed. I don't get it.

Like I said, I value what they provide and will continue to donate.

Re: Wikimedia Foundation v. NSA

#80

Post by fweespeech »

asher wrote: post #11

Seems like it's trendy to hate the NSA. It gets conflated with an anti-authoritarian mindset. I wish smart people would gain some perspective - I got some by reading Bamford's books and a new one by Fred Kaplan - Dark Territories, about NSAs painful move to cyber. Some key points: * All the great powers have NSA equivalents. Meaning they play offence and defense in crypto, RF, and cyber. We (USA) can impose restricti…

> Seems like it's trendy to hate the NSA. It gets conflated with an anti-authoritarian mindset. I wish smart people would gain some perspective - I got some by reading Bamford's books and a new one by Fred Kaplan - Dark Territories, about NSAs painful move to cyber. Some key points:

> * All the great powers have NSA equivalents. Meaning they play offence and defense in crypto, RF, and cyber. We (USA) can impose restrictions on our NSA but not on anyone else's. Our exploit-riddled networks are a playground for American, Russian and Chinese cyber warriors - and probably many others.

> * In cyber, offense and defense become the same. Kaplan's book covers this. So a smart country seeks cyber-superiority. The more we hamper NSA, the more we empower foreign cyber-warriors.

Reducing domestic surveillance doesn't substantially impact that mission.

> * Fear of an overreaching state is always justified; however we should focus that fear more on how NSA shares data than how it acquires it. For instance fusion centers: https://www.eff.org/deeplinks/2014/04/why-fusion-centers-mat....

The CIA/NSA can't hold onto its intelligence as shown by various security breaches, whistleblowers, etc.

Not gathering domestic surveillance data in the first place avoids that problem. The NSA can keep an eye on China, Russia, etc. all they want.

Post reply on HN