Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon threatens to suspend Signal's AWS account over censorship circumvention

signal.org

Post reply on HN
Print view View original

171–180 of 519 posts

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#171

Post by mpartel »

mpartel wrote: post #149
kempbellt wrote: post #53

Earlier quoted context omitted.

I agree. The intent is noble, but this headline makes Amazon look like the bad guy for disapproving unauthorized use of one of their domains, which is quite reasonable.

Amazon and Google are certainly within their rights to refuse this. Allowing domain fronting is likely to put quite a lot of their money at risk, so this outcome is unsurprising, but it's still the less ethical one. This might be the only possible outcome given a corporation's legal responsibilities to its shareholders etc, I don't know all that well enough, but I think it's still justified to lower my opinion of Goo…

I realized I glossed over the fact that this would put other AWS/GAE customers's money at risk too. This complicates matters somewhat, and some (I believe a negligible number of) customers might switch to an unblocked competitor.

Personally this weakens my view a little, but is not enough to change it substantially.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#172

Post by analognoise »

andrepd wrote: post #153
unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

Morally, it's still the right thing to do, even though I guess it's in amazon's best interests not to allow it.

How is it moral for Amazon to shirk their fiduciary duty to shareholders for the sake of a political battle it isn't theirs to wage?

I counter it would be more immoral to put, say, the retirement funds of firefighters and teachers arty risk to achieve what is the responsibility of, say, the State Department?

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#174

Post by tony101 »

drusepth wrote: post #46
pyre wrote: post #16

Earlier quoted context omitted.

The part you're missing is: ... to third parties. They aren't spoofing the domain, they are just making sure that outside parties to an SSL connection will have a difficult time determining where that SSL connection is going. The two parties creating the SSL connection are not lying to each other, though.

Would you mind explaining why this makes the spoofing any more acceptable?

Because this spoofing only prevents the ISP / government censors from seeing the correct destination. I would argue that the ISP and the government censors have no legitimate right to that information in the first place, especially if they use it for oppression.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#175

Post by textmode »

"Unfortunately, a TLS handshake fully exposes the target hostname in plaintext, since the hostname is included in the SNI header in the clear. This remains the case even in TLS 1.3, and it gives a censor all they need."

Does this mean that endpoints that require SNI are potentially contributing to censorship?

Facts: SNI is optional. Not all websites require it. For example, https://signal.org does not require SNI; clients that do not send SNI can be used to fetch this blog post, without exposing the hostname.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#176

Post by adventured »

smileysteve wrote: post #126
criley2 wrote: post #67

Earlier quoted context omitted.

Amazon isn't in the business of forcing oppressive regimes to realize they are oppressive regimes, they are in the business of selling goods and services regardless of the oppressiveness of the regime governing the region where the currency comes from. If you want Amazon to stop doing business with oppressive regimes, contact your politicians about sanctions.

You're not wrong, it would certainly not be in shareholder's financial interest for amazon to take this stance. For the record, U.S. politicians have voted on sanctions on Russia for cyber crimes and brought representatives to the UN raising the issue of their human rights records.

> For the record, U.S. politicians have voted on sanctions on Russia

Indeed, the US nearly destroyed Russia's largest aluminum company - Rusal - recently in a sanctions move against an oligarch close to Putin (Oleg Deripaska, who owns the majority of Rusal).

The best way to deal with oppressive regimes, is generally to go through powerful political bodies/groups, whether the UN, G7, or US Congress. The impact a company like Amazon (or Google, Facebook, etc) can make is very trivial. So trivial as to be meaningless to a typical oppressive regime. Congress, in tandem with large allies, can hammer eg Russia's primitive industrial economy, by comparison, with targeted sanctions on steel, aluminum, whatever.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#177

Post by marme »

smileysteve wrote: post #50
QuinnyPig wrote: post #7

Sorry, I'm not on board with using an Amazon owned domain for this. That's got the potential to get Amazon itself blacklisted in some places, so they're absolutely not going to be okay with it.

Or it forces oppressive regimes to realize that they are being an oppressive regime. Want to censor the internet, fine, send your citizens back to the dark ages; see how long it is until they protest or move.

china did this and it just caused every major service to be recreated for chinese users on their side of the internet

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#178

Post by glogla »

johnwheeler wrote: post #63
icebraining wrote: post #44

Earlier quoted context omitted.

What part of the post shows they feel entitled to it?

The fact that they posted the e-mail from Amazon, so readers could direct the blame at them. You can’t read that blog post and say it’s the most unbiased and objective way they could have presented this, especially if they want to remain on good terms with Amazon, who has done nothing wrong at all.

The blame is with Amazon. They decided to help censorship.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#179

Post by beefield »

freedomben wrote: post #152
beefield wrote: post #127

Earlier quoted context omitted.

> After reading that you will completely understand why "see how long it is until they protest or move" is a silly thing to say. I wonder if you could give TL;DR on this, assuming there is something else than the basic prisoner's dilemma going on?

I'd be happy to give a very brief TL;DR with the disclaimer that I recommend either the book for a full picture or the Michael Malice interview on Joe Rogan's podcast (WARNING: NSFW language) [1] There are a few factors involved (and please bear in mind I'm leaving out a lot of detail here, and this is nowhere near a comprehensive list). 1. There is extensive "brainwashing" regarding the great leader. He is praised f…

Thank you. I think I will add the book on my reading list.

Re: Amazon threatens to suspend Signal's AWS account over censorship circumvention

#180

Post by simias »

dice wrote: post #157
unethical_ban wrote: post #18

They're spoofing identity of non-consenting parties. The cause is noble, but it isn't what the headline would imply. Amazon isn't saying "You can't host encrypted services on our platform", they are saying "You can't use TLS and load balancing hacks to pretend to be us in oppresive countries". And >The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. I…

>You can't use TLS and load balancing hacks to pretend to be us in oppresive countries They're not pretending to be Amazon, they're pretending to initiate a connection to an Amazon domain. The "conversation" goes like so: Clear text request: "Hello, I would like to speak TLS with souq.com" Clear text response: "Why yes, let us do that with these parameters" Encrypted request: "Please give me the page for signal.org/a…

They're arguably impersonating Amazon on the server side by hosting their service behind Amazon's proxies and using a trick to pretend that they're talking to some Amazon service instead of their own.
Post reply on HN