It is not about PR with malicious code, I expect. I think the PR which will have backdoor code wold bump version of some dependency package only. Like the targeted attack on Bitcoin vallet few weeks ago. If you or your company isn't scanning dependencies you would never discover it.
Australia’s vague anti-encryption law sets a dangerous new precedent
201–210 of 265 posts
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#202While I understand why they didn't mention this (because it's not clear if this interpretation of the bill is correct -- given there is currently no common law around it), I would like to point out what is the most concerning thing (to me) about this legislation. It potentially allows the government to turn employees into saboteurs. According to s.317C(6), a "designated service provider" can be someone who has develo…
From what appears in the media it looks like not so much back-door dealings as realpolitik. There is considerable domestic politics in play where the opposition (Australian Labor) party didn't want to get labelled 'soft on terrorism' by a struggling government which is looking for any message to attack the opposition over the xmas holiday period, particularly if there are any 'incidents' during this time. The opposition have requested that the legislation be reviewed and, one would hope, amended when parliament is resumed.
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#203Earlier quoted context omitted.
I was worried about this as well which is why I read the law and commented above. The short answer is: 1. Non-compliance with a TAN/TCN is a civil not a criminal mater 2. As I stated above the law clearly says that it is a defence for non-compliance if a TAN/TCN would compel you to commit a crime in a foreign country. The issue is whether you can be compelled to commit an act in Australia, which would be a crime in a…
It seems like the fine for noncompliance for an individual is 238 "penalty units", which currently corresponds to nearly $50,000 (Australian), unless I misunderstand things. A $50,000 fine is quite serious even for a well-paid software engineer. I agree that a lot of people seem to be catastrophizing this, but it still seems like a pretty big mess. If I end up writing a little library and it gets popular, who's to sa…
> It seems like the fine for noncompliance for an individual is 238 "penalty units", which currently corresponds to nearly $50,000 (Australian), unless I misunderstand things. A $50,000 fine is quite serious even for a well-paid software engineer.
Note that they can always revoke the request they gave you and request a new one. So they can fine you an infinite amount of money and drive you to bankruptcy if they want to. Now, it's possible this would be seen as an abuse of power but you'd need to go to court over it and you can't afford lawyers nearly expensive as the government's.
> If I end up writing a little library and it gets popular, who's to say the spooks won't decide that's where they want the backdoor, and just send me a TAN to the email on my GitHub profile? Very likely not, but it is possible and would cost me at least several thousand dollars in legal bills to figure out how to respond.
TCN, not TAN.
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#204Earlier quoted context omitted.
Pretty simple: there are countries where these activities are highly illegal. I'll become a citizen of one of them instead.
As I said before: it is a defence for non-compliance if a TAN/TCN would compel you to commit a crime in a foreign country That has nothing to do with whether you are an Australian citizen or not. If you are a resident in Austria, these laws do not allow the government to compel you to commit a crime in Austria.
How long until other countries explicitly outlaw complying with TAN/TCNs?
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#205I am an Australian software developer. There is no way I am putting any backdoor into any software I write and I am willing to go to jail if needed. If all us Aussie developers tell the government to go jump this stupid law will fail.
Yep. This is what I'm leaning towards as well. They can't lock us all up!!
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#206(essentially repeating a recent twitter thread here) Imagine you work in a modern software house and you get one of these ... and here I mean you, not your boss, not your coworkers, the govt knocks on your door and demands you put a back door in the thing you are working on at work ... So you write the code ... how do you write the unit test? how do you get it past the code review? the mandatory QA tests? ... all the…
Here's what I would do: send it back to them and tell them to send it to my employer's legal department.
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#207Consider Signal, which is open source and not based in Australia. If AU wants to intercept a signal message, then presumably they would need to either force Google and/or Apple to push a custom app to a specific user, or take over the entire phone (again, via Google or Apple). In the first case, is the app that comes from the app store somehow verifiable, or do you need to build from source to be sure? Is there anything that can be done about the second case (which I suspect is the general intent of this law)
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#208(essentially repeating a recent twitter thread here) Imagine you work in a modern software house and you get one of these ... and here I mean you, not your boss, not your coworkers, the govt knocks on your door and demands you put a back door in the thing you are working on at work ... So you write the code ... how do you write the unit test? how do you get it past the code review? the mandatory QA tests? ... all the…
Good read: Reflections of trusting trust https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...
That said, this requires you to be clever and I don't think anybody can be forced to be clever with a court order, or at least what you describe offers plausible deniability
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#209Earlier quoted context omitted.
Well, I'm working on software systems that are precisely the sort of thing that the Australian government will target with this law (transportation systems), and it is highly likely that these systems will be targeted with a TAN/TCN. In fact, I'm pretty sure that the software segment that I currently work on is going to be hit by this law, and hard, within the next year or so. If I don't get a TAN/TCN request, I'm al…
An easier option than 2 for most Australians: come help build the software industry in New Zealand. It's a 3 hour flight and requires zero paperwork for Aussies to work here (as long as you have no criminal record; so you probably can't move so easily after you disobey one of these requests...).
Now that this is through I'm sure the rest of the five eyes nations will at least try and follow suit.
Our left-leaning party voted for this fucking bullshit too, remember. Jacinda Ardern probably isn't going to save you.
Re: Australia’s vague anti-encryption law sets a dangerous new precedent
#210(essentially repeating a recent twitter thread here) Imagine you work in a modern software house and you get one of these ... and here I mean you, not your boss, not your coworkers, the govt knocks on your door and demands you put a back door in the thing you are working on at work ... So you write the code ... how do you write the unit test? how do you get it past the code review? the mandatory QA tests? ... all the…
Every time you come across a double free bug or some complex concurrency issue that gives an attacker arbitrary write access to a process, remember that you might have been looking at a back door. Someone has an off-by-one error on an array access: is that a back door? Why do you think a backdoor is somehow noticeable in the code?