Cloudflare expands its government warrant canaries
techcrunch.com
Cloudflare expands its government warrant canaries
1–10 of 163 posts
Re: Cloudflare expands its government warrant canaries
#2Potentially naive question, but genuinely curious. How does someone know if a warrant canary has been "abandoned," as the article mentions, or used as intended?
If they disappear, that indicates something. If they stay there without change, that indicates something too. Or am I missing something?
Re: Cloudflare expands its government warrant canaries
#3The rsync.net warrant canary is 13 years old this April:
https://www.rsync.net/resources/notices/canary.txt
"The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[1]
Re: Cloudflare expands its government warrant canaries
#4Potentially naive question, but genuinely curious. How does someone know if a warrant canary has been "abandoned," as the article mentions, or used as intended? If they disappear, that indicates something. If they stay there without change, that indicates something too. Or am I missing something?
" If they stay there without change, that indicates something too."
Usually they stipulate that they are to be updated every X days/weeks/months/whatever. So if you see one that promises to update every Monday, for instance, and it's old, that would be the same as being abandoned.
Re: Cloudflare expands its government warrant canaries
#5unpopular opinion: the main point of these canaries is PR. As far as I understand (and I understand nearly nothing about US law, so pinch of salt blah blah), exploiting legal loopholes is something that makes people excited and talk about your product, but doesn't really change anything in a court.
If you assume the US govt is an adversary or potential adversary, and you assume that they are fairly powerful through direct and indirect influences, then I just can't imagine the NSA or whichever three-letter agency deals with this kind of thing going "oh no, they have canaries, can't do anything there" and going back to spying on private Facebook messages that old people send to each other or whatever they usually do in their free time
Re: Cloudflare expands its government warrant canaries
#6Potentially naive question, but genuinely curious. How does someone know if a warrant canary has been "abandoned," as the article mentions, or used as intended? If they disappear, that indicates something. If they stay there without change, that indicates something too. Or am I missing something?
" If they stay there without change, that indicates something too." Usually they stipulate that they are to be updated every X days/weeks/months/whatever. So if you see one that promises to update every Monday, for instance, and it's old, that would be the same as being abandoned.
What is to stop them from lying? They get a warrant, but don't remove the canary. Later on, someone finds proof of the warrant, but then what? You sue Cloudflare for...what? False advertising?
Re: Cloudflare expands its government warrant canaries
#7>has never installed any law enforcement software or equipment anywhere on our network;
Is the NSA a law enforcement agency? Does looking the other way while an agency installs it count? Can you really know if the hardware you get has not been tampered with by a government agency?
I'm not sure how any company could assure me about these issues.
Re: Cloudflare expands its government warrant canaries
#8>has never terminated a customer or taken down content due to political pressure
https://blog.cloudflare.com/why-we-terminated-daily-stormer/
No comment on whether or not the termination was justified.
Re: Cloudflare expands its government warrant canaries
#9Potentially naive question, but genuinely curious. How does someone know if a warrant canary has been "abandoned," as the article mentions, or used as intended? If they disappear, that indicates something. If they stay there without change, that indicates something too. Or am I missing something?
" If they stay there without change, that indicates something too." Usually they stipulate that they are to be updated every X days/weeks/months/whatever. So if you see one that promises to update every Monday, for instance, and it's old, that would be the same as being abandoned.
Ideally, sure. But even CloudFlare's doesnt indicate any sort of update date that I can see: https://www.cloudflare.com/transparency/
Re: Cloudflare expands its government warrant canaries
#10They still dropped switter without comment tho?