21–30 of 163 posts
>has never terminated a customer or taken down content due to political pressure https://blog.cloudflare.com/why-we-terminated-daily-stormer/ No comment on whether or not the termination was justified.
> Our terms of service reserve the right for us to terminate users of our network at our sole discretion. By political pressure they mean pressure from a political entity, that is, a government. That's what I'm assuming anyways, I'd love for a Cloudflare representative to confirm.
The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…
Earlier quoted context omitted.
" If they stay there without change, that indicates something too." Usually they stipulate that they are to be updated every X days/weeks/months/whatever. So if you see one that promises to update every Monday, for instance, and it's old, that would be the same as being abandoned.
Ideally, sure. But even CloudFlare's doesnt indicate any sort of update date that I can see: https://www.cloudflare.com/transparency/
In my mind, the "correct" way to do this is to:
1) pgp sign the entire warrant canary statement with a published key.
2) add unfakeable news headlines to the canary itself (such as recent stock prices or sports scores)
3) date the warrant canary and include a well defined schedule of updates
I believe this is the authoritative example:
unpopular opinion: the main point of these canaries is PR. As far as I understand (and I understand nearly nothing about US law, so pinch of salt blah blah), exploiting legal loopholes is something that makes people excited and talk about your product, but doesn't really change anything in a court. If you assume the US govt is an adversary or potential adversary, and you assume that they are fairly powerful through d…
* A online warrant statement canary that disappears when it does not apply anymore. If there is a gag order preventing this Cloudfare promises to challenge this in the court.
>if Cloudflare were asked to take an action violating one of the warrant canaries, we would pursue legal remedies challenging the request in order to protect our customers from what we believe are improper, illegal, or unconstitutional requests.
* A periodically given statement. For example in annual letter to shareholders or periodic transparency update It's very hard or impossible for the western governments to force companies to give misleading statements to consumers and shareholders.
* Caveat: If there is a gag order that prevents informing the people responsible for any public statements, nothing works. Usually the company lawyers know. For example: Coudfare HQ may not know what their workers in France are asked to do.
Earlier quoted context omitted.
But isn't the primary point of the canaries to give people the information that the government has been requesting some sort of information? A secondary point would be that this might prevent the government from doing so in the first place.
If the government has declared that giving people such information is illegal, it doesn't matter how that information is conveyed.
The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…
I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?
Or our ZFS filesystems are actually raid-5 ext2 volumes and we fake the snapshots.
Or one of the locations is just running in my basement.
There are all kinds of ways for a service provider to act in bad faith. In many ways, the warrant canary is an attempt to signal what kind of people we are and the manner in which we act in good faith.
> Cloudflare has never modified the intended destination of DNS responses at the request of law enforcement or another third party. Didn't they modify the DNS responses of mit.edu to point back to MIT (during the 2013 domain hijack incident)? This canary seems a bit ambiguous.
The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…
I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?
The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…
I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?
Three-letter government agencies can't both comply with the law and at the same time force you to break the law.