Wonder if they could stretch the law even further and do per customer canaries? We won't tell you that we've handed your data over because we can't, but we will tell you if we didn't.
Cloudflare expands its government warrant canaries
41–50 of 163 posts
Re: Cloudflare expands its government warrant canaries
#42Here is what I don't understand: On my website I can make every path resolve. I.e., I can have www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad Render a page that says: > I haven't been paid off by the Mossad Easy peasy. Then, if I take a grubby payment to fuck over a client (with an NDA, of course) I don't write about it, I just make that one path fail to resolve. It's writing by omission. This is why I'm ideo…
They are just good for business.
No company is going to defy an order from a secret court or a NSL that states they are not to modify statements on their website until further notice. People will dispute the legality of such orders, but companies know how long they can be off the internet before going out of business. At least, that is based on conversations I have had with a corporate legal executive.
Re: Cloudflare expands its government warrant canaries
#43>has never terminated a customer or taken down content due to political pressure https://blog.cloudflare.com/why-we-terminated-daily-stormer/ No comment on whether or not the termination was justified.
Maybe it should read "external political pressure"?
If we have to parse these things with our own suppositions to make them true, the canary is already dead.
Re: Cloudflare expands its government warrant canaries
#44> Cloudflare has never modified the intended destination of DNS responses at the request of law enforcement or another third party. Didn't they modify the DNS responses of mit.edu to point back to MIT (during the 2013 domain hijack incident)? This canary seems a bit ambiguous.
I assume by "third party" they mean an outside request from someone who doesn't own the service they're hosting. MIT is unambiguously the first-party owner of MIT.edu, even though a third party used Cloudflare to hijack it.
Re: Cloudflare expands its government warrant canaries
#45Earlier quoted context omitted.
The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!" The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not. If you put a gag order on me and suggest…
I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request wh…
Maybe you don't actively do anything. It is the absence of action.
You don't REMOVE a warrant canary. You DO NOT update it.
As of date X we have not been forced to do BAD THING.
I simply stop updating X on the notice.
In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING.
I didn't take any action to disclose anything. I simply stopped updating something.
Re: Cloudflare expands its government warrant canaries
#46Earlier quoted context omitted.
I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request wh…
Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…
> I didn't take any action to disclose anything. I simply stopped updating something.
This might work if judges are fucking idiots.
Re: Cloudflare expands its government warrant canaries
#47These canaries seem overly specific. > [To date, the company] has never installed any law enforcement software or equipment anywhere on our network; Someone else might have, or they might have allowed other people to do so.
Being overly specific is one potential problem.
Another is that the person who routinely updates the canary might be UNAWARE that the company has been forced to do some bad thing.
Maybe the General Counsel has been notified and gagged. It seems that maybe the General Counsel should be the person who routinely updates the canary. Come in to work. Get coffee. Check messages. Update canary. Read news. Attend daily meeting. Etc.
Just skip that Update canary part. You didn't actively do anything to disclose anything. It was lack of action. You didn't actively communicate anything. You just changed your daily routine.
It is important that the person who updates the canary is the one who KNOWS whether the company has been forced to do something bad.
Re: Cloudflare expands its government warrant canaries
#48The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…
Glad you guys included this part:
> "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations."
That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by authorities taking over private keys and doing it themselves? Canaries appear to be pretty much untested in court.
Re: Cloudflare expands its government warrant canaries
#49Here is what I don't understand: On my website I can make every path resolve. I.e., I can have www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad Render a page that says: > I haven't been paid off by the Mossad Easy peasy. Then, if I take a grubby payment to fuck over a client (with an NDA, of course) I don't write about it, I just make that one path fail to resolve. It's writing by omission. This is why I'm ideo…
To make the path stop resolving, you'd have to perform an action (update the server, etc.).
These canaries are not automatically updated: they are manually updated (that's the whole point).
If you receive a gag order you just do nothing.
Re: Cloudflare expands its government warrant canaries
#50Earlier quoted context omitted.
I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request wh…
Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…
Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished!
Judges do not think like that though.
Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But since some of the dll's were also used in other parts of the OS, this version of Windows could not run. But they had complied with the ruling!
Microsoft thought it was very unfair when they were ruled in contempt of court.