Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

101–110 of 163 posts

Re: Cloudflare expands its government warrant canaries

#101

Does anyone have a list of instances where a warrant canary was _succesfully_ used to signal government surveillance or other court order, that the company involved would have been otherwise legally forbidden to communicate? It's been at least a decade since the 'warrant canary' was proposed. We _know_ the government has been doing all sorts of things by sealed court order in that decade. I'm not sure it has proven u…

Where _succesfully_ also means that they didn't end in jail.

Edit: hail -> jail. Thanks.

Re: Cloudflare expands its government warrant canaries

#102
post #50

Earlier quoted context omitted.

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But s…

Does this mean that if you were screaming from the rooftops "I'VE DONE NOTHING WRONG" every day leading up to the gag order and then you stop screaming from the rooftops that you'll be in contempt of court? Can the court compel you to continue with behaviour to cover something up? Would that be akin to conspiracy to commit fraud or wire fraud if electronic? Wouldn't that make the court and thus the judge complicit in…

It doesn't matter if "screaming from the rooftops" seems to you _logically_ the same as a warrant canary. The courts tend to care about the _practical_ effect too. If the practical effect is to violate the gag order (because people were actually paying attention to you screaming from the rooftops, maybe), then... maybe? We aren't sure.

And dude, judges don't get disbarred even when they do CRAZY stuff. A judge getting disbarred (or even dis-judged) is _exceedingly_ rare.

A judge is _definitely_ not going to get disbarred for making a ruling _you_ think is irrational, but isn't actually inconsistent with any established case law, because it's not estabished yet.

Not even going to get _reprimanded_, let alone disbarred.

The U.S. just doesn't work how you think it works.

Re: Cloudflare expands its government warrant canaries

#103
post #72
post #50

Earlier quoted context omitted.

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But s…

Has anyone been held in contempt of court for failing to update a warrant canary. I don't believe so. So it seems to be working? Another poster pointed out that courts generally do not uphold orders to compel speech when that speech is untruthful. So a court order to untruthfully update a warrant canary will not likely survive a legal challenge.

Has anyone used a warrant canary to succesfully convey the information it's intended to _without_ being held in contempt? Is there a list somewhere?

Re: Cloudflare expands its government warrant canaries

#104

Does anyone have a list of instances where a warrant canary was _succesfully_ used to signal government surveillance or other court order, that the company involved would have been otherwise legally forbidden to communicate? It's been at least a decade since the 'warrant canary' was proposed. We _know_ the government has been doing all sorts of things by sealed court order in that decade. I'm not sure it has proven u…

Where _succesfully_ also means that they didn't end in jail. Edit: hail -> jail. Thanks.

"end in hail"? oh, jail. I mean, I'd want a list of those too.

Basically a list of _anything_ interesting that's happened with a warrant canary. Even a short list.

Re: Cloudflare expands its government warrant canaries

#107

> "has never turned over their SSL keys or customers’ SSL keys to anyone;" How would they be able to give up customers' SSL keys?

Customers on some plan can upload a certificate of their choice, and generally have to provide the key along with it. Keyless SSL exists, but isn't widespread.

Re: Cloudflare expands its government warrant canaries

#109
post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

Speaking from an engineering perspective, this is part of the reason I've never been comfortable with warrant canary or "extra-warrant" compromise canary.

Let's say you run some kind of service for which you offer privacy/security assurances, but, at some point, you're compelled in some extra-warrant way to violate those assurances. Or you're simply compelled by warrant, while also being compelled not to implicitly signal that by canary. Or you discover a compromise, previously without your knowledge, and are compelled not to disclose it.

I could easily imagine that many of the same official powers (public or secret), or de facto powers, that would enable the compelling wouldn't see the legal arguments of some lawyers as showstopper barriers to keeping the canary intact. If you think that kind of scenario is plausible, then touting a canary is arguably doing a disservice, from the start.

At least half of engineering is honesty and specification, so the introduction of a canary, in an environment in which you can't be sure you can comply with it, and perhaps can't disclose when you realize you definitely can't comply-- doesn't seem like good engineering.

If we're not sure we can honor canaries, then perhaps it's better not to do canaries at all -- and perhaps to instead specify our assurances better, including broad exceptions we anticipate we can't cover. Maybe lawyers and C-suite ultimately determine it makes sense to qualify the assurances with language like, "conceivably could be compelled by [particular government where company is based]" and "conceivably compelled not to disclose".

Personally, some of the hypotheticals are way outside my expertise (and stomach), and I'd rather focus only on engineering good solutions. But canary-type situations and assurances sometimes involve engineering, and sometimes we can foresee potential future problems that we should discuss with the appropriate people in our organization, before it becomes a problem. Then, hopefully we work with people who use all the information, from engineering and other sources, to do the best thing.

(BTW, I'm in the US, and I think, for example, that a practice of warrants is a very good thing, in principle, and I have some trust in the mechanisms and checks&balances of our system. I appreciate that different countries and people have different situations and perspectives, and that things are very complicated and imperfect, even in my own country.)

Re: Cloudflare expands its government warrant canaries

#110
post #84

Earlier quoted context omitted.

The child porn guy also votes. Are you going to call that political too?

My now deceased great aunt married when she was 13 to a man of 33. Now, we'd be screaming "PEDO" from the rooftops while calling for castration and prison, or even execution. What actually happened, was marrying when you were 13 as a female was the norm. It was OK. She had 4 children.. And if you asked her, had a wonderful life. But in a fairly short time, social norms went from "Puberty means you're an adult, or dar…

There were plenty of 13 year old child brides, but very few child husbands... Strange how the child brides never married another child. Until the 1940s it wasn't uncommon to see preteens and teens working hard labor, does that mean it was ever OK?

I also doubt it was ever the "norm" in the modern civilized world. A quote from wikipedia [1]:

"In the last decades of the [16th] century the age at marriage had climbed to averages of 25 for women and 27 for men in England..."

1: https://en.wikipedia.org/wiki/Western_European_marriage_patt...

Post reply on HN