Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

dot.gov.in

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#41

Post by batista »

Symmetry wrote: post #37

You're all thinking about this as if it were a law the First World, where this would be enforced impartially. Its just a revenue generation method for whatever bureaucracy gets to pretend to enforce it, aka another excuse to demand bribes. Same principle as countries with official tax rates over 100%.

>You're all thinking about this as if it were a law the First World, where this would be enforced impartially.

And I think you're overestimating the "impartiality" of the law in the First World.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#43

Post by Symmetry »

batista wrote: post #41
Symmetry wrote: post #37

You're all thinking about this as if it were a law the First World, where this would be enforced impartially. Its just a revenue generation method for whatever bureaucracy gets to pretend to enforce it, aka another excuse to demand bribes. Same principle as countries with official tax rates over 100%.

> You're all thinking about this as if it were a law the First World, where this would be enforced impartially. And I think you're overestimating the "impartiality" of the law in the First World.

Yeah, I guess I was. In the US you see things like relatives of police officers not getting ticketed when they crash while driving drunk, for instance, and other sorts of selective non-enforcement of laws and sometimes selective enforcement based on the prejudices the enforcers. But I've never had to pay a bribe, and I don't know anyone else who's had to pay one either.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#44

Post by batista »

Symmetry wrote: post #43
batista wrote: post #41

Earlier quoted context omitted.

> You're all thinking about this as if it were a law the First World, where this would be enforced impartially. And I think you're overestimating the "impartiality" of the law in the First World.

Yeah, I guess I was. In the US you see things like relatives of police officers not getting ticketed when they crash while driving drunk, for instance, and other sorts of selective non-enforcement of laws and sometimes selective enforcement based on the prejudices the enforcers. But I've never had to pay a bribe, and I don't know anyone else who's had to pay one either.

Well, it's for higher echelons, and in that level it's not even called a "bribe". You know, like having your company get huge commissions from the very business your war policies created, or having your friends in DC bail you out because you're "too big to fail", etc. E.g (Wikipedia):

Halliburton has become the object of several controversies involving the 2003 Iraq War and the company's ties to former U.S. Vice President Dick Cheney. Cheney retired from the company during the 2000 U.S. presidential election campaign with a severance package worth $36 million.[40] As of 2004, he had received $398,548 in deferred compensation from Halliburton while Vice President. Cheney was chairman and CEO of Halliburton Company from 1995 to 2000 and has received stock options from Halliburton. In the run-up to the Iraq war, Halliburton was awarded a $7 billion contract for which 'unusually' only Halliburton was allowed to bid.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#45

Post by leostatic »

chris_wot wrote: post #34
chris_wot wrote: post #28

Earlier quoted context omitted.

Actually... is this current policy? I just checked the wayback machine, and this has been there since at least 2006. See http://web.archive.org/web/20060222081026/http://www.dot.gov... Is this really still in effect?

OK, this is getting weird. Check out the front page: http://www.dot.gov.in/ This is their "Department of Telecommunication"! But the site could have been slapped together by a 12 year old. It looks like an abandoned server - full of flashing "New!" images... And down the bottom it says: This site can be best viewed at 800x600 resolution in IE 4.0/ Netscape 3.1 or above Copyright � 2002, Department of Telecommunicatio…

Most of the govt sites of india are in similar state. They are hardly ever updated. The main reason for this is the paperwork/legalese needed before a site can be revamped. Permissions have to be taken from various post holders. I have an email account that is given by govt college and the allotted space is 5Mb.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#46

Post by batista »

hannibalhorn wrote: post #9

Horrible idea. Can anyone explain what is motivating the Indian government to require such access? We all basically know what the deal is with China and certain oppressive regimes in the middle east, but India is an actual democracy (maybe with a somewhat high level of corruption.)

>Horrible idea. Can anyone explain what is motivating the Indian government to require such access? We all basically know what the deal is with China and certain oppressive regimes in the middle east, but India is an actual democracy (maybe with a somewhat high level of corruption.)

Democracy in that sense is an empty word. You mean it's a democracy because people get to vote? In the US the democratic part amounts to getting to chose between the same two century old parties, which have heavy corporate backing and dead-ringer platforms. With the main issues (economic policy, foreign policy, educational policy, labour laws) are only debated superficially, reduced to slogans and yes/no decisions.

Still, the democratic US snoops on its own citizens, maintains (and demands ISP's maintain) huge backlogs of private data, has the Patriot Act, has private prisons, the list goes on and on...

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#47

Post by chris_wot »

leostatic wrote: post #45
chris_wot wrote: post #34

Earlier quoted context omitted.

OK, this is getting weird. Check out the front page: http://www.dot.gov.in/ This is their "Department of Telecommunication"! But the site could have been slapped together by a 12 year old. It looks like an abandoned server - full of flashing "New!" images... And down the bottom it says: This site can be best viewed at 800x600 resolution in IE 4.0/ Netscape 3.1 or above Copyright � 2002, Department of Telecommunicatio…

Most of the govt sites of india are in similar state. They are hardly ever updated. The main reason for this is the paperwork/legalese needed before a site can be revamped. Permissions have to be taken from various post holders. I have an email account that is given by govt college and the allotted space is 5Mb.

In that case, the Indian Government needs wholesale reform. And soon. If India wants to be a forerunner in the world of IT (which it's rapidly becoming) this is only going to cause massive problems.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#49

Post by jmspring »

France had a similar policy in the mid 90s. I recall SSL had a renegotiation to allow banking sites to upgrade from the weak key to a stronger one. Over time, this policy went away.

There are companies that do disallow ssh or require you use a null cipher/key to a gateway before going to the outside world.

I'm not sure how this will be enforced, however from prior comments, it looks like it may be an old policy?

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#50

Post by mnazim »

chris_wot wrote: post #34
chris_wot wrote: post #28

Earlier quoted context omitted.

Actually... is this current policy? I just checked the wayback machine, and this has been there since at least 2006. See http://web.archive.org/web/20060222081026/http://www.dot.gov... Is this really still in effect?

OK, this is getting weird. Check out the front page: http://www.dot.gov.in/ This is their "Department of Telecommunication"! But the site could have been slapped together by a 12 year old. It looks like an abandoned server - full of flashing "New!" images... And down the bottom it says: This site can be best viewed at 800x600 resolution in IE 4.0/ Netscape 3.1 or above Copyright � 2002, Department of Telecommunicatio…

National Informatics Center(http://www.nic.in/) is what's wrong with the IT in government here.

NIC acts as a complete "mean guard at the door" for anyone trying to get work in government. NIC insists on doing things "their way" or you just take "the highway".

Here is an example of a few thing we have to deal with every day. There is a small Java Swings app built by a government department which generates a few reports everyday. A few beauties:

- Hard coded mysql host(localhost), db name, username(root) and no password.

- Run it from command line(java -jar) and you can see a hellish amount of debugging statements scroll by(e.g. "I am here", "Inside Xyz.abc", "asdasdasd" etc). A lot of sensitive info is also printed out on the console that even, we vendors, might not be supposed to know.

- This app requires a 0777 permission on '/home' directory. Yes '/home', not '/home/'

- If it's 1 minute past midnight there is absolutely no way to generate day's report. According to Cheif Programmer of that department this is a security feature. Oh wait, we just change the system date.

- When our project in-charge (politely) confronted this "Chief Programmer" about this he just said that I was lying and there is absolutely no problem in 'sudo chmod 777 /home'. "we do it all the time"

I know this because we have been working with the government on some quite big projects.

Post reply on HN