Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

meta.crypto.stackexchange.com

Post reply on HN
Print view View original

71–80 of 87 posts

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#71

Post by tptacek »

AnthonyMouse wrote: post #63
DannyBee wrote: post #55

Earlier quoted context omitted.

Yes, you would get some nominal damages, plus any actual loss you could prove (IE the money of the people who spent time processing your DMCA request, plus how much you would have earned from ads on the post) or, and if they did it repeatedly, you may get something more (Punitive damages are rare in contract law, but possible). Look, as much as I don't like it, this is a tradeoff. On one side, you have the fact that…

>You really think torrentfreak/isohunt/et al wouldn't just start filing suits over every single DMCA request they receive? What do they have to lose? Money? Time? It wouldn't make any sense for them to litigate the cases they would obviously lose when they could choose the subset of cases where the take down issuer clearly has no copyright in the material in question -- which is the whole idea. You're also giving the…

You're not following his reasoning to its conclusion. The people who run Isohunt surely don't want to spend their time writing court filings. But they'd be sitting on top of a mountain of potential claims, which would prove lucrative if even a tiny percentage resulted in damages. Unscrupulous law firms would notice and send Isohunt offers; at some point, it would become irrational of Isohunt not to accept one of them.

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#72

Post by jaytaylor »

_b8r0 wrote: post #49
moxie wrote: post #35

What's interesting is that there is a whole ecosystem of companies like CipherCloud that do the minimum required to provide solutions for those interested in "compliance," not "security." My sense has been that their customers are predominately those bound by things like HIPPA or PCI, who want to use cloud services, but can't do it with a straight face unless they can say they're "encrypting" their data. What their c…

I've mirrored Emil Vokstrom's mirror[1] here[2] and I encourage HNers outside of the US to do the same and post here. [1] - http://lajm.eu/emil/dump/ciphercloud-security.html [2] - http://securitybookreviews.eu/ciphercloud/

I've mirrored everything I can find[0].

[0] http://scala.sh/ciphercloud/

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#73

Post by betterunix »

jared314 wrote: post #70

I wonder if doing something similar to Ciphercloud, using a homomorphic encryption library like libScarab[0], would actually make it secure. I guess I still don't understand what Ciphercloud does. [0] https://hcrypt.com/scarab-library/

FHE is far too slow for any practical use. In a few more years, things might be different, but for now anyone marketing a practical FHE solution is probably lying.

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#74

Post by jared314 »

betterunix wrote: post #73
jared314 wrote: post #70

I wonder if doing something similar to Ciphercloud, using a homomorphic encryption library like libScarab[0], would actually make it secure. I guess I still don't understand what Ciphercloud does. [0] https://hcrypt.com/scarab-library/

FHE is far too slow for any practical use. In a few more years, things might be different, but for now anyone marketing a practical FHE solution is probably lying.

I'm still trying to find performance numbers that prove it impractical. Otherwise, it just sounds like a problem that could be mitigated by clustering.

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#75

Post by caf »

dangrossman wrote: post #59
troels wrote: post #50

Earlier quoted context omitted.

But surely neither is Stackexchange obliged to host any discussions online. So this content may never reappear - counterfiling or not.

That's not how it works. If StackExchange wants safe harbor from being sued itself, it must put the content back online if it receives a counternotice. YouTube doesn't have this problem because it's not receiving DMCA notices in the first place. One can't send a counternotice when there was never a notice to begin with. Since Google gives all the major media companies direct access to their system, they don't have to…

Sure it is. Upon receiving the counternotice, StackExchange can just say "OK, we're no longer have the question offline because of the DMCA notice; as a separate matter we have decided that we decline to host this question". To believe otherwise would be to believe that a DMCA notice and counternotice somehow privileges the subject content above all other content on the site.

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#76

Post by dangrossman »

caf wrote: post #75
dangrossman wrote: post #59

Earlier quoted context omitted.

That's not how it works. If StackExchange wants safe harbor from being sued itself, it must put the content back online if it receives a counternotice. YouTube doesn't have this problem because it's not receiving DMCA notices in the first place. One can't send a counternotice when there was never a notice to begin with. Since Google gives all the major media companies direct access to their system, they don't have to…

Sure it is. Upon receiving the counternotice, StackExchange can just say "OK, we're no longer have the question offline because of the DMCA notice; as a separate matter we have decided that we decline to host this question" . To believe otherwise would be to believe that a DMCA notice and counternotice somehow privileges the subject content above all other content on the site.

But it does privilege that content above all other if the service provider wants the liability protection. You either treat that content specially or you are open to being sued for having hosted it before you took it down. To meet the requirements of the act, they must actually "replace the removed material and cease disabling access to it" (H.R.2281 Sec. 501(g)(2)(C)). Doing what you said would fail to meet that, as would some kind of "it was available for a split second but you didn't see it" prank. Real judges don't take kindly to trying to weasel around the intent of a law.

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#78

Post by DannyBee »

tptacek wrote: post #71
AnthonyMouse wrote: post #63

Earlier quoted context omitted.

>You really think torrentfreak/isohunt/et al wouldn't just start filing suits over every single DMCA request they receive? What do they have to lose? Money? Time? It wouldn't make any sense for them to litigate the cases they would obviously lose when they could choose the subset of cases where the take down issuer clearly has no copyright in the material in question -- which is the whole idea. You're also giving the…

You're not following his reasoning to its conclusion. The people who run Isohunt surely don't want to spend their time writing court filings. But they'd be sitting on top of a mountain of potential claims, which would prove lucrative if even a tiny percentage resulted in damages. Unscrupulous law firms would notice and send Isohunt offers; at some point, it would become irrational of Isohunt not to accept one of them…

Right. Think of prenda law, just on the other side. It still wouldn't be a good thing, even if we happen to like the targets.

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#79

Post by betterunix »

jared314 wrote: post #74
betterunix wrote: post #73

Earlier quoted context omitted.

FHE is far too slow for any practical use. In a few more years, things might be different, but for now anyone marketing a practical FHE solution is probably lying.

I'm still trying to find performance numbers that prove it impractical. Otherwise, it just sounds like a problem that could be mitigated by clustering.

Here are some results from a research team that has been on the forefront of FHE implementations; note that this has been improved on significantly since last August, but you are still looking at minutes of computation for relatively small functions:

http://www.iacr.org/cryptodb/archive/2012/CRYPTO/presentatio...

Also, throwing "clustering" at every problem is misguided. Not all problems are easily parallelized:

https://en.wikipedia.org/wiki/P-complete

Re: CipherCloud used DMCA Takedown on StackExchange discussion of their cryptography

#80

Post by moxie »

DanBC wrote: post #37
moxie wrote: post #35

What's interesting is that there is a whole ecosystem of companies like CipherCloud that do the minimum required to provide solutions for those interested in "compliance," not "security." My sense has been that their customers are predominately those bound by things like HIPPA or PCI, who want to use cloud services, but can't do it with a straight face unless they can say they're "encrypting" their data. What their c…

Is it really that simple? Or is it that crypto is difficult and buyers have no knowledge and thus are wide open for people selling snake-oil?

On some level, the fact that compliance regulations exist is an indication that security is not a priority for many of the entities that it applies to.

Certainly snake-oil is a problem, but I think this particular area is one where buyers are most concerned about being able to effectively claim that they made what seemed like reasonable efforts.

Post reply on HN