Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Saudi Arabia Telecom's Surveillance Pitch

thoughtcrime.org

Post reply on HN
Print view View original

81–90 of 115 posts

Re: A Saudi Arabia Telecom's Surveillance Pitch

#81

Post by GHFigs »

gnu8 wrote: post #77
ComputerGuru wrote: post #67

Earlier quoted context omitted.

You don't have to be such an ass. I asked nicely enough. I fully acknowledge Moxie is better at security than I ever will even dream of being. I just hoped he might see the value in releasing it under a more-amicable license. I don't have the numbers, but more-liberal licenses are by a wide margin the choice for open-source crypto. I'm not speaking from the armchair, I've released open-source code under BSD/MIT mysel…

There's more value in forcing vendors to work with Free Software licenses than in compromising the ideals of open source to allow vendors to benefit without contributing back. You should be asking yourself how you can change your project so that GPL3 licensed code will be acceptable, rather than asking others to relicense their code.

I humbly contend that forcing people to do anything in the name of an preserving the purity of an ideology is a Bad Idea.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#82

Post by phunel »

moxie wrote: post #35
aw3c2 wrote: post #7

> TextSecure and RedPhone could serve as appropriate secure replacements sadly those are only available for Android.

iOS versions are in the works!

Excited to try the iOS implementation. Is a desktop client (OSX, Linux, etc) for RedPhone feasible? I understand (I think) that RedPhone doesn't use usernames, but instead uses your phone number as the identifier - but I'm curious if that's a structural restriction at this point. Every time the issue of secure communications comes up the issue of what program to use comes up as well. There aren't a lot of good options at this point. Jitsi seems to be the best people can suggest.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#83

Post by GHFigs »

guelo wrote: post #72

We all supposedly know how totalitarian Saudi Arabia is compared to the free United States, so giving Saudi Arabia eaves dropping and decryption tools is something we all obviously dislike. But we are all bathing in American propaganda, so many people, like those "patriotic hackers", support the Feds having the same power that Saudi Arabia is seeking. In fact, the US government is doing much more sophisticated eavesd…

From libertarians to environmentalists to any kind of anti-authoritarian that doesn't serve the interests of the establishment.

Who do you mean? Who is being called a terrorist?

Re: A Saudi Arabia Telecom's Surveillance Pitch

#84

Post by pyrocat »

GHFigs wrote: post #83
guelo wrote: post #72

We all supposedly know how totalitarian Saudi Arabia is compared to the free United States, so giving Saudi Arabia eaves dropping and decryption tools is something we all obviously dislike. But we are all bathing in American propaganda, so many people, like those "patriotic hackers", support the Feds having the same power that Saudi Arabia is seeking. In fact, the US government is doing much more sophisticated eavesd…

From libertarians to environmentalists to any kind of anti-authoritarian that doesn't serve the interests of the establishment. Who do you mean? Who is being called a terrorist?

Kids who post youtube videos of themselves rapping: http://news.yahoo.com/teenagers-social-media-terrorism-threa...

The Methuen, Mass., high school student was arrested last week after posting online videos that show him rapping an original song that police say contained “disturbing verbiage” and reportedly mentioned the White House and the Boston Marathon bombing. He is charged with communicating terrorist threats, a state felony, and faces a potential 20 years in prison. Bail is set at $1 million.

And lots and lots of other ridiculous examples, if you search.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#86

Post by robbietables »

ComputerGuru wrote: post #67
tptacek wrote: post #63

Earlier quoted context omitted.

If he hadn't taken the time to publish this code, you wouldn't have even known to try to zing him for using the "wrong" license. Perhaps the most rational solution for people like Moxie would simply be to never publish their code, and simply continue to write forcefully and effectively about technical controls and privacy. Then they wouldn't have to jump through silly hoops to prove whether they "really want the worl…

You don't have to be such an ass. I asked nicely enough. I fully acknowledge Moxie is better at security than I ever will even dream of being. I just hoped he might see the value in releasing it under a more-amicable license. I don't have the numbers, but more-liberal licenses are by a wide margin the choice for open-source crypto. I'm not speaking from the armchair, I've released open-source code under BSD/MIT mysel…

I hardly think that calling moxie's choice of license "viral" and questioning whether he "really wants the world to be a more secure place" is asking "nicely enough". religous wars aside i also would like to hear from one of the cryptography gods about licensing cryptography software since ComputerGuru does have a good point when talking about software such as openssh

Re: A Saudi Arabia Telecom's Surveillance Pitch

#87

Post by pyre »

pyrocat wrote: post #84
GHFigs wrote: post #83

Earlier quoted context omitted.

From libertarians to environmentalists to any kind of anti-authoritarian that doesn't serve the interests of the establishment. Who do you mean? Who is being called a terrorist?

Kids who post youtube videos of themselves rapping: http://news.yahoo.com/teenagers-social-media-terrorism-threa... The Methuen, Mass., high school student was arrested last week after posting online videos that show him rapping an original song that police say contained “disturbing verbiage” and reportedly mentioned the White House and the Boston Marathon bombing. He is charged with communicating terrorist threats,…

Choice excerpt:

  “If you’re not a terrorist, if you’re not a threat,
  prove  it," he says.

  “This is the price you pay to live in free society
  right now. It’s just the way it is,” Mullins adds.
[Disclaimer: for some definitions of 'free']

Re: A Saudi Arabia Telecom's Surveillance Pitch

#88

Post by moxie »

ComputerGuru wrote: post #67
tptacek wrote: post #63

Earlier quoted context omitted.

If he hadn't taken the time to publish this code, you wouldn't have even known to try to zing him for using the "wrong" license. Perhaps the most rational solution for people like Moxie would simply be to never publish their code, and simply continue to write forcefully and effectively about technical controls and privacy. Then they wouldn't have to jump through silly hoops to prove whether they "really want the worl…

You don't have to be such an ass. I asked nicely enough. I fully acknowledge Moxie is better at security than I ever will even dream of being. I just hoped he might see the value in releasing it under a more-amicable license. I don't have the numbers, but more-liberal licenses are by a wide margin the choice for open-source crypto. I'm not speaking from the armchair, I've released open-source code under BSD/MIT mysel…

Basically all of the software that I write for projects like this is GPL by default, but I generally include a note (as in this case) that developers should contact me if the license doesn't work for them.

I find this to be a good balance: those who wish to take my work and openly contribute their own work are free to do so, and those that don't need to contact the copyright holder. I don't think it's a lot to ask in this case, and I definitely don't think that licensing issues are what's holding back internet security here or otherwise.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#89

Post by moxie »

tomjen3 wrote: post #69
tptacek wrote: post #32

Earlier quoted context omitted.

They pin the TLS certificate: to successfully create a connection to Twitter, their mobile apps will check not only the validity of the certificate the server presents, but also a hardcoded digest of the correct certificate, so that a "valid" certificate for Twitter from a CA Twitter has no relationship with will be rejected.

Wouldn't that break when they need to update the certificate, due to expiration?

What's "pinned" isn't the site's certificate, but rather the CA's certificate. Or more accurately, the CA's public key.

This is the problem with public key pinning. The site is still vulnerable to a compromise from its own CA, and many sites actually use a number of different CAs for unfortunate reasons. If you check out the list of pins for twitter.com, it's quite large. Still, at least it's not vulnerable to compromise from every CA that exists.

Trevor Perrin and I have been working on something called TACK (http://tack.io) to make all of this easier and more secure. Rather than embedding pin fingerprints into the binaries of web browsers and mobile apps, you can advertise them and update them via a TLS extension. What's pinned is also your site's certificate, not the CA's certificate, making the site additionally immune to compromise from its CA (or list of CAs, as it were).

Re: A Saudi Arabia Telecom's Surveillance Pitch

#90

Post by forgottenpaswrd »

ianlevesque wrote: post #64
tedks wrote: post #60

Earlier quoted context omitted.

From the README: >Please contact me if this license doesn't work for you. I see no reason why Moxie should give Facebook and Instagram this valuable feature for free. When did open-source hackers become the unpaid laborers for silicon valley? If they want it, they can either release the source code for their applications and liberate their users, or they can pay (hopefully) through the nose for it. Maybe that'll buy…

Facebook or Instagram will just reimplement it themselves if they care. Smaller developers will just remain insecure. GPLv3 harms adoption of something like this.

Facebook or Instagram could PAY for getting a license better than GPLv3.

That something is GPL does not mean that could not be also licenced as proprietary for those that pay if they don't want the limitations of GPL.

Post reply on HN