A Saudi Arabia Telecom's Surveillance Pitch • Hacker News Board

Re: A Saudi Arabia Telecom's Surveillance Pitch

#91

Post by delinka » Mon, May 13, 2013, 10:18 PM UTC

GHFigs wrote: post #81

gnu8 wrote: post #77

Earlier quoted context omitted.

There's more value in forcing vendors to work with Free Software licenses than in compromising the ideals of open source to allow vendors to benefit without contributing back. You should be asking yourself how you can change your project so that GPL3 licensed code will be acceptable, rather than asking others to relicense their code.

I humbly contend that forcing people to do anything in the name of an preserving the purity of an ideology is a Bad Idea.

Not to mention, you can't really force them to do anything: they'll just avoid the GPL code, create it themselves, or find something similar under another license.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#92

Post by tptacek » Mon, May 13, 2013, 10:25 PM UTC

moxie wrote: post #89

tomjen3 wrote: post #69

Earlier quoted context omitted.

Wouldn't that break when they need to update the certificate, due to expiration?

What's "pinned" isn't the site's certificate, but rather the CA's certificate. Or more accurately, the CA's public key. This is the problem with public key pinning. The site is still vulnerable to a compromise from its own CA, and many sites actually use a number of different CAs for unfortunate reasons. If you check out the list of pins for twitter.com, it's quite large. Still, at least it's not vulnerable to compro…

Just a quick note that there are apps that pin site certs and not just CA certs; if you're implementing your own iOS app, for instance, you can do it either way depending on your margin of error w/r/t certificate revocation and expiration and software update.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#93

Post by tptacek » Mon, May 13, 2013, 10:26 PM UTC

tomjen3 wrote: post #68

tptacek wrote: post #66

Earlier quoted context omitted.

If you think that, go implement a MIT-licensed variant.

Not that simple, you have often stated that normal programmers shouldn't be near security and now you are stating that they should go implement something that is specifically to enhance the security of the web. The gp isn't asking for a change of license because he hate the GPL, he is (properly correctly) predicting what will happen if that license isn't changed: specifically, the thing that Moxie is trying to preven…

I don't say normal developers shouldn't be near "security"; I say they shouldn't be implementing cryptographic primitives.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#94

Post by moxie » Mon, May 13, 2013, 10:40 PM UTC

tptacek wrote: post #92

moxie wrote: post #89

Earlier quoted context omitted.

What's "pinned" isn't the site's certificate, but rather the CA's certificate. Or more accurately, the CA's public key. This is the problem with public key pinning. The site is still vulnerable to a compromise from its own CA, and many sites actually use a number of different CAs for unfortunate reasons. If you check out the list of pins for twitter.com, it's quite large. Still, at least it's not vulnerable to compro…

Just a quick note that there are apps that pin site certs and not just CA certs; if you're implementing your own iOS app, for instance, you can do it either way depending on your margin of error w/r/t certificate revocation and expiration and software update.

In that case, I would generally recommend that you create your own trust root and validate against it, rather than using pinning?

Re: A Saudi Arabia Telecom's Surveillance Pitch

#95

Post by edoloughlin » Mon, May 13, 2013, 10:41 PM UTC

GHFigs wrote: post #81

gnu8 wrote: post #77

Earlier quoted context omitted.

There's more value in forcing vendors to work with Free Software licenses than in compromising the ideals of open source to allow vendors to benefit without contributing back. You should be asking yourself how you can change your project so that GPL3 licensed code will be acceptable, rather than asking others to relicense their code.

I humbly contend that forcing people to do anything in the name of an preserving the purity of an ideology is a Bad Idea.

Authors are giving their work away, subject to restrictions of their choosing. There's no coercion involved.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#96

Post by adamt » Mon, May 13, 2013, 10:43 PM UTC

wfunction wrote: post #75

There's no reason to believe Saudi Arabia is alone in surveillance like this. Meet the United States: http://www.guardian.co.uk/commentisfree/2013/may/04/telephon...

Furthermore - the US has a big advantage. Many of the companies that handle digital communication services (Facebook, Twitter, Google etc) are US based and have to by law co-operate with the US law enforcement agencies. So if the FBI (or other three-letter agency) wants access to your Facebook or gmail, they can get it via those companies.

In countries like Saudi Arabia they don't have the same level of power/control so they have to look at intercepting & blocking the traffic.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#97

Post by tptacek » Mon, May 13, 2013, 11:02 PM UTC

moxie wrote: post #94

tptacek wrote: post #92

Earlier quoted context omitted.

Just a quick note that there are apps that pin site certs and not just CA certs; if you're implementing your own iOS app, for instance, you can do it either way depending on your margin of error w/r/t certificate revocation and expiration and software update.

In that case, I would generally recommend that you create your own trust root and validate against it, rather than using pinning?

That makes sense if yours is the only client that connects to your endpoint, but less sense if your client shares an endpoint with, say, a web app.

I try and I try to get clients to consider just rolling their own root certificate and eschewing the TLS PKI, but people have an irrational fear of the process of making certificates.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#98

Post by michael_h » Tue, May 14, 2013, 12:16 AM UTC

jghrng wrote: post #80

michael_h wrote: post #78

Earlier quoted context omitted.

...so many people, like those "patriotic hackers", support the Feds having the same power that Saudi Arabia is seeking They do? I'm not sure I can name a single hacker that wants the US, or any other govt, to have the same power.

Here's the link from TFA: http://erratasec.blogspot.de/2012/08/who-will-fight-for-me.h...

I don't think I'd classify the EFF as a hacking group.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#99

Post by RRRA » Tue, May 14, 2013, 2:00 AM UTC

So according to a comment in that article, Taher ElGamal would be working in KSA doing interception... Anyone has a source? We need to modify wikipedia, this is shameful if true.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#100

Post by wnight » Tue, May 14, 2013, 3:10 AM UTC

ComputerGuru wrote: post #67

tptacek wrote: post #63

Earlier quoted context omitted.

If he hadn't taken the time to publish this code, you wouldn't have even known to try to zing him for using the "wrong" license. Perhaps the most rational solution for people like Moxie would simply be to never publish their code, and simply continue to write forcefully and effectively about technical controls and privacy. Then they wouldn't have to jump through silly hoops to prove whether they "really want the worl…

You don't have to be such an ass. I asked nicely enough. I fully acknowledge Moxie is better at security than I ever will even dream of being. I just hoped he might see the value in releasing it under a more-amicable license. I don't have the numbers, but more-liberal licenses are by a wide margin the choice for open-source crypto. I'm not speaking from the armchair, I've released open-source code under BSD/MIT mysel…

> Why don't you let him reply.

The internet doesn't work that way.

> You don't have to be such an ass. I asked nicely enough.

No, not really. Would you have asked the creator of a closed source crypto library to give it away?

I used to agree with you, that security software should be BSDLed to encourage use, but now I see it just encourages more low-end closed-source software.

If that software was open, users could know what they were using and could with work really be safe. But by trusting a closed source app, especially one that can't afford anything for security, they'll never be secure (see this article for proof) and thus are worse off than if they're knowingly only partially secure.

It sounds rough, but better the mob steal some money because you used an insecure app, causing you learn and audit your security requirements, than for you to feel secure until someone shows up and shoots you.