Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Saudi Arabia Telecom's Surveillance Pitch

thoughtcrime.org

Post reply on HN
Print view View original

101–110 of 115 posts

Re: A Saudi Arabia Telecom's Surveillance Pitch

#101

Post by wnight »

GHFigs wrote: post #81
gnu8 wrote: post #77

Earlier quoted context omitted.

There's more value in forcing vendors to work with Free Software licenses than in compromising the ideals of open source to allow vendors to benefit without contributing back. You should be asking yourself how you can change your project so that GPL3 licensed code will be acceptable, rather than asking others to relicense their code.

I humbly contend that forcing people to do anything in the name of an preserving the purity of an ideology is a Bad Idea.

Isn't it amazing how people come out of the woodwork to point out the force inherent in the GPL never say "oh, by the way, thanks for publishing a reference spec I'm free to use to develop my own code."

As Thomas said, people would be less bitchy, and less holier-than-thou (cough), had Moxie not written any code, or written it and charged an arm and a leg for it.

It's sort of what patio11 talks about. The cheaper the service, the worse the people treat you.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#102

Post by cantankerous »

tptacek wrote: post #93
tomjen3 wrote: post #68

Earlier quoted context omitted.

Not that simple, you have often stated that normal programmers shouldn't be near security and now you are stating that they should go implement something that is specifically to enhance the security of the web. The gp isn't asking for a change of license because he hate the GPL, he is (properly correctly) predicting what will happen if that license isn't changed: specifically, the thing that Moxie is trying to preven…

I don't say normal developers shouldn't be near "security"; I say they shouldn't be implementing cryptographic primitives.

Note: AndroidPinning is not a cryptographic primitive.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#103

Post by cantankerous »

wnight wrote: post #100
ComputerGuru wrote: post #67

Earlier quoted context omitted.

You don't have to be such an ass. I asked nicely enough. I fully acknowledge Moxie is better at security than I ever will even dream of being. I just hoped he might see the value in releasing it under a more-amicable license. I don't have the numbers, but more-liberal licenses are by a wide margin the choice for open-source crypto. I'm not speaking from the armchair, I've released open-source code under BSD/MIT mysel…

> Why don't you let him reply. The internet doesn't work that way. > You don't have to be such an ass. I asked nicely enough. No, not really. Would you have asked the creator of a closed source crypto library to give it away? I used to agree with you, that security software should be BSDLed to encourage use, but now I see it just encourages more low-end closed-source software. If that software was open, users could k…

Fully agree. Securing an application is just part of the overhead of creating it. To expect people to hand these bits and pieces out seems a bit overboard, if not somewhat entitled. This stuff costs time, money, and effort to make. The author released it under GPL3. If you can't afford to shell out for it, you can use the code to reroll your own. There's plenty of documentation on the topic as well.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#104

Post by tptacek »

cantankerous wrote: post #102
tptacek wrote: post #93

Earlier quoted context omitted.

I don't say normal developers shouldn't be near "security"; I say they shouldn't be implementing cryptographic primitives.

Note: AndroidPinning is not a cryptographic primitive.

No, it isn't.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#105

Post by pyre »

forgottenpaswrd wrote: post #90
ianlevesque wrote: post #64

Earlier quoted context omitted.

Facebook or Instagram will just reimplement it themselves if they care. Smaller developers will just remain insecure. GPLv3 harms adoption of something like this.

Facebook or Instagram could PAY for getting a license better than GPLv3. That something is GPL does not mean that could not be also licenced as proprietary for those that pay if they don't want the limitations of GPL.

We live in a world where if the cost of too high for something like this, it will be written off as unnecessary. Unless there is someone really pushing this from within, Facebook/Instagram/etc probably won't implement something like this, or will just create their own (possibly poor) substitute.

I get the idea that people should be paid for their work, and it's his choice how he licenses it. On there other hand, if the point is to make sure this spreads as far as possible and gets used everywhere, then maybe a very permissive license is called for.

Re: A Saudi Arabia Telecom's Surveillance Pitch

#106

Post by icambron »

I'm a total outsider to the security community. Of course I understand that are plenty of hackers selling exploits to shady government actors, but I'm to understand from this article that the practice is generally not considered abhorrent and immoral? Like, there's a real debate to be had here?

Re: A Saudi Arabia Telecom's Surveillance Pitch

#107

Post by rmc »

tptacek wrote: post #63
ComputerGuru wrote: post #55

Earlier quoted context omitted.

If you really want the world to be a more secure place, can I please ask that you relicense the AndroidPinning code as BSD or something less viral than GPLv3? I don't see Instagram, Facebook, etc. using that code to secure their apps, they won't license their Android clients as GPLv3 just to use the Android pinning library. While it is easy enough to re-create your code (though I have not looked at it), given that we…

If he hadn't taken the time to publish this code, you wouldn't have even known to try to zing him for using the "wrong" license. Perhaps the most rational solution for people like Moxie would simply be to never publish their code, and simply continue to write forcefully and effectively about technical controls and privacy. Then they wouldn't have to jump through silly hoops to prove whether they "really want the worl…

Agreed. The onus shouldn't just be on Moxie. We could easily flip the question around. Why not put the onus on the company's mentioned. Why don't Facebook and Instagram relicence their code as GPL to be compatible. Do they not want the Web to be safe? Will they put "not having a GPL app" before "our users are safe"? Etc etc

Re: A Saudi Arabia Telecom's Surveillance Pitch

#108

Post by willvarfar »

peterwwillis wrote: post #29
tptacek wrote: post #4

Earlier quoted context omitted.

Nobody trusts CAs. There is a lot of work being done on layering more trustworthy authentication features on top of the TLS CA system, one good one being TACK: http://tack.io/draft.html The problem with simply abandoning CAs is that it creates a situation in which it's even easier for government sponsored agencies to mass-intercept traffic, at least for a window of time (probably several years), and all that window b…

So, even though the government can snoop on us, we shouldn't stop using CAs, because then the government could snoop on us. With TACK you depend on CAs to establish the initial connection, set up a "pin", and then no longer rely on the CA for future connections. That initial connection is fungible by a MITM, so it's not secure. We need a term for connections that are "probably" secure, but for which there is no compl…

(Small technical nit-pick: the mass automated MITM of all postcards is entirely possible and with a ridiculously small budget too.)

Re: A Saudi Arabia Telecom's Surveillance Pitch

#109

Post by josephlord »

tptacek wrote: post #4
peterwwillis wrote: post #3

There needs to be an RFC for Postcard Key Encryption - send each other public keys on hand-written postcards to single-use P.O. boxes to avoid mitm of the initial key exchange. I don't understand why anyone trusts CAs any more.

Nobody trusts CAs. There is a lot of work being done on layering more trustworthy authentication features on top of the TLS CA system, one good one being TACK: http://tack.io/draft.html The problem with simply abandoning CAs is that it creates a situation in which it's even easier for government sponsored agencies to mass-intercept traffic, at least for a window of time (probably several years), and all that window b…

"In the US Department of Defense, a `trusted system or component' is defined as `one which can break the security policy'." [1]

This really gets to the crux of it. We might deem the CA's untrustworthy but we currently trust them anyway because there isn't really that much choice.

[1] http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html - Ross Anderson (Trusted Computing FAQ - Q24)

Re: A Saudi Arabia Telecom's Surveillance Pitch

#110

Post by spyder »

moxie wrote: post #27
luser001 wrote: post #12

I'm very curious what aspect of Twitter's TLS code makes hard to intercept whereas other websites can be easily intercepted? I'm also very curious about how they intercepted Whatsapp. Does it do something stupid like eval'ing code received over regular HTTP? Quoting the paragraph, in case my paraphrasing is inaccurate: "What’s depressing is that I could have easily helped them intercept basically all of the traffic t…

WhatsApp doesn't use TLS, and their protocol has a fairly long history of criticism.

and it seems somebody got so angry about they security that he made this site: http://www.whatsappsucks.com
Post reply on HN