FastMail’s servers are in the US – what this means for you • Hacker News Board

Re: FastMail’s servers are in the US – what this means for you

#51

Post by gibwell » Mon, Oct 07, 2013, 6:33 AM UTC

danenania wrote: post #42

annnnd wrote: post #35

Earlier quoted context omitted.

Note that G, FB, A and MS are not in a position where they can write such disclosure. I am not arguing with your main point, I applaud FastMail for taking a stand - it's just that USA companies must use "ambiguous slimeball statements" to at least appear clean (because they are not). I would argue that if FastMail were an USA company their statements (if any) would be just as ambiguous as those of G, FB, A and MS.

I understand your viewpoint, but I don't accept that as an excuse. Remember how quickly SOPA sank after the Silicon Valley establishment turned against it? Do you think the government is going to put the CEOs of some of America's most popular and profitable companies in jail for an act of civil disobedience that the majority of the country and the world would support wholeheartedly? SV is more powerful than it realiz…

SOPA was a single proposed piece of legislation proposed by corporate lobbyists, who are on an essentially level playing field with Silicon Valley.

The NSA is a 60 year old spy agency at the heart of the national security infrastructure and government.

You are comparing two entirely dissimilar things.

Also, how exactly is the American national security state 'weakened and vulnerable'?

Re: FastMail’s servers are in the US – what this means for you

#52

Post by lessnonymous » Mon, Oct 07, 2013, 6:35 AM UTC

robn_fastmail wrote: post #33

lessnonymous wrote: post #28

Earlier quoted context omitted.

Hi Rob, Has the headline on HN been updated? Because both you and brongondwana talk about it being sensationalist, where I see it as just being a summary of the most salient part of what you have to say. Do you have Australian legal advice to back up your conclusions? (I agree with them, but would like to make sure we're talking more than the "gist" of the law)

> Has the headline on HN been updated? Because both you and brongondwana talk about it being sensationalist, where I see it as just being a summary of the most salient part of what you have to say. To my mind it was one of the least interesting parts of what we had to say. "Non-US company not bound by US law" - its hardly earth-shattering news. Would "Non-Senegalese company not bound by Senegal law" be as interesting…

Thanks Rob. Yes, it has been updated. Your post makes sense now.

Re: FastMail’s servers are in the US – what this means for you

#53

Post by iSnow » Mon, Oct 07, 2013, 6:37 AM UTC

Since the Silk Road bust we know the US LE is able to convince or force colocation providers to provide them with an image of a server. After that, pretty much any communication can be considered open to the NSA. I am not surprised that he does not clearly mentions this.

So FM should move their servers out of the US even if that's inconvenient.

Re: FastMail’s servers are in the US – what this means for you

#54

Post by sillysaurus2 » Mon, Oct 07, 2013, 6:40 AM UTC

brongondwana wrote: post #41

frank_boyd wrote: post #30

Earlier quoted context omitted.

You're implying that you would make less money by trading in your US location for more security. That means that you believe not enough users care enough about their privacy to accept that (really light) trade-off.

It might also mean that many of our users believe in the same tradeoff that we do - that we're not overreacting to one low probability/high visibility risk by throwing out the incredibly good reliability we've had for years to shut everything down, ship it to a location with unknown reliability and spin it all back up again - complete with new IP addresses and all the headache that would cause tons of customers who h…

You're not representing your company very well. If you're going to be mean, you'd better be right. But in the scenario you describe, the solution is to move incrementally, one server at a time, not "shut everything down, ship it, then reboot everything simultaneously."

FYI you have about 1.5 hours to edit your post. You may want to do that, because otherwise it will probably scare off most informed potential customers who read it.

Re: FastMail’s servers are in the US – what this means for you

#55

Post by merusame » Mon, Oct 07, 2013, 6:41 AM UTC

tweeeyjg wrote: post #2

This is a joke right? How much were they paid by the NSA to write this post?

Ffs, why even bother writing junk like this at all?

Re: FastMail’s servers are in the US – what this means for you

#56

Post by robn_fastmail » Mon, Oct 07, 2013, 6:49 AM UTC

iSnow wrote: post #53

Since the Silk Road bust we know the US LE is able to convince or force colocation providers to provide them with an image of a server. After that, pretty much any communication can be considered open to the NSA. I am not surprised that he does not clearly mentions this. So FM should move their servers out of the US even if that's inconvenient.

Actually we did clearly mention it:

  "Our colocation providers could be compelled to give physical access to our servers."

But in the very next paragraph:

    "These are not things we can protect against directly but again, we can make it extremely difficult for these things to occur by using strong encryption and careful systems monitoring. Were anything like this ever to happen we would be talking about it very publically. Such an action would not remain secret for long."

Its not hard for a skilled sysadmin to take an image of a running server. Its extremely difficult to do it without administrative access to the machine AND to do it without anyone noticing.

Re: FastMail’s servers are in the US – what this means for you

#57

Post by alan_cx » Mon, Oct 07, 2013, 6:53 AM UTC

nullc wrote: post #6

> There are of course other avenues available to obtain your data. Our colocation providers could be compelled to give physical access to our servers. Network capturing devices could be installed. And in the worst case an attacker could simply force their way into the datacentre and physically remove our servers. > These are not things we can protect against directly but again, we can make it extremely difficult for…

"This kind of frank disclosure should be highly rewarded."

With all due, Im sorry but, no.

Had it come before the Snowden leaks, absolutely. But it didn't.

After the event, facing a danger of customer loss or loss of confidence, it can only be seen as too late and defensive move. All these companies must have known something about these risks, yet remained in a passive conspiracy of silence. Not one stood up until Snowden did. By then, too damn late.

Re: FastMail’s servers are in the US – what this means for you

#58

Post by westicle » Mon, Oct 07, 2013, 6:54 AM UTC

robn_fastmail wrote: post #47

westicle wrote: post #39

> Australia does not have any equivalent to the US National Security Letter, so we cannot be forced to do something without being allowed to disclose it. This is not true. The Australian Crime Commission has some of the most extensive secret coercive powers in the Western world. http://www.austlii.edu.au/au/legis/cth/consol_act/acca200228... I would suggest that either: a) Fastmail is aware of this and is covertly sp…

I would argue that section 29 is very narrow in its scope, and allows for disclosure once an investigation is completed, and allows for disclosure to an attorney, whereas my understanding of an NSL is that it can order pretty much anything it wants without limitation. That seems quite different to me. But then, I'm not lawyer. You're probably not either. Which is why I keep telling people to get their own legal advic…

Actually I am a lawyer. In the past I have even advised clients who received ACC notices (they are more common than most people would think).

Needless to say I was staggered at the scope of the powers granted. Forget about transparency, justice and the rule of law. If you receive one of these you can be compelled to give evidence or documents in secret, without judicial oversight or public scrutiny.

Re: FastMail’s servers are in the US – what this means for you

#59

Post by Zancarius » Mon, Oct 07, 2013, 6:57 AM UTC

sillysaurus2 wrote: post #54

brongondwana wrote: post #41

Earlier quoted context omitted.

It might also mean that many of our users believe in the same tradeoff that we do - that we're not overreacting to one low probability/high visibility risk by throwing out the incredibly good reliability we've had for years to shut everything down, ship it to a location with unknown reliability and spin it all back up again - complete with new IP addresses and all the headache that would cause tons of customers who h…

You're not representing your company very well. If you're going to be mean, you'd better be right. But in the scenario you describe, the solution is to move incrementally, one server at a time, not "shut everything down, ship it, then reboot everything simultaneously." FYI you have about 1.5 hours to edit your post. You may want to do that, because otherwise it will probably scare off most informed potential customer…

> You're not representing your company very well.

> FYI you have about 1.5 hours to edit your post. You may want to do that, because otherwise it will probably scare off most informed potential customers who read it.

(The above post was, curiously, edited very slightly before I was able to reply.)

It's possible brongondwana is taking some of the discussion here personally, but most people invested emotionally in their company are going to feel some need to defend their decisions against criticism they see as invalid or misplaced. I can't help but feel that some of your post is also somewhat emotionally-charged. I apologize if I'm misreading it.

Regardless, to play devil's advocate, both of the FastMail employees have a point (I also fail to see how they're being "mean;" maybe it's a cultural difference?). While they may not be a huge company with a great deal of leverage with the right government officials, I think such criticism levied against them is indeed kneejerk and perhaps a touch myopic. It's ignoring the greater story at large, which is the souring of US policy abroad, particularly among our allies. As an example, an enterprising Australian politician who wanted to make a name for his or her self could certainly take any such incidents against FastMail and use them as political leverage.

I can only imagine just how incendiary such headlines might become: US Seizes Australian Servers in NSA/FBI/Scary-three-letter-name US Agency Sting Operation. That'd go over real well, especially among Commonwealth nations.

I would submit to you (and others) that the best means of debating this would be to research case law and find examples where US courts upheld government actions against foreign assets held or based in the US. IANAL, but I can't help myself from thinking that such a foundation would be much better than accusing one side in particular of being "mean."

Re: FastMail’s servers are in the US – what this means for you

#60

Post by sandstrom » Mon, Oct 07, 2013, 7:08 AM UTC

robn_fastmail wrote: post #24

frank_boyd wrote: post #20

> our primary servers are located in the US Why would you do that, especially when you're not even a US company?

Because most of our customers are in the US. If your goal is to provide the fastest service around, it helps to put your servers near your users.

What about European users? That market should be roughly equal in size.

As others have noted, I would consider Fastmail if servers were located in a country with greater respect for privacy, judicial oversight and rule of law.