Wikimedia v. NSA: Wikimedia Foundation files suit against NSA • Hacker News Board

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#81

Post by copsarebastards » Tue, Mar 10, 2015, 2:41 PM UTC

stingraycharles wrote: post #68

mathetic wrote: post #48

Earlier quoted context omitted.

>> If everyone is shouting that you're bad, the most basic human instinct is to shout back even louder. Citation needed. Even if this is the case, then it is lucky that we developed cognitive tools that allow us to reflect on our actions and try to comprehend why those people are shouting at us in a civilised society.

Well this is basically part of how you try to convince someone of your opinion. If you only shout "you are bad", you are going to get shouts back. It's all about the way how to have a decent discussion. If you first acknowledge that the other party has some good points (for example, acknowledge the need for the government to acquire intelligence), and use that as a basis for further discussion, you have a much better…

If it gets to the point where someone is hacking into my personal communications I no longer am interested in conversing that person. Our differences are too fundamental for a conversation to be productive. My interests at this point are seeing that this person is stripped of power and brought to justice (the knowledgeable members of the NSA should be put in jail, just as any other group conspiring to commit a felony would be). No conversation is going to result in them agreeing that they should be stripped of power and jailed, so discussion is pointless.

The discussions I'm having are not with members of the NSA, they're with other people who might potentially be able to help at least prevent further criminal activity by the NSA.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#82

Post by bhayden » Tue, Mar 10, 2015, 2:45 PM UTC

judemelancon wrote: post #69

bhayden wrote: post #66

Earlier quoted context omitted.

I think you're focusing on the wrong thing. It doesn't really matter if it's legal or constitutional, because if it's not then they'll change the laws or reinterpret them in a new way or write a new Patriot Act. What we should focus on is whether a government should be allowed to operate in secrecy, without any public oversight or knowledge, and whether the government can be morally justified in surveilling citizens…

It matters to me, at least, that the law be followed as written. Rule by whim and secret dictate does not seem like a good system of government.

It matters to me too, but it's not the root of the problem.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#83

Post by EthanHeilman » Tue, Mar 10, 2015, 2:48 PM UTC

sheensleeves wrote: post #67

Dorian-Marie wrote: post #19

The solution should be technical: You don't want to NSA to read your communications: encrypt them (eg: HTTPS everywhere, encryption built-in everywhere). And that's us, builders of technologies, that need to make that happen. Basically securing against the NSA is the same as securing against hackers, it should be treated as a security threat like any other.

Offense and defense are asymmetric in computer security just as they are in physical security. Offense has the advantage since defense is a thin skin around complex entropy waiting to pop. I think that the relevant essay is George Orwell, "You and the Atomic Bomb." Just as the 2nd amendment is obsolete due to modern military hardware, privacy is dead if an APT wants in. Not that I know.

That is because you have framed offense and defense in that way. If a resourceful attacker's only goal in life is to get access to a particular file on your network connected laptop, the attacker will win. Generally this is not the case, the attacker often wants to:

1. remain undetected over a long period of time, 2. in the face of detection they wish to preserve their anonymity, 3. not be fooled by misinformation, 4. not reveal anything of greater value to them than the value of the file, 5. not open themselves up to reprisals.

This is much harder. While the defender doesn't win short term, a resourceful defender can make the costs to the attacker high enough that future attacks are deterred, the attacker loses, or even that the defender gains more from the attack than they lose. For instance Google in responding to Chinese penetrations via technical, economic, governmental and diplomatic avenues has increased Google's credible deterrence, punished some of the people responsible and increased Google's reputation in the realm of security.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#84

Post by cryoshon » Tue, Mar 10, 2015, 2:51 PM UTC

chippy wrote: post #14

I have some sympathy for our fellow hackers who work as contractors or in big companies, many of them with security clearance. Database engineers, software developers, data experts - the five eyes intelligence agencies directly and indirectly fund many of you readers of HN. They might be becoming increasingly disillusioned with their chosen life and/or unable to change course. Perhaps the money is too good, perhaps t…

Why sympathize with them? They either decided in bad faith that working on an interesting problem was more important to them than acting ethically, or they are saying "I'm just doing my job" also in bad faith. These philosophical decisions are simply malicious relative to the rest of us.

There is also the possibility that they have been deluded by nationalism or propaganda in order to believe that a panopticon is acceptable in a democracy, but there isn't much we can do to help these people connect the dots between the panopticon they are helping to build and Orwellian thoughtcrime-- we simply don't have access to them that we could use to be persuasive, as you mentioned. I think this population of people is actually pretty large among the government contractors.

Finally, though you are correct that NSA employees would probably mention this, for the purposes of agencies operating in the public interest in a democracy, the concept of "insider knowledge" is not permissible. I say this not to suggest that we make all the operations of our clandestine groups transparent, but rather to suggest that the complete ignorance the American public has found itself to be in is a byproduct of intentional grooming along the lines of "national security secrets" which really are intentionally crafted backdoors to the process of informed democracy. The citizens not involved in agency day-to-day have a firm need to know the methods and rationales used, and they need to have direct and powerful oversight.

We don't have any of these things, currently.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#85

Post by copsarebastards » Tue, Mar 10, 2015, 2:51 PM UTC

davidgerard wrote: post #5

nullc wrote: post #4

“If you don’t like people looking why not try putting on some pants?”, my response on the Wikimedia Blog: http://www.reddit.com/r/wikipedia/comments/2yjda6/wikimedia_... (cross-posted to reddit because I could provide links there)

SSL in the casual case relies on all CAs being uncompromised. I understand this is not the case. In any case, both technical and legal approaches are appropriate. And you know as well as I do that everyone at WMF desperately wants SSL for everything, and that this is a thing they are specifically working toward (but it turns out to be a bit more complicated than just switching everyone to SSL) - there is no way in wh…

CAs aren't the only possible point of failure.

Simply by obtaining private keys for Google/Facebook/YouTube/Yahoo/Baidu, the NSA can passively decrypt a HUGE percentage of the world's traffic. Any server encrypting for Google will need to have these keys so it's quite difficult to keep all these servers secure, and given the keys' values, the NSA would have no trouble budgeting infiltrating companies to get them.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#86

Post by davidgerard » Tue, Mar 10, 2015, 3:02 PM UTC

copsarebastards wrote: post #85

davidgerard wrote: post #5

Earlier quoted context omitted.

SSL in the casual case relies on all CAs being uncompromised. I understand this is not the case. In any case, both technical and legal approaches are appropriate. And you know as well as I do that everyone at WMF desperately wants SSL for everything, and that this is a thing they are specifically working toward (but it turns out to be a bit more complicated than just switching everyone to SSL) - there is no way in wh…

CAs aren't the only possible point of failure. Simply by obtaining private keys for Google/Facebook/YouTube/Yahoo/Baidu, the NSA can passively decrypt a HUGE percentage of the world's traffic. Any server encrypting for Google will need to have these keys so it's quite difficult to keep all these servers secure, and given the keys' values, the NSA would have no trouble budgeting infiltrating companies to get them.

Absolutely, I was just giving one example.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#87

Post by unreal37 » Tue, Mar 10, 2015, 3:07 PM UTC

motbob wrote: post #71

Despite what they say in the article, I really don't think they have standing. But I would love to hear why they do from someone familiar with the legal argument.

I thought that too at first. But the NYT op-ed does a better job of explaining.[1]

Basically, they think that the NSA has the ability to index anonymous readers with pages visited, and anonymous editors with pages changed. Then if the NSA is sending that data to a bunch of governments around the word (Egypt, Israel, the Five Eyes, whoever else), dissidents around the world are at risk of being caught for browsing/editing Wikipedia for the crime of being opposed to the government in power.

[1] http://www.nytimes.com/2015/03/10/opinion/stop-spying-on-wik...

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#88

Post by kidcoach » Tue, Mar 10, 2015, 3:09 PM UTC

karmacondon wrote: post #44

chippy wrote: post #14

I have some sympathy for our fellow hackers who work as contractors or in big companies, many of them with security clearance. Database engineers, software developers, data experts - the five eyes intelligence agencies directly and indirectly fund many of you readers of HN. They might be becoming increasingly disillusioned with their chosen life and/or unable to change course. Perhaps the money is too good, perhaps t…

I have no problem voicing my beliefs publicly. I'm always more than willing to explain the policies of the NSA, and happy to denounce the actions of Edward Snowden. I don't think he was a traitor, by definition, but what he did was wrong. It isn't necessary to divulge confidential information, the situation is pretty clear. I don't see any point in re-litigating the whole thing on this particular thread though, it wo…

> I don't see any point in re-litigating the whole thing on this particular thread though, it would be off topic.

Would you care to litigate it somewhere else ?

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#89

Post by bmelton » Tue, Mar 10, 2015, 3:27 PM UTC

karmacondon wrote: post #40

cryptoz wrote: post #37

Earlier quoted context omitted.

On NSA stories, the top HN comment is always "too bad. whatever. let the NSA do its thing." NO. This is not about you. This is not about your data. This is about our society's collective ability to think and act for itself. Blanket acceptance of surveillance is a dangerous attitude and shockingly common. Political efforts, technological efforts, societal changes are all required to keep democracy alive. And that's wh…

> This is not about you. This is not about your data Democracy means that your fellow citizens get a vote too. If you and those that agree with you can't craft a message that appeals to them and their day-to-day concerns, the grandparent comment will continue to be quite correct.

Which is why we have a Constitutionally limited system of democracy. The rights enumerated in the Bill of Rights are inviolable, even by a majority.

The suppression of the minority factions by the majority is always popular, which is exactly why the bill of rights exists.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#90

Post by motbob » Tue, Mar 10, 2015, 3:30 PM UTC

unreal37 wrote: post #87

motbob wrote: post #71

Despite what they say in the article, I really don't think they have standing. But I would love to hear why they do from someone familiar with the legal argument.

I thought that too at first. But the NYT op-ed does a better job of explaining.[1] Basically, they think that the NSA has the ability to index anonymous readers with pages visited, and anonymous editors with pages changed. Then if the NSA is sending that data to a bunch of governments around the word (Egypt, Israel, the Five Eyes, whoever else), dissidents around the world are at risk of being caught for browsing/edi…

I see. I thought it might be impossible for any U.S. entity to ever get standing in a lawsuit against the NSA, but this theory might have a fair shot.