Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cock.li server seized again by German prosecutor, service moves to Romania

arstechnica.com

Post reply on HN
Print view View original

11–20 of 30 posts

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#11

Post by ryanlol »

darklajid wrote: post #5

Ignoring the childish domain name, hopefully the discussion won't go down that route again - that guy seems quite sincere and explains the situation quite well. My take away: Don't (blindly) trust Germany, and certainly don't use Hetzner. If he's correct ("Hetzner didn't provide a copy of the confiscation order to me or my lawyer") I'm glad to be the first in this community that runs around, arms flailing, shouting "…

Yeah, Hetzner also has this strange habit of spitting out SQL errors when you put apostrophes into forms on their website.

I'd avoid them.

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#12

Post by bitwize »

glasz wrote: post #9

since people seem surprised, let me reiterate on those laughable german data protection laws: http://glasz.org/sheeplog/2015/02/data-privacy-regulations-i... DO NOT trust any government or company. everything is full of submissive sheep. particularly so in germany.

One of the remarkable things about the U.S. constitution is that it theoretically allows no escape rope from protection of rights; by contrast the constitutions of many European democracies as well as Canada contain "notwithstanding clauses" that allow free rein to the government when they deem it necessary for any reason to trample on your rights.

Not saying the USA is particularly good about upholding those rights... pur government has been looking for loopholes in the Bill of Rights since it was ratified.

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#13

Post by gexcolo »

striking wrote: post #3

Mr. Canfield's thoughts on the matter: >> Of course, though the facts of the case are yet to be seen since no one in Germany is talking to us, I will definitely never host anything in Germany ever again He was trusting of authorities and purposely did not use TLS (beyond STARTTLS) or encrypt his hard drives. And this is what happens. They take his hard drives immediately and seize his entire service. How are we suppo…

"Mr. Canfield" here,

I don't know if I would say I was "trusting of authorities" but I'm definitely distrusting now. I didn't bother with FDE because I figured it was more trouble than it was worth for a server that I ultimately don't own and can't control or protect against the oodles of key recovery attacks I'd have to worry about. In the event of a seizure I don't want to be like "hey uh they might have gotten everything maybe not!" so it's just not something I bothered with.

The situation is different now though as the service is being colocated instead of hosted on a rented server, which gives me a lot more freedom what can be done to secure the server against data theft. I'm also hosting with a privacy-conscious host (FlokiNET) I know will cooperate with me and fight bullshit government requests if/when they arrive (not saying what happened with Germany is bullshit, it's yet to be seen and I've been advised not to speculate).

Data theft aside, the service is in a more secure position it's ever been in. There's comfort in that, at least...

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#14

Post by belorn »

striking wrote: post #3

Mr. Canfield's thoughts on the matter: >> Of course, though the facts of the case are yet to be seen since no one in Germany is talking to us, I will definitely never host anything in Germany ever again He was trusting of authorities and purposely did not use TLS (beyond STARTTLS) or encrypt his hard drives. And this is what happens. They take his hard drives immediately and seize his entire service. How are we suppo…

I wish that Debian installer (and other distributions) would have encryption on as default, especially if the installer ask you if you intend to install it as a mail server. Users are entrusting their communication to the server which means that the sane defaults should address their need for privacy and control.

Law enforcement always operate on what is easiest and cheapest. A common practice seem to have been established to raid a data center and take anything that could be valuable and then have it put on the backlog to be sorted in the next 5 years or until statute of limitations. By adding encryption to the situation, its possible to change the economics so its more economical to go through a judge and compel the service provider to provide the specific record that is being requested.

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#15

Post by teddyh »

Running a server containing users’ data (especially an e-mail server) in 2016 without full-disk encryption is like running a web server without HTTPS. Just don’t. It’s a privacy disaster waiting to happen.

This can happen in any country, even to a silly cock joke site like this, and your users will be hurt by it, possibly for many years to come. There is no longer any excuse not to do it.

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#16

Post by currysausage »

ryanlol wrote: post #11
darklajid wrote: post #5

Ignoring the childish domain name, hopefully the discussion won't go down that route again - that guy seems quite sincere and explains the situation quite well. My take away: Don't (blindly) trust Germany, and certainly don't use Hetzner. If he's correct ("Hetzner didn't provide a copy of the confiscation order to me or my lawyer") I'm glad to be the first in this community that runs around, arms flailing, shouting "…

Yeah, Hetzner also has this strange habit of spitting out SQL errors when you put apostrophes into forms on their website. I'd avoid them.

At least a few years ago, shared hosting with Hetzner used to be a complete security mess. By default, every user could access many other users' www directories via SFTP, including loads of PHP config files with MySQL access data inside. No SFTP jails in place, no automated process to prevent 775 (or 777!) permissions. (Yes, you could delete other users' whole www directories.) Real names of all users on the same server world-readable in /etc/passwd. Didn't exactly increase my trust in their products.

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#17

Post by detaro »

necessity wrote: post #10
darklajid wrote: post #6

Earlier quoted context omitted.

I'm surprised that they give out your drive(s) without handing out a document that explains why they had to do that. As far as I'm aware (not a lawyer, a complete layman) there's no 'gag order' here. So, my limited understanding so far is that this is either a complete fuck-up ("Nah, we don't care to provide that document") or malicious. Even if I follow the 'probably stupid, not malicious' argument: Why would you wa…

Why do you assume there's no gag order? From what I understand it's either that or what you suggest.

If there were a gag order, why would they have told him at all? Grab the disk, blame a hardware failure, done.

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#18

Post by 345218435 »

bitwize wrote: post #12
glasz wrote: post #9

since people seem surprised, let me reiterate on those laughable german data protection laws: http://glasz.org/sheeplog/2015/02/data-privacy-regulations-i... DO NOT trust any government or company. everything is full of submissive sheep. particularly so in germany.

One of the remarkable things about the U.S. constitution is that it theoretically allows no escape rope from protection of rights; by contrast the constitutions of many European democracies as well as Canada contain "notwithstanding clauses" that allow free rein to the government when they deem it necessary for any reason to trample on your rights. Not saying the USA is particularly good about upholding those rights.…

i have to admit i'm quite jealous of the u.s. constitution as it is very restrictive and works by the assumption that the state has no rights except those explicitely granted therein. really a beautiful document.

though there are some stupid loopholes it heavily depends on the people to defend it. but meanwhile, everybody is whining, brainwashed, focussing on the 2nd amendmend. unable to see its purpose.

other shit is more important, i guess. like what the gas price is and if silicon valley is eating money.

sheep have just lost their way.

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#19

Post by dawnbreez »

ryanlol wrote: post #11
darklajid wrote: post #5

Ignoring the childish domain name, hopefully the discussion won't go down that route again - that guy seems quite sincere and explains the situation quite well. My take away: Don't (blindly) trust Germany, and certainly don't use Hetzner. If he's correct ("Hetzner didn't provide a copy of the confiscation order to me or my lawyer") I'm glad to be the first in this community that runs around, arms flailing, shouting "…

Yeah, Hetzner also has this strange habit of spitting out SQL errors when you put apostrophes into forms on their website. I'd avoid them.

As someone who just applied for (and failed to get) a job at a DB company:

Not sanitizing your inputs is unacceptable, even for a newbie. These guys must be really stupid.

Re: Cock.li server seized again by German prosecutor, service moves to Romania

#20

Post by cmurf »

345218435 wrote: post #18
bitwize wrote: post #12

Earlier quoted context omitted.

One of the remarkable things about the U.S. constitution is that it theoretically allows no escape rope from protection of rights; by contrast the constitutions of many European democracies as well as Canada contain "notwithstanding clauses" that allow free rein to the government when they deem it necessary for any reason to trample on your rights. Not saying the USA is particularly good about upholding those rights.…

i have to admit i'm quite jealous of the u.s. constitution as it is very restrictive and works by the assumption that the state has no rights except those explicitely granted therein. really a beautiful document. though there are some stupid loopholes it heavily depends on the people to defend it. but meanwhile, everybody is whining, brainwashed, focussing on the 2nd amendmend. unable to see its purpose. other shit i…

It was rather uncommon at the time of its writing to have a written constitution. It's something to point to and say, "no that's not what it says, look here, it says this." I think the founders would have said nothing's perfect, there is no magic, of course the people have to decide, including by arguing a lot, whether to defend it and what detailed policy that translates into. If they don't defend it, they're f'd no matter what anyway.
Post reply on HN