Wikimedia v. NSA: Wikimedia Foundation files suit against NSA • Hacker News Board

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#21

Post by sitic » Tue, Mar 10, 2015, 11:53 AM UTC

Dorian-Marie wrote: post #19

The solution should be technical: You don't want to NSA to read your communications: encrypt them (eg: HTTPS everywhere, encryption built-in everywhere). And that's us, builders of technologies, that need to make that happen. Basically securing against the NSA is the same as securing against hackers, it should be treated as a security threat like any other.

The technical solution can not solve all problems, wikimedia plans to activate HTTPS per default for all users: http://blog.wikimedia.org/2013/08/01/future-https-wikimedia-...

One of the problems is that certain countries block HTTPS (e.g. China), should wikimedia effectively block all chinese users from free knowledge that wikimedia aims to provide? https://en.wikipedia.org/wiki/Censorship_of_Wikipedia

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#22

Post by Sven7 » Tue, Mar 10, 2015, 11:55 AM UTC

chippy wrote: post #14

I have some sympathy for our fellow hackers who work as contractors or in big companies, many of them with security clearance. Database engineers, software developers, data experts - the five eyes intelligence agencies directly and indirectly fund many of you readers of HN. They might be becoming increasingly disillusioned with their chosen life and/or unable to change course. Perhaps the money is too good, perhaps t…

Their opinions are bought and paid for. At current rates its 75 Billion dollars a year.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#23

Post by Dorian-Marie » Tue, Mar 10, 2015, 12:01 PM UTC

sitic wrote: post #21

Dorian-Marie wrote: post #19

The solution should be technical: You don't want to NSA to read your communications: encrypt them (eg: HTTPS everywhere, encryption built-in everywhere). And that's us, builders of technologies, that need to make that happen. Basically securing against the NSA is the same as securing against hackers, it should be treated as a security threat like any other.

The technical solution can not solve all problems, wikimedia plans to activate HTTPS per default for all users: http://blog.wikimedia.org/2013/08/01/future-https-wikimedia-... One of the problems is that certain countries block HTTPS (e.g. China), should wikimedia effectively block all chinese users from free knowledge that wikimedia aims to provide? https://en.wikipedia.org/wiki/Censorship_of_Wikipedia

Thanks for the link, very interesting that it's a technical limitation for them to not enable HTTPS.

About china, maybe only the IPs from china can use HTTP, maybe only zh.wikipedia.org can use HTTP, ...

I think legal solutions are just temporary fixes, technical ones fix the root of the problem in a more generic way.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#24

Post by lgp171188 » Tue, Mar 10, 2015, 12:02 PM UTC

htor wrote: post #17

lgp171188 wrote: post #13

Almost all of our communication protocols and technologies are built on trust on those who run various services. So as long as that is the case, imho there is no way to stop surveillance. It would be great to start from scratch and build things without the expectation of any trustability from anyone, but I don't see that happening ever! Sad to see that the people elected by other people like us to do good for all the…

It is a fact that the internet - designed to be de-centralised - is becoming more and more centralised, evolving around service providers. > Almost all of our communication protocols and technologies are built on trust on those who run various services. That is why we need to build and use de-centralized systems like Bitcoin, Tor and physical mesh networks to share and communicate. These evolve around people, not ser…

> Too bad that you're not too bright about the future. A lot of people are working on fixing it. Maybe these links will inspire you to think about it differently?

I have come across these things that you have pointed out and yes they are steps in the right direction. But if you ask me if any of those will become the mainstream de-facto thing that everyone will use some time in the future? Based on the evidence available at the moment, I would still stick to what I said and maintain that it is highly unlikely given the current state of affairs. Yes, I would be very glad to be proven wrong but not enough atm to feel optimism. :)

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#25

Post by 7952 » Tue, Mar 10, 2015, 12:06 PM UTC

Dorian-Marie wrote: post #19

The solution should be technical: You don't want to NSA to read your communications: encrypt them (eg: HTTPS everywhere, encryption built-in everywhere). And that's us, builders of technologies, that need to make that happen. Basically securing against the NSA is the same as securing against hackers, it should be treated as a security threat like any other.

I agree that we need encyption everywhere, although I think the current apporoach of implementing it in client software is not fit for purpose. You constantly see apps making mistakes in how they implement encryption that leave the user vulnerable. Because the data is encypted it is very difficult to validate and moniter.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#26

Post by michaelt » Tue, Mar 10, 2015, 12:08 PM UTC

scrrr wrote: post #11

I've been thinking about surveillance lately and have come to the conclusion that it's simply here to stay. I really doubt any legal action will change anything what the NSA does. The future is digital, they cannot and will not step down while other countries, basically everyone that is capable to do it, will do it. It's such a big power factor that it cannot be ignored. The arms race in cyberspace has begun long ago…

  they cannot and will not step down while other
  countries, basically everyone that is capable
  to do it, will do it

It's true that even if the NSA stopped tapping undersea cables, that wouldn't stop China doing it.

But there are plenty of other things they could do. Instead of weakening encryption standards, they could work to strengthen them. Instead of trying to get software vendors to install backdoors, they could get them to use deterministic builds with release checksum transparency. Instead of developing hardware backdoors, they could develop inspection systems to find them.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#27

Post by aros » Tue, Mar 10, 2015, 12:13 PM UTC

scrrr wrote: post #11

I've been thinking about surveillance lately and have come to the conclusion that it's simply here to stay. I really doubt any legal action will change anything what the NSA does. The future is digital, they cannot and will not step down while other countries, basically everyone that is capable to do it, will do it. It's such a big power factor that it cannot be ignored. The arms race in cyberspace has begun long ago…

Surveillance isn't something that just manifested at the same time as "big" data collection. The NSA, CIA, FBI, and other alphabet soup agencies have been conducting surveillance and spying for many years prior to the Internet.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#28

Post by retrogradeorbit » Tue, Mar 10, 2015, 12:15 PM UTC

scrrr wrote: post #11

I've been thinking about surveillance lately and have come to the conclusion that it's simply here to stay. I really doubt any legal action will change anything what the NSA does. The future is digital, they cannot and will not step down while other countries, basically everyone that is capable to do it, will do it. It's such a big power factor that it cannot be ignored. The arms race in cyberspace has begun long ago…

There's no need to give up on the offensive tactic (legal action) because we will implement a defensive tactic (encryption). Inevitable or not, we can do both.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#29

Post by cjslep » Tue, Mar 10, 2015, 12:16 PM UTC

Sven7 wrote: post #22

chippy wrote: post #14

I have some sympathy for our fellow hackers who work as contractors or in big companies, many of them with security clearance. Database engineers, software developers, data experts - the five eyes intelligence agencies directly and indirectly fund many of you readers of HN. They might be becoming increasingly disillusioned with their chosen life and/or unable to change course. Perhaps the money is too good, perhaps t…

Their opinions are bought and paid for. At current rates its 75 Billion dollars a year.

If you would like to put words in my mouth, please at least put the right ones in there for me. Otherwise, I'll take that $75 billion you are referring to and let you say whatever you want on my behalf.

In all seriousness, you can support the Federal Government and still have constructive debates.

EDIT: My point is no person is getting $75 billion just to shut up and have their opinion swayed. Being loyal to the Federal Government does not bar you from using its processes to improve its processes.

Re: Wikimedia v. NSA: Wikimedia Foundation files suit against NSA

#30

Post by florianletsch » Tue, Mar 10, 2015, 12:19 PM UTC

scrrr wrote: post #11

I've been thinking about surveillance lately and have come to the conclusion that it's simply here to stay. I really doubt any legal action will change anything what the NSA does. The future is digital, they cannot and will not step down while other countries, basically everyone that is capable to do it, will do it. It's such a big power factor that it cannot be ignored. The arms race in cyberspace has begun long ago…

The "cyberwar" which you're undoubtedly referring to is one thing. Mass surveillance of the world's population is something else.

Yes, the future is digital. And yes, there will be dangers from several global parties. But why does the NSA chose to effectively weaken public communication by discovering and using security issues in known protocols instead of making sure those get fixed (if the NSA can find it, who's to say no one else can?).

With their proven effort to make everyone's communication interceptable (and effectively weakening crypto systems in all possible manners) they aren't protecting anyone, but instead putting US companies, US citizens and all global users of the web at an even higher risk.

I haven't even started on the effects on civil rights and freedom of speech of a global surveillance apparatus that is acting in secret and not under democratic control.

If it would be about an arms race, why not enforce secure crypto standards and help the industry in that regard? Clearly it's not about having more "cyber power" than China, North Korea and what have you. Instead, it's about having power on individuals, no matter where they're from.