Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

Post reply on HN
Print view View original

31–40 of 163 posts

Re: Cloudflare expands its government warrant canaries

#31

Post by balabaster »

skrebbel wrote: post #22
rsync wrote: post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!"

The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not.

If you put a gag order on me and suggest trying me for contempt of court if I say anything and I think the value of me talking is greater than that of my freedom, I will speak up. If I can get around the gag order by using a warrant canary to implicitly say what I'm not allowed to say without being tried for being in contempt of court, then that's what I will do. Until the laws are rewritten to prevent the use of warrant canaries, there's nothing the courts can do about this. It's a valid loophole.

There's little point in killing my family if everything I know is already out there in the wind. I can't do any more harm than has already been done. All you have is retribution. Our agencies often take a pretty dim view of retribution. Chances are, I'd just end up with a contempt of court charge and be thrown in jail, potentially indefinitely. But realistically, the damage is done. Once again, you can't unring a bell.

There's little they can legally do to pursue my family, there would be political uproar. So beyond charging me, I imagine they'd be relatively safe.

Re: Cloudflare expands its government warrant canaries

#32

Post by idlewords »

rhema wrote: post #7

>has never installed any law enforcement software or equipment anywhere on our network; Is the NSA a law enforcement agency? Does looking the other way while an agency installs it count? Can you really know if the hardware you get has not been tampered with by a government agency? I'm not sure how any company could assure me about these issues.

The NSA is an intelligence agency, not a law enforcement agency, but for domestic surveillance it relies on the FBI, which is a law enforcement agency.

Re: Cloudflare expands its government warrant canaries

#33

Post by penagwin »

rsync wrote: post #23
jaredwiener wrote: post #9

Earlier quoted context omitted.

Ideally, sure. But even CloudFlare's doesnt indicate any sort of update date that I can see: https://www.cloudflare.com/transparency/

Maybe it's buried in footnotes to that page or in their ToS or something. In my mind, the "correct" way to do this is to: 1) pgp sign the entire warrant canary statement with a published key. 2) add unfakeable news headlines to the canary itself (such as recent stock prices or sports scores) 3) date the warrant canary and include a well defined schedule of updates I believe this is the authoritative example: https://…

Other then the scheduling piece, this seems like the kind of problem a block chain would _actually solve_. I know we're all tired of "The banks/shipping industry/insurance need to use webscale blockchain!!!!"

But a signed message that's publicly audited as authentic and stored non-centrally seems perfect for canaries....

Re: Cloudflare expands its government warrant canaries

#34

Post by P_I_Staker »

sixhobbits wrote: post #5

unpopular opinion: the main point of these canaries is PR. As far as I understand (and I understand nearly nothing about US law, so pinch of salt blah blah), exploiting legal loopholes is something that makes people excited and talk about your product, but doesn't really change anything in a court. If you assume the US govt is an adversary or potential adversary, and you assume that they are fairly powerful through d…

What's to stop the courts and three letter orgs from strongarming you into continuing to send the canary? Couldn't they consider stopping a form of speech that violates a court order, in other words contempt.

Re: Cloudflare expands its government warrant canaries

#35

Post by rdiddly »

Sir_Cmpwn wrote: post #8

>has never terminated a customer or taken down content due to political pressure https://blog.cloudflare.com/why-we-terminated-daily-stormer/ No comment on whether or not the termination was justified.

Yeah technically they terminated that one with no pressure.

Re: Cloudflare expands its government warrant canaries

#37

Post by malnourish »

mrguyorama wrote: post #20
Sir_Cmpwn wrote: post #8

>has never terminated a customer or taken down content due to political pressure https://blog.cloudflare.com/why-we-terminated-daily-stormer/ No comment on whether or not the termination was justified.

I am hesitant to conflate actual neo-nazis with actual politics

They are actual politics, regardless of your or my beliefs. They vote, and if there are enough of them, someone will cater to them. To willfully ignore them is to ignore a sad reality, they will continue to grow unabated; to meaningfully engage them is to platform a disingenuous group (not to mention giving their beliefs acknowledgement).

It seems to be a catch-22 to me.

Re: Cloudflare expands its government warrant canaries

#38

Post by 3pt14159 »

Here is what I don't understand:

On my website I can make every path resolve. I.e., I can have

www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad

Render a page that says:

> I haven't been paid off by the Mossad

Easy peasy. Then, if I take a grubby payment to fuck over a client (with an NDA, of course) I don't write about it, I just make that one path fail to resolve.

It's writing by omission.

This is why I'm ideologically against these canaries. They paper over a real problem and they expose a new one without really solving the first.

Tech naturally centralizes while politicians naturally push the limits of governmental power to enact their objectives to the furthest degree possible, and these things come into conflict. But some information should not be shared and, at times, we need to allow the government to decide when. Sometimes we need to pushback too. It's not an all or nothing thing, but these canaries are inherently anarchistic and, to me, distasteful.

Re: Cloudflare expands its government warrant canaries

#39

Post by gonehome »

balabaster wrote: post #31
skrebbel wrote: post #22

Earlier quoted context omitted.

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!" The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not. If you put a gag order on me and suggest…

I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function.

I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request when there actually might have been.

Re: Cloudflare expands its government warrant canaries

#40

Post by naaaaak »

Sir_Cmpwn wrote: post #8

>has never terminated a customer or taken down content due to political pressure https://blog.cloudflare.com/why-we-terminated-daily-stormer/ No comment on whether or not the termination was justified.

Top comment gets it right:

> No debate needed. You terminated due to political pressure and gave up one of your warrant canaries.

That Cloudflare continues to include this clause shows how worthless the other clauses are.

Maybe their warrant canaries have already been violated and that case was their way of telling us?

Post reply on HN