Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yahoo installed a backdoor for the NSA behind the back of the security team

diracdeltas.github.io

Post reply on HN
Print view View original

41–50 of 302 posts

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#41

Post by ahelwer »

walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

Undergraduate ethics courses usually just go over the big historically-important ethical analysis systems (utilitarianism, Kantian deontology, veil of ignorance, social contract, etc.) Unlikely to touch on trickier issues such as why you ought to act ethically at all, or even what it means to act ethically - why, for instance, are you so certain writing backdoors for the NSA is unethical? This is certainly something which can be argued.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#42

Post by huac »

k8t wrote: post #20
huac wrote: post #13

Yahoo stock hasn't moved very much recently over these issues. I guess the market still thinks that the Verizon acquisition will still go through. For context, the price was ~$43 after the acquisition and closed at ~$41 today.

Most of the value from yhoo is from its holdings in alibaba. So this actually is fairly irrelevant for the stock.

There was a big jump in the stock when the acquisition was announced, so it would follow that the acquistion premium is priced in.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#43

Post by imjustsaying »

rmcpherson wrote: post #29
walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

I don't know how common this is in general, but an ethics course was a required part of the engineering core curricula at my school (Case Western Reserve). Ultimately, though, an ethics course isn't going to make people stand up for their ethics. A professional organization along the lines of the American Medical Association (at least in terms of political strength) that stands up for its members and censures those w…

> When there are few professional consequences for unethical behavior at the behest of your employer, taking an ethical stand is ineffective and quixotic. You will be fired and another engineer will likely complete the job.

Well quitting a job as a concentration camp gas chamber constructor may merely slow down the operation a bit, but that could mean more lives saved until VE day arrives.

And yes I did just make that metaphor.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#44

Post by eganist »

peterkelly wrote: post #32

I know this is from October, but it warrants re-reading now. Today, Yahoo announced a hack of 1B accounts. They say they don't know who it is, but we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. Previously, Yahoo willingly assisted an attacker in compromising 1B accounts. In this case, they did not disclose the attack publicly, or even to their own chief i…

> we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it.

This implies a potentially fatal assumption that IC agencies perform clandestine activities with prior notice to mission targets.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#46

Post by kabdib »

wildmusings wrote: post #26
walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.

Options:

- Refuse to take action. They want engineering done, they can bloody well do it themselves. Don't type a single keystroke in the direction of helping them.

- Announce what is going on anonymously. Plenty of avenues for this.

- Announce what is going on, publicly. See if they do indeed want to take you to court.

- Quit.

- Take down the service. Much easier if the service is only a part of your company. Helps a lot if you don't retain the information they're looking for.

- Lie.

- Destroy records (this is by far the riskiest action here, above a simple public announcement).

- Delay. And delay more.

- Keep information outside the jurisdiction, possibly controlled by a third party who will not comply with orders.

- Misunderstand ("Is that a one, or an ell?")

Most of these will get you into trouble, a few won't. Most of these are really difficult roads.

I've given this some thought before. If I found a backdoor in a product, I would remove it with a tracking bug and a checkin, and send internal email about a really bad bug that I'd just fixed; the more internal people that know, the better. And if a VP showed up and berated me, I'd just tell them to fuck off, and quit if it came to that.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#47

Post by jrowley »

walrus01 wrote: post #30
wildmusings wrote: post #26

Earlier quoted context omitted.

When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.

People have the option to quit. The company is legally bound to obey, but individual employees can chose for themselves whether they want to be a party to it. Yahoo may still be court ordered to implement it, just hopefully not with their best and brightest developers. I also have a theory that a lot of the recent terrible news coming out of Yahoo is due to staff complying with the letter of the legal order but not t…

The other point to be made is that you probably want your best developers implementing back doors (if you are compelled to do so), so at least the back door is as secure as possible (and not trivially bipassed)

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#48

Post by bluesmoon »

hourislate wrote: post #33

I would be surprised if anyone was using Yahoo for anything but a spam account when this occurred. I guess a really good indicator that things were not right was when the CSO left the company with no real reason. He was like I want no part of this shit.

yahoo groups is still very big. it was big before yahoo acquired it (egroups), remained almost unchanged throughout the years, and is now in maintenance mode, but there are still millions of users who continue to sign up.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#49

Post by user837387 »

walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

>> take at least one full term length ethics course

I did take one for my Masters in Computer Science. I think it was required. Unfortunately, for some reason I didn't understand most of it. Don't know why. My suspicion is that they didn't know what they were talking about or it was just a class full of BS.

Re: Yahoo installed a backdoor for the NSA behind the back of the security team

#50

Post by hbt »

wildmusings wrote: post #26
walrus01 wrote: post #22

I seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backd…

When you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.

This is why we (as a community/industry) need to have the equivalent of a prison/death threat.

The government wins by making it personal, by threatening prison and death for your obedience. It's not an abstract threat. It is directed to a specific person not a company or security team.

The people who comply can quit those companies but they don't. I'm not referring to the ones down the chain (e.g the security team who was unaware) but the ones who obeyed and pushed something they believed was wrong.

Whether it is public shaming or having a permanent stain on their reputation next time they go job hunting, we need a way to retaliate.

Right now, they can fuck us and get away with it and what's their excuse? "the government told me to do it. Just doing my job. I had no choice."

There are no societal consequences to cooperating with the government even when we believe it's wrong.

Create a climate of "snitches get stitches" and maybe they will think twice before selling out the lives of a billion people. The same way these government officials hide behind patriotism when they mean blind obedience to my authority.

Post reply on HN