Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

Post reply on HN
Print view View original

51–60 of 163 posts

Re: Cloudflare expands its government warrant canaries

#51

Post by [deleted] »

DannyB2 wrote: post #45
gonehome wrote: post #39

Earlier quoted context omitted.

I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request wh…

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

[deleted]

Re: Cloudflare expands its government warrant canaries

#52

Post by floofy222 »

legohead wrote: post #6
rsync wrote: post #4

Earlier quoted context omitted.

" If they stay there without change, that indicates something too." Usually they stipulate that they are to be updated every X days/weeks/months/whatever. So if you see one that promises to update every Monday, for instance, and it's old, that would be the same as being abandoned.

What is to stop them from lying? They get a warrant, but don't remove the canary. Later on, someone finds proof of the warrant, but then what? You sue Cloudflare for...what? False advertising?

> What is to stop them from lying?

Nothing, at the end of the day, whether giving someone else your data is a good idea or not remains a question of trust.

Do you trust them to stop updating the canary in case they become compromised?

If the answer is no, then you probably shouldn't be giving them valuable data.

Re: Cloudflare expands its government warrant canaries

#53

Post by RcouF1uZ4gsC »

I wonder if it is in the government’s interest to serve warrants to all the canaried providers simultaneously . The thing about a warrant canary is that it is a one time use feature. If one day all the warrant canaries disappear from all the services that had them, what will the public do?

Re: Cloudflare expands its government warrant canaries

#54

Post by DannyB2 »

goto11 wrote: post #50
DannyB2 wrote: post #45

Earlier quoted context omitted.

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But s…

If the warrant canary is in the company's financial statements, is the judge going to now try to force the company to introduce inaccurate information into their public financial disclosures? The SEC might take a dim view of that.

The company can take the 'can neither confirm nor deny' posture, and simply remove the warrant canary from public financial statements. Or leave the most recent accurate and dated one unchanged.

Re: Cloudflare expands its government warrant canaries

#55

Post by TheLoneAdmin »

skrebbel wrote: post #22
rsync wrote: post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

The government can issue a gag order on a specific subject. This prevents you from disclosing the existence of a subpoena. However, the opposite is not true. The government cannot compel speech.

Sure, the government can take illegal actions...

However, they cannot force someone to make an untrue statement.

Re: Cloudflare expands its government warrant canaries

#56

Post by DannyB2 »

DanBC wrote: post #46
DannyB2 wrote: post #45

Earlier quoted context omitted.

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

> I didn't take any action to disclose anything. I simply stopped updating something. This might work if judges are fucking idiots.

See my post immediately above about if the warrant canary is in the company's public financial statements.

Re: Cloudflare expands its government warrant canaries

#57

Post by jjeaff »

rsync wrote: post #26
skrebbel wrote: post #22

Earlier quoted context omitted.

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

There is also the possibility that we take your money for cloud storage and run away to Costa Rica without providing anything to you. Or our ZFS filesystems are actually raid-5 ext2 volumes and we fake the snapshots. Or one of the locations is just running in my basement. There are all kinds of ways for a service provider to act in bad faith. In many ways, the warrant canary is an attempt to signal what kind of peopl…

Except all those are examples of acting in bad faith. The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure.

The only bad faith might be using warrant canaries knowing that they may still be able to be compelled legally to comply.

Re: Cloudflare expands its government warrant canaries

#58

Post by goto11 »

DannyB2 wrote: post #54
goto11 wrote: post #50

Earlier quoted context omitted.

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But s…

If the warrant canary is in the company's financial statements, is the judge going to now try to force the company to introduce inaccurate information into their public financial disclosures? The SEC might take a dim view of that. The company can take the 'can neither confirm nor deny' posture, and simply remove the warrant canary from public financial statements. Or leave the most recent accurate and dated one uncha…

The judge can punish the company severely for breaking the law.

Re: Cloudflare expands its government warrant canaries

#59

Post by mrguyorama »

malnourish wrote: post #37
mrguyorama wrote: post #20

Earlier quoted context omitted.

I am hesitant to conflate actual neo-nazis with actual politics

They are actual politics, regardless of your or my beliefs. They vote, and if there are enough of them, someone will cater to them. To willfully ignore them is to ignore a sad reality, they will continue to grow unabated; to meaningfully engage them is to platform a disingenuous group (not to mention giving their beliefs acknowledgement). It seems to be a catch-22 to me.

I'm arguing that people wanting the removal of a hate group who's largest purpose is the purge of specific ethnic groups is not a political matter, but a humanitarian one, therefore taking down Stormfront was not due to political pressure

Re: Cloudflare expands its government warrant canaries

#60

Post by balabaster »

goto11 wrote: post #50
DannyB2 wrote: post #45

Earlier quoted context omitted.

Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped up…

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But s…

Does this mean that if you were screaming from the rooftops "I'VE DONE NOTHING WRONG" every day leading up to the gag order and then you stop screaming from the rooftops that you'll be in contempt of court?

Can the court compel you to continue with behaviour to cover something up?

Would that be akin to conspiracy to commit fraud or wire fraud if electronic? Wouldn't that make the court and thus the judge complicit in conspiracy to commit wire fraud?

I have a feeling a judge is not about to risk being disbarred for such behaviour.

Of course, I'm not a lawyer and this is purely conjecture on my part.

Post reply on HN