15 ms·
Dutch government says no to backdoors, grants $540k to OpenSSL
- breakingcups 11y agoThis is a refreshing voice to hear in the media. I really appreciate the nuance that the Dutch government has displayed here, aligning itself with what most people in this audience would consider common sense. Are there other governments that have spoken out in support of encryption like this? I'm sure there must be, but (casually following the news) I haven't seen any.
- Cyph0n 11y agoThis is how it's done, if you truly want a more secure world, that is.
- neuromute 11y agoCredit where credit is due. This is exactly the right approach. If only other governments would follow suit.
- peteretep 11y agoThe EU has a remarkable track record on implementing the best of its constituent governments policies on human rights and privacy, so there's hope there.
- tomp 11y agoThis reminds me of the time when NSA offered an encryption algorithm to the public...
- stephenr 11y agoi haven't read the article but isn't this the dutch government just giving money to an existing open source project, to use as they see fit to improve/maintain the existing library? seems ultimately the opposite of what you're talking about.
- tomp 11y agoSure, but you never know what (non-public) conditions are attached to the money...
- ksec 11y agoSo to OpenSSL and not to LibreSSL?
- icebraining 11y agoApparently, money will go to OpenSSL, LibreSSL and PolarSSL. http://www.theregister.co.uk/2015/12/09/netherlands_votes_to_spend_on_encryption/ http://www.theregister.co.uk/2015/12/09/netherlands_votes_to...
- rplnt 11y agoWasn't OpenSSL quite vulnerable and not recommended to use few years back and people were phasing it out? Or am I mistaking this with something else?
- chadzawistowski 11y agoYes, the OpenBSD folks have forked it as LibreSSL.
- benchaney 11y agoThere was a pretty serious security issue in it, but it was fixed. A lot of people were predicting the end of OpenSSL, but at the end of the day, most viable alternatives came around too late for people to phase it out.
- DiabloD3 11y agoYou're a bit mistaken. A lot of FOSS political warrghble happened, but OpenSSL still remains the most audited and used SSL library out there. Yes, it may have bugs. Yes, the NSA may have tampered with the standards themselves (that everyone else must also implement, else risk compatiblity issues in some areas). But there are no drop in alternatives that aren't based on the same codebase, and almost no one is using any alternatives: NSS (Mozilla's framework) is rarely used outside of Firefox, GnuTLS is rarely used, I've never heard of anyone using PolarSSL outside of very specific embedded projects, and LibreSSL (a OpenSSL fork) is being adopted only as a license-related political response, and BoringSSL is Google's response to the entire thing (their own OpenSSL fork that they control, to just ignore the entire political bullshit).
- jlgaddis 11y agoFWIW, LibreSSL replaced OpenSSL in OpenBSD 5.6 -- over a year ago.
- DiabloD3 11y agoOpenBSD started the LibreSSL project, so, naturally, they would adopt it. OSX has also adopted it for purely license politics reasons, El Capitan shipped with it: $ /usr/bin/ssh -V OpenSSH_6.9p1, LibreSSL 2.1.8
- Freak_NL 11y agoI tried to open the (Dutch) DOCX that contains the official position paper of our government, but LibreOffice refuses to open it: File format error found at SAXParseException: '[word/document.xml line 2]: unknown error', Stream 'word/document.xml', Line 2, Column 30060(row,col). http://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2016Z00009&did=2016D00015 http://www.tweedekamer.nl/kamerstukken/brieven_regering/deta... Great. Usually OOXML Word files at least open in LibreOffice, but this one seems to have some unsolvable weirdness. I don't get why they don't offer a PDF download — it, at least, is an open format that can be reliably opened on any OS. Or offer a plain text version, or simply post the paper on their website in HTML.
- Rubu 11y agoPerhaps something on your end? LibreOffice (4.2.8.2) doesn't have a problem with the file on my system.
- Freak_NL 11y agoInteresting. This is LibreOffice 5.0.2.2.
- icebraining 11y agoWorks fine for me, but I've made a PDF version: https://drive.google.com/file/d/0B2WvkUwBYadXb3pYVk1pWmIyekk/view?usp=sharing https://drive.google.com/file/d/0B2WvkUwBYadXb3pYVk1pWmIyekk...
- Freak_NL 11y agoMuch appreciated. :)
- tech-no-logical 11y agomy old libreoffice (Version: 4.2.4.2) opens it fine.
- Freak_NL 11y ago
- omarforgotpwd 11y agoThe danger of critical infrastructure being attacked digitally is already far greater than the risk of say, a bomb attack. Weakening our digital defenses to spy on terrorists is like throwing your laptop in the pool because you're afraid someone might light it on fire.
- rsync 11y ago"The danger of critical infrastructure being attacked digitally is already far greater than the risk of say, a bomb attack." This is not true. However, it is important to keep in mind that were it ever true it would be because of blatant negligence on the part of human actors. It is neither obvious nor inevitable that a nuclear plant will ever be attacked digitally because a nuclear plant need not be networked - even internally. It is neither obvious nor inevitable that a hydro dam will ever be attacked digitally because a hydro dam need not be networked - even internally. With an open mind and some creativity this could be true even for things like air traffic control and the power grid. They don't need Internet access. They might not even need IP. If any of these things are fragile to digital attacks it is because they were gratuitously made fragile.
- Lawtonfogle 11y agoOne only needs to look at the recent issue with hacking cars to see that it is quite possible. A single bomb, short of a nuke, would do far less damage than a virus attacking certain vehicles. The real issue is the effort needed to acquire the bomb/build the virus. Bombs seem to still have a far lower startup cost, so while you may get less bang for your dollar, they are more popular. Is it popularity or damage/$ that determines what is more dangerous?
- omarforgotpwd 11y agoWhat I mean is "the potential for damage is far greater". Getting access to the right persons email account could shut down roads, power, communication, etc.
- HappyDreamer 11y agoSeems you are arguing that it is with 100% certainty not true, because nothing has happened thus far. You don't know what will happen tomorrow though, so you cannot be that certain. Blatant negligence and human factors seems to me to be what to expect, rather than rare exceptions. — Well, not for nuclear plants. But for the power grid for example, and trains and cars and the water pipe system perhaps.
- timwaagh 11y ago'Although the Dutch position is nuanced and firm, the government also has the luxury of not having real impact on the real world' noted.
- synctext 11y agoThey actually put money in development of strong encryption, €0.5M. Here are the details from the government ordering to support OpenSSL: https://zoek.officielebekendmakingen.nl/kst-34300-XIII-10 https://zoek.officielebekendmakingen.nl/kst-34300-XIII-10
- oever 11y agoAnd contrary to the document on the parliament website [1], that link points to the document in PDF, ODT, HTML and XML. [1] http://www.tweedekamer.nl/kamerstukken/brieven_regering/detail?id=2016Z00009&did=2016D00015 http://www.tweedekamer.nl/kamerstukken/brieven_regering/deta...
- Arnt 11y agoSome people desire simplicity, and will think it into existence if necessary. I expect the author of those words didn't, for example, think about the Netherlands being a net contributor to the EU, he just knew it's a small country. In the EU, net contributors seem to have something awfully close to an effective veto regarding minor issues, so this is good news.
- wobbleblob 11y ago> In the EU, net contributors seem to have something awfully close to an effective veto regarding minor issues, Do you have a source for this? I never got this impression. Some countries have proportionally large influence due to their size, namely France and Germany. Some others due to the high quality diplomats and politicians they send to Europe, such as Belgium and Italy. Some countries actively sabotage their own influence in the EU, by showing nothing but hostility and obstruction (UK), or by using the EU as a kind of retirement plan for politicians and diplomats that failed domestically (Netherlands). Always echoing the German point of view should not be seen as "an effective veto", it is essentially an attempt to stay in favor with their formerly close, powerful friend to the east, who has been getting less and less interested over the years, as his attention shifts towards the East.
- teekert 11y agoIt's nice, meanwhile "we" now have a law being debated by government (not sure it will pass) that allows the government to hack individuals if they are suspect, this may even happen via people the suspect may know. It even includes being allowed to install spyware on a webcam. But I guess it is good to leave encryption strong, forget about mass surveillance and focus energy on individuals actually suspected of a crime. The cynic in me thinks the reasoning was: "We need a European Google", "We see that Europeans distrust American companies because of NSA economic spying in the past", "Let's make the Netherlands more attractive for large European companies"... no Idealism involved. Edit: Updated original post: This new law ("Wet Computercriminaliteit 3") has not been passed yet!
- halviti 11y agoWithout knowing the details, I think this sounds fine as long as there is reasonable suspicion, it is approved by a court or judge, and a warrant is issued to conduct the surveillance.
- teekert 11y agoIndeed, it is the way to go imo, it is akin to a steak-out, hacking friends and family though... a bit fishy.
- halviti 11y agoYes, you most definitely should not target people not suspected of a crime. This seems to go against the Dutch Constitution, so hopefully people are fighting this.
- jlgaddis 11y agoAs an American unhappy with the way our government is heading (backdoors in encryption), I would love to see a "European Google". I am certainly no expert in laws in the EU but, as I understand it, the data protection laws there are actually pretty good. I would much rather handle/host my data in countries where the companies are held to these standards.
- 11y ago
- jlgaddis 11y agoIf I'm thinking of the same thing (and I believe I am), the vote actually happened a month or so ago. The original proposal was to give 500k euro to OpenSSL but what actually was approved was to spread that out amongst OpenSSL, PolarSSL (which, I think, comes from .nl), and LibreSSL, in a manner that was not yet determined. Personally, I'd prefer to see the majority of it go to the guys working on LibreSSL simply because I think it would have the most impact there. I somewhat expect most of it go to OpenSSL, however, if for no other reason than it being the most widely used of the three.
- praseodym 11y agoYes, the proposal was changed to spend the 500k EUR on open source encryption projects in general, to quote: "OpenSSL, LibreSSL, PolarSSL, etc." - no particular distribution of the money has been decided on as far as I can see. Source: http://www.tweedekamer.nl/kamerstukken/amendementen/detail?id=2015Z23825&did=2015D48058 http://www.tweedekamer.nl/kamerstukken/amendementen/detail?i...
- lucb1e 11y ago> the vote actually happened a month or so ago. Yup, I posted the result on HN but nobody cared at that point. I guess it wasn't quite concrete enough because the money would go to "undetermined open source projects that have to do with encryption, such as polarssl and openssl".
- nomercy400 11y agoDutch here. The argumentation is remarkably good. The privacy like you have with letters and phone calls is part of our constitution, and also part of European guidelines. The rules to violate this privacy, only in certain cases, is already part of the law (eg. wiretaps under suspicion). ISPs have to cooperate where possible. That the dutch intelligence services are now hampered by end-to-end encryption making the ISPs have no way to cooperate any more, is basically the problem of the intelligence services to solve, and not a legal problem. Hence, encryption stays in place.
- rambambam 11y agoHow much privacy with phone calls is there, when The Netherlands are known for having the most phone taps in the world? The formal privacy looks pretty strong indeed, government needs a warrant, etc., but at the end of the day they can do whatever they want.
- Maarten88 11y agoFrom what I hear, police here can also freely access and query all phone metadata, without the need for a warrant.
- tootie 11y agoIn the US, there are laws on the books that telecom corps are required to facilitate searches or wiretaps on client communication when presented with a court order. And if you look at the metadata collection deal that Obama passed recently, it says that the NSA can't collect metadata, but telecoms are required to do it instead and produce it when served with a court order. So, it's not at all unprecedented for government to make it a legal problem and put the onus on private industry. This is actually Hillary's most recent stance on encryption. She says if we can't "break" encryption or have backdoors, you have to give us another option. Wouldn't be surprised if Holland and others have a similar idea in mind.
- timonv 11y agoThis statement was made early December. And I think it does deserve some nuance: Minister Steur (Security and Justice) this monday said, representing the second chamber, that "laws that prohibit encryption are not desirable at this time". That doesn't retract their early statement, but I think it's an important nuance. Arguably, it might also just be political play to get some douchebag rightwing parties over the line. (dutch source http://tweakers.net/nieuws/107104/kabinet-beperking-van-encryptie-is-op-dit-moment-niet-wenselijk.html http://tweakers.net/nieuws/107104/kabinet-beperking-van-encr...) Similarly, in december, a law was passed that allows authorities to hack 'criminals' without a warrant. In many countries, (liberty) activists are criminals too. That said, I still appreciate where things are going. Privacy is a very tough political climate and I think it's solid that we (the Dutch) take this standpoint. Baby steps.
- vincentkriek 11y agoI think this needs a whole lot more nuance. Minister Steur said that the laws are not desirable at this time, after other cabinet members said it will hurt economic relations. This is not a statement saying we don't want this, this is a statement saying we can't do this right now. Also, the money going to OpenSSL and others is completely unrelated to the current encryption banning talks going on in the Netherlands. This is a great initiative that should be applauded. I agree with your conclusion though, but I am very weary of the dutch MoD.
- gpvos 11y agoYou probably meant "wary". But weary too.
- Freak_NL 11y agoThe money going to OpenSSL might be related to the issue the Dutch government ran into in 2011 with the Diginotar (a certificate authority) hack; the TLS certificates for Dutch government websites were compromised at that time. While this hack was not related to weaknesses in OpenSSL (as far as I know), this did put the spotlight on the vulnerability and dependence on of the certificate chain. Supporting the software that provides this crucial layer of security makes a lot of sense for a government that has been bitten once.
- mhixson 11y agoIs an English translation of the original position paper available somewhere?
- lucb1e 11y agoFWIW, when news first broke I posted a translation of a news article: https://news.ycombinator.com/item?id=10698743 https://news.ycombinator.com/item?id=10698743
- deleted 11y ago[deleted]
- rdl 11y agoI hope we don't get someone in a few years "uncovering secret information that OpenSSL is funded by a foreign government".
- chei0aiV 11y agoDon't worry, they can still get your stuff; the new Dutch cybercrime law allows the likes of Fox-IT to hack your laptop/ISP and grab your data from there.
- meshko 11y agoYou can read the headline in a hilariously ironic way.
- theandrewbailey 11y agoDamn. This really encourages me to start donating to open source projects.
- jacquesm 11y agoAs much as I like this I'm sad to say that we also have numerous violations of the law with respect to privacy by many branches of the Dutch government. Journalists have had their phones tapped, the schools and health care providers are asking for ever more absolutely private information about parents from both the parents and their children (this is of course 'for the children' so never mind the violations), finger prints of non-felons are still collected with impunity, dragnet style information collection is on the order of the day, there are no means of transport that are not under continuous surveillance outside of going on foot and by bicycle (and even there the little snitch in your pocket will tell big daddy where you are) and so on. It's sad that we seem to be able to make the right decisions from time to time but at the same time we are actually making the wrong decisions most of the time. Here's to hoping things will eventually get better, I shudder to think of the kind of catastrophe that would swing the pendulum back the other way and turn the tide.
- clentaminator 11y agoI think part of the reason why it seems that we're making the wrong decisions most of the time is that the actual decision-making is less obvious in a lot of situations. While everybody knows that their mobile phone can be/is tracked as it moves between cell towers, it's far less obvious than an explicit vote for or against some kind of invasion of privacy. In which case, raising awareness so that people can actively override the decisions being made for them seems like a good place to start.
- speleding 11y agoI agree with most of your points, but why do you think "finger print collection of non-felons" is a problem? There are well-documented examples of that database being used to catch bad guys, and I have not heard of any abuses of that database. So I would think this is one example where a small privacy incursion is offset by a proven gain in security. I would go as far as saying that collection of fingerprints and DNA profiles should be expanded. I have enough trust in Dutch democracy to change it back again if it turns out not to improve security after all. (As someone who has lived in other countries, I would not say the same of any democracy).
- known 11y agoI'd install http://wiki.debian.org/iptables http://wiki.debian.org/iptables
- dmichulke 11y agoAny government that imposes less taxes (all else being equal) and has thereby managed to entice its population to spend an equivalent or higher amount of time or money on the project did a better job. Unfortunately their deeds will be unsung.
- rand1012 11y agoDoes it not bother anyone else that openssl doesn't support HTTPS on their website?