40 ms·
Reddit removed NSL canary from 2015 Transparency Report
- jat850 11y agoBased on spez's language, is it safe to assume that a NSL has indeed been received? That's my interpretation (and it seems that of other reddit commentors too).
- jessaustin 11y agoAny other interpretation would call into serious question the entire concept of canaries.
- rconti 11y ago"maybe they just got bored of it". Haha.
- kevin_thibedeau 11y agoOr Twitter sent then a C&D. All your birds are belong to us.
- jat850 11y agoI agree. One commentor suggested that they could have voluntarily removed it for some other unrelated reason, but then they would have no reason to not say exactly that - which they aren't. Seems to leave only one reason why they did.
- hxegon 11y agoWhich spez responds to and says: "I've been advised not to say anything". Only explanation I can see is NSL.
- firebones 11y agoWhich leaves open the possibility of the nefarious catch-22 of the pre-emptive NSL: the NSL that threatens you to take down the canary before they have to issue you a substantive NSL!
- look_lookatme 11y agoThis is not how an NSL works.
- recursive 11y agoBut if you knew how an NSL worked, how could you say?
- deleted 11y ago[deleted]
- irascible 11y agoN.ot to S.ay A.nything.
- nickpsecurity 11y agoPeople see NSA everywhere they want to. Yet, domesric authority here is FBI which compels SIGINT-enabling for NSA per leaks. Court order, NSL, or backdoor are all FBI if coerced.
- vacri 11y agoSo, one disadvantage of these loophole canaries is that they only work once. What happens when another NSL is issued at a later date?
- lugg 11y agoIt doesn't matter. Once is all it takes, from that point forward you can't fully trust anything they say about their privacy / security. The only real questions are: is this an april fools? And does it matter?
- jat850 11y agoI suspect you were being tongue in cheek about it, but I don't think this would be an April Fools' matter for Reddit.
- colejohnson66 11y agoThey could bring it back but with a catch: "between 1 April 2016 and (today) we have not received any NSLs, etc." But if you're gonna do that, you could do: "Yesterday, (date), we did not revive any NSLs, etc."
- grrowl 11y agoTHAT would definitely draw the ire of the law. They're even limited in how many regular orders they received to ranges of 500.
- colejohnson66 11y agoBut as has been said before, it's undecided if warrent canaries are even legal. So until we get a ruling on wether they are legal or not, we really have no way of knowing what we can and can't do.
- rdtsc 11y agoMoreover. The state, as an actor, should simply generate constant stream of NSL requests to trip as many canaries as possible. They have the time and resources. This would basically nullify the effectiveness of canaries as a concept. "Hey George, did you hear Reddit has a canary now too. Ok, add it to the list. Pick a user there and issue an NSL. And don't forget about Google and FB this month as well, they are about to reset theirs". Putting oneself in the shoes of such an actor this is a rational approach to take.
- deleted 11y ago[deleted]
- shmerl 11y agoHere is a good explanation: https://www.reddit.com/r/announcements/comments/4cqyia/for_your_reading_pleasure_our_2015_transparency/d1kvvr8 https://www.reddit.com/r/announcements/comments/4cqyia/for_y...
- shalmanese 11y agoBetter link with context: https://www.reddit.com/r/announcements/comments/4cqyia/for_your_reading_pleasure_our_2015_transparency/d1kvvr8?context=9 https://www.reddit.com/r/announcements/comments/4cqyia/for_y... edit: There appears to be a bug in the reddit context code, here's the original root comment that sparked the discussion: https://www.reddit.com/r/announcements/comments/4cqyia/for_your_reading_pleasure_our_2015_transparency/d1knc88 https://www.reddit.com/r/announcements/comments/4cqyia/for_y...
- schneidmaster 11y agoIncidentally, it's not a bug per se, reddit only supports contexts between 0 and 8, presumably for performance reasons. It's documented in the API docs: https://www.reddit.com/dev/api#GET_comments_{article} https://www.reddit.com/dev/api#GET_comments_{article}
- Aelinsaar 11y agoIt's the ONLY safe assumption.
- yk 11y agoI think there are basically two plausible scenarios, either they received a NSL or they do no longer believe that a canary is necessary and misjudged the interpretation. (In the second case, they could of course clarify in the comments.)
- krapp 11y agoIt's a dead man's switch. If it's gone, they've been served with an NSL and the site has been compromised. There's no room for interpretation and no other scenario can be considered plausible.
- abetusk 11y agoCEO of Reddit Steve Huffman, username "spez", writes: "I've been advised not to say anything one way or the other." [1] when asked whether he withdrew the canary voluntarily. The comment directly beneath sums it up: "In case anyone is still confused or in disbelief, this is where he confirmed it. He really can't say it any more clearly without teasing the law to go after him." [1] https://www.reddit.com/r/announcements/comments/4cqyia/for_your_reading_pleasure_our_2015_transparency/d1kpn4k https://www.reddit.com/r/announcements/comments/4cqyia/for_y...
- rtpg 11y agoI do not believe that a canary can be a reasonable defense for "Oh I didn't say anything" There's two situations here: Either the gov't doesn't care that you say you got an NSL (without specifics on time/subject), or they do care. If they do care, discussion with judge: - Did you say you got an NSL, despite there being a gag order? - Well I didn't not say anything - You had previously had a communication strategy set up to communicate when you would get an NSL - ... - So you did say it. Case where the gov't doesn't care that you mention you got one (given you hide the time/subject through delays): - Why did you do all the crazy stuff to tell people instead of just telling people? - It was funner this way Is the canary really a legal defence? I can only imagine that no, it isn't. At best it lets you imply that you got an NSL even if you didn't (oops we removed it from the template). At worst you're facing the same legal issues as before
- unchocked 11y agoCan the government compel you to lie? (I don't know). If they can't, then the canary is a legal defense, unless of course the gov't prohibits those of us who haven't got an NSL from confirming that we haven't got one. But even that could not be retroactive.
- rtpg 11y agoIt's not about compelling you to lie. Nobody compelled you to start the canary in the first place. The gov't gives you a gag order, and a priori gag orders are constitutional, so... you're going to have a hard time finding a judge who will accept the "Oh I was going to follow the gag order but my duty to my redditors to not write my haiku was so big!" argument. The government has no responsibility to assist you in self-perpetuating logic puzzles.
- 794CD01 11y agoWhy does it matter? Are you really going to change your behavior based on this assumption?
- grecy 11y agoThe more important part is that in a country that supposedly has very strong free speech laws, the government can issue a gag order, for any reason they deem, without using normal courts. Surely that's a very, very bad thing.
- freehunter 11y agoIf you decide to put in a canary and then at any time after remove the canary, the only way to interpret that is that the canary died. There's no point in debating any nuance in his comment. The canary died.
- JdeBP 11y agoNo; it's just pining for the fjords. ... What? A canary? Oh, right ... No; it's just pining for the volcanoes.
- tomlongson 11y agoFor those who aren't familiar, a NSL Canary is like a Warrant Canary, but for National Security Letters. https://en.wikipedia.org/wiki/Warrant_canary https://en.wikipedia.org/wiki/Warrant_canary Australia just outlawed warrant canaries. Scary times.
- darklajid 11y agoI like the section from Moxie in that article. Did anyone check if this is lawful to begin with? I mean, if you can't tell that you were asked for private data, can you 'tell' by now saying that you weren't asked for private data? Just to be safe: Any NSL is crap. Braindead. I'm not trying to support that BS. This is among the worst possible ideas a government can come up with and belongs in the realm of (referring to recent posts) Turkey at the moment. But IF they exist for some reason, is a canary really working? Isn't this just another 'The government cannot crack my password' argument, missing the lead pipe way..?
- shalmanese 11y agoThis seems like one of those better to ask for forgiveness than permission kind of things. What NSLs thrive on the most is lack of attention. Anything that brings more high profile is something the NSA would prefer to avoid, lest case law gets more clarified around them.
- snowpanda 11y agoIf you follow the source there's a section stating that according to EFF having a warrant canary should not be a problem: https://github.com/WhisperSystems/whispersystems.org/issues/34 https://github.com/WhisperSystems/whispersystems.org/issues/... What EFF wrote says more to me than Moxie saying 'every lawyer I've spoken to'. Which lawyers? In what context? What was said?
- ChristianBundy 11y ago> Which lawyers? In what context? What was said? Sounds like we need a lawyer canary. /s
- acqq 11y agoHow the canary looked like in the 2014 report: https://www.reddit.com/wiki/transparency/2014#wiki_national_security_requests https://www.reddit.com/wiki/transparency/2014#wiki_national_... The 2015 report: https://www.reddit.com/wiki/transparency/2015 https://www.reddit.com/wiki/transparency/2015
- gpvos 11y agoIt's a pity they can only use such a canary once.
- CaptSpify 11y agoCouldn't they just update a timestamp? "As of april 3rd 2016, we haven't received an NSL"
- peterwwillis 11y agoIANAL, but based on the EFF's page on warrant canaries, it seems like they can, in a way. They can state any legal processes they have not been involved in, for basically any period of time, though EFF recommends several months between any such kind of report. The easiest thing is for them to issue, say, quarterly transparency reports and saying "For this past quarter we have received no XYZ".
- ChristianBundy 11y agoSome services have a daily canary (like https://proxy.sh/canary https://proxy.sh/canary), but we don't know whether they could be forced to sign a new canary even after they've been served an NSL.
- deleted 11y ago[deleted]
- Viper007Bond 11y agohttps://transparency.automattic.com/national-security/ https://transparency.automattic.com/national-security/
- mtgx 11y agoI don't see why not. It would be funnier if they said "Until March 1st and starting with March 3rd we haven't received any NSL."
- shalmanese 11y agoIs this the first warrant canary that we have a reasonably high degree of certainty was actually tripped? I remember a couple of other warrant canary cases that could be more parsimoniously attributed to user error but none this clearcut. Any other warrant canaries trip before?
- ikeboy 11y agohttp://www.zdnet.com/article/apple-omits-warrant-canary-from-latest-transparency-reports-patriot-act-data-demands-likely-made/ http://www.zdnet.com/article/apple-omits-warrant-canary-from...
- jat850 11y agoAccording to Wikipedia, Apple's warrant canary was removed in the July-December 2013 transparency report (and remained absent in the following transparency report in 2014).
- alanfalcon 11y agoThey now report on the number of such requests they receive using a banding system, right? They can say they received between 0-249 such requests this year, something (essentially useless) like that?
- Houshalter 11y agoIf you don't assume compromise when a canary is tripped, then it defeats the entire purpose of a canary. At the very least, someone could ask the site owners about it, and they could deny it. If thu don't respond at all then they definitely have been ordered not to talk about it. Either way you can get the truth with certainty.
- rsync 11y agoThis reminds me ... the rsync.net warrant canary[1][2] is ten years old this month. I was hoping that it would be irrelevant after all of these years... [1] https://www.rsync.net/resources/notices/canary.txt https://www.rsync.net/resources/notices/canary.txt [2] https://en.wikipedia.org/wiki/Warrant_canary#Usage https://en.wikipedia.org/wiki/Warrant_canary#Usage
- cyphar 11y agoI didn't know Australia outlawed warrant canaries. Luckily, it looks like that actually only outlawed journalist warrant canaries (so a company couldn't use a warrant canary to say that a journalist was investigating one of their customers).
- Myrmornis 11y agoI gather from stuff like the quote on Wikipedia pasted below that there is doubt about the protection from prosecution that canaries give you. But I'm finding that hard to believe. What about if it's literally a picture of a canary you remove, rather than any actual sentences, and you don't say anything about it? Or you change it to a cardinal (red) one day? Or you give a string of 1s and 0s with the understanding that the proportion of 1s should be interpreted as the probability that you've been subpoenad? Would the court's decision depend on the belief in the general population about the semantics of the page decorations? Bruce Schneier wrote in a blog post that "[p]ersonally, I have never believed [warrant canaries] would work. It relies on the fact that a prohibition against speaking doesn't prevent someone from not speaking. But courts generally aren't impressed by this sort of thing
- shostack 11y agoThis is incredibly disheartening to hear, but I have to say I'm glad to see the currently top-voted comment is about this, and most of the thread has turned to focus on this. I wonder how big of an issue this NSL will become for Reddit, or whether it will be forgotten about in a week. I also wonder what it means for me as a Redditor. "If you have nothing to hide" arguments aside, does this mean it is safe to assume that the NSA got full access to all of Reddit's data and hoovered it all up? Or are these NSLs only able to target individuals? Not sure you can really make that distinction from a data mining standpoint I guess.
- hxegon 11y agoNo matter what the extent is, I have to assume that everything is compromised and reddit is now totally untrustworthy.
- thrillgore 11y agoI was slowly letting the idea of going back to Reddit something worth doing (after the blackout). Now, I have it DNS filtered. I won't be going back.
- coldcode 11y agoSomeday someone will get an NSL, say screw it, publish it on the internet (with mirrors) and tell the government screw you I now have standing.
- hellbanTHIS 11y agoSurprised it hasn't happened yet, not sure what the penalty would be but I'd guess months rather than years.
- cthor 11y agoThe government would very much want to make an example of anyone who did that. The punishment would be as severe as they could get away with.
- billmalarky 11y agoAre you nuts? It doesn't matter if it's reasonable or not, as an issue of national security I would imagine treason would be on the table due to the "aiding enemies" clause in the law. Treason is _minimum_ 5 years, capital punishment at worst.
- pluma 11y agoThat is either incredibly naive or an underhanded joke. This isn't exactly the kind of thing US law treats as a minor offence, especially if it involves computers. Get the right prosecutor involved and this is a national security concern, an act of treason and a cybercrime all at once.
- foota 11y agoI found myself just now wondering whether a court case has been fought over whether the government can force someone to keep up a canary. It's sad that we can't even know this kind of information.
- dfc 11y agoI have never understood what value I personally would derive from a warrant canary. For the sake of discussion let's assume that reddit's warrant canary was intentionally removed and but for an NSL it would have continued to appear on reddit. How do my actions differ in this universe compared to one where the canary was present in the report?
- awqrre 11y agoMaybe they are now able to get posts from private subreddits and private messages, without warrants...
- dfc 11y agoMaybe they are? The question is, what am I doing differently in this universe compared to the universe where the canary is still present? It seems like your answer is "In this universe (canary removed) I no longer treat reddit as a secure and private communication platform." My personal threat model assumes that reddit is not a secure and private communication platform so the status of the canary does not change my behavior, utility schedules, outlook, etc.
- awqrre 11y agoI personally would not be doing anything differently but that is besides the point... they should not be able to get that data without a warrant. So I guess the value of it would be that you are now aware of something else that the government is doing that they should not be doing...
- dfc 11y agoI apologize if I am missing something in your answer but "NSLs are bad, mmkay?" does not seem to be very responsive. We knew about NSLs before warrant canaries. If that is the only utility they provide it seems like they are not very useful to me.
- 11y ago
- wamatt 11y agoSerious question, what's to stop the NSL including language along the lines: 'Any warrant canaries need to remain in place'?
- ikeboy 11y agoThere's a significant legal difference between compelled speech and compelled silence. The latter is easier than the former.
- ars 11y agoAn NSL can't just make stuff up. Everything in it must be specifically authorized by congress or a court.
- 794CD01 11y agoThe All Writs Act means that's not much of a bar.
- r3bl 11y agoTechnically, they remained in place here too. Warrant canary is still in 2014 report. What they did is they did not repeat it in 2015 report.
- zmmmmm 11y agoIt's amazing that it lasted this long. Given how I assumed the government was handing these things out like candy I would have thought just about every major tech organisation was getting dozens at least every year. In a weird way, it almost increases my faith in the system. Or it decreases my faith even further in the competence of the security agencies .. I'm not sure which. (after Facebook and Google, Reddit is probably one of the most obvious and valuable places to hit they could go to ... how did it take them this long?).
- patrickmclaren 11y agoKeep in mind that canaries do not preclude false negatives, especially in larger organizations.
- brians 11y agoThe only plausible NSL served on Reddit is for subscriber information related to a national security investigation. Reddit was compelled to provide the records they already had on some username's real name, billing details, and similar---and maybe a list of who they exchanged messages with.
- chrissnell 11y agoThere are a number of English-speaking, self-identifying ISIS members who post regularly in /r/JihadInFocus. /u/thelord4444 is one and /u/AnsarAlKhilafah is another. I wouldn't be the least surprised to find out it was about them.
- chippy 11y agoIf I was a national security agency with the ability to perform man in the middle attacks, I'd ask for their keys / certificates and crack encrypted communication, and insert my own targeted payload.
- awinter-py 11y agoI'm surprised nobody has tried to game this system using the CFAA. The CFAA makes unauthorized access a felony, i.e. it permits a site operator to define criminal behavior as they see fit. (and there are prosecutions to back this interpretation). The hack: define 'unauthorized behavior' in your TOS / user agreement to include release of data to any third party. A court can't order you to commit a felony.
- SwellJoe 11y agoA contract is not protection from a lawful order by police. e.g. you cannot make a contract with the mafia, agreeing to never speak to police about the business you conduct, and then expect the law to say, "Oh, OK. You have a contract, of course we can't ask for those records! Sorry to have bothered you." In short, when a court orders you to turn over information, it is not a felony to turn over that information, and in fact it is your legal obligation to do so. You can argue under what terms (e.g. in sealed documents that will not be disclosed in public records of the trial), which the court may or may not agree to. I oppose NSL letters, to be clear, but armchair lawyering aint gonna make you or anyone else immune to them. As long as they are the law, you and I are subject to them, no matter what terms of service we post on our websites.
- awinter-py 11y agoNothing to do with contract law -- the CFAA makes unauthorized access a felony, and 'unauthorized access' has been taken to mean 'violations of the terms of service'. If the court rules to enforce the NSL, fine, but there's now a new precedent that de-claws the CFAA; a solid win. Either way it will be a fun appeals process.
- SwellJoe 11y agoWhat do you believe "terms of service" is, if not a contract between a service provider and their customer? And, regardless, even if terms of service falls under something entirely different from contract law, you cannot apply the law to law enforcement in the same way it applies to you or I. Police openly carry firearms in places where it is illegal for others to do so (and occasionally shoot and kill people), courts regularly order activity that is ordinarily illegal (or even unconstitutional without the order from the court), etc. Police search people, homes, and autos; not legal for you or me, but with the proper procedures, it is legal for police. You're trying to apply law in a way that is nonsensical. It is not that law enforcement is above the law, but that the courts have said that the NSL is not violating the law when law enforcement officers do it. Again, I don't like that NSL is a thing, and I really don't like that courts have upheld them as constitutional. But, that is not the same as saying you can "hack" the legal system to make an otherwise lawful order from law enforcement into a non-lawful order and that they or the courts would have any concern about that hack. "If the court rules to enforce the NSL, fine, but there's now a new precedent that de-claws the CFAA; a solid win." So, if the court rules that law enforcement can enforce an NSL, regardless of the CFAA, you consider it a solid win? For whom? All it does is further cement law enforcement's ability to issue administrative NSLs. Again, you're somehow conflating the law as we must follow it and the law as law enforcement must follow it, in a situation where courts have already said they have this authority. There is nothing we can put in our terms of service that magically makes law enforcement subject to it, in pursuit of duty as a law enforcement officer. Police can lie, can detain people, can stick them in jail, etc. A "No Trespassing" sign will not stop an officer in pursuit or with a warrant. CFAA will not be de-clawed by this, and no one would even try to take such a case to court.
- sloppycee 11y agoWhat terrifies me is not the potential data leak, but that the NSA may be obtaining their TLS certificates, bypassing the threat (to them) of "https everywhere".
- sievebrain 11y agoCertificates are public, the NSA can just download them. You mean private keys. Reddit uses forward secure TLS, so obtaining the private keys does not allow the NSA to decrypt the traffic, as fresh keys are negotiated on each connection. The long term private key is used only for identification, so they allow you to impersonate the server but as far as I'm aware, nobody has yet seen evidence of a large, popular website having all of its traffic hijacked by state actors with stolen SSL keys. I can only imagine that such an attack would be quite visible (unless the taps were done internally inside a big CDN).
- chippy 11y agoAccording to the Snowden documents, traffic is hijacked in a targeted manner. So, for example, only on pages served to the designated user, IP address or IP blocks etc. We would not see all it's traffic altered, we would only see traffic being altered if we were being directly targeted. It would be incredibly hard to see by others. Also, the SSL keys are not stolen, we have to assume that they have been given to them based on the letter. The gag order and canary indicated that everything has been compromised.
- sievebrain 11y agoDoing that requires you to be able to see through at least some connections in the first place, in order to figure out which connections are from your target victim. That's why QUANTUM is a combination of packet sniffing and packet injection. If everything is SSLd then it's much harder to deal with cases where a users connection moves around.
- chippy 11y ago
- i_laugh_at_you 11y agoA workaround to the canary is to every month release an affidavit that says that you have not received an NSL last month. The month you receive one you do not release one.
- foodstances 11y agoUh, that's exactly how canaries work, that's not a workaround.
- i_laugh_at_you 11y agoYou sure?
- maaku 11y agoThe NSL could compell you to release an affidavit anyway.
- i_laugh_at_you 11y agoThey can force you to lie? They can force speech? I thought it was a crime to make a false affidavit no matter the reasons.
- aeze 11y agoIn the name of safety, citizen.
- rincebrain 11y agoThe entire premise of the canary, and this discussion, is that you cannot (currently, legally) be compelled to lie, you can merely be compelled to not tell the truth. If they could, we would not be observing any changes in warrant canaries, ever.
- maaku 11y agoWelcome to the real world, where armchair legal opinions don't matter. A canary is a way of communicating information about the NSL, which is prevented by the gag order of the NSL. The courts see through the canary for the transparent practice that it is. And guess what? These days they side with the government, not the recipient.
- nickysielicki 11y agoReddit should take one for the team and shut the website down. Redirect it to nsa.gov or a pastebin and provide 223MM monthly uniques with the impetus to fix this fucked up country. Maybe a multi-billion dollar company disappearing overnight would be enough to convince our lawmakers that this isn't compatible with being a part of the new global economy. Maybe it would be enough to get people in the streets. As an aside, I'd like to see more sites put something like, "if we are ever served a NSL, our website will stop operating", in their privacy policy. The government can't force you to keep operating a business. If they want to abuse NSL's, so be it. I want the John McCains in our government to realize what they're doing.
- jpttsn 11y agoAt the risk of sounding cynical, I think this whole ordeal indicates the opposite. If "people in the streets" is to be evidence that surveillance "isn't compatible with being part of the new global economy," then we should also take a hint from the lack of "people in the streets."
- nickysielicki 11y agoThat's fair. It's also incredibly depressing.
- look_lookatme 11y agoDoes a reddit thread constitute an email? How does the authorization define what an email is?
- deleted 11y ago[deleted]
- p4wnc6 11y agoI was just about to ask if Hacker News has an NSL canary, when I saw this: < https://news.ycombinator.com/item?id=11402439 https://news.ycombinator.com/item?id=11402439 >.
- alphydan 11y agoIsn't all communication on HN public? (I thought the only additional info on the servers was the votes. Or are IP addresses and timestamps stored for visitors?)
- deleted 11y ago[deleted]
- arca_vorago 11y agoThis reminds me of when people asked Linus Torvalds if the NSA had approached him about putting in backdoors. To which he answered "No" while shaking his head yes... Red Hat and Systemd anyone?
- deleted 11y ago[deleted]
- okasaki 11y agoHonestly the reddit admins lie so much and have so little respect for their users that I don't think we can conclude anything about this.
- dolguldur 11y agoAssuming reddit received a national security letter (NSL), what does it mean? What are the implications?
- deleted 11y ago[deleted]
- wesleyd 11y ago- Have you been served an NSL? - No, I have not. - Have you been served an NSL? - No, I have not. - Have you been served an NSL? - On the advice of counsel, I decline to answer.
- 6stringmerc 11y agoThis sounds like the most logical explanation and basic legal standing of the situation. Not saying what has been said in the past is as clear an indicator as possible, given the circumstances.
- gizmo385 11y agoYishan just posted this a followup that I think is quite interesting[1]. Excerpt: "If you get an NSL, you're gagged. You can't talk about it. I can say that during my time we did not receive any National Security Letters. /r/ekjp was able to say in her Transparency Report for 2014 that they never got any. Apparently in this 2015 report they are not saying that." [1] https://www.reddit.com/r/yishan/comments/4cub02/transparency_reports_and_subpoenas_eli5/ https://www.reddit.com/r/yishan/comments/4cub02/transparency...
- pfortuny 11y agoCould this be an elaborate April's fool practical joke?
- hardlianotion 11y agoI am interested in what Yishan has to say about Amazon AWS https://www.reddit.com/r/yishan/comments/4cub02/transparency_reports_and_subpoenas_eli5/ https://www.reddit.com/r/yishan/comments/4cub02/transparency... Does that inform anyone's choice of cloud infrastructure?
- regularfry 11y agoUntil we get workable homomorphic encryption, the bit about encrypted machine images is (charitably) optimistic. I wrote about this a year ago: http://blackkettle.org/blog/2015/02/19/youve-got-to-trust-your-vm-host/ http://blackkettle.org/blog/2015/02/19/youve-got-to-trust-yo...
- anonymousDan 11y agoUnless you're willing to trust the hardware manufacturer, at which point something like Intel SGX could be a runner.
- regularfry 11y agoYou also have to trust your VM host not to provide an emulated SGX (which is what https://github.com/sslab-gatech/opensgx https://github.com/sslab-gatech/opensgx is, unless I'm very much mistaken).
- anonymousDan 11y agoI think you're mistaken. Intel provides infrastructure to ensure you're talking to an enclave running on an actual Intel machine, and you can then do a remote attestation to verify the contents of that enclave.
- CaptSpify 11y agoI thought this was well known already? if you send your data to someone else's server (even if you are renting it), there is no way you can be reasonably sure it will remain untouched.
- lucaspiller 11y agoSo as an average netizen what can I do about it? Is anyone actually going to boycott Reddit, and lose access to all of the communities that are there because of this?
- Mendenhall 11y agoCompany creates "Government request officer" position in company. Company policy states each month a polygraph must be taken by "Government request officer" covering "certain" topics, and the results are posted online. This month the "Government request division" officer failed his poly. The wording of poly test could be done to never even speak of nsl etc or even what poly was designed to do, and no company document/policy or spoken word ever says anything about the nsl etc.
- deleted 11y ago[deleted]
- nxzero 11y agoTurns out this was intended to be a April Fools joke; not by Reddit, but the FBI. Pretty sick taste in jokes; FBI already had all of Reddit's data because they're hosted on AWS; Amazon already gives all AWS data to the FBI.
- god_bless_texas 11y agoWe'll never know, but I have to wonder if it was bitcoin related. And I don't mean like dark web, but like Mt Gox or other.
- randommodnar 11y agoWhy are you all arguing about fucking canaries? I grew up with this idea that there was a right to freedom of speech and expression. You're all playing their little games when you should be standing up for your right.
- nixgeek 11y agoIn the case of violating the gag provisions of an NSL, that's a 'Fast Track' to an 8x10 cell in an institution not necessarily of your choosing. Do feel free to write your representatives and complain, but don't try and sweep this all away under "right to freedom of speech and expression". National security is far more nuanced.
- randommodnar 11y agoGreat. Freedom of speech in fucking quotes. National security is nuanced. You've got to be kidding me. America has disappointed me.
- freehunter 11y agoSo do something about it. You can't complain in the preposterous way that you're complaining and not actively do something about it. And I'm not talking about voting, it's decades too late for that, and you'd never get the rest of the country to agree with your views. Do something. You're sitting here bitching us out for how the US government works like it's our fault and we should have done something different. Well what are you doing? Because if the answer is "nothing", then maybe you should sit down and reevaluate your tone.
- Domenic_S 11y agoThat's a bullshit response. You can't disagree with policy or people's attitudes unless you're "doing something about it"?
- freehunter 11y ago
- ISL 11y agoAs a reddit users, might this give us standing to make a class action suit to see the letter?
- YesProcrast 11y agoErm, can't edit thanks to noprocrast -- "As Reddit users" would be more correct.