6 ms·

> But at the same time, we technologists as a class knew academically that these capabilities could be abused, but nobody actually believed they would be abused

• sp332 11y ago
  You knew GCHQ tapped Google's datacenter-to-datacenter links?
  • lubujackson 11y ago
    http://archive.wired.com/science/discoveries/news/2006/05/70908 http://archive.wired.com/science/discoveries/news/2006/05/70... This stuff has been going on, and widely discussed, for over a decade. But no one really cared or understood the full scope until Snowden's slapped everyone across the face with it.
    • sp332 11y ago
      Yeah I know about the AT&T splitters mentioned in the footnotes. But the Snowden leak was a lot bigger than that. Did 0xCMP know that the NSA was recording the full contents of every cell phone call in the Bahamas and keeping them around for at least 30 days?
      • nickpsecurity 11y ago
        We didn't know but it wasn't paranoid to assume it. The reason was the Echelon leaks and what was done about those. The answer: nothing.
        • setpatchaddress 11y ago
          It wasn't paranoid in crypto-knowledgable circles. It earned you a tinfoil hat outside of them. That's why Snowden was important.
          • nickpsecurity 11y ago
            I totally agree with that. His work was greatest in raising awareness of people who'd otherwise never be exposed to it.
          • 0xCMP 11y ago
            This 100%. Snowden was so important because he brought this stuff mainstream. But, let's be completely clear that it was already mostly known in bits and pieces and many leaders in tech had already been sounding the alarms. I am in no way downplaying Snowden or what he prompted everyone to do, but everyone knew it was happening. They just weren't motivated or felt no one else cared. Its kind of like trying to get people to use PGP for normal communications: You understand why, and they might too, but they don't care enough. So it doesn't get done.
            • nickpsecurity 11y ago
              "Its kind of like trying to get people to use PGP for normal communications: You understand why, and they might too, but they don't care enough. So it doesn't get done." Good example. I've seen harder to use tools with little benefit adopted by enterprises because management forced it. The simplest version of encrypted email and storage often was ignored for just apathy.
    • barrkel 11y ago
      That archive link doesn't reference Google at all, or non-consenting data feeds from internal networks of friendly companies. I too knew about that whistleblower before Snowden. I didn't know about Google intranet being compromised, or things like hostile code uploaded to hard disk controllers, or data exfiltration via compromised in-transit routers, etc.
  • nickpsecurity 11y ago
    Definitely. They could, targets were using it, they were known to tap backhaul microwaves/satellites, their own guideance in high-assurance side was using link encryptors between sites, its in their commercial recommendations (NIPSOM Industrial Security Manual), and so on. Everything in the world to make you think somebody was tapping your line and that they might. So, some groups that were wise went ahead and deployed link encryptors. Black programs, follow NIPSOM and SAP supplements, sure as hell used link encryptors so good [1] we can't buy them because... national security. I sure as hell used end-to-end crypto and VPN's for anything significant. Google and Facebook... treasure troves of PII and I.P.... didn't for reasons I can't imagine. Result was they got intercepted in bulk by something that's been a known risk for 20+ years. Take NSA out of picture and they should've still thought the lines might get tapped by crooks or foreign spooks. So, yes, Snowden leaks mostly just taught us what we already knew in greater detail. People ignored it then, some ignore it now, and yeah problems happened. [1] http://www.raytheon.com/capabilities/products/high_speed_network/ http://www.raytheon.com/capabilities/products/high_speed_net...
    • barrkel 11y ago
      The core infrastructure security people at Google didn't know it, from what I understand. Maybe they're all incompetent; maybe they were lying; or maybe the knowledge (not rumour or suspicion) wasn't as pervasive as you say it was.
      • nickpsecurity 11y ago
        I addressed it here: https://news.ycombinator.com/item?id=11553070 https://news.ycombinator.com/item?id=11553070
    • pyre 11y ago
      Google's datacenter-to-datacenter links probably weren't going over the public internet, so they didn't feel the need to protect against man-in-the-middle attacks on physical lines that they owned. If you connected two computers to each other with a cross-over cable, would you feel the need to encrypt all communications between them, just in case?
  • 0xCMP 11y ago
    I had no idea. I'm not downplaying Snowden. The guy is 100% a hero in my eyes. But, to claim we in tech community were all like "I have no idea this was happening" is completely bogus.
    • tanderson92 11y ago
      It was also very easy to dismiss us as conspiracy theorists. And indeed we were. The Snowden revelations are useful as a way of saying "we predicted the state was engaging in mass surveillance and they denied it while they continued the program". That is immensely useful for the future.
      • nickpsecurity 11y ago
        I agree. I agree in a specific way: people were always thinking that anything with a significant chunk of people would've been revealed by a bunch of them. There's probably thousands involved in everything in the Snowden leaks from government to private industry. About biggest stuff, only one or two people talked while the rest worked in secret by the thousands to make it happen for around 10 years. That's one hell of a counter to the bullshit I keep hearing that nothing secret or evil could happen if it's 2 or more government people.
• deepnet 11y ago
  Foresight has been essential in this. Without Stallman's foresight of the need for public domain open source software, there would only be proprietary software, all subject to PRISM. Without the foresight of potential Government's to come the US founding fathers would not have written in such protections as still exist today. Before Snowden there were many that suspected but now everyone knows. >Um. Who thought this? Snowden himself: "I had too much faith that the government really would do no wrong. I was drinking the Kool-Aid in the post-9/11 moment. I believed the claims of government, that this was a just cause, a moral cause, and we don't need to listen to these people who say we broke this law or that law." pre Snowden this was unopposable, the NSA's James Clapper lied to Ron Wyden in Congress about mass surveillance.
  • nickpsecurity 11y ago
    "Without Stallman's foresight of the need for public domain open source software, there would only be proprietary software, all subject to PRISM." Or proprietary, shared-source software provided by nonprofits or companies in jurisdictions that aren't surveillance heavy. No, you don't need FOSS to avoid PRISM lol. It has its advantages in resisting totalitarianism for sure but you don't actually need them. More of author or organization's intent and licensing that really matters. Many models available. Btw, the first, secure-ish mainframe OS (MCP of Tron fame) was sold in source form by Burroughs with fixes/updates allowed to be submitted. In 1963. High-assurance stuff under Orange Book similarly had to deliver source that was reviewed and provided a way to know you had same copy. Just to support my claim that there's proprietary models for it but most just wanted money instead. ;)
    • deepnet 11y ago
      There was a cultural change when Bell was broken up and UNIX became less laissez-faire, a paradigm shift. Software became valuable and not just bundled with hardware. Stallman saw it coming early enough that he had completed his GNU Free toolchain in time for Torvalds to use it. A developer community is less likely to arise when your modifications can be closed and you cannot fork. If your business runs in someone elses walled garden it can be taken away. Without the GPL's four freedoms we would not have the rich public domain of code we have today - a legally protected commons. Before the GPL the public domain suffered from the tradgedy of the commons, a fantastic legal hack.
• nickpsecurity 11y ago
  Yeah, he's full of it. We in high-assurance community and even the cypherpunks have been telling people forever it was being abused. Because people were abusing it and its design practically asked for it. These were ignored as externalities by people motivated by convenience, feature bloat, price, and/or profit. Even getting it down to almost identical cost/speed didn't help if it lacked unnecessary feature X. This was censorship by business and security communities plus apathy by consumers. Plain and simple. The business communities didn't want to spend crap on INFOSEC. The ones that did faced two obstacles: (a) low volume meant real deal was ridiculously expensive with slower development; (b) mainstream INFOSEC conned companies with bandaids or fake security because they made more money that way. Constantly charging to fix problems they left in or upgrades people didn't need. So, result was everything is shit security and stays that way. Neither proprietary nor FOSS learn from lessons 99% of the time. All due to what Schneier always called "perverse incentives" that keep bad stuff produced.
  • mercurial 11y ago
    > Yeah, he's full of it. We in high-assurance community and even the cypherpunks have been telling people forever it was being abused. Because people were abusing it and its design practically asked for it. These were ignored as externalities by people motivated by convenience, feature bloat, price, and/or profit. Even getting it down to almost identical cost/speed didn't help if it lacked unnecessary feature X. So, you're saying that Snowden is right, that computer people as a whole were not aware of it. There is a huge difference between a theoretical risk and someone coming forward with a huge amount of proof that it is, in fact, happening right now.
    • nickpsecurity 11y ago
      It was a theoretical risk pre-Snowden that PC and neteork security was horrible? No, it was in thd news every day with recommendations from industry and government on how to counter a lot of it. Further, academia was teaching the INFOSEC people about high assurance methods from the old days. Such things were mostly ignored despite being in media, conferences, government certifications... yoh name it. Interestinv enough, Snowden had seeminglh no impact on number of high assurance dsvelopments out there. So, even as bad as it is, people aren't doing the things that stop even NSA during evaluations and which they themselves use for most critical stuff.
• 0xCMP 11y ago
  > > But we were confronted with documented evidence in 2013 that even what most people would consider to be a fairly forthright upstanding government was abusing these capabilities in the most indiscriminate way. > Um. Who thought this? Ever? Since the 90s. To be clear this meant who thought we had "a fairly forthright upstanding government [not] abusing these capabilities in the most indiscriminate way" ever since the 90s.
• partiallypro 11y ago
  Yeah...there was a pretty hit movie in the 90s about government abusing surveillance powers with two power house actors (Enemy of the State.) I think what Snowden did was good generally, but I think he thinks too highly of himself. Almost everything he leaked was already suspected or known, he just pushed it into the public eye.