3 ms·

Obtaining the software is hard, that is certain - but human beings have been successfully smuggling contraband for as long as there has been such a thing. And w

by yarg 9y ago

Obtaining the software is hard, that is certain - but human beings have been successfully smuggling contraband for as long as there has been such a thing. And when you download the dozen specific fluffy cat videos, you don't just download that set - that would be fundamentally stupid - the set exists to mask the source, not to protect the receiver. The receiver would download a naively popular superset of the target set - you mask suspicion by hiding with the sheep. Absolute trust is fundamentally impossible (the place where there is no darkness is a legitimate concern here). How do you even know that the public keys on your machines are true, that the hashes of your OS ISOs are not false, that every semblance of the assumption of security that you are working within is not simply a cleverly laid trap designed to lead you to naively reveal your hitherto hidden intentions? Eventually, you just have to run with "fuck it, I'll do what I can to cover my arse - let the chips fall where they may". The fact that it is fundamentally impossible to know the underlying intention of any foreign consciousness or computational context does not necessarily mean that none can ever be trusted, only that they can never be fully trusted - and that you should use whatever degree of caution you believe is justified for the given situation.

acdha 9y ago
I think it's very risky to conflate different classes of threat. Yes, the state could suborn a CA but simply using SSL does not make you stand out. Using software which is designed to evade surveillance is by itself a bad thing to be caught possessing and unless it's perfect it will leave traces which will draw attention. The problem I'm concerned with is the promise: tell people that something like this works and they are likely to trust it – at least until news spreads about other people getting caught by basic statistical traffic analysis. This is basically the Bitcoin anonymity trap: the marketing guys like to run around telling people it's anonymous and people often miss the distinction that any mistake will cause it to fail open with a full public history.

by yarg 9y ago

acdha 9y ago

I think it's very risky to conflate different classes of threat. Yes, the state could suborn a CA but simply using SSL does not make you stand out. Using software which is designed to evade surveillance is by itself a bad thing to be caught possessing and unless it's perfect it will leave traces which will draw attention. The problem I'm concerned with is the promise: tell people that something like this works and they are likely to trust it – at least until news spreads about other people getting caught by basic statistical traffic analysis. This is basically the Bitcoin anonymity trap: the marketing guys like to run around telling people it's anonymous and people often miss the distinction that any mistake will cause it to fail open with a full public history.