4 ms·

I'm confused by some points. 1) Why were they writing their own system to do this? Haystack sounds similar to Tor, which is probably more tested. 2) How is hy

I'm confused by some points. 1) Why were they writing their own system to do this? Haystack sounds similar to Tor, which is probably more tested. 2) How is hype being allowed to succeed in decisions made to address very real causes? The glamour of hacker culture appears to have won, over the science of hacking.

jgrahamc 16y ago
I think the media liked the 'Austin Heap' persona. A combination of that and a hot topic like Iran meant that many outlets decided to put normal journalism aside and report what looks like a non-story. Hell, The Guardian made him Innovator of the Year: http://www.guardian.co.uk/media/2010/mar/29/austin-heap-megas-innovator-award http://www.guardian.co.uk/media/2010/mar/29/austin-heap-mega...
- tptacek 16y ago
  The really unfortunate thing about the Haystack debacle is that it's going to be framed as a problem with Austin Heap and his team --- as if a better team might have been able to pull something like Haystack off --- when in fact the problem is with the fundamental economics of pitting private activist groups against foreign governments on engineering problems.
  - kevinskii 16y ago
    A better team “might” have been able to pull something like Haystack off. Disruptive technologies are often brought about by small groups of skilled visionaries, and it was certainly possible that Austin Heap may have been one of them. But he isn’t. He greatly exaggerated his own hacking abilities, he refused numerous offers of review from real experts, and he fabricated stories of Haystack’s impact inside Iran while soliciting donations all the while. In doing so, he likely made the “fundamental economics” problem that you mentioned even worse. During Iran’s election, people everywhere were anxious to help protestors in any way they could. Legitimate anti-censorship groups may well have benefited from increased media attention and a resulting increase in funding, had Heap not stolen the spotlight. Lay people could have been educated on the real challenges in thwarting censorship. Instead many were led to believe that the problem had already been solved by a boy genius, and that it was simply a matter of sending him enough thumb drives. Heap’s dishonesty and the lax journalism that encouraged it should rightly be discussed.
    - tptacek 16y ago
      Everything I've read about the "legitimate anti-censorship" efforts during the election suggests that no matter how well-intentioned, people sitting on their butts in front of computers in North America and Europe have minimal --- if any --- real world impact in the Islamic Republic. But either way: a better team would almost certainly not have produced a tool that the Islamic Republic couldn't have turned against its innocent users, because no team we can conceive of can match Iran's ability to fund countermeasures. People are inherently captive to the narrative fallacy. They adhere to stories of "us" against "them", and what a great "them" they find in Iran, which stones women and hangs people for writing blog posts! But in the real world, the narrative is irrelevant. The person who figures out how to turn Haystack^2 into a dissident marker and arrest warrant generator isn't going to be a Muslim, and almost certainly will never have set foot in Iran --- based on how governments currently acquire exploits, they probably won't even know they're working for Iran. There are many hundreds of very, very smart people who will write security tools for $1MM (their handlers will probably take the other $9MM for themselves).
      - kevinskii 16y ago
        It's true that any internet anti-censorship efforts, even if completely successful, wouldn't have nearly as much real world impact as some armchair enthusiasts like to believe. It’s also true that reality is much more complicated than some “us against them” narrative. And perhaps to your main point: it’s also not like the Haystack project would have succeeded if only its members had a bit more technical know-how, or if they had just had been willing to open their source, etc. The challenge in thwarting the Islamic Republic’s censorship measures is almost impossibly enormous. However, this challenge could conceivably be met. Perhaps another Phil Zimmermann might come along one day and revolutionize steganography to bring us a step closer. Unfortunately this becomes less likely with a consummate self-promoter like Austin Heap publicly claiming to have already solved the entire problem.
        tptacek 16y ago
        Phil Zimmerman failed repeatedly while developing PGP (best example: ADK). Fortunately, PGP wasn't life-or-death for anyone known to have been using it at the time. PGP has now had about as much peer review as most SSL stacks --- and we still find vulnerabilities in SSL stacks. Nobody smart enough to solve this problem would have the hubris to release it to the public on their own.
JulianMorrison 16y ago
Haystack and Tor do different stuff. Tor conceals your origin from the endpoint (web server etc). Haystack conceals the fact you are communicating and about what, from a man in the middle, by pretending to be innocuous web requests.
- j2d2j2d2 16y ago
  Ah, thank you for the clarification. The Tor project's page says the same. Tor anonymizes the origin of your traffic, and it encrypts everything between you and the Tor network and everything inside the Tor network, but it can't encrypt your traffic between the Tor network and its final destination. If you are communicating sensitive information, you should use as much care as you would on the normal scary Internet — use HTTPS or other end-to-end encryption and authentication. http://www.torproject.org/download.html.en#Warning http://www.torproject.org/download.html.en#Warning

jgrahamc 16y ago

I think the media liked the 'Austin Heap' persona. A combination of that and a hot topic like Iran meant that many outlets decided to put normal journalism aside and report what looks like a non-story. Hell, The Guardian made him Innovator of the Year: http://www.guardian.co.uk/media/2010/mar/29/austin-heap-megas-innovator-award http://www.guardian.co.uk/media/2010/mar/29/austin-heap-mega...

tptacek 16y ago
The really unfortunate thing about the Haystack debacle is that it's going to be framed as a problem with Austin Heap and his team --- as if a better team might have been able to pull something like Haystack off --- when in fact the problem is with the fundamental economics of pitting private activist groups against foreign governments on engineering problems.
- kevinskii 16y ago
  A better team “might” have been able to pull something like Haystack off. Disruptive technologies are often brought about by small groups of skilled visionaries, and it was certainly possible that Austin Heap may have been one of them. But he isn’t. He greatly exaggerated his own hacking abilities, he refused numerous offers of review from real experts, and he fabricated stories of Haystack’s impact inside Iran while soliciting donations all the while. In doing so, he likely made the “fundamental economics” problem that you mentioned even worse. During Iran’s election, people everywhere were anxious to help protestors in any way they could. Legitimate anti-censorship groups may well have benefited from increased media attention and a resulting increase in funding, had Heap not stolen the spotlight. Lay people could have been educated on the real challenges in thwarting censorship. Instead many were led to believe that the problem had already been solved by a boy genius, and that it was simply a matter of sending him enough thumb drives. Heap’s dishonesty and the lax journalism that encouraged it should rightly be discussed.
  - tptacek 16y ago
    Everything I've read about the "legitimate anti-censorship" efforts during the election suggests that no matter how well-intentioned, people sitting on their butts in front of computers in North America and Europe have minimal --- if any --- real world impact in the Islamic Republic. But either way: a better team would almost certainly not have produced a tool that the Islamic Republic couldn't have turned against its innocent users, because no team we can conceive of can match Iran's ability to fund countermeasures. People are inherently captive to the narrative fallacy. They adhere to stories of "us" against "them", and what a great "them" they find in Iran, which stones women and hangs people for writing blog posts! But in the real world, the narrative is irrelevant. The person who figures out how to turn Haystack^2 into a dissident marker and arrest warrant generator isn't going to be a Muslim, and almost certainly will never have set foot in Iran --- based on how governments currently acquire exploits, they probably won't even know they're working for Iran. There are many hundreds of very, very smart people who will write security tools for $1MM (their handlers will probably take the other $9MM for themselves).
    - kevinskii 16y ago
      It's true that any internet anti-censorship efforts, even if completely successful, wouldn't have nearly as much real world impact as some armchair enthusiasts like to believe. It’s also true that reality is much more complicated than some “us against them” narrative. And perhaps to your main point: it’s also not like the Haystack project would have succeeded if only its members had a bit more technical know-how, or if they had just had been willing to open their source, etc. The challenge in thwarting the Islamic Republic’s censorship measures is almost impossibly enormous. However, this challenge could conceivably be met. Perhaps another Phil Zimmermann might come along one day and revolutionize steganography to bring us a step closer. Unfortunately this becomes less likely with a consummate self-promoter like Austin Heap publicly claiming to have already solved the entire problem.
      - tptacek 16y ago
        Phil Zimmerman failed repeatedly while developing PGP (best example: ADK). Fortunately, PGP wasn't life-or-death for anyone known to have been using it at the time. PGP has now had about as much peer review as most SSL stacks --- and we still find vulnerabilities in SSL stacks. Nobody smart enough to solve this problem would have the hubris to release it to the public on their own.

JulianMorrison 16y ago

Haystack and Tor do different stuff. Tor conceals your origin from the endpoint (web server etc). Haystack conceals the fact you are communicating and about what, from a man in the middle, by pretending to be innocuous web requests.

j2d2j2d2 16y ago
Ah, thank you for the clarification. The Tor project's page says the same. Tor anonymizes the origin of your traffic, and it encrypts everything between you and the Tor network and everything inside the Tor network, but it can't encrypt your traffic between the Tor network and its final destination. If you are communicating sensitive information, you should use as much care as you would on the normal scary Internet — use HTTPS or other end-to-end encryption and authentication. http://www.torproject.org/download.html.en#Warning http://www.torproject.org/download.html.en#Warning