3 ms·

A better team “might” have been able to pull something like Haystack off. Disruptive technologies are often brought about by small groups of skilled visionarie

A better team “might” have been able to pull something like Haystack off. Disruptive technologies are often brought about by small groups of skilled visionaries, and it was certainly possible that Austin Heap may have been one of them. But he isn’t. He greatly exaggerated his own hacking abilities, he refused numerous offers of review from real experts, and he fabricated stories of Haystack’s impact inside Iran while soliciting donations all the while. In doing so, he likely made the “fundamental economics” problem that you mentioned even worse. During Iran’s election, people everywhere were anxious to help protestors in any way they could. Legitimate anti-censorship groups may well have benefited from increased media attention and a resulting increase in funding, had Heap not stolen the spotlight. Lay people could have been educated on the real challenges in thwarting censorship. Instead many were led to believe that the problem had already been solved by a boy genius, and that it was simply a matter of sending him enough thumb drives. Heap’s dishonesty and the lax journalism that encouraged it should rightly be discussed.

tptacek 16y ago
Everything I've read about the "legitimate anti-censorship" efforts during the election suggests that no matter how well-intentioned, people sitting on their butts in front of computers in North America and Europe have minimal --- if any --- real world impact in the Islamic Republic. But either way: a better team would almost certainly not have produced a tool that the Islamic Republic couldn't have turned against its innocent users, because no team we can conceive of can match Iran's ability to fund countermeasures. People are inherently captive to the narrative fallacy. They adhere to stories of "us" against "them", and what a great "them" they find in Iran, which stones women and hangs people for writing blog posts! But in the real world, the narrative is irrelevant. The person who figures out how to turn Haystack^2 into a dissident marker and arrest warrant generator isn't going to be a Muslim, and almost certainly will never have set foot in Iran --- based on how governments currently acquire exploits, they probably won't even know they're working for Iran. There are many hundreds of very, very smart people who will write security tools for $1MM (their handlers will probably take the other $9MM for themselves).
- kevinskii 16y ago
  It's true that any internet anti-censorship efforts, even if completely successful, wouldn't have nearly as much real world impact as some armchair enthusiasts like to believe. It’s also true that reality is much more complicated than some “us against them” narrative. And perhaps to your main point: it’s also not like the Haystack project would have succeeded if only its members had a bit more technical know-how, or if they had just had been willing to open their source, etc. The challenge in thwarting the Islamic Republic’s censorship measures is almost impossibly enormous. However, this challenge could conceivably be met. Perhaps another Phil Zimmermann might come along one day and revolutionize steganography to bring us a step closer. Unfortunately this becomes less likely with a consummate self-promoter like Austin Heap publicly claiming to have already solved the entire problem.
  - tptacek 16y ago
    Phil Zimmerman failed repeatedly while developing PGP (best example: ADK). Fortunately, PGP wasn't life-or-death for anyone known to have been using it at the time. PGP has now had about as much peer review as most SSL stacks --- and we still find vulnerabilities in SSL stacks. Nobody smart enough to solve this problem would have the hubris to release it to the public on their own.

tptacek 16y ago

Everything I've read about the "legitimate anti-censorship" efforts during the election suggests that no matter how well-intentioned, people sitting on their butts in front of computers in North America and Europe have minimal --- if any --- real world impact in the Islamic Republic. But either way: a better team would almost certainly not have produced a tool that the Islamic Republic couldn't have turned against its innocent users, because no team we can conceive of can match Iran's ability to fund countermeasures. People are inherently captive to the narrative fallacy. They adhere to stories of "us" against "them", and what a great "them" they find in Iran, which stones women and hangs people for writing blog posts! But in the real world, the narrative is irrelevant. The person who figures out how to turn Haystack^2 into a dissident marker and arrest warrant generator isn't going to be a Muslim, and almost certainly will never have set foot in Iran --- based on how governments currently acquire exploits, they probably won't even know they're working for Iran. There are many hundreds of very, very smart people who will write security tools for $1MM (their handlers will probably take the other $9MM for themselves).

kevinskii 16y ago
It's true that any internet anti-censorship efforts, even if completely successful, wouldn't have nearly as much real world impact as some armchair enthusiasts like to believe. It’s also true that reality is much more complicated than some “us against them” narrative. And perhaps to your main point: it’s also not like the Haystack project would have succeeded if only its members had a bit more technical know-how, or if they had just had been willing to open their source, etc. The challenge in thwarting the Islamic Republic’s censorship measures is almost impossibly enormous. However, this challenge could conceivably be met. Perhaps another Phil Zimmermann might come along one day and revolutionize steganography to bring us a step closer. Unfortunately this becomes less likely with a consummate self-promoter like Austin Heap publicly claiming to have already solved the entire problem.
- tptacek 16y ago
  Phil Zimmerman failed repeatedly while developing PGP (best example: ADK). Fortunately, PGP wasn't life-or-death for anyone known to have been using it at the time. PGP has now had about as much peer review as most SSL stacks --- and we still find vulnerabilities in SSL stacks. Nobody smart enough to solve this problem would have the hubris to release it to the public on their own.