4 ms·

I've had some mixed feelings about SpiderOak in the past, but at least they did this right. Props to them for making a canary and then following through on it.

by Lazare 8y ago

Caipenghui 8y ago
v
maxerickson 8y ago
Or it doesn't mean anything. Who knows, that's the beauty of it.
- Cthulhu_ 8y ago
  Well no, it means that either they've been compromised and thus shouldn't be trusted anymore, or they forgot (?) to update their canary which means they shouldn't be trusted anymore. Don't "who knows?" on this subject, it makes you look like a government shill trying to lull privacy conscious people into indifference.
  - maxerickson 8y ago
    What if their lawyer explained to them that removing the canary for a reason was likely to be criminal and they removed it preemptively? Unless you want to cite a bunch of jurisprudence that warrant canaries actually work, I'm gonna stick on "who knows", even though I'm not a government shill (I'm more "pragmatic about who really has the power in that particular relationship").
    - NullPrefix 8y ago
      >even though I'm not a government shill Let's just stick with "who knows" on that one too.
    - viraptor 8y ago
      > What if their lawyer explained to them that removing the canary for a reason was likely to be criminal and they removed it preemptively? Then a nice solution would be to say "our lawyer explained to us that removing the canary for a reason is likely to be criminal, so we're letting you know we're going to remove it in 2 months to make you more sure we're not doing it in response to a current issue".
      - cyphar 8y ago
        And people would have precisely the same primary reaction (as they should) but then would also get angry at SpiderOak for "poisoning the well" with doubts about the legality of warrant canaries. To be clear, as far as I know there is no legal precedent that says warrant canaries are a legal way of subverting gag orders (then again, the fact there is no such legal case even though Reddit activated their warrant canary could point in the favour that the US government doesn't want to try their luck in court).
    - philipov 8y ago
      It doesn't matter what kind of excuses they give. Once a canary is dead, everyone should behave as if the target has been compromised. That is what the canary is for, and once you sign it, you can't just go back. If you don't continue updating a deadman's switch, it doesn't matter if you died or not: it activates.
    - rocqua 8y ago
      Technically, this is why the canary had an expiration. This means they did not need to remove the canary, just let it expire and refuse to publish a new canary.
  - brownbat 8y ago
    > makes you look like a government shill We're on a site where we strive to assume good faith, avoid name calling, reply to the argument not the person, take the strongest possible form of what someone is saying (iron man not straw man), etc. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- peterkelly 8y ago
  If it's gone, it means that have received a warrant. That's the whole point of the warrant canary.
- forkerenok 8y ago
  I think nobody really needs to know exactly what's happening to make the right decision. People that are serious about opsec/etc. will read this (fuzzy/distorted) signal and jump ship. They will not be dwelling on the nature of this signal.
  - maxerickson 8y ago
    I have a hard time believing that People that are serious about opsec/etc. even care about the warrant canary to begin with. People with real concerns aren't going to rely on an untested legal gizmo.
- Lazare 8y ago
  SpiderOak basically said "if we do this, you should stop using us" (well, if you care about warrant canaries). And then they did it. It doesn't mean that they received a warrant, but it does mean SpiderOak is telling you not to use them, and I think that when a service tell you that, for whatever reason, it means quite a lot. :) (Even if, as you suggest further down, they received legal advice that warrant canaries were a bad idea and they needed to take it down, the way they handled the entire process makes it clear that they aren't taking this seriously. Posting a warrant canary, updating it regularly, and then taking it down while not telling the real (legit) reason is reckless at best, and in my view is basically the worst way they could handle it.) Whatever a realistic estimation of SpiderOak's security was before this news, I think it has to be strictly lower now, right? (Mind you...on further reflection I'm not convinced the transparency report is any more - or less - meaningful than the canary. The theory behind both is that the government cannot compel false speech. If that's true, then both are equally protective; if it's false, both are equally pointless. SpiderOak did say "if we stop updating this stop using us", and then they stopped updating it, but...then they published a transparency report saying "0 NSLs". So...maybe they're just really awful at communication.)

I've had some mixed feelings about SpiderOak in the past, but at least they did this right. Props to them for making a canary and then following through on it.

by Lazare 8y ago

I've had some mixed feelings about SpiderOak in the past, but at least they did this right. Props to them for making a canary and then following through on it.

Caipenghui 8y ago

maxerickson 8y ago

Or it doesn't mean anything. Who knows, that's the beauty of it.

Cthulhu_ 8y ago
Well no, it means that either they've been compromised and thus shouldn't be trusted anymore, or they forgot (?) to update their canary which means they shouldn't be trusted anymore. Don't "who knows?" on this subject, it makes you look like a government shill trying to lull privacy conscious people into indifference.
- maxerickson 8y ago
  What if their lawyer explained to them that removing the canary for a reason was likely to be criminal and they removed it preemptively? Unless you want to cite a bunch of jurisprudence that warrant canaries actually work, I'm gonna stick on "who knows", even though I'm not a government shill (I'm more "pragmatic about who really has the power in that particular relationship").
  - NullPrefix 8y ago
    >even though I'm not a government shill Let's just stick with "who knows" on that one too.
  - viraptor 8y ago
    > What if their lawyer explained to them that removing the canary for a reason was likely to be criminal and they removed it preemptively? Then a nice solution would be to say "our lawyer explained to us that removing the canary for a reason is likely to be criminal, so we're letting you know we're going to remove it in 2 months to make you more sure we're not doing it in response to a current issue".
    - cyphar 8y ago
      And people would have precisely the same primary reaction (as they should) but then would also get angry at SpiderOak for "poisoning the well" with doubts about the legality of warrant canaries. To be clear, as far as I know there is no legal precedent that says warrant canaries are a legal way of subverting gag orders (then again, the fact there is no such legal case even though Reddit activated their warrant canary could point in the favour that the US government doesn't want to try their luck in court).
  - philipov 8y ago
    It doesn't matter what kind of excuses they give. Once a canary is dead, everyone should behave as if the target has been compromised. That is what the canary is for, and once you sign it, you can't just go back. If you don't continue updating a deadman's switch, it doesn't matter if you died or not: it activates.
  - rocqua 8y ago
    Technically, this is why the canary had an expiration. This means they did not need to remove the canary, just let it expire and refuse to publish a new canary.
- brownbat 8y ago
  > makes you look like a government shill We're on a site where we strive to assume good faith, avoid name calling, reply to the argument not the person, take the strongest possible form of what someone is saying (iron man not straw man), etc. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
peterkelly 8y ago
If it's gone, it means that have received a warrant. That's the whole point of the warrant canary.
forkerenok 8y ago
I think nobody really needs to know exactly what's happening to make the right decision. People that are serious about opsec/etc. will read this (fuzzy/distorted) signal and jump ship. They will not be dwelling on the nature of this signal.
- maxerickson 8y ago
  I have a hard time believing that People that are serious about opsec/etc. even care about the warrant canary to begin with. People with real concerns aren't going to rely on an untested legal gizmo.
Lazare 8y ago
SpiderOak basically said "if we do this, you should stop using us" (well, if you care about warrant canaries). And then they did it. It doesn't mean that they received a warrant, but it does mean SpiderOak is telling you not to use them, and I think that when a service tell you that, for whatever reason, it means quite a lot. :) (Even if, as you suggest further down, they received legal advice that warrant canaries were a bad idea and they needed to take it down, the way they handled the entire process makes it clear that they aren't taking this seriously. Posting a warrant canary, updating it regularly, and then taking it down while not telling the real (legit) reason is reckless at best, and in my view is basically the worst way they could handle it.) Whatever a realistic estimation of SpiderOak's security was before this news, I think it has to be strictly lower now, right? (Mind you...on further reflection I'm not convinced the transparency report is any more - or less - meaningful than the canary. The theory behind both is that the government cannot compel false speech. If that's true, then both are equally protective; if it's false, both are equally pointless. SpiderOak did say "if we stop updating this stop using us", and then they stopped updating it, but...then they published a transparency report saying "0 NSLs". So...maybe they're just really awful at communication.)