5 ms·

There's nothing to be proud of and writing a blog post about it. Your users used the software to protect them, or even paid for it. Now this "Dave" can crack f

by mtw 8y ago

There's nothing to be proud of and writing a blog post about it. Your users used the software to protect them, or even paid for it. Now this "Dave" can crack files generated by this shareware. Maybe "Dave" had a genuine national security situation. But was it really? What if Dave just wanted to prank the author, during a boring afternoon? What if it were a couple of guys parked outside who hijacked the phone system, so even if you call 411, it would route to their van outside? Or what if Dave already did the same demand to dozens of other security vendors, effectively having the source code of all encryption software? And even if it was a national security situation, what is the legal basis of giving up source code and keys? What I get is "I was just a regular computer programmer and overnight, I was actually important enough to be useful for the NSA"

metildaa 8y ago
The ethical implications are often not considered by software developers, thus you get cases like this where the author did not stop to push back, acting as a useful idiot for the NSA. There are way too many people like that in tech, who don't stop to take in the bigger picture before performing the requested action.
- Taniwha 8y ago
  I agree, the first thing he should have asked for is a warrant signed by a judge, and then independently verified it was real.
- Latteland 8y ago
  At the very least there are many circumstances where reporters who were reporting on pretty underhanded activities in the us were targeted by the us govt, and what if this situation happened to them. My govt is generally good here in the us, but we know plenty of cases where they didn't have good intentions, this is done to intimidate. So if you are an author of security software, you might keep this in mind. And other countries like Russia and China would definitely put pressure on people to help them.
StavrosK 8y ago
Let's be a bit more realistic, the title might as well have been "how I open-sourced my encryption software at the request of someone". Yes, the author was way too quick to give up the source code, but it was just source code, not a backdoor key.
- apeace 8y ago
  The code was not open-sourced. It was only given to one party, and presumably did not come with a license to redistribute the source code. This means all users of the software are less safe. If the NSA can find a bug in the code, they can unlock everyone's files, but nobody else could ever uncover that bug.
  - StavrosK 8y ago
    Fair point.
- pavritch 8y ago
  I'm the author of the article. All common ciphers are available as open source already. I just packaged it into a product. Encryption done right does not suddenly become vulnerable if published to an open forum. I gave up nothing. I did not put any customers at risk, nor did I put my product at risk. People who think otherwise do not really know how encryption works. It works because the ciphers are public and tested by time. And for the record -- I would do it again if asked.
  - cmroanirgo 8y ago
    Thanks for your honesty. However, I would probably respond along the lines, "I'd be happy to supply this, right after you show me a court order". Otherwise, no matter what, I cannot see how it would not be used for anything other than a nefarious purpose.
  - tarboreus 8y ago
    If it doesn't help them get into files used to encrypt the software, then why did they need it?
tomatotomato37 8y ago
If it was for criminal purposes it would have been easier to bribe a janitor at their office to plug a USB drive into one of their machines for a couple minutes before tossing it. I'm willing to bet Dave was a government employee, though I won't give up the possiblity he wasn't NSA and more likely some other government organization that needed to stop something yesterday but didn't have the clout to get the big 3 letter organizations to pay attention and help them out
pavritch 8y ago
Yeah, makes sense. And I planned it all out even down to timing the post to hit last night after midnight before all the pipe bomb news this morning on TV. Or, much closer to reality, maybe I just wanted to see if I could write a post that got some traction. Don't overthink it.
- hnmonkey 8y ago
  This is an incredibly condescending and insensitive post... Why would you attack the completely valid opinion from that person in this way?
bb88 8y ago
Please. Save the moral judgement for events that happened after Edward Snowden. This happened 18 years ago. And judging his actions back then through the lens of what the NSA has done in recent history is very unfair. Fast forward a year to 9/11, and the question would be, "What is the legal basis for not doing everything you can to help the NSA?"
- mtw 8y ago
  For a 9/11 situation, I would ask that the case should be reviewed by a judge who'd mandate an injunction (or similar) to deliver source code. In a national security situation, I'm sure the judge will work quickly, and you will still get your NSA cup. Everyone's happy. There are laws and a constitution, you can't just throw it out the window at the first phone call.
  - bb88 8y ago
    > ... should be reviewed by a judge who'd mandate an injunction (or similar) to deliver source code. The NSA has been reverse engineering binaries for decades. Having the source saves them time and resources from doing that. Today, however, I would expect the NSA has their own binary decompiler. > There are laws and a constitution, you can't just throw it out the window at the first phone call. In pretty much most cases there are no laws preventing a private individual from fully cooperating with a government agency under your own free will. There may be professional consequences and civil damages, but it's not outright illegal. You would see this in cases of child porn, terrorist attacks, etc. And frankly, most people would be so happy to see child pornographers locked up, that they wouldn't ask for a warrant from the investigating agency.

by mtw 8y ago

metildaa 8y ago

The ethical implications are often not considered by software developers, thus you get cases like this where the author did not stop to push back, acting as a useful idiot for the NSA. There are way too many people like that in tech, who don't stop to take in the bigger picture before performing the requested action.

Taniwha 8y ago
I agree, the first thing he should have asked for is a warrant signed by a judge, and then independently verified it was real.
Latteland 8y ago
At the very least there are many circumstances where reporters who were reporting on pretty underhanded activities in the us were targeted by the us govt, and what if this situation happened to them. My govt is generally good here in the us, but we know plenty of cases where they didn't have good intentions, this is done to intimidate. So if you are an author of security software, you might keep this in mind. And other countries like Russia and China would definitely put pressure on people to help them.

StavrosK 8y ago

Let's be a bit more realistic, the title might as well have been "how I open-sourced my encryption software at the request of someone". Yes, the author was way too quick to give up the source code, but it was just source code, not a backdoor key.

apeace 8y ago
The code was not open-sourced. It was only given to one party, and presumably did not come with a license to redistribute the source code. This means all users of the software are less safe. If the NSA can find a bug in the code, they can unlock everyone's files, but nobody else could ever uncover that bug.
- StavrosK 8y ago
  Fair point.
pavritch 8y ago
I'm the author of the article. All common ciphers are available as open source already. I just packaged it into a product. Encryption done right does not suddenly become vulnerable if published to an open forum. I gave up nothing. I did not put any customers at risk, nor did I put my product at risk. People who think otherwise do not really know how encryption works. It works because the ciphers are public and tested by time. And for the record -- I would do it again if asked.
- cmroanirgo 8y ago
  Thanks for your honesty. However, I would probably respond along the lines, "I'd be happy to supply this, right after you show me a court order". Otherwise, no matter what, I cannot see how it would not be used for anything other than a nefarious purpose.
- tarboreus 8y ago
  If it doesn't help them get into files used to encrypt the software, then why did they need it?

tomatotomato37 8y ago

If it was for criminal purposes it would have been easier to bribe a janitor at their office to plug a USB drive into one of their machines for a couple minutes before tossing it. I'm willing to bet Dave was a government employee, though I won't give up the possiblity he wasn't NSA and more likely some other government organization that needed to stop something yesterday but didn't have the clout to get the big 3 letter organizations to pay attention and help them out

pavritch 8y ago

Yeah, makes sense. And I planned it all out even down to timing the post to hit last night after midnight before all the pipe bomb news this morning on TV. Or, much closer to reality, maybe I just wanted to see if I could write a post that got some traction. Don't overthink it.

hnmonkey 8y ago
This is an incredibly condescending and insensitive post... Why would you attack the completely valid opinion from that person in this way?

bb88 8y ago

Please. Save the moral judgement for events that happened after Edward Snowden. This happened 18 years ago. And judging his actions back then through the lens of what the NSA has done in recent history is very unfair. Fast forward a year to 9/11, and the question would be, "What is the legal basis for not doing everything you can to help the NSA?"

mtw 8y ago
For a 9/11 situation, I would ask that the case should be reviewed by a judge who'd mandate an injunction (or similar) to deliver source code. In a national security situation, I'm sure the judge will work quickly, and you will still get your NSA cup. Everyone's happy. There are laws and a constitution, you can't just throw it out the window at the first phone call.
- bb88 8y ago
  > ... should be reviewed by a judge who'd mandate an injunction (or similar) to deliver source code. The NSA has been reverse engineering binaries for decades. Having the source saves them time and resources from doing that. Today, however, I would expect the NSA has their own binary decompiler. > There are laws and a constitution, you can't just throw it out the window at the first phone call. In pretty much most cases there are no laws preventing a private individual from fully cooperating with a government agency under your own free will. There may be professional consequences and civil damages, but it's not outright illegal. You would see this in cases of child porn, terrorist attacks, etc. And frankly, most people would be so happy to see child pornographers locked up, that they wouldn't ask for a warrant from the investigating agency.