5 ms·

This is based on a false premise, that the Govt will ask developers, and that they would care if it is difficult/infeasible/impossible to actually complete. In

This is based on a false premise, that the Govt will ask developers, and that they would care if it is difficult/infeasible/impossible to actually complete. In reality, they issue a notice to the company, give them a timeframe, and expect it to be done. They don’t care about the intricacies of git.

mabbo 8y ago
But the problem remains the same: how do you keep it a secret? How does the backdoor not get leaked immediately to the press, to the customers of the software, etc? Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. Edit later: by 'freedom taken seriously I mean by the people, not by the government.'
- vermilingua 8y ago
  > where freedom is taken seriously. Ahahahahahahaha
- brokenmachine 8y ago
  >Australia is a Western nation where freedom is taken seriously. Oh, you sweet summer child.
- hvklos 8y ago
  Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. That’s the carefully cultivated reality distortion field at work. It may look that way from the outside, but it’s a tightly controlled, aging and fearful society. Anyone who steps out of line is dealt with harshly and swiftly. The government may loosen the leash on those who align with their political philosophy (so figures who vilify vulnerable groups are given a bit of freedom under the current government) but the jackboot of the state isn’t far away. Re your edit: there is compulsory voting, so the people obviously like it that way.
cylinder 8y ago
Yeah you just go to the CEO or legal counsel, threaten loss of licenses, seizure of personal assets
- alfiedotwtf 8y ago
  CEO or legal counsel? They can directly compel current and former individual employees: https://twitter.com/alfiedotwtf/status/1070658693409079296 https://twitter.com/alfiedotwtf/status/1070658693409079296
  - brokenmachine 8y ago
    Former employees? So you can't even resign? WTF?
cyphar 8y ago
The law explicitly allows them to target individuals. I don't believe that they gave themselves this power for no reason -- it's much easier to coerce an individual developer (who doesn't have fancy legal council) than force a company to do something. I'm sure they'll do it both ways of course, but I disagree that they'll only target companies.
- mtarnovan 8y ago
  I also think they would normally approach this top-down. The provision to target individuals might have been added just for the odd case were the normal approach is not feasible. I still wonder how this law doesn't go against individual rights provided by the Constitution or other fundamental laws. Either way this law is hilariously clueless and extremely worrying at the same time.
- 3pt14159 8y ago
  That's a mischaracterization. Any type of entity can be targeted, but not any agent. That's an important distinction to stop people acting as private individuals on their own time from being exempt from the law. Not that I think this will work—it wont in the long run—but I'd rather argue against the strongest case of an argument.
  - cyphar 8y ago
    According to Sect 317C, a "designated communications provider" includes: A person is a designated communications provider if ... 6. the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-users in Australia ... and the eligible activities of the person are ... (a) the development by the person of any such software; or (b) the supply by the person of any such software; or (c) the updating by the person of any such software So individuals can definitely be targeted -- it's specifically in the bill. In your parlance, all individuals that "develop, supply, or update software that is likely to be used by an electronic service that has one or more end-users in Australia" are entities and not agents. They are defined to be a "designated communications provider" and the same rules apply to them as any other "designated communications provider".
pdkl95 8y ago
You're "reality" doesn't match the historical record how FVEY agencies work. Programs like the NSA's BULLRUN[1] or GCHQ's EDGEHILL are well funded ($B/yr) target individuals, companies, standards committees[2], and anything else that serves the purpose of preventing or compromising encryption. One well documented[2] example where individuals were "tasked" (spy on) directly is the compromise of satellite ISP Stellar: > The document lists "key staff" at the company. The document states they should be identified and "tasked." "Tasking" somebody in signals intelligence jargon means that they are to be targeted for surveillance. In addition to CEO Christian Steffen, nine other employees are named in the document. The shock on the IT chief's face[4] when he saw his name in an NSA document... [1] https://en.wikipedia.org/wiki/Bullrun_%28decryption_program%29 https://en.wikipedia.org/wiki/Bullrun_%28decryption_program%... [2] https://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html https://www.mail-archive.com/cryptography@metzdowd.com/msg12... [3] http://www.spiegel.de/international/world/snowden-documents-indicate-nsa-has-breached-deutsche-telekom-a-991503.html http://www.spiegel.de/international/world/snowden-documents-... [4] http://www.spiegel.de/video/chokepoint-the-moment-stellar-learns-it-has-been-hacked-video-1521333.html http://www.spiegel.de/video/chokepoint-the-moment-stellar-le...
- vermilingua 8y ago
  I may have phrased it badly, but my point wasn't that they would/could not target individuals, but more that they don't really care about their capacity as developers; more that these people are simply government implants in the target org, and that whether they are unable to provide the capability through ordinary channels is simply irrelevant. If the Govt strongarms a developer into implanting a backdoor, they won't care that they can't do it without breaking company policy or QA or workflow or even the law, because they cease to be primarily an employee, and become an asset of ASIO.
  - alfiedotwtf 8y ago
    This is why I'm choosing to stick to the term commandeering

mabbo 8y ago

But the problem remains the same: how do you keep it a secret? How does the backdoor not get leaked immediately to the press, to the customers of the software, etc? Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. Edit later: by 'freedom taken seriously I mean by the people, not by the government.'

vermilingua 8y ago
> where freedom is taken seriously. Ahahahahahahaha
brokenmachine 8y ago
>Australia is a Western nation where freedom is taken seriously. Oh, you sweet summer child.
hvklos 8y ago
Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously. That’s the carefully cultivated reality distortion field at work. It may look that way from the outside, but it’s a tightly controlled, aging and fearful society. Anyone who steps out of line is dealt with harshly and swiftly. The government may loosen the leash on those who align with their political philosophy (so figures who vilify vulnerable groups are given a bit of freedom under the current government) but the jackboot of the state isn’t far away. Re your edit: there is compulsory voting, so the people obviously like it that way.

cylinder 8y ago

Yeah you just go to the CEO or legal counsel, threaten loss of licenses, seizure of personal assets

alfiedotwtf 8y ago
CEO or legal counsel? They can directly compel current and former individual employees: https://twitter.com/alfiedotwtf/status/1070658693409079296 https://twitter.com/alfiedotwtf/status/1070658693409079296
- brokenmachine 8y ago
  Former employees? So you can't even resign? WTF?

cyphar 8y ago

The law explicitly allows them to target individuals. I don't believe that they gave themselves this power for no reason -- it's much easier to coerce an individual developer (who doesn't have fancy legal council) than force a company to do something. I'm sure they'll do it both ways of course, but I disagree that they'll only target companies.

mtarnovan 8y ago
I also think they would normally approach this top-down. The provision to target individuals might have been added just for the odd case were the normal approach is not feasible. I still wonder how this law doesn't go against individual rights provided by the Constitution or other fundamental laws. Either way this law is hilariously clueless and extremely worrying at the same time.
3pt14159 8y ago
That's a mischaracterization. Any type of entity can be targeted, but not any agent. That's an important distinction to stop people acting as private individuals on their own time from being exempt from the law. Not that I think this will work—it wont in the long run—but I'd rather argue against the strongest case of an argument.
- cyphar 8y ago
  According to Sect 317C, a "designated communications provider" includes: A person is a designated communications provider if ... 6. the person develops, supplies or updates software used, for use, or likely to be used, in connection with: (a) a listed carriage service; or (b) an electronic service that has one or more end-users in Australia ... and the eligible activities of the person are ... (a) the development by the person of any such software; or (b) the supply by the person of any such software; or (c) the updating by the person of any such software So individuals can definitely be targeted -- it's specifically in the bill. In your parlance, all individuals that "develop, supply, or update software that is likely to be used by an electronic service that has one or more end-users in Australia" are entities and not agents. They are defined to be a "designated communications provider" and the same rules apply to them as any other "designated communications provider".

pdkl95 8y ago

You're "reality" doesn't match the historical record how FVEY agencies work. Programs like the NSA's BULLRUN[1] or GCHQ's EDGEHILL are well funded ($B/yr) target individuals, companies, standards committees[2], and anything else that serves the purpose of preventing or compromising encryption. One well documented[2] example where individuals were "tasked" (spy on) directly is the compromise of satellite ISP Stellar: > The document lists "key staff" at the company. The document states they should be identified and "tasked." "Tasking" somebody in signals intelligence jargon means that they are to be targeted for surveillance. In addition to CEO Christian Steffen, nine other employees are named in the document. The shock on the IT chief's face[4] when he saw his name in an NSA document... [1] https://en.wikipedia.org/wiki/Bullrun_%28decryption_program%29 https://en.wikipedia.org/wiki/Bullrun_%28decryption_program%... [2] https://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html https://www.mail-archive.com/cryptography@metzdowd.com/msg12... [3] http://www.spiegel.de/international/world/snowden-documents-indicate-nsa-has-breached-deutsche-telekom-a-991503.html http://www.spiegel.de/international/world/snowden-documents-... [4] http://www.spiegel.de/video/chokepoint-the-moment-stellar-learns-it-has-been-hacked-video-1521333.html http://www.spiegel.de/video/chokepoint-the-moment-stellar-le...

vermilingua 8y ago
I may have phrased it badly, but my point wasn't that they would/could not target individuals, but more that they don't really care about their capacity as developers; more that these people are simply government implants in the target org, and that whether they are unable to provide the capability through ordinary channels is simply irrelevant. If the Govt strongarms a developer into implanting a backdoor, they won't care that they can't do it without breaking company policy or QA or workflow or even the law, because they cease to be primarily an employee, and become an asset of ASIO.
- alfiedotwtf 8y ago
  This is why I'm choosing to stick to the term commandeering