4 ms·

(essentially repeating a recent twitter thread here) Imagine you work in a modern software house and you get one of these ... and here I mean you, not your bos

(essentially repeating a recent twitter thread here) Imagine you work in a modern software house and you get one of these ... and here I mean you, not your boss, not your coworkers, the govt knocks on your door and demands you put a back door in the thing you are working on at work ... So you write the code ... how do you write the unit test? how do you get it past the code review? the mandatory QA tests? ... all these things are designed into our modern software design processes essentially designed to stop bad stuff like this happening ... what happens when you get caught? you lose your job, get blacklisted in the industry, after all you can't tell them the govt made you do it (on your CV/resume trying to explain why you were fired) Equally say you run a big open source software project and you have valued contributors from Australia, people you trust and depend on ... what do you do? refuse them commit right? explicitly audit their every checkin? ask them to move on? Suppose you buy closed source code from Australia .... you can't trust it in any way, even if you trust the company any one of their employees may have been asked to suborn the code you've paid good money for ... any smart purchaser is simply going to put Aussie software on the "do not purchase" list ..... So how do I find out which software on Android Play is written in Oz?

BLKNSLVR 8y ago
This: https://twitter.com/alfiedotwtf/status/1070047303275175936 https://twitter.com/alfiedotwtf/status/1070047303275175936 Which is absolutely brilliant.
- Taniwha 8y ago
  yes that's the thread, thanks
paulie_a 8y ago
For large oss projects, accept PRs from those contributers, and outright tell the Australian government to go fuck themselves. They have zero recourse.
- kbsletten 8y ago
  I think they were trying to say "how do I know the Australians submitting PRs aren't secretly working for the govt?" Of course this raises (but does not beg) the question, "how do I ever know anybody submitting PRs isn't trying to sabatoge me?" You just have to judge people by their fruits and hope they do the right thing or stop associating with Australians at all.
  - Taniwha 8y ago
    The problem is that Aussie contributors of good character may find themselves forced by their government to sabotage a project they are working on - I think at the very least we have to check their work closely
  - Sir_Substance 8y ago
    >or stop associating with Australians at all. As an Australian, I hope people do this. Internationally speaking, the tech community is not very good at drawing lines in the sand, we tend to want to please everyone. I was really hoping that when it was shown how much the US was spying on traffic crossing it's borders, other countries would modify their routes to ensure their nations data didn't transit the US unless it was terminating there, but nope, didn't happen. Brazil talked about it but didn't do it. Anyway, this is another rubicon moment. If we don't make this explode in the Australian governments face, then the US and UK will follow suit after the testing period is over. It's really important for the international software community to reject this utterly. Start pulling out of Australia now and make it painful, or this will happen in countries it's impossible for you to pull out of.
    - cmroanirgo 8y ago
      Agreed. As an Australian, I'd also suggest that all IT staff, devs and PMs should now be treated as a plague ship for any company hiring us. At any time, our Gov can pull this new law out and coerce us into undermining your software. This is not good for international relations at all.
    - idontpost 8y ago
grecy 8y ago
> modern software design processes essentially designed to stop bad stuff like this happening ... what happens when you get caught? you lose your job, get blacklisted in the industry, after all you can't tell them the govt made you do it (on your CV/resume trying to explain why you were fired) I often wonder about this in regards to those "signed" orders in the USA, and it seems now Australia is similar. And I wonder if we need more people going public in a very big way. i.e. Jim Smith has to put out a press release that says "I work for company X and the Government of Y country asked me to do xyz, and I refused." Go very, very public with it, putting out press releases, etc. etc. Obviously there are laws against that, and Jim Smith is risking a lot, but I can't imagine how things will get better until people on the front lines do stuff like this.
caf 8y ago
Here's what I would do: send it back to them and tell them to send it to my employer's legal department.
- cyphar 8y ago
  This might not be legal, and is one of the large problems that needs to be resolved. You individually are listed in this law as a "designated service provider", and thus you can't really pass the buck to your employer. There is a valid question as to whether you are listed as a "designated service provider" if the only time you ever developed the relevant software under s317C(6) was as part of a job. But software developers that have done free software work outside of their job definitely would be counted. As always, I would suggest you get legal council before doing anything in response to a notice -- even throwing it back in the face of the AG.
ithkuil 8y ago
Good read: Reflections of trusting trust https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... That said, this requires you to be clever and I don't think anybody can be forced to be clever with a court order, or at least what you describe offers plausible deniability
saurik 8y ago
Every time you come across a double free bug or some complex concurrency issue that gives an attacker arbitrary write access to a process, remember that you might have been looking at a back door. Someone has an off-by-one error on an array access: is that a back door? Why do you think a backdoor is somehow noticeable in the code?
xorcist 8y ago
There's another, perhaps more insidious perspective, on this. After the emergence of these type of laws there's going to be potential backdoors explained away with "sorry, can't tell, wink wink" and nobody will ever know for sure. What's an employer to do? Or even end users?
metta2uall 8y ago
I expect they won't ask for anything crazy like that or violate the prohibition on asking for a "systemic weakness" - one of the reasons being that they want this law to be deployed as smoothly as possible to make a good case study for their 5-Eyes mates.
jsjohnst 8y ago
> So how do I find out which software on Android Play is written in Oz? If the above bothers you, then you should avoid any software written in the US too. The exact scenario you described can happen in the US, especially if you have a security clearance, but work in a regular tech job.
lostmsu 8y ago
Why would the government ping you? Your boss can set a secondary build pipeline, that merges his brunch before producing a release build. Unless your company requires repeatable builds, you'll never notice this.

BLKNSLVR 8y ago

This: https://twitter.com/alfiedotwtf/status/1070047303275175936 https://twitter.com/alfiedotwtf/status/1070047303275175936 Which is absolutely brilliant.

Taniwha 8y ago
yes that's the thread, thanks

paulie_a 8y ago

For large oss projects, accept PRs from those contributers, and outright tell the Australian government to go fuck themselves. They have zero recourse.

kbsletten 8y ago
I think they were trying to say "how do I know the Australians submitting PRs aren't secretly working for the govt?" Of course this raises (but does not beg) the question, "how do I ever know anybody submitting PRs isn't trying to sabatoge me?" You just have to judge people by their fruits and hope they do the right thing or stop associating with Australians at all.
- Taniwha 8y ago
  The problem is that Aussie contributors of good character may find themselves forced by their government to sabotage a project they are working on - I think at the very least we have to check their work closely
- Sir_Substance 8y ago
  >or stop associating with Australians at all. As an Australian, I hope people do this. Internationally speaking, the tech community is not very good at drawing lines in the sand, we tend to want to please everyone. I was really hoping that when it was shown how much the US was spying on traffic crossing it's borders, other countries would modify their routes to ensure their nations data didn't transit the US unless it was terminating there, but nope, didn't happen. Brazil talked about it but didn't do it. Anyway, this is another rubicon moment. If we don't make this explode in the Australian governments face, then the US and UK will follow suit after the testing period is over. It's really important for the international software community to reject this utterly. Start pulling out of Australia now and make it painful, or this will happen in countries it's impossible for you to pull out of.
  - cmroanirgo 8y ago
    Agreed. As an Australian, I'd also suggest that all IT staff, devs and PMs should now be treated as a plague ship for any company hiring us. At any time, our Gov can pull this new law out and coerce us into undermining your software. This is not good for international relations at all.
  - idontpost 8y ago

grecy 8y ago

> modern software design processes essentially designed to stop bad stuff like this happening ... what happens when you get caught? you lose your job, get blacklisted in the industry, after all you can't tell them the govt made you do it (on your CV/resume trying to explain why you were fired) I often wonder about this in regards to those "signed" orders in the USA, and it seems now Australia is similar. And I wonder if we need more people going public in a very big way. i.e. Jim Smith has to put out a press release that says "I work for company X and the Government of Y country asked me to do xyz, and I refused." Go very, very public with it, putting out press releases, etc. etc. Obviously there are laws against that, and Jim Smith is risking a lot, but I can't imagine how things will get better until people on the front lines do stuff like this.

caf 8y ago

Here's what I would do: send it back to them and tell them to send it to my employer's legal department.

cyphar 8y ago
This might not be legal, and is one of the large problems that needs to be resolved. You individually are listed in this law as a "designated service provider", and thus you can't really pass the buck to your employer. There is a valid question as to whether you are listed as a "designated service provider" if the only time you ever developed the relevant software under s317C(6) was as part of a job. But software developers that have done free software work outside of their job definitely would be counted. As always, I would suggest you get legal council before doing anything in response to a notice -- even throwing it back in the face of the AG.

ithkuil 8y ago

Good read: Reflections of trusting trust https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... That said, this requires you to be clever and I don't think anybody can be forced to be clever with a court order, or at least what you describe offers plausible deniability

saurik 8y ago

Every time you come across a double free bug or some complex concurrency issue that gives an attacker arbitrary write access to a process, remember that you might have been looking at a back door. Someone has an off-by-one error on an array access: is that a back door? Why do you think a backdoor is somehow noticeable in the code?

xorcist 8y ago

There's another, perhaps more insidious perspective, on this. After the emergence of these type of laws there's going to be potential backdoors explained away with "sorry, can't tell, wink wink" and nobody will ever know for sure. What's an employer to do? Or even end users?

metta2uall 8y ago

I expect they won't ask for anything crazy like that or violate the prohibition on asking for a "systemic weakness" - one of the reasons being that they want this law to be deployed as smoothly as possible to make a good case study for their 5-Eyes mates.

jsjohnst 8y ago

> So how do I find out which software on Android Play is written in Oz? If the above bothers you, then you should avoid any software written in the US too. The exact scenario you described can happen in the US, especially if you have a security clearance, but work in a regular tech job.

lostmsu 8y ago

Why would the government ping you? Your boss can set a secondary build pipeline, that merges his brunch before producing a release build. Unless your company requires repeatable builds, you'll never notice this.