4 ms·

Them not keeping a record may be true... But the rsyslog was delivering the logs to *.fbi.gov And not retaining logs would still be correct. They said nothing

Them not keeping a record may be true... But the rsyslog was delivering the logs to *.fbi.gov And not retaining logs would still be correct. They said nothing about transporting them to the relevant feds.

rayvy 8y ago
Ahhh. They aren't keeping the logs, they're merely forwarding the logs to another "non-associated entity" (giving them legal cover), and storing the logs there. Makes sense. They can advertise "we don't keep logs" (we meaning the corporate entity itself) so they have legal cover, and they make the three letter agencies happy (and thus are allowed to continue to operate)
- crankylinuxuser 8y ago
  Indeed. And those tools to do such an analysis already exist. Its the formerly NSA tool called "Apache NiFi". It even has a syslog server plugin specifically for this purpose (it's built in already; drag, drop, configure, done): https://nifi.apache.org/docs/nifi-docs/components/org.apache.nifi/nifi-standard-nar/1.5.0/org.apache.nifi.processors.standard.ListenSyslog/ https://nifi.apache.org/docs/nifi-docs/components/org.apache... Link/proof asserting Apache NiFi is one of the NSA data analytics tools: https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa-nifi-big-data-automation-project-out-in-the-open/#1377a1e555d6 https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa...
  - willstrafach 8y ago
    Proof also can be found here: https://code.nsa.gov https://code.nsa.gov
mrsteveman1 8y ago
And there's still real value in that, even if they work with law enforcement. If you actually need a VPN, the last thing you want is for the service to create an opportunity, which wouldn't otherwise exist, for a malicious 3rd party to quietly obtain existing records of DNS queries, connections, and other traffic data. By not storing the data in advance, the risk is reduced. A malicious actor would have to compromise the servers and either use one as a network tap to send the traffic somewhere else, or enable logging or other analytics locally. Both are more likely to be detected than a one-time access or leak of data that was already stored.

rayvy 8y ago

Ahhh. They aren't keeping the logs, they're merely forwarding the logs to another "non-associated entity" (giving them legal cover), and storing the logs there. Makes sense. They can advertise "we don't keep logs" (we meaning the corporate entity itself) so they have legal cover, and they make the three letter agencies happy (and thus are allowed to continue to operate)

crankylinuxuser 8y ago
Indeed. And those tools to do such an analysis already exist. Its the formerly NSA tool called "Apache NiFi". It even has a syslog server plugin specifically for this purpose (it's built in already; drag, drop, configure, done): https://nifi.apache.org/docs/nifi-docs/components/org.apache.nifi/nifi-standard-nar/1.5.0/org.apache.nifi.processors.standard.ListenSyslog/ https://nifi.apache.org/docs/nifi-docs/components/org.apache... Link/proof asserting Apache NiFi is one of the NSA data analytics tools: https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa-nifi-big-data-automation-project-out-in-the-open/#1377a1e555d6 https://www.forbes.com/sites/adrianbridgwater/2015/07/21/nsa...
- willstrafach 8y ago
  Proof also can be found here: https://code.nsa.gov https://code.nsa.gov

mrsteveman1 8y ago

And there's still real value in that, even if they work with law enforcement. If you actually need a VPN, the last thing you want is for the service to create an opportunity, which wouldn't otherwise exist, for a malicious 3rd party to quietly obtain existing records of DNS queries, connections, and other traffic data. By not storing the data in advance, the risk is reduced. A malicious actor would have to compromise the servers and either use one as a network tap to send the traffic somewhere else, or enable logging or other analytics locally. Both are more likely to be detected than a one-time access or leak of data that was already stored.