8 ms·

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt https://www.rsync.net/resources/notices/canary.txt

• skrebbel 8y ago
  I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?
  • rsync 8y ago
    There is also the possibility that we take your money for cloud storage and run away to Costa Rica without providing anything to you. Or our ZFS filesystems are actually raid-5 ext2 volumes and we fake the snapshots. Or one of the locations is just running in my basement. There are all kinds of ways for a service provider to act in bad faith. In many ways, the warrant canary is an attempt to signal what kind of people we are and the manner in which we act in good faith.
    • jjeaff 8y ago
      Except all those are examples of acting in bad faith. The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure. The only bad faith might be using warrant canaries knowing that they may still be able to be compelled legally to comply.
      • cco 8y ago
        Of course they could compel you to keep it, the CIA has overthrown countries, performed psychological experiments on unwilling US citizens, they've sold crack and smuggled arms against Congress's wishes, the list goes on. There is nothing stopping a part of the US government from compelling a company to keep a warrant canary. But that doesn't mean canaries are useless, they're just not protective if the US government has deemed it important enough to force it.
      • rsync 8y ago
        "The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure." I personally (which is the only viewpoint that matters here) would consider falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith. YMMV.
        • grecy 8y ago
          > falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith. Except that in the case of the canary, there might be the very real threat of violence or jail time for you or your loved ones. If it were me, I can see a world where I would do things I think are morally negative if it keeps me and my loves ones alive and out of jail, and I think many other people are the same.
          • ijpoijpoihpiuoh 8y ago
            > might be the very real threat of violence or jail time for you or your loved ones I mean, hypothetically there could be. But in the real world, in some countries, you can be fairly sure that the rule of law will be followed.
            • pure-awesome 8y ago
              Just take a look at this: https://en.wikipedia.org/wiki/Unethical_human_experimentation_in_the_United_States https://en.wikipedia.org/wiki/Unethical_human_experimentatio... And these are just the ones we know about, and the page only pertains to experimentation. You have to give some consideration to what "legal" even means when you're dealing with a government.
    • cheeze 8y ago
      Love what you folks do. Keep up the hard work!
  • deleted 8y ago
    [deleted]
  • Arnt 8y ago
    Well, of course anyone can point a gun at your newborn baby. But a government agency have to comply with the law, and the law makes certain requirements on officers of companies. The details are complicated, but simplifying, if a company is publicly traded and someone whose title starts with V or C says something in public, then it has to be true. Three-letter government agencies can't both comply with the law and at the same time force you to break the law.
    • throwaway88643 8y ago
      Didn’t Snowden reveal that government agencies routinely break the law?
      • Arnt 8y ago
        Indeed he did. He didn't reveal that they routinely compel random CxOs to do so, though.
    • java-man 8y ago
      ... and break the law themselves.
  • balabaster 8y ago
    The problem with this threat is that once the cat is out of the bag, you can't put it back in. It's similar as making defamatory statements in court and having it stricken from the record - "OBJECTION!" The problem is, you can't force the jury to un-hear that. The damage is done. You can't unring a bell. You've tainted their opinion, whether the judge tries to undo it or not. If you put a gag order on me and suggest trying me for contempt of court if I say anything and I think the value of me talking is greater than that of my freedom, I will speak up. If I can get around the gag order by using a warrant canary to implicitly say what I'm not allowed to say without being tried for being in contempt of court, then that's what I will do. Until the laws are rewritten to prevent the use of warrant canaries, there's nothing the courts can do about this. It's a valid loophole. There's little point in killing my family if everything I know is already out there in the wind. I can't do any more harm than has already been done. All you have is retribution. Our agencies often take a pretty dim view of retribution. Chances are, I'd just end up with a contempt of court charge and be thrown in jail, potentially indefinitely. But realistically, the damage is done. Once again, you can't unring a bell. There's little they can legally do to pursue my family, there would be political uproar. So beyond charging me, I imagine they'd be relatively safe.
    • fossuser 8y ago
      I'm not sure there's much of a distinction between removing a warrant canary and breaking a gag order. Judges tend to have a low opinion of loop hole technicalities like this that provide the same function. I'd suspect the legal punishment/risk is the same so at best they're kind of pointless and at worst they might be extra misleading since users may believe the presence of the canary means there wasn't a request when there actually might have been.
      • DannyB2 8y ago
        Maybe you don't actively do anything. It is the absence of action. You don't REMOVE a warrant canary. You DO NOT update it. As of date X we have not been forced to do BAD THING. I simply stop updating X on the notice. In the past, the updates had happened at interval Z. Once interval Z passes without an update, everyone knows that I've done BAD THING. I didn't take any action to disclose anything. I simply stopped updating something.
  • TheLoneAdmin 8y ago
    The government can issue a gag order on a specific subject. This prevents you from disclosing the existence of a subpoena. However, the opposite is not true. The government cannot compel speech. Sure, the government can take illegal actions... However, they cannot force someone to make an untrue statement.
    • zaarn 8y ago
      Maybe they can't force you but you might still be found in contempt of court and jailed or fined large amounts of money. Either option, force or contempt of court, isn't that well explored in the domain of cyber security yet, especially because the lack of updates on the warrant canaries are supposed to communicate something and the lack of updates would therefore also constitute communicating the presence of a warrant to outside parties. Law isn't like logic puzzles.
  • neilv 8y ago
    Speaking from an engineering perspective, this is part of the reason I've never been comfortable with warrant canary or "extra-warrant" compromise canary. Let's say you run some kind of service for which you offer privacy/security assurances, but, at some point, you're compelled in some extra-warrant way to violate those assurances. Or you're simply compelled by warrant, while also being compelled not to implicitly signal that by canary. Or you discover a compromise, previously without your knowledge, and are compelled not to disclose it. I could easily imagine that many of the same official powers (public or secret), or de facto powers, that would enable the compelling wouldn't see the legal arguments of some lawyers as showstopper barriers to keeping the canary intact. If you think that kind of scenario is plausible, then touting a canary is arguably doing a disservice, from the start. At least half of engineering is honesty and specification, so the introduction of a canary, in an environment in which you can't be sure you can comply with it, and perhaps can't disclose when you realize you definitely can't comply-- doesn't seem like good engineering. If we're not sure we can honor canaries, then perhaps it's better not to do canaries at all -- and perhaps to instead specify our assurances better, including broad exceptions we anticipate we can't cover. Maybe lawyers and C-suite ultimately determine it makes sense to qualify the assurances with language like, "conceivably could be compelled by [particular government where company is based]" and "conceivably compelled not to disclose". Personally, some of the hypotheticals are way outside my expertise (and stomach), and I'd rather focus only on engineering good solutions. But canary-type situations and assurances sometimes involve engineering, and sometimes we can foresee potential future problems that we should discuss with the appropriate people in our organization, before it becomes a problem. Then, hopefully we work with people who use all the information, from engineering and other sources, to do the best thing. (BTW, I'm in the US, and I think, for example, that a practice of warrants is a very good thing, in principle, and I have some trust in the mechanisms and checks&balances of our system. I appreciate that different countries and people have different situations and perspectives, and that things are very complicated and imperfect, even in my own country.)
  • matt4077 8y ago
    The idea (and reality) is that government entities in democracy tend to follow the law. Trying to invent schemes to defend against the breakdown of the rule of law is sort of like buying insurance against the world ending.
• jakejarvis 8y ago
  Glad you guys included this part: > "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations." That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by authorities taking over private keys and doing it themselves? Canaries appear to be pretty much untested in court.
  • jcrites 8y ago
    The EFF has a FAQ about warrant canaries which addresses some of these topics: https://www.eff.org/deeplinks/2014/04/warrant-canary-faq https://www.eff.org/deeplinks/2014/04/warrant-canary-faq It is believed to be unlikely that a court would compel a company's false speech to maintain a warrant canary. > Have courts upheld compelled speech? > Rarely. In a few instances, the courts have upheld compelled speech in the commercial context, where the government shows that the compelled statements convey important truthful information to consumers. For example, warnings on cigarette packs are a form of compelled commercial speech that have sometimes been upheld, and sometimes struck down, depending on whether the government shows there is a rational basis for the warning. > Have courts upheld compelled false speech? > No, and the cases on compelled speech have tended to rely on truth as a minimum requirement. For example, Planned Parenthood challenged a requirement that physicians tell patients seeking abortions of an increased risk of suicidal ideation. The court found that Planned Parenthood did not meet its burden of showing that the disclosure was untruthful, misleading, or not relevant to the patient’s decision to have an abortion.
    • dev_dull 8y ago
      I don’t think it would be forced directly. I think they’d put the company under a gag with threat of criminal punishment if they do anything to “signal” an investigation. Then an operator has to ask themself “is it worth risking jail time by updating this page?”
      • graedus 8y ago
• joering2 8y ago
  Whats the purpose? Most judges will understand what warrant canary is, and can simply ask them to continue signing it. Judge has the power to gag you, or force you to sign or continue doing something. Its very common in multi-scheme crimes where forcing one criminal to continue their criminal conduct is "greater good" for the sake of a whole investigation.
  • throwaway88643 8y ago
    Surely if the criminal is an assassin, the judge wouldn’t order them to continue taking contracts for “the greater goood.”
    • dragonwriter 8y ago
      They certainly won't order them to continue fulfilling contracts, but they might order them to continue accepting (and reporting) them.
    • zaarn 8y ago
      There is a difference between killing people and continuing to make cryptographic signatures that even the most densest of judges should recognize.