4 ms·
Whilst I commend any attempt to avoid the police kettling we have seen in the UK at recent demonstrations, I have a number of concerns about Sukey which I made
by mwg66 16y ago
Whilst I commend any attempt to avoid the police kettling we have seen in the UK at recent demonstrations, I have a number of concerns about Sukey which I made to them at launch - and never received a response. I will try and reiterate here:
* I urge nobody to trust a protest tool that is closed. Where is the source? Where is the documentation on its architecture? The official line is:
"It has always been our plan to make the code open source. Security is paramount and we feel it would benefit from being released to the public after each protest."
I'm sorry but retrospective release of source code is simply not good enough. Security software (which this is, essentially) needs to be out in the open from the start. Not after a protest has happened and all data collected. The wider community must be able to audit this software before it can be trusted. No exceptions.
* If the security depends on secrecy before a protest, is it dependant on a random seed? Can this seed be extracted from a binary (IPA, for example)?
* Sukey has one of the worst pages on "security" I have ever read (see http://sukey.org/security http://sukey.org/security). To paraphrase:
"The team members involved on the security side are a mix of commercial information security experts and computer nerd under/post graduates who love nothing better than a complex algorithm."
That scares me. Complex algorithms are not normally conducive to secure applications. I want to hear about cryptographers - not computer nerds. I want to know what crypto implementations you are using.
Continuing:
"One of our key team members has technical commercial data security patents in his name and has provided information security consultancy to IBM, Lockheed Martin, and to the NHS."
Let's have a citation then please. Who is this expert and what (where?) are the granted patents?
"Your data is safe with Sukey."
Okay, prove it.
* How can we prove the application distributed on the App Store matches that which we (hopefully, in future) have the source for? Is there a mechanism for which we could compare checksums - if the provisioning certificates were also published? This needs to be considered. There is more to trust than merely publishing a source tree.
Let me finally restate my original point: I commend the effort (and I was once involved in a similar application). However, these are serious concerns that need to be addressed.
- mayank 16y agoNot to mention that their name (at least in the US) is phonetically synonymous with "doesn't work".
- Joakal 16y agoSeems far better to offer the system to be managed by the protest organisers. This means the organisers can delegate 'scouts' and 'commanders', yet still allow anyone to submit data. The whole thing sounds shady by technical buzzwords and not showing the product. Even then, I'd prefer to make Kettling illegal over implementing schemes that are reinforcing the unhealthy "Us vs Them" mentality. It seems that Sukey.org have no intent to make Kettling illegal which leads me to believe that they're exploiting the situation (A campaign section would mitigate this, eg ministers against kettling, plans to make it banned, etc).
- TimHardy 16y agoRight now it's a service: there's no product to see, just a live updated map during the demonstration on Saturday. We are not giving instructions to people as to the route to follow. That is the role of the stewards (what you call organisers, scouts, commanders). We merely provide people with information with which they can make their own decisions. We aim to reduce tension between police and protesters by increasing transparency: our approach is the diametric opposite of encouraging us and them thinking. I would personally be very happy to see kettling banned and support the legal challenges being made to it at the moment. However, if the threat of kettling is being used to prevent peaceful protest and to scare people away from exercising their democrat right to do so then I believe that a tool like Sukey is essential rather than waiting years and years for the law to be changed, not knowing if it ever will be.
- mwg66 16y agoThanks for answering. You continue to ignore my legitimate concerns, however.
- TimHardy 16y agoIt's Saturday night/Sunday morning and I think I'm the only idiot who didn't go out and have fun after weeks of hard work ;) Can I direct you to a discussion of these topics here: http://visionon.tv/forum/-/message_boards/view_message/45043 http://visionon.tv/forum/-/message_boards/view_message/45043 If the responses there don't answer all your questions, please come back to me. In fact, email the sukey team and address it in the body "attention Tim Hardy" or contact me via the address on the About page on beyondclicktivism and I promise you I will make sure that each and every one of your legitimate concerns is addressed. Security is highly important to us and if we have failed to communicate that clearly then we need to do better. We are receiving literally thousands of emails, tweets and phone calls, including requests for interviews and clarifications from press around the world. We have a shoe-string budget, no equipment beyond our own personal phones and laptops, no office space beyond what we can borrow for free. None of us are paid for our work on Sukey and many of us also have full-time careers. Please be patient with us. All concerns will be addressed as soon as possible - but there are only so many nights you can do without sleep :)
- TimHardy 16y agoI'll get one of the team who specialises in security to answer your questions. I've emailed everyone but it may not be until tomorrow if they are out or asleep right now. You're right that it is paramount that we be open about security and I apologise for the rushed nature of our security pages. Rewriting all of the copy on the site is on our road map right now.