7 ms·

Certainly doesn't make me want to use any software made by this guy.

by superhuzza 6y ago

pixxel 6y ago
This was pre 9/11 too, so he didn’t hesitate to hand over the source code based on any sense of patriotism.
- Hnrobert42 6y ago
  There were patriots before 9/11.
partiallypro 6y ago
I guess to be fair, this was in 2000. Before we knew the Snowden revelations, etc. I also wonder if he handed over just the source code to the shareware version or the full version? Also, nearly everything is open sourced now...so I guess it isn't the biggest boundary to cross?
- secfirstmd 6y ago
  We knew about Crypto AG and Echelon at this point though.
  - jacobush 6y ago
    I knew about Echelon in 1998, but nobody I talked to would believe a word of it. (Or rather, I "knew" what other people ranted about on web pages with badly scanned photos of satellite dishes. But still.)
- raverbashing 6y ago
  > I also wonder if he handed over just the source code to the shareware version or the full version? It's probably an #IFDEF or an if (registered) somewhere in the source code.
marcus_holmes 6y ago
Why not? I mean, if the cops turned up at your door with a search warrant, you'd let them in, right?
- burrows 6y ago
  The NSA agent didn't have a "search warrant".
  - marcus_holmes 6y ago
    No they didn't, but they proved who they were to the OP's satisfaction, and left it to him to decide whether he should help them or not. To me, this is a bit of a no-brainer. A government agency wants my help to do something. Do I trust them? Do I help them? Well... yes. They're the government. Incompetent sometimes, irrelevant a lot of the time, inefficient, sure. But ultimately there to provide a service for me as a citizen. If they need my help, then I should probably help them. I understand that Americans don't trust their government like this. I'm not sure why not.
    - duncan_bayne 6y ago
      https://en.m.wikipedia.org/wiki/Tuskegee_syphilis_experiment https://en.m.wikipedia.org/wiki/Tuskegee_syphilis_experiment https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) Those two spring to mind immediately, and I'm not American, I'm Australian. Personally, I don't understand why anyone trusts their Government more than the bare minimum required to support the rule of law.
      - ycombi3 6y ago
        You can lead a horse to water.... People are way to trusting.
- rcoveson 6y ago
  If I ran an neighborhood ISP, and the cops asked me to spy on a neighbor (for reasons they wouldn't even provide), then I'd shut down first. If they just wanted to search _my_ stuff, sure. But if the only reason that I'm even capable of assisting the government in spying on somebody is that they are my customer, neighbor, friend, or user then I will not offer that assistance. That would be evil. Don't be evil.
voz_ 6y ago
Wait, why would you not want to use software relied on for national security interests?
- Frost1x 6y ago
  Does this jump into the "something/nothing to hide" argument? The idea that there's an intentional backdoor through security for some institution that may or may not be acting in your best interest is enough for me to not want to use it. Just about everyone has something to hide, but what they're hiding and the reasons they're hiding it may only be used as leverage against them and have nothing that's a threat to anyone else. My encrypted data has some old tax returns and past medical records--nothing too exciting or compromising, but neither are things I want random people having access to should my copy of the data be compromised. There are plenty of valid reasons not to want a government agency to be able to pry into every aspect of it's citizens lives. I'd say most people hiding things do it for a lot of social/cultural purposes that aren't too significant at least not in terms of national security. Take most peoples' browser history--few people want others crawling through searches that might make them feel stupid or insecure for whatever reason. Perhaps they looked at someone's public profile they're interested in dating and don't want to be labeled a 'creep' or perhaps they've been making great use of the free PornHub Premium access lately. People have rights to secure/hide those things and they're no real threat to national security.
  - deleted 6y ago
    [deleted]
  - Hnrobert42 6y ago
    That’s not the question. The question is, why would opening source to the NSA cause you to lose trust in the quality of work. You seem to have answered the question, “Why is privacy good?” Your answer, at least to me, seems valid, but if you are answering other questions, I would ask, “Can you imagine situations in which individual liberties are trumped by physical safety of a large number of folks?” How have you reacted to CoVID-19 restrictions? Are those two things really so different?
  - 6y ago
selykg 6y ago
Curious why... Your security should never depend upon security of your source code. If you're doing things correctly, then the source code doesn't change anything about the security of the data that is encrypted. Perhaps you mean that he chose to use 40-bit keys instead of 256-bit keys in the free version? I mean, I guess. But that's just a matter of better understanding the details. It sounds like he outlined this clearly and anyone looking for more security knew to pay for the product to get the 256-bit keys.
- stevep98 6y ago
  At that time, if you made software available for export (and that included making a version freely downloadable), it was limited by law to 40 bits.
  - hinkley 6y ago
    The practice of looking up algorithms by name dates back to that same time. The phrasing of the law, since they were treated as munitions, was that you couldn't even export something that was designed to have crypto bolted on. So you made it so anything could be bolted on and some of them just happened to be crypto. The legacy being things like the blacklist/whitelist discussion we had the other day about case sensitivity in crypto algorithms. We still look up algorithms by string name (instead of enum or some other mechanism) decades later.
    - mratsim 6y ago
      But books had exemptions and you could export crypto as long as it was printed on a book
- rcoveson 6y ago
  > Your security should never depend upon security of your source code. For sure. I don't think it's about that, though. Even if the application in question were open source, if the project lead is willing to cooperate in any way their government asks, they could probable ensure the existence of a back door. For this reason, where possible, I would prefer to use encryption software written by people who are principled to a fault (or who at least do a good job acting as if they were). Let's imagine Linus Torvalds or Greg Kroah-Hartman in this same situation. Linux source is available, so let's say they were asked to ensure that a certain patch to a cryptographic API was not accepted before a certain window. Maybe the crypto API maintainers were on the call as well saying that they were on board with the plan (apologies to those people, I don't know you and mean no offense). I like to think that they would: 1. Turn down the NSA. 2. Attempt to get the word out about what they had been asked. 3. Find new crypto maintainers. And yes, it's entirely possible that this is not at all how it would go down. Maybe they would be very cooperative. I don't know any of these people personally. But what I do know is that they have not, as of yet, made a blog post about that time when the NSA did ask them to betray an unspecified user and how they did everything they asked without resistance. I don't think I'm being idealistic here. Software and encryption are global endeavors. People who blindly believe that the enemies of their state are also their enemies, or even that obedience to local laws is a moral imperative, should not write crypto software. Or at least, I hope they make their beliefs known like this guy did so that I can avoid their software.
xenocyon 6y ago
As others have pointed out, the source code isn't endangering the user(s). Nonetheless, I agree with you. The writer appears emotionally swayed and flattered by the request, like a protagonist in a WWII-era young-adult novel ("Your country needs you!"), and is eager to satisfy the ask immediately without the slightest bit of skepticism or diligence. That's not the kind of temperament one would want an encryption software dev to have.
tinus_hn 6y ago
Better not use any software by Microsoft then. Also definitely none of that scary open source stuff by people who’ll just hand over the code to anyone who asks.
- superhuzza 6y ago
  Kind of missing the point, it's not about the source code. It's about the authors willingness to cooperate just because an NSA agent implied "it's important".
  - tinus_hn 6y ago
    Consider the amount of cooperation which in this case was ‘send them the source code’.
Hnrobert42 6y ago
So you don’t use any open source stuff, huh?

Certainly doesn't make me want to use any software made by this guy.

pixxel 6y ago

This was pre 9/11 too, so he didn’t hesitate to hand over the source code based on any sense of patriotism.

Hnrobert42 6y ago
There were patriots before 9/11.

partiallypro 6y ago

I guess to be fair, this was in 2000. Before we knew the Snowden revelations, etc. I also wonder if he handed over just the source code to the shareware version or the full version? Also, nearly everything is open sourced now...so I guess it isn't the biggest boundary to cross?

secfirstmd 6y ago
We knew about Crypto AG and Echelon at this point though.
- jacobush 6y ago
  I knew about Echelon in 1998, but nobody I talked to would believe a word of it. (Or rather, I "knew" what other people ranted about on web pages with badly scanned photos of satellite dishes. But still.)
raverbashing 6y ago
> I also wonder if he handed over just the source code to the shareware version or the full version? It's probably an #IFDEF or an if (registered) somewhere in the source code.

marcus_holmes 6y ago

Why not? I mean, if the cops turned up at your door with a search warrant, you'd let them in, right?

burrows 6y ago
The NSA agent didn't have a "search warrant".
- marcus_holmes 6y ago
  No they didn't, but they proved who they were to the OP's satisfaction, and left it to him to decide whether he should help them or not. To me, this is a bit of a no-brainer. A government agency wants my help to do something. Do I trust them? Do I help them? Well... yes. They're the government. Incompetent sometimes, irrelevant a lot of the time, inefficient, sure. But ultimately there to provide a service for me as a citizen. If they need my help, then I should probably help them. I understand that Americans don't trust their government like this. I'm not sure why not.
  - duncan_bayne 6y ago
    https://en.m.wikipedia.org/wiki/Tuskegee_syphilis_experiment https://en.m.wikipedia.org/wiki/Tuskegee_syphilis_experiment https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program) Those two spring to mind immediately, and I'm not American, I'm Australian. Personally, I don't understand why anyone trusts their Government more than the bare minimum required to support the rule of law.
    - ycombi3 6y ago
      You can lead a horse to water.... People are way to trusting.
rcoveson 6y ago
If I ran an neighborhood ISP, and the cops asked me to spy on a neighbor (for reasons they wouldn't even provide), then I'd shut down first. If they just wanted to search _my_ stuff, sure. But if the only reason that I'm even capable of assisting the government in spying on somebody is that they are my customer, neighbor, friend, or user then I will not offer that assistance. That would be evil. Don't be evil.

voz_ 6y ago

Wait, why would you not want to use software relied on for national security interests?

Frost1x 6y ago
Does this jump into the "something/nothing to hide" argument? The idea that there's an intentional backdoor through security for some institution that may or may not be acting in your best interest is enough for me to not want to use it. Just about everyone has something to hide, but what they're hiding and the reasons they're hiding it may only be used as leverage against them and have nothing that's a threat to anyone else. My encrypted data has some old tax returns and past medical records--nothing too exciting or compromising, but neither are things I want random people having access to should my copy of the data be compromised. There are plenty of valid reasons not to want a government agency to be able to pry into every aspect of it's citizens lives. I'd say most people hiding things do it for a lot of social/cultural purposes that aren't too significant at least not in terms of national security. Take most peoples' browser history--few people want others crawling through searches that might make them feel stupid or insecure for whatever reason. Perhaps they looked at someone's public profile they're interested in dating and don't want to be labeled a 'creep' or perhaps they've been making great use of the free PornHub Premium access lately. People have rights to secure/hide those things and they're no real threat to national security.
- deleted 6y ago
  [deleted]
- Hnrobert42 6y ago
  That’s not the question. The question is, why would opening source to the NSA cause you to lose trust in the quality of work. You seem to have answered the question, “Why is privacy good?” Your answer, at least to me, seems valid, but if you are answering other questions, I would ask, “Can you imagine situations in which individual liberties are trumped by physical safety of a large number of folks?” How have you reacted to CoVID-19 restrictions? Are those two things really so different?
- 6y ago

selykg 6y ago

Curious why... Your security should never depend upon security of your source code. If you're doing things correctly, then the source code doesn't change anything about the security of the data that is encrypted. Perhaps you mean that he chose to use 40-bit keys instead of 256-bit keys in the free version? I mean, I guess. But that's just a matter of better understanding the details. It sounds like he outlined this clearly and anyone looking for more security knew to pay for the product to get the 256-bit keys.

stevep98 6y ago
At that time, if you made software available for export (and that included making a version freely downloadable), it was limited by law to 40 bits.
- hinkley 6y ago
  The practice of looking up algorithms by name dates back to that same time. The phrasing of the law, since they were treated as munitions, was that you couldn't even export something that was designed to have crypto bolted on. So you made it so anything could be bolted on and some of them just happened to be crypto. The legacy being things like the blacklist/whitelist discussion we had the other day about case sensitivity in crypto algorithms. We still look up algorithms by string name (instead of enum or some other mechanism) decades later.
  - mratsim 6y ago
    But books had exemptions and you could export crypto as long as it was printed on a book
rcoveson 6y ago
> Your security should never depend upon security of your source code. For sure. I don't think it's about that, though. Even if the application in question were open source, if the project lead is willing to cooperate in any way their government asks, they could probable ensure the existence of a back door. For this reason, where possible, I would prefer to use encryption software written by people who are principled to a fault (or who at least do a good job acting as if they were). Let's imagine Linus Torvalds or Greg Kroah-Hartman in this same situation. Linux source is available, so let's say they were asked to ensure that a certain patch to a cryptographic API was not accepted before a certain window. Maybe the crypto API maintainers were on the call as well saying that they were on board with the plan (apologies to those people, I don't know you and mean no offense). I like to think that they would: 1. Turn down the NSA. 2. Attempt to get the word out about what they had been asked. 3. Find new crypto maintainers. And yes, it's entirely possible that this is not at all how it would go down. Maybe they would be very cooperative. I don't know any of these people personally. But what I do know is that they have not, as of yet, made a blog post about that time when the NSA did ask them to betray an unspecified user and how they did everything they asked without resistance. I don't think I'm being idealistic here. Software and encryption are global endeavors. People who blindly believe that the enemies of their state are also their enemies, or even that obedience to local laws is a moral imperative, should not write crypto software. Or at least, I hope they make their beliefs known like this guy did so that I can avoid their software.

xenocyon 6y ago

As others have pointed out, the source code isn't endangering the user(s). Nonetheless, I agree with you. The writer appears emotionally swayed and flattered by the request, like a protagonist in a WWII-era young-adult novel ("Your country needs you!"), and is eager to satisfy the ask immediately without the slightest bit of skepticism or diligence. That's not the kind of temperament one would want an encryption software dev to have.

tinus_hn 6y ago

Better not use any software by Microsoft then. Also definitely none of that scary open source stuff by people who’ll just hand over the code to anyone who asks.

superhuzza 6y ago
Kind of missing the point, it's not about the source code. It's about the authors willingness to cooperate just because an NSA agent implied "it's important".
- tinus_hn 6y ago
  Consider the amount of cooperation which in this case was ‘send them the source code’.

Hnrobert42 6y ago

So you don’t use any open source stuff, huh?