8 ms·

A more charitable interpretation is that the copy/paste isn't because the authors are hopelessly out of touch: instead, they're seeking to enable the direct re-

A more charitable interpretation is that the copy/paste isn't because the authors are hopelessly out of touch: instead, they're seeking to enable the direct re-use of all of the executive policy and judicial precedent which has developed around those legal particulars since they were first codified.

2T1Qka0rEiPr 6y ago
This seems like a good explanation to me, thanks! One question though - why have the EU texts themselves not been updated since 2008?
- volta87 6y ago
  Probably because legislators have better things to do.
- foepys 6y ago
  No need. The intend is clear and there are more important things to do.
- kqvamxurcagg 6y ago
  In reality more modern communication techniques will be in use now. The legislation is in effect setting a minimum standard for implementation.
- thayne 6y ago
  Better question, why was it not written so it could be updated by security experts without requiring new legislation.
  - evgen 6y ago
    Because it is not necessary. The actual parties involved know what is meant and intended, so adding some ongoing and constant amendment process is counter-productive.
    - SV_BubbleTime 6y ago
      > The actual parties involved know what is meant and intended Trying to keep lawyers in business it sounds like. “Intent” is one of the trickiest things in the world when you want it to be.
    - tyxodiwktis 6y ago
      Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. I have worked on govt projects where we had to downgrade to an insecure cipher suite to comply with outdated regulations. Putting on my govt contractor hat, there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. Could charge a pretty penny too - it’ll all get budgeted as “Brexit compliance” costs.
      - Natsu 6y ago
        > Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. That reminds me of FIPS for some reason...
      - sonotmyname 6y ago
        > there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. The text quoted in the linked article in no way mandates the use of Netscape Navigator or Mozilla Mail - it merely references them as being widely distributed software capable of using RSA 1024 and SHA-1 (which it does appear to mandate).
        colejohnson66 6y ago
        It does mention AES-256. The pairing of that with SHA-1 and RSA-1024 is peculiar.
    - thayne 6y ago
      Then why give specifics at all? Why not say something like "use industry best practices for encryption" or equivalent legalese?
  - brigandish 6y ago
    Acts and regulations (to use the UK legal parlance) perform different functions. Legislators will write a law (primary legislation) via an Act (of parliament) and powers are delegated to a regulator (or minister) who will then set regulations (secondary legislation) that fit within the power of the Act. The secondary legislation is the bit that can be updated without requiring a new Act. If EU law is set up in the same manner, (and no doubt it will be similar as not only is this method good when meeting the ideal but useful for corrupt politicians to write law with less scrutiny) then the copy and paste is from secondary legislation. It may well need an update but that doesn't mean it can't be updated in the manner you advocate. https://en.wikipedia.org/wiki/Delegated_legislation_in_the_United_Kingdom https://en.wikipedia.org/wiki/Delegated_legislation_in_the_U...
  - Ekaros 6y ago
    That really brings question will all of those experts be trusted? Or might they be swayed by a hostile party like NSA? So the updated version would be more insecure than the existing one...
    - xxpor 6y ago
      It's not even a question of being swayed. I don't know about the process in the UK, but regulation writing is so slow in the US that being FIPS compliant usually means you're actually less secure since you're behind the latest in security.
- thesuitonym 6y ago
  Law moves slowly, this is a feature, not a bug.
soneil 6y ago
That's how I understand it. If you take for granted that the existing corpus already has multiparty agreement, and that any changes you make need the agreement of 28(?) countries - then you change as little as possible. Especially since this isn't some hand-wavy-future agreement, it comes into force (provisionally) in 3 days.
- rusk 6y ago
  It’s basically when you have depend on a 3p library that you discover 3 days before release has a crucial bug and the only way to deal with it is to copy and paste huge swathes of library code into your app, tweaking the bits you need to while leaving the rest there, that you don’t understand, possible bugs and all ... but don’t worry there will be 1.1 in a couple of months ...
nimbius 6y ago
Charitable indeed. Friar Occham awaits you in the parlour to delight you with a most fascinating piece of cutlery.... On the one hand, a legislative body so recklessly plunged the nation into chaos through its own incompetence that the parliament changed hands thrice, each assembling with a new headmaster more incompetent than the last. That it, in its eminence and wise foresight, divined it prudent to carefully and diligently craft both in word and in meaning a strong and thorough treatise that on its face may seem silly yet upon only the most assiduous review is the machination of a truly divine primium mobile into which this nation will resume its normal course... or.. the same bumbling octogenarian landed gentry that put everything from food security to the protestant catholic truce in jeopardy has somehow forgotten the year again.
- basicneo 6y ago
  Let's keep political cheerleading off HN.
  - deleted 6y ago
    [deleted]
  - TheOtherHobbes 6y ago
    In this case Brexit is going to have a huge and damaging effect on the UK's IT industry. Not only will some corps leave for Ireland taking their jobs with them, not only will small businesses and consultants find it far harder to sell services in the EU, not only will the UK be excluded from cutting edge research programs and funding, and not only will UK students be excluded from the international Erasmus scheme - but the current government literally has no idea why these losses even matter, never mind why it's important to mitigate them. The absence of No Deal means the UK will tend towards slow decay rather than instant crash and burn, but the medium/long term prospects of almost everyone working in IT are now significantly diminished.
    - basicneo 6y ago
      Perhaps so, but none of this is relevant to jgraettinger1's subthread.
brmgb 6y ago
Most likely a case of "if you don't change the text you don't need to change the system". You have to remember that this is not actually a new agreement. EU countries and the UK are already exchanging this data and have been doing so for decades.
Moodles 6y ago
In Britain we have a phrase to describe silly outrage news like this: "Storm in a teacup". This, combined with "Signal hacked by cellebrite" last week (bullshit: https://signal.org/blog/cellebrite-and-clickbait/ https://signal.org/blog/cellebrite-and-clickbait/) means the BBC is on a roll lately.
- jen20 6y ago
  Are you sure that this is the not the editorial staff of the BBC News trying to present some illusion of balance in its (hopeless) Keunnsberg-led coverage of Brexit, instead?
  - Moodles 6y ago
    I think it's poor journalism without due diligence verging on clickbait.
    - worik 6y ago
      Is it though? Is the fact that parts of this agreement, that means so much for so many, is nonsensical worthy of a journalist's attention and a paper's publication?
      - Moodles 6y ago
        I agree with OP's interpretation: > A more charitable interpretation is that the copy/paste isn't because the authors are hopelessly out of touch: instead, they're seeking to enable the direct re-use of all of the executive policy and judicial precedent which has developed around those legal particulars since they were first codified. I mean honestly if this is the most egregious thing they have found in the agreement so far, it doesn't sound that bad (and I voted to remain)
jariel 6y ago
It's not even charitable, more likely it's true. Commercial agreements are complicated, if you can re-use text, you do. I suggest the lawyers may not view the 'examples of tech' as we do, after all 'Mozilla' is still a 'browser'. Brexit was never so much about commercial terms, it was about political ones. There would be no 'Brexit' from the EEC. So if the mandate is 'keep the trade stuff the same as possible so 28 different countries can just say yes quickly' - then this snafu would seem more than rational.
deleted 6y ago
[deleted]

2T1Qka0rEiPr 6y ago

This seems like a good explanation to me, thanks! One question though - why have the EU texts themselves not been updated since 2008?

volta87 6y ago
Probably because legislators have better things to do.
foepys 6y ago
No need. The intend is clear and there are more important things to do.
kqvamxurcagg 6y ago
In reality more modern communication techniques will be in use now. The legislation is in effect setting a minimum standard for implementation.
thayne 6y ago
Better question, why was it not written so it could be updated by security experts without requiring new legislation.
- evgen 6y ago
  Because it is not necessary. The actual parties involved know what is meant and intended, so adding some ongoing and constant amendment process is counter-productive.
  - SV_BubbleTime 6y ago
    > The actual parties involved know what is meant and intended Trying to keep lawyers in business it sounds like. “Intent” is one of the trickiest things in the world when you want it to be.
  - tyxodiwktis 6y ago
    Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. I have worked on govt projects where we had to downgrade to an insecure cipher suite to comply with outdated regulations. Putting on my govt contractor hat, there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. Could charge a pretty penny too - it’ll all get budgeted as “Brexit compliance” costs.
    - Natsu 6y ago
      > Speaking from personal experience, it is necessary to update these references, because people implementing them have no choice but to follow the letter of the law. That reminds me of FIPS for some reason...
    - sonotmyname 6y ago
      > there may be a business opportunity here to set up VMs running Win95/Netscape Communicator for use by all the civil servants looking to comply with the law. The text quoted in the linked article in no way mandates the use of Netscape Navigator or Mozilla Mail - it merely references them as being widely distributed software capable of using RSA 1024 and SHA-1 (which it does appear to mandate).
      - colejohnson66 6y ago
        It does mention AES-256. The pairing of that with SHA-1 and RSA-1024 is peculiar.
  - thayne 6y ago
    Then why give specifics at all? Why not say something like "use industry best practices for encryption" or equivalent legalese?
- brigandish 6y ago
  Acts and regulations (to use the UK legal parlance) perform different functions. Legislators will write a law (primary legislation) via an Act (of parliament) and powers are delegated to a regulator (or minister) who will then set regulations (secondary legislation) that fit within the power of the Act. The secondary legislation is the bit that can be updated without requiring a new Act. If EU law is set up in the same manner, (and no doubt it will be similar as not only is this method good when meeting the ideal but useful for corrupt politicians to write law with less scrutiny) then the copy and paste is from secondary legislation. It may well need an update but that doesn't mean it can't be updated in the manner you advocate. https://en.wikipedia.org/wiki/Delegated_legislation_in_the_United_Kingdom https://en.wikipedia.org/wiki/Delegated_legislation_in_the_U...
- Ekaros 6y ago
  That really brings question will all of those experts be trusted? Or might they be swayed by a hostile party like NSA? So the updated version would be more insecure than the existing one...
  - xxpor 6y ago
    It's not even a question of being swayed. I don't know about the process in the UK, but regulation writing is so slow in the US that being FIPS compliant usually means you're actually less secure since you're behind the latest in security.
thesuitonym 6y ago
Law moves slowly, this is a feature, not a bug.

soneil 6y ago

That's how I understand it. If you take for granted that the existing corpus already has multiparty agreement, and that any changes you make need the agreement of 28(?) countries - then you change as little as possible. Especially since this isn't some hand-wavy-future agreement, it comes into force (provisionally) in 3 days.

rusk 6y ago
It’s basically when you have depend on a 3p library that you discover 3 days before release has a crucial bug and the only way to deal with it is to copy and paste huge swathes of library code into your app, tweaking the bits you need to while leaving the rest there, that you don’t understand, possible bugs and all ... but don’t worry there will be 1.1 in a couple of months ...

nimbius 6y ago

Charitable indeed. Friar Occham awaits you in the parlour to delight you with a most fascinating piece of cutlery.... On the one hand, a legislative body so recklessly plunged the nation into chaos through its own incompetence that the parliament changed hands thrice, each assembling with a new headmaster more incompetent than the last. That it, in its eminence and wise foresight, divined it prudent to carefully and diligently craft both in word and in meaning a strong and thorough treatise that on its face may seem silly yet upon only the most assiduous review is the machination of a truly divine primium mobile into which this nation will resume its normal course... or.. the same bumbling octogenarian landed gentry that put everything from food security to the protestant catholic truce in jeopardy has somehow forgotten the year again.

basicneo 6y ago
Let's keep political cheerleading off HN.
- deleted 6y ago
  [deleted]
- TheOtherHobbes 6y ago
  In this case Brexit is going to have a huge and damaging effect on the UK's IT industry. Not only will some corps leave for Ireland taking their jobs with them, not only will small businesses and consultants find it far harder to sell services in the EU, not only will the UK be excluded from cutting edge research programs and funding, and not only will UK students be excluded from the international Erasmus scheme - but the current government literally has no idea why these losses even matter, never mind why it's important to mitigate them. The absence of No Deal means the UK will tend towards slow decay rather than instant crash and burn, but the medium/long term prospects of almost everyone working in IT are now significantly diminished.
  - basicneo 6y ago
    Perhaps so, but none of this is relevant to jgraettinger1's subthread.

brmgb 6y ago

Most likely a case of "if you don't change the text you don't need to change the system". You have to remember that this is not actually a new agreement. EU countries and the UK are already exchanging this data and have been doing so for decades.

Moodles 6y ago

In Britain we have a phrase to describe silly outrage news like this: "Storm in a teacup". This, combined with "Signal hacked by cellebrite" last week (bullshit: https://signal.org/blog/cellebrite-and-clickbait/ https://signal.org/blog/cellebrite-and-clickbait/) means the BBC is on a roll lately.

jen20 6y ago
Are you sure that this is the not the editorial staff of the BBC News trying to present some illusion of balance in its (hopeless) Keunnsberg-led coverage of Brexit, instead?
- Moodles 6y ago
  I think it's poor journalism without due diligence verging on clickbait.
  - worik 6y ago
    Is it though? Is the fact that parts of this agreement, that means so much for so many, is nonsensical worthy of a journalist's attention and a paper's publication?
    - Moodles 6y ago
      I agree with OP's interpretation: > A more charitable interpretation is that the copy/paste isn't because the authors are hopelessly out of touch: instead, they're seeking to enable the direct re-use of all of the executive policy and judicial precedent which has developed around those legal particulars since they were first codified. I mean honestly if this is the most egregious thing they have found in the agreement so far, it doesn't sound that bad (and I voted to remain)

jariel 6y ago

It's not even charitable, more likely it's true. Commercial agreements are complicated, if you can re-use text, you do. I suggest the lawyers may not view the 'examples of tech' as we do, after all 'Mozilla' is still a 'browser'. Brexit was never so much about commercial terms, it was about political ones. There would be no 'Brexit' from the EEC. So if the mandate is 'keep the trade stuff the same as possible so 28 different countries can just say yes quickly' - then this snafu would seem more than rational.

deleted 6y ago

[deleted]