4 ms·

Maybe the one thing worse than boasting that you're putting malware in your product is boasting about it and not doing it.

deleted 6y ago
[deleted]
mannerheim 6y ago
Is it malware if users desire for their devices to be resistant to surveillance tools?
- spinny 6y ago
  goodware ??
- PeterisP 6y ago
  Those are not related issues - it's malware or not malware based on what it does or did (e.g. did it corrupt data on someone else's computer system because it was intended to do just that thing?) regardless of the reason for placing it there. If you can't figure out a way to satisfy your desire for your devices to be resistant to surveillance tools with legal means, well, then you can't satisfy that desire. Furthermore, not only the ends don't justify the means, the ends can be prohibited too - if you explicitly design something to destroy your own data knowing that this data would get used in a criminal investigation, that may be a crime on its own (tampering with evidence/obstruction of justice, location matters of course); you don't have to testify against yourself, but destroying evidence is a crime even if it's your property (e.g. throwing your gun into a river after a shooting so it wouldn't be found) and furthermore in that case the court may be allowed to assume that the destroyed evidence was unfavorable to you, that the data contained the damning things they expected to find there - so if you want to protect your devices from surveillance tools operated with a legal warrant, you might want to consult a lawyer to find out if that's a good idea in your jurisdiction, it may well be worse for you than doing nothing.
  - mannerheim 6y ago
    It is software that many of us are perfectly content with possessing on our devices. Cellebrite may not want it on their devices, but it's not like we consent to Cellebrite copying over our data. Holding us or Signal responsible for this is akin to holding a dog or its owner responsible for a burglar getting mauled - it would be one matter if the dog mauled a guest, but you can hardly blame either with unauthorised entry. In this case, exploiting this can be considered a form of digital rights management. As for tampering with evidence, your claims are certainly overbroad, otherwise one could consider Signal's vanishing messages and deliberate lack of logging to be tampering with evidence. In any case, an individual is hardly responsible for those actions; they presumably did not deliberately seek to destroy Cellebrite data since Signal may choose to do this entirely at random.
  - tgragnato 6y ago
    > If you can't figure out a way to satisfy your desire for your devices to be resistant to surveillance tools with legal means, well, then you can't satisfy that desire. I fear this part of your argument is fallacious. A peaceful and hilarious response to an abuse is not illegal. An if it is, it should not be. This post just highlights how petty the means and methods used by "some companies" are. Moxie is rightfully mocking Cellebrite and its customers, and it's fantastic. About the obstruction of justice... If governments around the world are having an appetite for abuses, we shall not fall for it. There are other ways to get to criminals. Tell state officers they can do their job without abusing the private sphere of citizens. It's Cellebrite devices that should be made illegal, because "justice" should not depend on surveillance tools. Just days ago the same US IC shared a memo/report about the rise of authoritarianism and how western democracies are threatened by it. Let's stop this double standard.
rOOb85 6y ago
They are not putting malware into their app. They are adding athletically pleasing files to their app. Is it Signals fault if someone else's software doesn't work properly with them? How can Signal test every piece of software to make sure it's compatible with their own software? Especially when the other software is using Signal in a unintended way. It's not signals job to secure 3rd party software, that's entirely on the 3rd party.
- PeterisP 6y ago
  Intent matters, come on, your arguments are ridiculuous. If one of the aesthetically pleasing files turns out to contain an exploit targeted at Cellebrite software, then it wouldn't be hard to convince a jury that this isn't a coincidence but intentional malware, especially combined with this wink-wink bragpost. It's not Signal's job to secure third party software, they can intentionally post incompatible data, but it definitely is their job (just as everyone else's, mandated by criminal law) to abstain from any activities that would tamper with evidence. If that incompatible data isn't limited to randomness or crashes but contains, quoting the article "a file that executes arbitrary code on the Cellebrite machine" or "undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine" then it obviously was intentionally made that way, which crosses the line and at that point yes, it's definitely Signal's fault. If that gets actually executed on a machine owned not by Signal but e.g. some law enforcement agency, then Signal and any involved developers personally may face criminal charges. It does not even need to involve any computer specific laws (though those are also likely to apply) - if there's an incident where evidence got disrupted, if there's evidence that this incident was caused by "aesthetically pleasing files" developed by Signal, and there's some evidence (e.g. this blogpost) that they made these files knowing that they might result in other evidence being destroyed - that's completely enough, that's tampering with evidence, a felony. Go directly to jail, do not collect $200, don't expect sympathy from law enforcement and the legal system. In my personal opinion this is all FUD and scaremongering, because actually doing so carries little benefit and high risk for Signal. But, of course, no one can be sure.
  - Dylan16807 6y ago
matheusmoreira 6y ago
Malware? Any countermeasure against state surveillance is a good thing for us.

deleted 6y ago

[deleted]

mannerheim 6y ago

Is it malware if users desire for their devices to be resistant to surveillance tools?

spinny 6y ago
goodware ??
PeterisP 6y ago
Those are not related issues - it's malware or not malware based on what it does or did (e.g. did it corrupt data on someone else's computer system because it was intended to do just that thing?) regardless of the reason for placing it there. If you can't figure out a way to satisfy your desire for your devices to be resistant to surveillance tools with legal means, well, then you can't satisfy that desire. Furthermore, not only the ends don't justify the means, the ends can be prohibited too - if you explicitly design something to destroy your own data knowing that this data would get used in a criminal investigation, that may be a crime on its own (tampering with evidence/obstruction of justice, location matters of course); you don't have to testify against yourself, but destroying evidence is a crime even if it's your property (e.g. throwing your gun into a river after a shooting so it wouldn't be found) and furthermore in that case the court may be allowed to assume that the destroyed evidence was unfavorable to you, that the data contained the damning things they expected to find there - so if you want to protect your devices from surveillance tools operated with a legal warrant, you might want to consult a lawyer to find out if that's a good idea in your jurisdiction, it may well be worse for you than doing nothing.
- mannerheim 6y ago
  It is software that many of us are perfectly content with possessing on our devices. Cellebrite may not want it on their devices, but it's not like we consent to Cellebrite copying over our data. Holding us or Signal responsible for this is akin to holding a dog or its owner responsible for a burglar getting mauled - it would be one matter if the dog mauled a guest, but you can hardly blame either with unauthorised entry. In this case, exploiting this can be considered a form of digital rights management. As for tampering with evidence, your claims are certainly overbroad, otherwise one could consider Signal's vanishing messages and deliberate lack of logging to be tampering with evidence. In any case, an individual is hardly responsible for those actions; they presumably did not deliberately seek to destroy Cellebrite data since Signal may choose to do this entirely at random.
- tgragnato 6y ago
  > If you can't figure out a way to satisfy your desire for your devices to be resistant to surveillance tools with legal means, well, then you can't satisfy that desire. I fear this part of your argument is fallacious. A peaceful and hilarious response to an abuse is not illegal. An if it is, it should not be. This post just highlights how petty the means and methods used by "some companies" are. Moxie is rightfully mocking Cellebrite and its customers, and it's fantastic. About the obstruction of justice... If governments around the world are having an appetite for abuses, we shall not fall for it. There are other ways to get to criminals. Tell state officers they can do their job without abusing the private sphere of citizens. It's Cellebrite devices that should be made illegal, because "justice" should not depend on surveillance tools. Just days ago the same US IC shared a memo/report about the rise of authoritarianism and how western democracies are threatened by it. Let's stop this double standard.

rOOb85 6y ago

They are not putting malware into their app. They are adding athletically pleasing files to their app. Is it Signals fault if someone else's software doesn't work properly with them? How can Signal test every piece of software to make sure it's compatible with their own software? Especially when the other software is using Signal in a unintended way. It's not signals job to secure 3rd party software, that's entirely on the 3rd party.

PeterisP 6y ago
Intent matters, come on, your arguments are ridiculuous. If one of the aesthetically pleasing files turns out to contain an exploit targeted at Cellebrite software, then it wouldn't be hard to convince a jury that this isn't a coincidence but intentional malware, especially combined with this wink-wink bragpost. It's not Signal's job to secure third party software, they can intentionally post incompatible data, but it definitely is their job (just as everyone else's, mandated by criminal law) to abstain from any activities that would tamper with evidence. If that incompatible data isn't limited to randomness or crashes but contains, quoting the article "a file that executes arbitrary code on the Cellebrite machine" or "undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine" then it obviously was intentionally made that way, which crosses the line and at that point yes, it's definitely Signal's fault. If that gets actually executed on a machine owned not by Signal but e.g. some law enforcement agency, then Signal and any involved developers personally may face criminal charges. It does not even need to involve any computer specific laws (though those are also likely to apply) - if there's an incident where evidence got disrupted, if there's evidence that this incident was caused by "aesthetically pleasing files" developed by Signal, and there's some evidence (e.g. this blogpost) that they made these files knowing that they might result in other evidence being destroyed - that's completely enough, that's tampering with evidence, a felony. Go directly to jail, do not collect $200, don't expect sympathy from law enforcement and the legal system. In my personal opinion this is all FUD and scaremongering, because actually doing so carries little benefit and high risk for Signal. But, of course, no one can be sure.
- Dylan16807 6y ago

matheusmoreira 6y ago

Malware? Any countermeasure against state surveillance is a good thing for us.