2 ms·

> Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on

> Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. I believe you're confusing "is not actively logging" with "will not log, even when law enforcement takes over the server" (which a court order essentially comes down to, if you don't comply). The former is what ProtonMail also does. The latter is what no company can offer.

denton-scratch 5y ago
Our server was seized by the police. Nobody was arrested (well, they didn't really know who we were). We weren't even asked to make the server start up for them; we certainly weren't asked to circumvent the logging suppression; and had we been asked, we would have declined. But then we weren't a corporation. Between us, we had little to lose. We didn't have to help the cops. Protonmail is a business, so I suppose they are much more likely to roll over. Still, I'm pretty disappointed; their whole sctick is security, and they pitch to the likes of whistleblowers. It looks pretty bad to me. The IndyUK server was seized from Rackspace, under the directions of the FBI (this was in Manchester, UK; I guess Rackspace US were leaned on by the feds, and HQ leaned on the Manchester datacenter). I think the feds kept the disks, which were encrypted.
- luckylion 5y ago
  I don't know, it looks fine to me. Switzerland isn't a super push-over state and has a reputation for valuing privacy (which is worth much more money than doing small favors for the US, RU or CN), so I don't expect them to go for "yeah sure that person leaked evidence of war crimes, we'll get right on getting you their IP". At the same time, to do business, you need to comply with the absolute minimum of laws. If Rackspace just flat out refused to follow court orders, they wouldn't be able to run a data center. A DC that will comply with a court order is better than no DC imho. Perfect is the enemy of good, and PM is definitely good at doing email with a high degree of privacy. Should you use it from your home dial-up while leaking the definite proof that reptilians are running the show? Probably not, but that doesn't make them unusable. For a lot of other threat models, they're perfectly fine, at least until proven otherwise. Virtually no one (besides a few trained super spies) will resist and not comply once the first finger nail is coming off. Court orders are just the friendly foreplay, and they'll escalate from there depending on how important it is for them to get them to comply. If you're betting your safety on anyone withstanding that and not giving up their password, you're setting yourself up for disappointment (and pain!).

denton-scratch 5y ago

Our server was seized by the police. Nobody was arrested (well, they didn't really know who we were). We weren't even asked to make the server start up for them; we certainly weren't asked to circumvent the logging suppression; and had we been asked, we would have declined. But then we weren't a corporation. Between us, we had little to lose. We didn't have to help the cops. Protonmail is a business, so I suppose they are much more likely to roll over. Still, I'm pretty disappointed; their whole sctick is security, and they pitch to the likes of whistleblowers. It looks pretty bad to me. The IndyUK server was seized from Rackspace, under the directions of the FBI (this was in Manchester, UK; I guess Rackspace US were leaned on by the feds, and HQ leaned on the Manchester datacenter). I think the feds kept the disks, which were encrypted.

luckylion 5y ago
I don't know, it looks fine to me. Switzerland isn't a super push-over state and has a reputation for valuing privacy (which is worth much more money than doing small favors for the US, RU or CN), so I don't expect them to go for "yeah sure that person leaked evidence of war crimes, we'll get right on getting you their IP". At the same time, to do business, you need to comply with the absolute minimum of laws. If Rackspace just flat out refused to follow court orders, they wouldn't be able to run a data center. A DC that will comply with a court order is better than no DC imho. Perfect is the enemy of good, and PM is definitely good at doing email with a high degree of privacy. Should you use it from your home dial-up while leaking the definite proof that reptilians are running the show? Probably not, but that doesn't make them unusable. For a lot of other threat models, they're perfectly fine, at least until proven otherwise. Virtually no one (besides a few trained super spies) will resist and not comply once the first finger nail is coming off. Court orders are just the friendly foreplay, and they'll escalate from there depending on how important it is for them to get them to comply. If you're betting your safety on anyone withstanding that and not giving up their password, you're setting yourself up for disappointment (and pain!).