4 ms·

So your solution is to get rid of speedy emergency requests entirely? Sounds like you’re just repeating the point that authenticating these requests is impossi

by rosndo 5y ago

So your solution is to get rid of speedy emergency requests entirely? Sounds like you’re just repeating the point that authenticating these requests is impossible, as that authentication would have to happen fast. And then you need to do this internationally. What will you do? Contact the embassy? Suddenly your authentication process could take months, which is a problem if you’re legally required to comply sooner than that.

Forgeties79 5y ago
>So your solution is to get rid of speedy emergency requests entirely? Who said that?
- coospep 5y ago
  That’s the implication. A lengthy verification process makes speedy processing of requests impossible.
  - Forgeties79 5y ago
    A fake subpoena is not a home invasion. It's not like seconds matter.
    - coospep 5y ago
      Until you get in trouble for not complying with a real one. Worst case scenario is probably a horrible PR disaster after a child dies because you couldn’t process a real request fast enough. And we’re not talking about seconds, but easily days or weeks.
      - Forgeties79 5y ago
        You think this is something someone can't figure out in a matter of weeks?
        coospep 5y ago
        Forgeties79 5y ago
        >Sorry, but this isn’t your first comment demonstrating severe struggles with reading comprehension. This isn't reddit, you can't talk to people like that here. I'm not engaging this further. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
        coospep 5y ago
        dang 5y ago
        Would you please stop perpetuating flamewars on HN and also please stop using HN primarily for political/ideological battle? We ban accounts that do those things because they destroy what the site is supposed to be for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
        dang 5y ago
        We've banned this account for breaking the site guidelines. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. They're here: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
  - throwawayboise 5y ago
    For some problems, there is no good solution.
    - coospep 5y ago
      That’s my point. The OP “riskable” claimed the opposite though.
novok 5y ago
Nope, but for cities to be prepared for such emergencies before hand by completing some basics of bureaucracy by being properly authenticated, much like you expect a city fire department to have some fire trucks purchased already instead of expecting to purchase one in seconds when they need one from the dealership 1000 miles away.
- coospep 5y ago
  Yeah, of course the federal government could legislate this problem away. Not gonna happen though. It is literally impossible for request recipients to solve this problem.
  - rootusrootus 5y ago
    > It is literally impossible for request recipients to solve this problem. This I agree with. I'm trying to find the actual text of the law, I'm surprised the government isn't pretty specific about what constitutes a valid EDR, who can send them, etc. Bureaucrats love to write rules.
    - novok 5y ago
      From the article, I couldn't see what actually compelled the need to comply with an "EDR". From what I could see, they were not actual warrants or subpoenas that legally compelled performance, they were requests. They do it out of not wanting to have bad PR in case it was real, because the consequences for a screw up are pretty much nil. The end solution is either an authentication scheme, a $1000 rush processing fee that includes a verification process and the requirement to call it in (It is an emergency, isn't it? Emergencies do not happen often, so what is $1000 to an american organization funded by taxpayer dollars?) or E2E encryption that makes it they can't give data. Another thing about the $1000 fee, is you get to see the payment information about the account it comes from, and you can further require it comes from a government account which matches the requesting organization. Thanks to governments being very gung ho about their financial surveillance infrastructure being a hard requirement for almost everything now.
rootusrootus 5y ago
> So your solution is to get rid of speedy emergency requests entirely? No? Anecdotally, from what we are reading today, a typical EDR response time is on the order of an hour. So while someone on my team is gathering the requested data, someone else is doing the verification. > Sounds like you’re just repeating the point that authenticating these requests is impossible, as that authentication would have to happen fast. If anything, I'm implying that if the government mandates that EDRs exist, they should have to back it up with someone to handle authentication. A phone number at the state level would do the trick. > And then you need to do this internationally. What will you do? First I'd have to be convinced why I should do this in every jurisdiction, why that jurisdiction would have access to customer data from other jurisdictions, etc. Sounds like you're saying the problem is that the government is mandating things and providing no rules about how it should work. That seems like such an un-government-like thing to do, they usually get weirdly specific.
- coospep 5y ago
  > So while someone on my team is gathering the requested data, someone else is doing the verification The whole point is that verification will take much longer than hours. > Sounds like you're saying the problem is that the government is mandating things and providing no rules about how it should work. That seems like such an un-government-like thing to do, they usually get weirdly specific. The government is very specific when it comes to what is required of you. The government is not very specific when it comes to what is required of the government.
  - logifail 5y ago
    > The whole point is that verification will take much longer than hours. How can it take longer than hours to reach the actual police department in $someSmallTown, USA ? $Deity forbid you actually happen to live in $someSmallTown and need the police in a hurry...
    - coospep 5y ago
      $someSmallTown might not even have a police department, how are you supposed to find out if the only one that comes up on the internet is fake?

by rosndo 5y ago

Forgeties79 5y ago

>So your solution is to get rid of speedy emergency requests entirely? Who said that?

coospep 5y ago
That’s the implication. A lengthy verification process makes speedy processing of requests impossible.
- Forgeties79 5y ago
  A fake subpoena is not a home invasion. It's not like seconds matter.
  - coospep 5y ago
    Until you get in trouble for not complying with a real one. Worst case scenario is probably a horrible PR disaster after a child dies because you couldn’t process a real request fast enough. And we’re not talking about seconds, but easily days or weeks.
    - Forgeties79 5y ago
      You think this is something someone can't figure out in a matter of weeks?
      - coospep 5y ago
        Forgeties79 5y ago
        >Sorry, but this isn’t your first comment demonstrating severe struggles with reading comprehension. This isn't reddit, you can't talk to people like that here. I'm not engaging this further. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
        coospep 5y ago
        dang 5y ago
        Would you please stop perpetuating flamewars on HN and also please stop using HN primarily for political/ideological battle? We ban accounts that do those things because they destroy what the site is supposed to be for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
        dang 5y ago
        We've banned this account for breaking the site guidelines. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. They're here: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
- throwawayboise 5y ago
  For some problems, there is no good solution.
  - coospep 5y ago
    That’s my point. The OP “riskable” claimed the opposite though.

novok 5y ago

Nope, but for cities to be prepared for such emergencies before hand by completing some basics of bureaucracy by being properly authenticated, much like you expect a city fire department to have some fire trucks purchased already instead of expecting to purchase one in seconds when they need one from the dealership 1000 miles away.

coospep 5y ago
Yeah, of course the federal government could legislate this problem away. Not gonna happen though. It is literally impossible for request recipients to solve this problem.
- rootusrootus 5y ago
  > It is literally impossible for request recipients to solve this problem. This I agree with. I'm trying to find the actual text of the law, I'm surprised the government isn't pretty specific about what constitutes a valid EDR, who can send them, etc. Bureaucrats love to write rules.
  - novok 5y ago
    From the article, I couldn't see what actually compelled the need to comply with an "EDR". From what I could see, they were not actual warrants or subpoenas that legally compelled performance, they were requests. They do it out of not wanting to have bad PR in case it was real, because the consequences for a screw up are pretty much nil. The end solution is either an authentication scheme, a $1000 rush processing fee that includes a verification process and the requirement to call it in (It is an emergency, isn't it? Emergencies do not happen often, so what is $1000 to an american organization funded by taxpayer dollars?) or E2E encryption that makes it they can't give data. Another thing about the $1000 fee, is you get to see the payment information about the account it comes from, and you can further require it comes from a government account which matches the requesting organization. Thanks to governments being very gung ho about their financial surveillance infrastructure being a hard requirement for almost everything now.

rootusrootus 5y ago

> So your solution is to get rid of speedy emergency requests entirely? No? Anecdotally, from what we are reading today, a typical EDR response time is on the order of an hour. So while someone on my team is gathering the requested data, someone else is doing the verification. > Sounds like you’re just repeating the point that authenticating these requests is impossible, as that authentication would have to happen fast. If anything, I'm implying that if the government mandates that EDRs exist, they should have to back it up with someone to handle authentication. A phone number at the state level would do the trick. > And then you need to do this internationally. What will you do? First I'd have to be convinced why I should do this in every jurisdiction, why that jurisdiction would have access to customer data from other jurisdictions, etc. Sounds like you're saying the problem is that the government is mandating things and providing no rules about how it should work. That seems like such an un-government-like thing to do, they usually get weirdly specific.

coospep 5y ago
> So while someone on my team is gathering the requested data, someone else is doing the verification The whole point is that verification will take much longer than hours. > Sounds like you're saying the problem is that the government is mandating things and providing no rules about how it should work. That seems like such an un-government-like thing to do, they usually get weirdly specific. The government is very specific when it comes to what is required of you. The government is not very specific when it comes to what is required of the government.
- logifail 5y ago
  > The whole point is that verification will take much longer than hours. How can it take longer than hours to reach the actual police department in $someSmallTown, USA ? $Deity forbid you actually happen to live in $someSmallTown and need the police in a hurry...
  - coospep 5y ago
    $someSmallTown might not even have a police department, how are you supposed to find out if the only one that comes up on the internet is fake?