19 ms·

Rsync.net warrant canary

239 points by losfair 4y ago

jaxn 4y ago
Go Grizzlies!
dvdplm 4y ago
If a government agency issues a secret warrant, doesn’t that imply rsync.net has to provide a valid canary at the right time as well? I don’t get how this is useful.
- dannyw 4y ago
  The Supreme Court has ruled that compelled speech (forcing someone to say something) is almost always a clear cut violation of the first amendment. There is no known case of US charging someone over a warrant canary. There have been plenty of warrant canaries that have ceased to be updated - e.g. Reddit, and more recently, Storj.
  - funOtter 4y ago
    Cases where compelled speech has been forced by the courts: 1. Forcing registered sex offenders to alert people in their neighborhood 2. Correcting misstatements
    - bombcar 4y ago
      For #1 you can do tons of things as condition for “early release” including warrantless searches so I suspect it’s related to that.
    - jkaplowitz 4y ago
      So not yet compelling a lie.
    - phpisthebest 4y ago
      Where in the US has number 1 been done? I am not aware of any places where the offender is required to alert people. Most commonly they need only to report to the local government/police who then may (and may be required) to publish that info. Often that is also often a condition of probation, meaning they are still under the authority of the courts and are still being "punished" by the system in leiu of prison. This is seen as the individual "giving up" some of their rights either by committing the offense or agreeing to the terms of probation instead of prison. This would also apply to #2. Neither one of those justification for infringement of the 1st amendment would apply in the cases of an NSL which are already on very very shaky legal ground and gag orders on them have been ruled constitutional in the past, currently they are only constitutional because a person getting an NSL now as the ability to appeal the NSL to a federal court, something that was previously missing
    - devman0 4y ago
      Forcing factual speech (such as disclosures, warnings, product information, truth-in-lending, etc) is a lot different than forcing someone to say something that isn't true.
    - YetAnotherNick 4y ago
      Could you refer the case?
    - tptacek 4y ago
      The better example here is warning labels. Presumably, part of the reasons warning labels are easily compelled by the government is that they involve commercial speech, which receives a lower degree of 1A scrutiny. But then, most warrant canaries fall into the same bucket; they're basically just an inverted warning label.
    - LarryMullins 4y ago
      Are there any known examples of the US Government legally being able to compel a lie?
      - Karellen 4y ago
        For people who have become involved with national security issues, aren't they often required to deny being involved with national security issues if asked? Would that count?
        LarryMullins 4y ago
        No I don't think it does. The paperwork they sign when they get their security clearances put those people in a special circumstance. American journalists, not having security clearances, are allowed to spill the beans on national secrets.
  - jcranmer 4y ago
    This is a colorable argument, but I think it's ultimately a pretty poor argument: First, freedom from compelled speech is not an inherently stronger (or weaker) freedom than freedom of speech. If the government can prevent you from saying something, then it can almost certainly prevent you from saying it by not not saying it. Second, national security is one of the most powerful legal trump cards in practice. The government saying that something is necessary for national security will be treated as fact by the court, no matter how much evidence there is to the contrary. Third, the purpose of freedom of speech is to protect freedom of expression. Speech that isn't expressive in nature has a much lower bar to clear for the government to be able to restrict it. Warrant canaries strike me as essentially commercial speech, which the government has pretty wide latitude to regulate.
    - phpisthebest 4y ago
      >>The government saying that something is necessary for national security will be treated as fact by the court, no matter how much evidence there is to the contrary. Citation please >> Speech that isn't expressive in nature has a much lower bar to clear for the government to be able to restrict it. Warrant canaries strike me as essentially commercial speech, which the government has pretty wide latitude to regulate. This case law around NSL have not been vary favorable for the government, Appeals courts have struck down the gag order provisions of the laws in the place, and are poised to do so again should a case come before them. The current make up the Supreme Court also leads me to believe they would not look favorably on Gag orders, though they would on the larger issue of National Security
      - tptacek 4y ago
        This is a circular argument. If the gag orders in question are struck, the canary doesn't do anything: you can just tell people you were served with the court order. But if the canary matters, that means we're dealing with a nondisclosure order that did, at least for the moment, survive strict scrutiny. Since there isn't a legal concept of "super strict scrutiny", that leaves the question of why people believe the canary will fare any better than the objection to the gag order.
  - tzs 4y ago
    That would apply (probably) if the government put you under a gag order and ordered you to keep updating your warrant canary. But what if they just put you under a gag order, and then when you stop updating the warrant canary they charge you with violating the gag order? Would that still fall under the compelled speech cases?
- mananaysiempre 4y ago
  Not a lawyer, but IIRC the theory was that generally speaking the bar for compelling you to lie is higher than that for compelling you to stay silent, even when those are equivalent information-theoretically. It’s not clear if the legal exploit of a warrant canary has ever been tested in court.
- ncallaway 4y ago
  I don’t think so. I think there’s a pretty significant legal difference between ordering someone not to say something, and ordering them to specifically publicly say something that’s false. The former has been tested and is (for some reason) within the bounds of the first amendment. While forcing someone to publicly say something false almost certainly is outside the bounds of the first amendment.
- jusssi 4y ago
  If they're brave enough, they'll render themselves unable to sign the canary with the key they previously used (by "accidently" destroying it), and accept whatever punishment is headed their way because of that.
  - javajosh 4y ago
    Assuming people take the canary seriously, this is an interesting case where deleting one file is equivalent to shutting down the company.
  - brookst 4y ago
    Switching from good faith legal dispute to bad faith technical argument and lying seems like a questionable strategy.
    - hgsgm 4y ago
      How is that bad faith? It's a technical enforcement of a commitment.
      - brookst 4y ago
        The implication was that they should intentionally destroy the key and falsely claim it was an accident. That is bad faith, and asking for trouble.
  - rsync 4y ago
    Let us please be clear: rsync.net is a real company. We have a board of directors. We have outside advisors and legal counsel. We have shareholders. Did we, in fact, create a poison pill provision in 2006 with regard to legal service, etc., ? Yes, we did. Will this be a wild west data caper with dramatic conclusions and brave, desperate actions ? No, it won't be. If there's one thing you should know about rsync.net it's that it's a very boring company. We're going to keep it that way.
- _Algernon_ 4y ago
  Can courts compel people to enter passwords? How is forcing a signature with a specific GPG key different? If worst comes to worst, say "Sorry bro, lost the key in a boating accident, nothing I can do".
aliqot 4y ago
Folks, keep your warrant canary short. 1 paragraph statement of intent, date, maybe a headline, signature. That's it.
- themulticaster 4y ago
  Do you suggest there is any security benefit of a short canary? Or is it just about keeping a canary simple and comprehensible even for non-technical users?
  - aliqot 4y ago
    If you'd like you may provide a rebuttal for whichever you feel strongest about
    - haswell 4y ago
      You haven't provided any argument to rebut, only an assertion. On the surface, there appears to be no actual canary-specific value to keeping the text short. If you have a specific reason you disagree, feel free to bring that argument forward.
- unsignednoop 4y ago
  If rsync devs cared about brevity then we might of had a decent syncing client
  - rgbrenner 4y ago
    rsync.net and rsync the open source project aren't related, afaik/afict. At the very least, no one at rsync.net has been the maintainer or original dev of rsync. Rsync either doesnt enforce their trademark, or rsync.net has an agreement with the project.
    - anecdotal1 4y ago
      They definitely are not related
eternalban 4y ago
I wonder about these bits of current news that is embedded in the signed message. Norway: https://imageio.forbes.com/specials-images/imageserve/60ce8f697bf2efc00def3ce0/S-shaped-curves-showing-EV-uptake-by-country--Norway-is-leading--US-is-lagging-/960x0.jpg https://imageio.forbes.com/specials-images/imageserve/60ce8f... (2021 - the Norway curve looks like it was headed to 80% but forecasters adjusted it to be in tandem with the other nations.) Tens of thousands view body of former Pope Benedict: https://www.theguardian.com/world/2020/aug/03/former-pope-benedict-xvi-reported-seriously-ill https://www.theguardian.com/world/2020/aug/03/former-pope-be... (2020) North Korea's Kim sacks No. 2 military official This one is funny. A bit more 'unpredictable' than having "NK's Kim launches missiles towards Sea of Japan" I suppose. So my q, specially given AI, is are these 'current news' bits really unpredictable? And if the message is signed anyway (and we hope the key is not compromised) what other purpose does this serve beyond key rotation issues (and they don't rotate these pub keys, right?) p.s. If these bits are supposed to be as unpredictable as possible, then we should note that any matter related to trends in industrial, technical, political, and major religious organizations (the Vatican) arenas are the bread and butter of security services of state actors. The current bits should be things that can neither be creations of state actors (i.e. sock puppets in 4chan starting a trend) nor matters that they by definition are laser focused (such as industrial output of near peers).
- rcxdude 4y ago
  They're sufficiently unpredictable, especially the exact phrasing (and the sport scores), that they offer pretty good proof that the message was signed recently. I suspect it's mostly to show that they have not been lazy and prepared all the messages well in advance (which if they did could conceivable weaken the scheme somewhat). But I agree it's probably a minimal improvement in the usefulness of the canary.
  - eternalban 4y ago
    Let's say a state actor needs a window of 1 week to do some mischief. Just a couple of days to comprise network x. Assume the exploit is worth knocking off a known person, or creating a news worthy event. I think these bits give a false sense of security.
giancarlostoro 4y ago
No updates since January 2nd, do they not update daily?
- ergonaught 4y ago
  "rsync.net will also make available, weekly, a "warrant canary" in the form of a cryptographically signed message containing the following:" ...
  - giancarlostoro 4y ago
    Gotcha I guess I missed that
deleted 4y ago
[deleted]
Amorymeltzer 4y ago
In 2006 this was, via Wikipedia[1], "[t]he first commercial use of a warrant canary," although it was proposed in 2002 on usenet.[2] 1: https://en.wikipedia.org/wiki/Warrant_canary#Usage https://en.wikipedia.org/wiki/Warrant_canary#Usage 2: https://web.archive.org/web/20131103121048/http:/groups.yahoo.com/neo/groups/cypherpunks-lne-archive/conversations/topics/5869 https://web.archive.org/web/20131103121048/http:/groups.yaho...
- ShamelessC 4y ago
  Short and informative, no citations needed, discusses interesting early internet lore... This is what a good hackernews comment looks like! edit: Yikes, remind me not to compliment people here. It boggles the mind how this could be seen as controversial. Did people assume sarcasm? I was being sincere. It is a good comment. double edit: back up to 0! Suppose I sounded a bit sarcastic.
  - HaZeust 4y ago
    The edit chains might be the rub of the downvotes, Shameless.
choeger 4y ago
I would argue that stopping to publish these statements is equivalent to announcing that some warrant has been served. So if the latter is a criminal offense, why should the former be legal?
- d_watt 4y ago
  Because compelling someone to actively do something is fundamentally different from restricting them from a future action, in the eyes of the law.
  - bitwize 4y ago
    What the Constitution says is not how the system actually works. The magic phrase "national security" means they can compel you to do as they please, and find you guilty without due process if you don't. Hell, the FBI is one of the largest CSAM distribution rings in the world, and they can simply "discover" CSAM on your computer if you don't knuckle under. Then you will be legit found guilty and morally discredited for the rest of your life. If the Feds really want to nail you -- to teach you a lesson and/or make an example out of you -- you're nailed.
    - orangepurple 4y ago
      They CP'd Paddock of Vegas
      - mcculley 4y ago
        You think they planted evidence? What makes you believe that?
        pc86 4y ago
        It's convenient for their particular brand of conspiracy theory.
        4y ago
pbhjpbhj 4y ago
So the law, presumably, says 'you can't tell people you've received a warrant' (or a national security letters?)? Surely this convoluted scheme is still telling people you've received a warrant?? Has there been caselaw on this?
- aliqot 4y ago
  Laws never said anything about what you stop saying, in this context.
  - smcl 4y ago
    I think courts often encounter people who have clever interpretations of laws, but who then get a bit of a rude awakening when their "Air Bud" style workaround gets slapped down when it meets a surly judge who has no time for their shit. Obviously not a lawyer, so I don't know whether this is one of these, whether it's something yet to be tested in court or whether Warrant Canaries are already accepted as valid.
    - aliqot 4y ago
      You must be referencing a court case where a modern warrant canary has ended with the perp in jail. Who might that be? You prefaced with "I think", but spoke with quite steadfast certainty, surely this piqued your interest for a reason.
      - smcl 4y ago
        No, nothing specifically related to Warrant Canaries but some law podcasts I listened to - ALAB and Mic Dicta for example - have referenced this phenomenon a few times. It's usually a tech bro or sovereign citizen with a novel interpretation of a law that ends up failing when they eventually have to try to argue their case it in court.
        brookst 4y ago
        Just because some legal strategies are batshit crazy sovcit nonsense doesn’t mean all legal strategies are. See: Apple vs FBI in San Bernardino.
lifeisstillgood 4y ago
What's the kings, wizards postscript about?
- garblegarble 4y ago
  They're scores from sports matches on that day, to show the statement was not signed prior to the listed date
  - upofadown 4y ago
    What is the specific attack addressed here? A secret cache of canaries generated before the destruction of the secret key material? If we can't trust rsync.net to not do that then how can we trust them to actually stop producing canaries after the gag order? Is it something to do with how they are produced?
    - to11mtm 4y ago
      > What is the specific attack addressed here? A secret cache of canaries generated before the destruction of the secret key material? It is to prevent 'pregenerated' message. Also increases the entropy of the message vs just a simple date change. > If we can't trust rsync.net to not do that then how can we trust them to actually stop producing canaries after the gag order? Elsewhere in thread it was discussed that, legally compelling someone NOT TO say something is somewhat easier than compelling them TO say something. As an interesting theory, if they were somehow 'compelled' by a court order to say they were OK for X weeks, they could just pregen the next X weeks without headlines, which would possibly be another way for the canary to squawk.
- rst 4y ago
  Headlines from the date of the canary; including them demonstrates that the canary was produced and signed on or after the date indicated, not before. See "notes" at the bottom.
  - Y_Y 4y ago
neilv 4y ago
I'd actually prefer people not do warrant canaries, and instead do conscientious periodic compliance reporting. Although a warrant canary sometimes suggests a very principled party (e.g., I first heard of public librarians doing it, decades ago), at the same time, it seems probably counterproductive. For one example, as a customer of a service provider, I want them to be stable -- not potentially antagonizing those who could shut them down, nor getting involved in what (to me) seem like ambiguous technicalities over what they can and can't do. For another example, imagine you run a service in which you've committed to a warrant canary. But one day a warrant comes, and you realize it's gravely important for the canary not to die and tip off some genocidal warlord you didn't realize was a customer. Now you're violating the canary assurance to your other customers, which is an assurance that you should've anticipated you couldn't give. Alternative: Some of the modern compliance reporting by tech companies, about warrants/censorship/etc. seems less likely to cause showstopper problems, can convey more info, and is ongoing rather than single-shot. Of course there will be warrants and other compliances, for various jurisdictions, and conscientious periodic reporting seems to help with civic checks&balances. (BTW, I really like the idea of rsync.net and its hard-working founder, have pointed new customers to them, and have a TODO to move some stuff to them myself. The only proviso I've mentioned to people thus far is that there's an unclear bus factor.)
- SQueeeeeL 4y ago
  >I'd actually prefer people not do warrant canaries, and instead do conscientious periodic compliance reporting. The whole point of warrant canaries is that you can literally be compelled to silence under US law when dealing with intelligence organizations. It is impossible to state "The FBI has requested our data, all our users reporting on police brutality might wanna get off our platform" It might be legal to state "The FBI has never asked for our data", it might not, this hasn't been tested in court. They're not being hostile towards them, the CIA has literally arranged for multiple individuals to be assassinated, they should freak you out lol
  - brookst 4y ago
    Lots of companies report aggregate statistics[0]. I believe that’s what parent was advocating. 0. https://www.documentcloud.org/documents/21046081-google-geofence-warrants https://www.documentcloud.org/documents/21046081-google-geof...
goshinda 4y ago
What if rsync.net are lying, and the only purpose of the warrant canary is to provide a false sense of trust? Be skeptical. This is almost certainly just a marketing ploy so potential customers feel like their data is safe and secure.
- ISL 4y ago
  If they are lying, the warrant canary opens them up to a substantial lawsuit.
  - hgsgm 4y ago
    Doubtful. Have you seen any precedent?
- zymhan 4y ago
  [flagged]
- karaterobot 4y ago
  You're being downvoted, but I don't know why: If a warrant canary is removed, that may be a sign that the authorities are asking for your data. But, just because it hasn't been removed, that doesn't mean your data is safe. Perfectly reasonable position to take. Cynical, but cynicism is congruent with the whole concept of a warrant canary. Imagine, a company lying about protecting your data!
jakobdabo 4y ago
I think this kind of warrant canary doesn't bring much value. It takes only one warrant to make this document historical. And then what? I wish every account had its own warrant canary.
- coffeeblack 4y ago
  Or they could host in a country where “secret warrants” don’t exist.
- staindk 4y ago
  I thought Reddit had a page with a bunch of canaries (pictures of canaries) on it, and their idea was to remove one at a time. Can't find that now so it must have been some other service. I think an elegant way for rsync to handle this would be to just move the page from ".../canary.txt" to ".../canary-2.txt". Sends the message that the first canary is dead, but leaves a second one up for the next warrant.
merpnderp 4y ago
Couldn’t a judge issue a warrant to take control of the keys needed to update the warrant thus sidestepping the first amendment prohibition on compelled speech? Everyone would think it is Rsync updating the canary, but it would be law enforcement.
- WirelessGigabit 4y ago
  Yes. That's the last paragraph.
- tobylane 4y ago
  How would the judge’s order update the website?
llimos 4y ago
Is there a dashboard from some neutral third-party validating that everybody's current warrant canary is in fact valid? Who would spot it if it either a) stopped being updated b) had an invalid signature, or c) the headlines were not current?
- greyface- 4y ago
  The EFF and Calyx Institute used to run https://canarywatch.org/ https://canarywatch.org/ for this, but shut it down at some point. AFAIK there's no such site now.
- rsync 4y ago
  EFF used to run a "Canary Watch"[1] website which is now defunct. In fact, EFF even held a "Canary Summit" at NYU in 2014 which I was invited to. It was only held that one year, however, and once Apple and other large firms discontinued their canaries all of the steam was seemingly lost ... [1] https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-later https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-...
tptacek 4y ago
The weird thing to me about this canary document and others like it is that they cover all warrants, not just NSLs. Warrant canaries were a reaction to the NSL process, which is invariably (and, I guess, permanently?) gagged, and was seen as exceptional and in some sense extra-judicial. It would be newsworthy for a service to be NSL'd, and further evidence of dragnet surveillance programs sweeping up Americans. Ordinary search warrants and disclosure demands occur, presumably, all the time; they're issued by courts in individual felony cases, such as for drug conspiracies, child pornography, and white collar criminal conspiracies. Serious crime happens all the time; it's not really all that newsworthy for a warrant to issue in, like, an insider trading case. So, what does it tell us if this particular canary document was taken down? Perhaps the DOJ is working with the intelligence community to dragnet the service, or establish a durable norm of being able to transactionally extract records that will amount to the same thing as a dragnet. Or, maybe, just some random state court judge in Oklahoma decided it was likely that somebody's meth distribution business kept records in that service. One of those is interesting, the other not. Why not just have more than one canary if you're going to do it this way? It's been this way for a long time, and I'm just now having this thought, so it's equally likely that my take here is just faulty; if so, let me know.
- twiss 4y ago
  Since the main purpose of the warrant canary is to be able to inform the public of being served one if they are gagged, I indeed think non-gagging warrants aren't super relevant for them, but it also doesn't matter much that they are included: the next warrant canary can simply say "we got a routine warrant, asking for X information; no other warrants have been served". Whether that is then interesting or not is up to the public to decide. In fact, if they didn't inform the public of regular warrants, only (indirectly, via the warrant canary) when they were gagged, it might incentivize the government to only serve regular warrants instead of NSLs, which surely isn't the intention. If regular warrants happen often, I guess they could make a separate mechanism to inform the public about them, but I guess it doesn't, so far? In any case, if they aren't gagging, they wouldn't need a canary to inform the public about them.
  - 4y ago
jwr 4y ago
I've always wondered whether this has any chance of holding up in court. I know it depends on jurisdiction, but at least in my region (EU/Poland), courts consider intent rather than a literal interpretation of laws. You can try to be oh-so-smart and implement a "canary" that doesn't get updated if you get a warrant, but the court would consider not updating the canary as the same thing as notifying people that a warrant has been served.
- _8j50 4y ago
  This whole thing I believe was a result of litigation with USGOV. Can the government entirely censor people acting onbehalf of a company from saying something? The answer was something like "It can prevent you from stating specific details but it cannot prevent you from making general statements on whether you have received a warrant or force speech by preventing you from taking down the canary" they even came up with a spefific granularity that you can state regarding the number of warrants you received. But if I was the gov, I would go to your webhost or colo provider first, the gag order would prevent them from telling the subject like rsync.net and the search warrant would allow access to read and tamper with code and data. This is why GPG signing is great, private keys won't be on devices you don't physically control if you do it right. And also why you shouldn't trust native encryption of cloud providers like iCloud where ultimately you are not managing the private key directly.
- LarryMullins 4y ago
  About a century ago in the UK, the Automotive Association (AA) did a similar thing. Lots of towns were setting up speed traps to catch speeding motorists, with very low speed limits, so the AA paid uniformed boys on bicycles to find the speed traps and flag down motorists to warn them before they reached the speed trap. This practice was legally challenged as obstructing the police, so the AA inverted the scheme. They instead paid boys on bicycles to salute motorists by default, except when there was a speed trap. If you saw the uniformed AA boy standing by the side of the road and he wasn't saluting you, you knew there was something wrong ahead. The idea was that the law might be able to ban saluting to warn motorists of the police, but the law couldn't ban not saluting to warn motorists. The law couldn't compel a salute. Evidently this worked, because the AA kept up the practice for a few more decades, before eventually discontinuing the practice in the 60s.
prirun 4y ago
I don't understand the value of a warrant canary: if it goes away or is not updated, what is the suggested action of users of the service? Is everyone supposed to leave? Because that ain't gonna happen, fortunately for the service. The bottom line to me is, encrypt your data before it leaves your control, and cross your fingers that whatever tool you used did it correctly. If the government wants to see which sites you are connecting to, it's easy enough for them to just ask Spectrum, Comcast, etc. So IMO, warrant canaries are useless.
- heretoo 4y ago
  What if the warrant canary is from the developers of the encryption software? See truecrypt -- assuming it was actually a warrant canary. Where "cross your fingers" is equivalent to the "warrant canary has not been revoked" when encryption is involved.
  - prirun 4y ago
    > What if the warrant canary is from the developers of the encryption software? That seems useful. Thanks!
- zamadatix 4y ago
  None of these points really explain why a warrant canary can't have value it just explains why you in particular don't find value in it which isn't necessarily supposed to be surprising. Why is every user of a service supposed to care about something for it to have value in the service? Why is everyone supposed to agree on what level of connectivity obfuscation makes them feel comfortable? Why can't someone find value in simply knowing the government isn't monitoring how they use services without notice? If it has no impact on monitoring ability why would the government bother getting a warrant in the first place? Why can't someone be interested in knowing how pervasive invisible warrant requests are? Why should everyone equally be comfortable with just encrypting and calling it a day? Even though I don't really have any direct utility from a warrant canary (e.g. Reddit's warrant canary went away ~7 years ago and it didn't trigger any direct consequences with me using Reddit) I still find them useful and, knowing how relatively lax I am about privacy/security compared to many, I have no doubts many find direct use of them. For some other specific companies/services/projects though I could even see a warrant canary possibly having high direct value.
dang 4y ago
Related: The rsync.net Warrant Canary is now 15 years old - https://news.ycombinator.com/item?id=26960204 https://news.ycombinator.com/item?id=26960204 - April 2021 (13 comments) Rsync.net Warrant Canary (2006) - https://news.ycombinator.com/item?id=5899197 https://news.ycombinator.com/item?id=5899197 - June 2013 (50 comments) Rsync.net Warrant Canary - https://news.ycombinator.com/item?id=5837351 https://news.ycombinator.com/item?id=5837351 - June 2013 (1 comment) Show HN: The rsync.net Warrant Canary - https://news.ycombinator.com/item?id=4834362 https://news.ycombinator.com/item?id=4834362 - Nov 2012 (1 comment) Rsync.net Warrant Canary - https://news.ycombinator.com/item?id=702247 https://news.ycombinator.com/item?id=702247 - July 2009 (46 comments)
Nifty3929 4y ago
Warrant canaries do not work, because they violate the spirit and law of what a gag or secret warrant means. No court would allow rsync to alert users this way without considering that a breach of the gag, just as if they said “hey we got a secret search warrant today.”
- dvh 4y ago
  Rsync will destroy key and nobody would be able to update canary. No new canary means canary is dead.
  - AndrewDucker 4y ago
    And then people will go to jail.

239 points by losfair 4y ago

jaxn 4y ago

Go Grizzlies!

If a government agency issues a secret warrant, doesn’t that imply rsync.net has to provide a valid canary at the right time as well? I don’t get how this is useful.

dannyw 4y ago
The Supreme Court has ruled that compelled speech (forcing someone to say something) is almost always a clear cut violation of the first amendment. There is no known case of US charging someone over a warrant canary. There have been plenty of warrant canaries that have ceased to be updated - e.g. Reddit, and more recently, Storj.
- funOtter 4y ago
  Cases where compelled speech has been forced by the courts: 1. Forcing registered sex offenders to alert people in their neighborhood 2. Correcting misstatements
  - bombcar 4y ago
    For #1 you can do tons of things as condition for “early release” including warrantless searches so I suspect it’s related to that.
  - jkaplowitz 4y ago
    So not yet compelling a lie.
  - phpisthebest 4y ago
    Where in the US has number 1 been done? I am not aware of any places where the offender is required to alert people. Most commonly they need only to report to the local government/police who then may (and may be required) to publish that info. Often that is also often a condition of probation, meaning they are still under the authority of the courts and are still being "punished" by the system in leiu of prison. This is seen as the individual "giving up" some of their rights either by committing the offense or agreeing to the terms of probation instead of prison. This would also apply to #2. Neither one of those justification for infringement of the 1st amendment would apply in the cases of an NSL which are already on very very shaky legal ground and gag orders on them have been ruled constitutional in the past, currently they are only constitutional because a person getting an NSL now as the ability to appeal the NSL to a federal court, something that was previously missing
  - devman0 4y ago
    Forcing factual speech (such as disclosures, warnings, product information, truth-in-lending, etc) is a lot different than forcing someone to say something that isn't true.
  - YetAnotherNick 4y ago
    Could you refer the case?
  - tptacek 4y ago
    The better example here is warning labels. Presumably, part of the reasons warning labels are easily compelled by the government is that they involve commercial speech, which receives a lower degree of 1A scrutiny. But then, most warrant canaries fall into the same bucket; they're basically just an inverted warning label.
  - LarryMullins 4y ago
    Are there any known examples of the US Government legally being able to compel a lie?
    - Karellen 4y ago
      For people who have become involved with national security issues, aren't they often required to deny being involved with national security issues if asked? Would that count?
      - LarryMullins 4y ago
        No I don't think it does. The paperwork they sign when they get their security clearances put those people in a special circumstance. American journalists, not having security clearances, are allowed to spill the beans on national secrets.
- jcranmer 4y ago
  This is a colorable argument, but I think it's ultimately a pretty poor argument: First, freedom from compelled speech is not an inherently stronger (or weaker) freedom than freedom of speech. If the government can prevent you from saying something, then it can almost certainly prevent you from saying it by not not saying it. Second, national security is one of the most powerful legal trump cards in practice. The government saying that something is necessary for national security will be treated as fact by the court, no matter how much evidence there is to the contrary. Third, the purpose of freedom of speech is to protect freedom of expression. Speech that isn't expressive in nature has a much lower bar to clear for the government to be able to restrict it. Warrant canaries strike me as essentially commercial speech, which the government has pretty wide latitude to regulate.
  - phpisthebest 4y ago
    >>The government saying that something is necessary for national security will be treated as fact by the court, no matter how much evidence there is to the contrary. Citation please >> Speech that isn't expressive in nature has a much lower bar to clear for the government to be able to restrict it. Warrant canaries strike me as essentially commercial speech, which the government has pretty wide latitude to regulate. This case law around NSL have not been vary favorable for the government, Appeals courts have struck down the gag order provisions of the laws in the place, and are poised to do so again should a case come before them. The current make up the Supreme Court also leads me to believe they would not look favorably on Gag orders, though they would on the larger issue of National Security
    - tptacek 4y ago
      This is a circular argument. If the gag orders in question are struck, the canary doesn't do anything: you can just tell people you were served with the court order. But if the canary matters, that means we're dealing with a nondisclosure order that did, at least for the moment, survive strict scrutiny. Since there isn't a legal concept of "super strict scrutiny", that leaves the question of why people believe the canary will fare any better than the objection to the gag order.
- tzs 4y ago
  That would apply (probably) if the government put you under a gag order and ordered you to keep updating your warrant canary. But what if they just put you under a gag order, and then when you stop updating the warrant canary they charge you with violating the gag order? Would that still fall under the compelled speech cases?
mananaysiempre 4y ago
Not a lawyer, but IIRC the theory was that generally speaking the bar for compelling you to lie is higher than that for compelling you to stay silent, even when those are equivalent information-theoretically. It’s not clear if the legal exploit of a warrant canary has ever been tested in court.
ncallaway 4y ago
I don’t think so. I think there’s a pretty significant legal difference between ordering someone not to say something, and ordering them to specifically publicly say something that’s false. The former has been tested and is (for some reason) within the bounds of the first amendment. While forcing someone to publicly say something false almost certainly is outside the bounds of the first amendment.
jusssi 4y ago
If they're brave enough, they'll render themselves unable to sign the canary with the key they previously used (by "accidently" destroying it), and accept whatever punishment is headed their way because of that.
- javajosh 4y ago
  Assuming people take the canary seriously, this is an interesting case where deleting one file is equivalent to shutting down the company.
- brookst 4y ago
  Switching from good faith legal dispute to bad faith technical argument and lying seems like a questionable strategy.
  - hgsgm 4y ago
    How is that bad faith? It's a technical enforcement of a commitment.
    - brookst 4y ago
      The implication was that they should intentionally destroy the key and falsely claim it was an accident. That is bad faith, and asking for trouble.
- rsync 4y ago
  Let us please be clear: rsync.net is a real company. We have a board of directors. We have outside advisors and legal counsel. We have shareholders. Did we, in fact, create a poison pill provision in 2006 with regard to legal service, etc., ? Yes, we did. Will this be a wild west data caper with dramatic conclusions and brave, desperate actions ? No, it won't be. If there's one thing you should know about rsync.net it's that it's a very boring company. We're going to keep it that way.
_Algernon_ 4y ago
Can courts compel people to enter passwords? How is forcing a signature with a specific GPG key different? If worst comes to worst, say "Sorry bro, lost the key in a boating accident, nothing I can do".

aliqot 4y ago

Folks, keep your warrant canary short. 1 paragraph statement of intent, date, maybe a headline, signature. That's it.

themulticaster 4y ago
Do you suggest there is any security benefit of a short canary? Or is it just about keeping a canary simple and comprehensible even for non-technical users?
- aliqot 4y ago
  If you'd like you may provide a rebuttal for whichever you feel strongest about
  - haswell 4y ago
    You haven't provided any argument to rebut, only an assertion. On the surface, there appears to be no actual canary-specific value to keeping the text short. If you have a specific reason you disagree, feel free to bring that argument forward.
unsignednoop 4y ago
If rsync devs cared about brevity then we might of had a decent syncing client
- rgbrenner 4y ago
  rsync.net and rsync the open source project aren't related, afaik/afict. At the very least, no one at rsync.net has been the maintainer or original dev of rsync. Rsync either doesnt enforce their trademark, or rsync.net has an agreement with the project.
  - anecdotal1 4y ago
    They definitely are not related

eternalban 4y ago

I wonder about these bits of current news that is embedded in the signed message. Norway: https://imageio.forbes.com/specials-images/imageserve/60ce8f697bf2efc00def3ce0/S-shaped-curves-showing-EV-uptake-by-country--Norway-is-leading--US-is-lagging-/960x0.jpg https://imageio.forbes.com/specials-images/imageserve/60ce8f... (2021 - the Norway curve looks like it was headed to 80% but forecasters adjusted it to be in tandem with the other nations.) Tens of thousands view body of former Pope Benedict: https://www.theguardian.com/world/2020/aug/03/former-pope-benedict-xvi-reported-seriously-ill https://www.theguardian.com/world/2020/aug/03/former-pope-be... (2020) North Korea's Kim sacks No. 2 military official This one is funny. A bit more 'unpredictable' than having "NK's Kim launches missiles towards Sea of Japan" I suppose. So my q, specially given AI, is are these 'current news' bits really unpredictable? And if the message is signed anyway (and we hope the key is not compromised) what other purpose does this serve beyond key rotation issues (and they don't rotate these pub keys, right?) p.s. If these bits are supposed to be as unpredictable as possible, then we should note that any matter related to trends in industrial, technical, political, and major religious organizations (the Vatican) arenas are the bread and butter of security services of state actors. The current bits should be things that can neither be creations of state actors (i.e. sock puppets in 4chan starting a trend) nor matters that they by definition are laser focused (such as industrial output of near peers).

rcxdude 4y ago
They're sufficiently unpredictable, especially the exact phrasing (and the sport scores), that they offer pretty good proof that the message was signed recently. I suspect it's mostly to show that they have not been lazy and prepared all the messages well in advance (which if they did could conceivable weaken the scheme somewhat). But I agree it's probably a minimal improvement in the usefulness of the canary.
- eternalban 4y ago
  Let's say a state actor needs a window of 1 week to do some mischief. Just a couple of days to comprise network x. Assume the exploit is worth knocking off a known person, or creating a news worthy event. I think these bits give a false sense of security.

giancarlostoro 4y ago

No updates since January 2nd, do they not update daily?

ergonaught 4y ago
"rsync.net will also make available, weekly, a "warrant canary" in the form of a cryptographically signed message containing the following:" ...
- giancarlostoro 4y ago
  Gotcha I guess I missed that

deleted 4y ago

[deleted]

Amorymeltzer 4y ago

In 2006 this was, via Wikipedia[1], "[t]he first commercial use of a warrant canary," although it was proposed in 2002 on usenet.[2] 1: https://en.wikipedia.org/wiki/Warrant_canary#Usage https://en.wikipedia.org/wiki/Warrant_canary#Usage 2: https://web.archive.org/web/20131103121048/http:/groups.yahoo.com/neo/groups/cypherpunks-lne-archive/conversations/topics/5869 https://web.archive.org/web/20131103121048/http:/groups.yaho...

ShamelessC 4y ago
Short and informative, no citations needed, discusses interesting early internet lore... This is what a good hackernews comment looks like! edit: Yikes, remind me not to compliment people here. It boggles the mind how this could be seen as controversial. Did people assume sarcasm? I was being sincere. It is a good comment. double edit: back up to 0! Suppose I sounded a bit sarcastic.
- HaZeust 4y ago
  The edit chains might be the rub of the downvotes, Shameless.

choeger 4y ago

I would argue that stopping to publish these statements is equivalent to announcing that some warrant has been served. So if the latter is a criminal offense, why should the former be legal?

d_watt 4y ago
Because compelling someone to actively do something is fundamentally different from restricting them from a future action, in the eyes of the law.
- bitwize 4y ago
  What the Constitution says is not how the system actually works. The magic phrase "national security" means they can compel you to do as they please, and find you guilty without due process if you don't. Hell, the FBI is one of the largest CSAM distribution rings in the world, and they can simply "discover" CSAM on your computer if you don't knuckle under. Then you will be legit found guilty and morally discredited for the rest of your life. If the Feds really want to nail you -- to teach you a lesson and/or make an example out of you -- you're nailed.
  - orangepurple 4y ago
    They CP'd Paddock of Vegas
    - mcculley 4y ago
      You think they planted evidence? What makes you believe that?
      - pc86 4y ago
        It's convenient for their particular brand of conspiracy theory.
        4y ago

pbhjpbhj 4y ago

So the law, presumably, says 'you can't tell people you've received a warrant' (or a national security letters?)? Surely this convoluted scheme is still telling people you've received a warrant?? Has there been caselaw on this?

aliqot 4y ago
Laws never said anything about what you stop saying, in this context.
- smcl 4y ago
  I think courts often encounter people who have clever interpretations of laws, but who then get a bit of a rude awakening when their "Air Bud" style workaround gets slapped down when it meets a surly judge who has no time for their shit. Obviously not a lawyer, so I don't know whether this is one of these, whether it's something yet to be tested in court or whether Warrant Canaries are already accepted as valid.
  - aliqot 4y ago
    You must be referencing a court case where a modern warrant canary has ended with the perp in jail. Who might that be? You prefaced with "I think", but spoke with quite steadfast certainty, surely this piqued your interest for a reason.
    - smcl 4y ago
      No, nothing specifically related to Warrant Canaries but some law podcasts I listened to - ALAB and Mic Dicta for example - have referenced this phenomenon a few times. It's usually a tech bro or sovereign citizen with a novel interpretation of a law that ends up failing when they eventually have to try to argue their case it in court.
      - brookst 4y ago
        Just because some legal strategies are batshit crazy sovcit nonsense doesn’t mean all legal strategies are. See: Apple vs FBI in San Bernardino.

lifeisstillgood 4y ago

What's the kings, wizards postscript about?

garblegarble 4y ago
They're scores from sports matches on that day, to show the statement was not signed prior to the listed date
- upofadown 4y ago
  What is the specific attack addressed here? A secret cache of canaries generated before the destruction of the secret key material? If we can't trust rsync.net to not do that then how can we trust them to actually stop producing canaries after the gag order? Is it something to do with how they are produced?
  - to11mtm 4y ago
    > What is the specific attack addressed here? A secret cache of canaries generated before the destruction of the secret key material? It is to prevent 'pregenerated' message. Also increases the entropy of the message vs just a simple date change. > If we can't trust rsync.net to not do that then how can we trust them to actually stop producing canaries after the gag order? Elsewhere in thread it was discussed that, legally compelling someone NOT TO say something is somewhat easier than compelling them TO say something. As an interesting theory, if they were somehow 'compelled' by a court order to say they were OK for X weeks, they could just pregen the next X weeks without headlines, which would possibly be another way for the canary to squawk.
rst 4y ago
Headlines from the date of the canary; including them demonstrates that the canary was produced and signed on or after the date indicated, not before. See "notes" at the bottom.
- Y_Y 4y ago

neilv 4y ago

I'd actually prefer people not do warrant canaries, and instead do conscientious periodic compliance reporting. Although a warrant canary sometimes suggests a very principled party (e.g., I first heard of public librarians doing it, decades ago), at the same time, it seems probably counterproductive. For one example, as a customer of a service provider, I want them to be stable -- not potentially antagonizing those who could shut them down, nor getting involved in what (to me) seem like ambiguous technicalities over what they can and can't do. For another example, imagine you run a service in which you've committed to a warrant canary. But one day a warrant comes, and you realize it's gravely important for the canary not to die and tip off some genocidal warlord you didn't realize was a customer. Now you're violating the canary assurance to your other customers, which is an assurance that you should've anticipated you couldn't give. Alternative: Some of the modern compliance reporting by tech companies, about warrants/censorship/etc. seems less likely to cause showstopper problems, can convey more info, and is ongoing rather than single-shot. Of course there will be warrants and other compliances, for various jurisdictions, and conscientious periodic reporting seems to help with civic checks&balances. (BTW, I really like the idea of rsync.net and its hard-working founder, have pointed new customers to them, and have a TODO to move some stuff to them myself. The only proviso I've mentioned to people thus far is that there's an unclear bus factor.)

SQueeeeeL 4y ago
>I'd actually prefer people not do warrant canaries, and instead do conscientious periodic compliance reporting. The whole point of warrant canaries is that you can literally be compelled to silence under US law when dealing with intelligence organizations. It is impossible to state "The FBI has requested our data, all our users reporting on police brutality might wanna get off our platform" It might be legal to state "The FBI has never asked for our data", it might not, this hasn't been tested in court. They're not being hostile towards them, the CIA has literally arranged for multiple individuals to be assassinated, they should freak you out lol
- brookst 4y ago
  Lots of companies report aggregate statistics[0]. I believe that’s what parent was advocating. 0. https://www.documentcloud.org/documents/21046081-google-geofence-warrants https://www.documentcloud.org/documents/21046081-google-geof...

goshinda 4y ago

What if rsync.net are lying, and the only purpose of the warrant canary is to provide a false sense of trust? Be skeptical. This is almost certainly just a marketing ploy so potential customers feel like their data is safe and secure.

ISL 4y ago
If they are lying, the warrant canary opens them up to a substantial lawsuit.
- hgsgm 4y ago
  Doubtful. Have you seen any precedent?
zymhan 4y ago
[flagged]
karaterobot 4y ago
You're being downvoted, but I don't know why: If a warrant canary is removed, that may be a sign that the authorities are asking for your data. But, just because it hasn't been removed, that doesn't mean your data is safe. Perfectly reasonable position to take. Cynical, but cynicism is congruent with the whole concept of a warrant canary. Imagine, a company lying about protecting your data!

jakobdabo 4y ago

I think this kind of warrant canary doesn't bring much value. It takes only one warrant to make this document historical. And then what? I wish every account had its own warrant canary.

coffeeblack 4y ago
Or they could host in a country where “secret warrants” don’t exist.
staindk 4y ago
I thought Reddit had a page with a bunch of canaries (pictures of canaries) on it, and their idea was to remove one at a time. Can't find that now so it must have been some other service. I think an elegant way for rsync to handle this would be to just move the page from ".../canary.txt" to ".../canary-2.txt". Sends the message that the first canary is dead, but leaves a second one up for the next warrant.

merpnderp 4y ago

Couldn’t a judge issue a warrant to take control of the keys needed to update the warrant thus sidestepping the first amendment prohibition on compelled speech? Everyone would think it is Rsync updating the canary, but it would be law enforcement.

WirelessGigabit 4y ago
Yes. That's the last paragraph.
tobylane 4y ago
How would the judge’s order update the website?

llimos 4y ago

Is there a dashboard from some neutral third-party validating that everybody's current warrant canary is in fact valid? Who would spot it if it either a) stopped being updated b) had an invalid signature, or c) the headlines were not current?

greyface- 4y ago
The EFF and Calyx Institute used to run https://canarywatch.org/ https://canarywatch.org/ for this, but shut it down at some point. AFAIK there's no such site now.
rsync 4y ago
EFF used to run a "Canary Watch"[1] website which is now defunct. In fact, EFF even held a "Canary Summit" at NYU in 2014 which I was invited to. It was only held that one year, however, and once Apple and other large firms discontinued their canaries all of the steam was seemingly lost ... [1] https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-later https://www.eff.org/deeplinks/2016/05/canary-watch-one-year-...

tptacek 4y ago

The weird thing to me about this canary document and others like it is that they cover all warrants, not just NSLs. Warrant canaries were a reaction to the NSL process, which is invariably (and, I guess, permanently?) gagged, and was seen as exceptional and in some sense extra-judicial. It would be newsworthy for a service to be NSL'd, and further evidence of dragnet surveillance programs sweeping up Americans. Ordinary search warrants and disclosure demands occur, presumably, all the time; they're issued by courts in individual felony cases, such as for drug conspiracies, child pornography, and white collar criminal conspiracies. Serious crime happens all the time; it's not really all that newsworthy for a warrant to issue in, like, an insider trading case. So, what does it tell us if this particular canary document was taken down? Perhaps the DOJ is working with the intelligence community to dragnet the service, or establish a durable norm of being able to transactionally extract records that will amount to the same thing as a dragnet. Or, maybe, just some random state court judge in Oklahoma decided it was likely that somebody's meth distribution business kept records in that service. One of those is interesting, the other not. Why not just have more than one canary if you're going to do it this way? It's been this way for a long time, and I'm just now having this thought, so it's equally likely that my take here is just faulty; if so, let me know.

twiss 4y ago
Since the main purpose of the warrant canary is to be able to inform the public of being served one if they are gagged, I indeed think non-gagging warrants aren't super relevant for them, but it also doesn't matter much that they are included: the next warrant canary can simply say "we got a routine warrant, asking for X information; no other warrants have been served". Whether that is then interesting or not is up to the public to decide. In fact, if they didn't inform the public of regular warrants, only (indirectly, via the warrant canary) when they were gagged, it might incentivize the government to only serve regular warrants instead of NSLs, which surely isn't the intention. If regular warrants happen often, I guess they could make a separate mechanism to inform the public about them, but I guess it doesn't, so far? In any case, if they aren't gagging, they wouldn't need a canary to inform the public about them.
- 4y ago

jwr 4y ago

I've always wondered whether this has any chance of holding up in court. I know it depends on jurisdiction, but at least in my region (EU/Poland), courts consider intent rather than a literal interpretation of laws. You can try to be oh-so-smart and implement a "canary" that doesn't get updated if you get a warrant, but the court would consider not updating the canary as the same thing as notifying people that a warrant has been served.

_8j50 4y ago
This whole thing I believe was a result of litigation with USGOV. Can the government entirely censor people acting onbehalf of a company from saying something? The answer was something like "It can prevent you from stating specific details but it cannot prevent you from making general statements on whether you have received a warrant or force speech by preventing you from taking down the canary" they even came up with a spefific granularity that you can state regarding the number of warrants you received. But if I was the gov, I would go to your webhost or colo provider first, the gag order would prevent them from telling the subject like rsync.net and the search warrant would allow access to read and tamper with code and data. This is why GPG signing is great, private keys won't be on devices you don't physically control if you do it right. And also why you shouldn't trust native encryption of cloud providers like iCloud where ultimately you are not managing the private key directly.
LarryMullins 4y ago
About a century ago in the UK, the Automotive Association (AA) did a similar thing. Lots of towns were setting up speed traps to catch speeding motorists, with very low speed limits, so the AA paid uniformed boys on bicycles to find the speed traps and flag down motorists to warn them before they reached the speed trap. This practice was legally challenged as obstructing the police, so the AA inverted the scheme. They instead paid boys on bicycles to salute motorists by default, except when there was a speed trap. If you saw the uniformed AA boy standing by the side of the road and he wasn't saluting you, you knew there was something wrong ahead. The idea was that the law might be able to ban saluting to warn motorists of the police, but the law couldn't ban not saluting to warn motorists. The law couldn't compel a salute. Evidently this worked, because the AA kept up the practice for a few more decades, before eventually discontinuing the practice in the 60s.

prirun 4y ago

I don't understand the value of a warrant canary: if it goes away or is not updated, what is the suggested action of users of the service? Is everyone supposed to leave? Because that ain't gonna happen, fortunately for the service. The bottom line to me is, encrypt your data before it leaves your control, and cross your fingers that whatever tool you used did it correctly. If the government wants to see which sites you are connecting to, it's easy enough for them to just ask Spectrum, Comcast, etc. So IMO, warrant canaries are useless.

heretoo 4y ago
What if the warrant canary is from the developers of the encryption software? See truecrypt -- assuming it was actually a warrant canary. Where "cross your fingers" is equivalent to the "warrant canary has not been revoked" when encryption is involved.
- prirun 4y ago
  > What if the warrant canary is from the developers of the encryption software? That seems useful. Thanks!
zamadatix 4y ago
None of these points really explain why a warrant canary can't have value it just explains why you in particular don't find value in it which isn't necessarily supposed to be surprising. Why is every user of a service supposed to care about something for it to have value in the service? Why is everyone supposed to agree on what level of connectivity obfuscation makes them feel comfortable? Why can't someone find value in simply knowing the government isn't monitoring how they use services without notice? If it has no impact on monitoring ability why would the government bother getting a warrant in the first place? Why can't someone be interested in knowing how pervasive invisible warrant requests are? Why should everyone equally be comfortable with just encrypting and calling it a day? Even though I don't really have any direct utility from a warrant canary (e.g. Reddit's warrant canary went away ~7 years ago and it didn't trigger any direct consequences with me using Reddit) I still find them useful and, knowing how relatively lax I am about privacy/security compared to many, I have no doubts many find direct use of them. For some other specific companies/services/projects though I could even see a warrant canary possibly having high direct value.

dang 4y ago

Related: The rsync.net Warrant Canary is now 15 years old - https://news.ycombinator.com/item?id=26960204 https://news.ycombinator.com/item?id=26960204 - April 2021 (13 comments) Rsync.net Warrant Canary (2006) - https://news.ycombinator.com/item?id=5899197 https://news.ycombinator.com/item?id=5899197 - June 2013 (50 comments) Rsync.net Warrant Canary - https://news.ycombinator.com/item?id=5837351 https://news.ycombinator.com/item?id=5837351 - June 2013 (1 comment) Show HN: The rsync.net Warrant Canary - https://news.ycombinator.com/item?id=4834362 https://news.ycombinator.com/item?id=4834362 - Nov 2012 (1 comment) Rsync.net Warrant Canary - https://news.ycombinator.com/item?id=702247 https://news.ycombinator.com/item?id=702247 - July 2009 (46 comments)

Nifty3929 4y ago

Warrant canaries do not work, because they violate the spirit and law of what a gag or secret warrant means. No court would allow rsync to alert users this way without considering that a breach of the gag, just as if they said “hey we got a secret search warrant today.”

dvh 4y ago
Rsync will destroy key and nobody would be able to update canary. No new canary means canary is dead.
- AndrewDucker 4y ago
  And then people will go to jail.