6 ms·

Interesting perspective. If the alternative to pursuing tools in this area is complete subjugation, perhaps some people are willing to bear the costs of risking

Interesting perspective. If the alternative to pursuing tools in this area is complete subjugation, perhaps some people are willing to bear the costs of risking going against that. What use is your life if it's not really yours? It's a position people at least ought to be able to choose for themselves.

tptacek 15y ago
I certainly wouldn't criticize anyone directly facing down a violent authoritarian regime. If, on the other hand, you're marketing to those people from the relative safety of a western computer keyboard...
- etherael 15y ago
  Unless you're from Bhutan, you're already facing down a violent authoritarian regime. It's all just a question of degrees. People in Iran may well look to North Korea and be thankful that at least they don't have it that bad. Those of us behind the "relative safety of a western computer keyboard" may have more of an obligation to act than those under more strenuous restrictions. At least in our case we likely won't be hanged from a crane, as you say. Or at least our governments will have the good courtesy to have us shipped off to a friendly tinpot dictatorship first so we can be spared the humiliation of having such a thing done at home. I don't think marketing really comes into it, all the circumvention tool vendors are quite direct and honest with the current state of their efforts and the extent upon which they can be relied. Also, they're not commercial efforts, and the creators stand to make no real direct economic gains from their adoption.
  - tptacek 15y ago
    Those of us behind the relative safety of a western keyboard may have more of an obligation to convince people in Iran to use tools we write that claim to keep them safe but instead pinpoint them to the Iranian security apparatus? I wouldn't criticize someone using circumvention tools in Iran. I might criticize an American who tried to make a name for themselves by building half-assed tools for Iranian dissidents. That was my point.
    - etherael 15y ago
      It's a fair one, I just don't know that it's reason to refrain from doing so. As a theoretical Iranian dissident with a typical end user grasp on technology I'd definitely rather have such tools available than need to resort to creating them myself. I think the chances such a theoretical user who will engage in subversion at any rate no matter the risk level is much more likely to be less capable of creating a circumvention tool than say the tor team.
wladimir 15y ago
I think his argument is a very bad one. It starts with the usual "Adversaries have more money and resources so it's better to just give up the fight". That is no help unless you're already on the winning side and posturing. While he certainly has a point that badly done circumvention tools give a false feeling of safety, I don't think completely giving up is a solution either. No matter what, activists in such countries are already daring their lives (through off-line activities). It is important to get some information out there, through regimes' firewalls, and the only way might be through such tools. And only circumvention tools (such as TOR) that are public, open source, and actively being used can be subject to scrutiny (otherwise it'd be a completely academic exercise), which improves the security of the tools over the long run. Edit: Also, with the recent push for internet censorship even in western countries it's starting to be pretty clear we need the tools here too.
- tptacek 15y ago
  The response I hear you giving my argument sounds like the one I always hear: "your argument is wrong because we need circumvention tools". That's fallacious because our need for circumvention tools is irrelevant. You are talking about moral imperatives and I'm talking about engineering. The fact of the matter is, there is no way to build an assuredly secure messaging system; every attempt to build cryptographically secured messaging has failed, often multiple times. It isn't unlikely that every fielded cryptographic system is broken right now, and we're just waiting to find out how. In the real world, resources matter. Nothing is perfect, so really we're talking about a contest between two parties. Will the circumvention tool authors figure out the flaws (that expose their messages, that allow attackers to use technical flaws in their tools to mislead users into compromising themselves, that allow attackers to easily pinpoint circumventing traffic, &c), or inadvertently fix them by laying more countermeasures into their code? Or will governments find those flaws first, and use them to turn the tools against their users. The governments we're talking --- Iran, Syria, China --- have zero scruples, unlimited funds, and (if you're under the delusion that dictatorships have a hard time finding technical talent or that money doesn't simply buy it like anything else) demonstrated access to research and development skill in this specific area. It doesn't matter that we need these tools. I'm betting on the hostile governments. If you think the dictatorships will win, you need to keep in mind that the worst case isn't "false sense of security". The worst case is, "run this tool and a government computer somewhere silently puts your name on a list".

tptacek 15y ago

I certainly wouldn't criticize anyone directly facing down a violent authoritarian regime. If, on the other hand, you're marketing to those people from the relative safety of a western computer keyboard...

etherael 15y ago
Unless you're from Bhutan, you're already facing down a violent authoritarian regime. It's all just a question of degrees. People in Iran may well look to North Korea and be thankful that at least they don't have it that bad. Those of us behind the "relative safety of a western computer keyboard" may have more of an obligation to act than those under more strenuous restrictions. At least in our case we likely won't be hanged from a crane, as you say. Or at least our governments will have the good courtesy to have us shipped off to a friendly tinpot dictatorship first so we can be spared the humiliation of having such a thing done at home. I don't think marketing really comes into it, all the circumvention tool vendors are quite direct and honest with the current state of their efforts and the extent upon which they can be relied. Also, they're not commercial efforts, and the creators stand to make no real direct economic gains from their adoption.
- tptacek 15y ago
  Those of us behind the relative safety of a western keyboard may have more of an obligation to convince people in Iran to use tools we write that claim to keep them safe but instead pinpoint them to the Iranian security apparatus? I wouldn't criticize someone using circumvention tools in Iran. I might criticize an American who tried to make a name for themselves by building half-assed tools for Iranian dissidents. That was my point.
  - etherael 15y ago
    It's a fair one, I just don't know that it's reason to refrain from doing so. As a theoretical Iranian dissident with a typical end user grasp on technology I'd definitely rather have such tools available than need to resort to creating them myself. I think the chances such a theoretical user who will engage in subversion at any rate no matter the risk level is much more likely to be less capable of creating a circumvention tool than say the tor team.

wladimir 15y ago

I think his argument is a very bad one. It starts with the usual "Adversaries have more money and resources so it's better to just give up the fight". That is no help unless you're already on the winning side and posturing. While he certainly has a point that badly done circumvention tools give a false feeling of safety, I don't think completely giving up is a solution either. No matter what, activists in such countries are already daring their lives (through off-line activities). It is important to get some information out there, through regimes' firewalls, and the only way might be through such tools. And only circumvention tools (such as TOR) that are public, open source, and actively being used can be subject to scrutiny (otherwise it'd be a completely academic exercise), which improves the security of the tools over the long run. Edit: Also, with the recent push for internet censorship even in western countries it's starting to be pretty clear we need the tools here too.

tptacek 15y ago
The response I hear you giving my argument sounds like the one I always hear: "your argument is wrong because we need circumvention tools". That's fallacious because our need for circumvention tools is irrelevant. You are talking about moral imperatives and I'm talking about engineering. The fact of the matter is, there is no way to build an assuredly secure messaging system; every attempt to build cryptographically secured messaging has failed, often multiple times. It isn't unlikely that every fielded cryptographic system is broken right now, and we're just waiting to find out how. In the real world, resources matter. Nothing is perfect, so really we're talking about a contest between two parties. Will the circumvention tool authors figure out the flaws (that expose their messages, that allow attackers to use technical flaws in their tools to mislead users into compromising themselves, that allow attackers to easily pinpoint circumventing traffic, &c), or inadvertently fix them by laying more countermeasures into their code? Or will governments find those flaws first, and use them to turn the tools against their users. The governments we're talking --- Iran, Syria, China --- have zero scruples, unlimited funds, and (if you're under the delusion that dictatorships have a hard time finding technical talent or that money doesn't simply buy it like anything else) demonstrated access to research and development skill in this specific area. It doesn't matter that we need these tools. I'm betting on the hostile governments. If you think the dictatorships will win, you need to keep in mind that the worst case isn't "false sense of security". The worst case is, "run this tool and a government computer somewhere silently puts your name on a list".