7 ms·

Ok, so what's your point? Mine was to alleviate the burden on Signal. Fact is, this can be done and done well. Real harm is happening and this popular bandwagon

by _8j50 3y ago

Ok, so what's your point? Mine was to alleviate the burden on Signal. Fact is, this can be done and done well. Real harm is happening and this popular bandwagon is part of the problem, not solution. Find a better way for govs to have an advantage against CSAM and other boogeymen. Technical people are supposed to find optimal technical solutions, not pretend to be technocrats or underdogs fighting against governments who are all unjust and out there to get us.

int_19h 3y ago
So, technical people are supposed to "just follow orders"? Nope. If what the government is trying to do is unjust in my own ethical judgment, then I have no obligation to help them find an "optimal technical solution" to do it - on the contrary, I have a moral duty to make it as hard as possible for them to do that. The usual argument is that if we don't "help" them, the regime that's actually enacted will be much worse all around. Which is likely true, but also exactly the point - let them be heavy-handed and incite more popular resistance that way. We'll see how much of the public still supports all this stuff when the "for CSAM only, pinky promise" tech will start being routinely used to bust them for stuff like drug use.
- _8j50 3y ago
  > So, technical people are supposed to "just follow orders"? No, just be honest about technical matters. You can refuse to publish your software entirely or ideally in this case, make it available only outside the UK and let UK users seek it out on their own or use vpns. You can also protest the measure and try to prevent the law from being passed on ideological grounds. > on the contrary, I have a moral duty to make it as hard as possible for them to do that. So long as you are not being dishonest because then why would anyone trust you with anything else. You can comply with laws by doing it well or simply refuse to participate in publishing software there. What is happening now is they want to publish software there but refuse to obey the law of the land. What kind of law do you get to follow, only when you agree with it? > We'll see how much of the public still supports all this stuff when the "for CSAM only, pinky promise" tech will start being routinely used to bust them for stuff like drug use. That's sort of my point. You can disagree with it ideologically, saying it will be abused. But if the people trust the government and think preventing CSAM is more important then it is their right to self-determine and find out for themeselves and repeal the law later on. You are not the people's nanny, they made their bed. Perhaps we can talk about phones without app stores and OSes people can use whatever unbackdooree app they want then?
  - worik 3y ago
    > No, just be honest about technical matters. Please follow your own advice. > Alright, technical argument here. This is false and tech talking heads are spreading this lie for ideological reasons. That is not true. The "lie" is that if you allow a back channel into secure communications then you cannot be sure who will use it. You have gone from trusting the other party (whom you probably know) to trusting them and a third party, who's identity is a bit of a mystery. > You don't need to backdoor the protocol, just the specific targeted client. Somebody else has pointed out this is nonsense. It makes no difference. Whilst it is a fact, it is also a lie. Well done. > Signal can scan messages before encryption and report to the authorities just fine. That too is a lie. Signal offers secure communications. If it scans messages and sends hem to third parties that is not "Signal", that is something else. > Whatever the UK government desires, Signal should accept it as the will of the UK people Extraordinarily naive about the habits, morals, and actions of the English state. That is so untrue it transcends "lie". > I don't know UK law... No shit! > ...but dragnet surveillance is illegal in the US but targeted warrantful requests to backdoor apps is lawful. Not under English law. There are no rights, as Americans know them, under English law. There are statutes, that can be changed at any time if the Lords agree, and over time if they do not > Find a better way for govs to have an advantage against CSAM and other boogeymen Constant surveillance of all people at all times. A camera in every bathroom, In general every bedroom. My point is a line must be drawn somewhere. The English, and Australian, states do not care at all for the personal liberty of the subjects of the English crown. Some very good people in England doing very good work, but the state there is very deep.
    - _8j50 3y ago
      > That is not true. The "lie" is that if you allow a back channel into secure communications then you cannot be sure who will use it. You have gone from trusting the other party (whom you probably know) to trusting them and a third party, who's identity is a bit of a mystery. No one is asking that! The communication channel is untampered. The app is where the backdoor is, before the communication channel. > Somebody else has pointed out this is nonsense. It makes no difference. Whilst it is a fact, it is also a lie. Well done Bullshit! You damn well know it does! A network adversary and an ondevice adversary are completely different. If you don't know that, you are clueless or a liar. There is security in transit and security on device. The backdoor applies to on device security before any transport crypto is applied. This is the same as your keyboard app being backdoored or a rat infecting your phone. > That too is a lie. Signal offers secure communications. If it scans messages and sends hem to third parties that is not "Signal", that is something else You know, just because you say words, that doesn't mean they mean things. How can that possibly in a logical universe be a lie when I said "can"? Are you claiming Signal by law would be forced to change its name or disband if it started scanning messages before encryption? Would there be a tear in timespace if that happened? Please do explained why I was called a liar for pointing out that possibility. > Extraordinarily naive about the habits, morals, and actions of the English state. That is so untrue it transcends "lie". Wth does that even mean. Are you saying corporations in the UK do not have to folloe the law or can pick and choose what laws to follow? I think yours and others problem is you don't get the absurdity of companies acting as if they were individual participants in political discourse. They are not. They have no right. Companies don't vote, they have privileges and reaponsibilities and never rights of any kind. > There are statutes, that can be changed at any time if the Lords agree, and over time if they do not I hope that applies to companies too? > Constant surveillance of all people at all times. A camera in every bathroom, In general every bedroom. My point is a line must be drawn somewhere. At no point did I disagree with that. I have refused to visit the UK multiple times because of the nightmarish CCTV surveillance there. I do not agree with what they are doing but I disagree that civil disobedience can be invoked every time a law you disagree is passed, especially when tech people like you are lying about what is and isn't possible instead of boycotting the UK market or finding alternate solutions to CSAM abuse and other tech abuses and also when the government's actions will materially and provably reduce actual harm but mass surveillance has no actual proven and physical harm to anyone. I am all ears for solutions and I do not support mass surveillance but don't pretend your human right was violated when you don't even need to use smartphones (or rather smartphone and tech dependency itself is the violation of rights).
Hizonner 3y ago
My point is that she is appropriately characterizing what she's being asked to do. > Real harm is happening ... and these proposals would be very unlikely to materially reduce that harm. They WOULD, however, create a bunch of other harm. Including harm to children. In fact even including sexual harm to children. > boogeymen You said it, I didn't. > Technical people are supposed to find optimal technical solutions, not pretend to be technocrats or underdogs fighting against governments who are all unjust and out there to get us. Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter.
- _8j50 3y ago
  > and these proposals would be very unlikely to materially reduce that harm. They WOULD, however, create a bunch of other harm. Including harm to children. In fact even including sexual harm to children I would want to hear your explanation for that but more importantly, you should convince lawmakers about this instead of claiming the tech is impossible. > You said it, I didn't. Yes I did, hope you got my point then. > Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter. I fully support tech people opoposing this law, so long as they don't claim apps can't scan messages before transmission which is obviously a lie. Of course the apps security is reduced and they can have opinions by how much, but so long as the security property and risks are communicated to policy makers and users honestly I have no problem with it. What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law. But if you read my comment, apple and google should do this, not Signal, but then again them or telcos pushing code that modifies appls like Signal would be much more insecure than Signal itself doing it nice and neat.
  - Hizonner 3y ago
    > I would want to hear your explanation for that but more importantly, The people who want it need to prove that it will help. I had started in to list paragraphs and paragraphs of failure modes, unintended consequences, and directly bad effects, but then I realized that that implicitly accepted an inappropriate burden of proof. I am tired of hearing "Something must be done. This is something. Therefore this must be done". Tell me, in detail, how any of these proposals will help. Include all of the steps from the initial scanning through the final removal of harm. Do not stop at "Authority(TM) will know about X, so they can fix it". Tell me how they will fix it, and how they will do that without doing harm. Not how they theoretically could. How they actually will. And make it plausible. After you've given me that, I'll be happy to rip it to shreds for you. Otherwise, if you can't figure out for yourself how it's harmful to give platforms massive incentives to shut down anybody who raises costs by triggering too many false positives, how it's equally harmful to give them massive incentives to broaden their definition of what's a "true" positive, how it's harmful to have thousands of random people viewing false "hits", how it's damaging to enable Authority(TM) to come down on kids for communicating among themselves, how it's dangerous to create a massive database of blackmail material on potentially vulnerable people, how it's trivial to repurpose a spying infrastructure for different targets, or how it's useless to give more reports to law enforcement that's overwhelmed with the reports it already has, then you'll have to content yourself with reading the vast volume of stuff other people have written up about the OSB and all the related proposals. > you should convince lawmakers about this Many of us have been trying. The OSB has not in fact passed yet. The EU and US proposals still less. > instead of claiming the tech is impossible. Nobody, not me, not Meredith Whittaker, not anybody, has claimed that client side scanning is impossible, or that you can't turn around and encrypt a copy of a message after you've spied on it. That is a straw man. It is entirely your fantasy. What they've said is that it's stupid and contrary to the whole point of having the encryption in the first place. It leaks information that's supposed to be private, including false positives, and paints a target on the most sensitive stuff. It creates infrastructure for abuse. Those are the "security properties" being "communicated". And that is 100 percent true. When she says "back doors", she's talking about system back doors, not necessarily protocol back doors. Although the protocol would have to have some way to report the data. Anybody with a remotely clear-headed view of the situation understands that sending off plaintext copies of the stuff you then turn around and encrypt is in tension with the purpose of doing the encryption. They also understand that once you have either the scanning or the reporting system in place, there's nothing that controls how it can be used. And they understand that the proponents of this stuff have no detailed story at all about how the leaked plaintext is supposed to be secured after the leaking is done... especially if it's actually going to be used for the stated purposes. That is a VAST technical and organizational problem that's constantly handwaved. > What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law. That's another fantasy of yours. She's been very clear that if the UK does this, Signal will exit the UK market. However, that's her and her corporation. It's not binding on the rest of us. The fact is that "lawmakers" do not have infinite legitimate power. It is sometimes right and maybe even morally required to directly break the law. Personally, I'm looking forward to the widespread use of P2P tools that will make Signal look like an open book... whether they're legal or not. At this point, laws even in the "free world" are descending into insanity.

by _8j50 3y ago

int_19h 3y ago

So, technical people are supposed to "just follow orders"? Nope. If what the government is trying to do is unjust in my own ethical judgment, then I have no obligation to help them find an "optimal technical solution" to do it - on the contrary, I have a moral duty to make it as hard as possible for them to do that. The usual argument is that if we don't "help" them, the regime that's actually enacted will be much worse all around. Which is likely true, but also exactly the point - let them be heavy-handed and incite more popular resistance that way. We'll see how much of the public still supports all this stuff when the "for CSAM only, pinky promise" tech will start being routinely used to bust them for stuff like drug use.

_8j50 3y ago
> So, technical people are supposed to "just follow orders"? No, just be honest about technical matters. You can refuse to publish your software entirely or ideally in this case, make it available only outside the UK and let UK users seek it out on their own or use vpns. You can also protest the measure and try to prevent the law from being passed on ideological grounds. > on the contrary, I have a moral duty to make it as hard as possible for them to do that. So long as you are not being dishonest because then why would anyone trust you with anything else. You can comply with laws by doing it well or simply refuse to participate in publishing software there. What is happening now is they want to publish software there but refuse to obey the law of the land. What kind of law do you get to follow, only when you agree with it? > We'll see how much of the public still supports all this stuff when the "for CSAM only, pinky promise" tech will start being routinely used to bust them for stuff like drug use. That's sort of my point. You can disagree with it ideologically, saying it will be abused. But if the people trust the government and think preventing CSAM is more important then it is their right to self-determine and find out for themeselves and repeal the law later on. You are not the people's nanny, they made their bed. Perhaps we can talk about phones without app stores and OSes people can use whatever unbackdooree app they want then?
- worik 3y ago
  > No, just be honest about technical matters. Please follow your own advice. > Alright, technical argument here. This is false and tech talking heads are spreading this lie for ideological reasons. That is not true. The "lie" is that if you allow a back channel into secure communications then you cannot be sure who will use it. You have gone from trusting the other party (whom you probably know) to trusting them and a third party, who's identity is a bit of a mystery. > You don't need to backdoor the protocol, just the specific targeted client. Somebody else has pointed out this is nonsense. It makes no difference. Whilst it is a fact, it is also a lie. Well done. > Signal can scan messages before encryption and report to the authorities just fine. That too is a lie. Signal offers secure communications. If it scans messages and sends hem to third parties that is not "Signal", that is something else. > Whatever the UK government desires, Signal should accept it as the will of the UK people Extraordinarily naive about the habits, morals, and actions of the English state. That is so untrue it transcends "lie". > I don't know UK law... No shit! > ...but dragnet surveillance is illegal in the US but targeted warrantful requests to backdoor apps is lawful. Not under English law. There are no rights, as Americans know them, under English law. There are statutes, that can be changed at any time if the Lords agree, and over time if they do not > Find a better way for govs to have an advantage against CSAM and other boogeymen Constant surveillance of all people at all times. A camera in every bathroom, In general every bedroom. My point is a line must be drawn somewhere. The English, and Australian, states do not care at all for the personal liberty of the subjects of the English crown. Some very good people in England doing very good work, but the state there is very deep.
  - _8j50 3y ago
    > That is not true. The "lie" is that if you allow a back channel into secure communications then you cannot be sure who will use it. You have gone from trusting the other party (whom you probably know) to trusting them and a third party, who's identity is a bit of a mystery. No one is asking that! The communication channel is untampered. The app is where the backdoor is, before the communication channel. > Somebody else has pointed out this is nonsense. It makes no difference. Whilst it is a fact, it is also a lie. Well done Bullshit! You damn well know it does! A network adversary and an ondevice adversary are completely different. If you don't know that, you are clueless or a liar. There is security in transit and security on device. The backdoor applies to on device security before any transport crypto is applied. This is the same as your keyboard app being backdoored or a rat infecting your phone. > That too is a lie. Signal offers secure communications. If it scans messages and sends hem to third parties that is not "Signal", that is something else You know, just because you say words, that doesn't mean they mean things. How can that possibly in a logical universe be a lie when I said "can"? Are you claiming Signal by law would be forced to change its name or disband if it started scanning messages before encryption? Would there be a tear in timespace if that happened? Please do explained why I was called a liar for pointing out that possibility. > Extraordinarily naive about the habits, morals, and actions of the English state. That is so untrue it transcends "lie". Wth does that even mean. Are you saying corporations in the UK do not have to folloe the law or can pick and choose what laws to follow? I think yours and others problem is you don't get the absurdity of companies acting as if they were individual participants in political discourse. They are not. They have no right. Companies don't vote, they have privileges and reaponsibilities and never rights of any kind. > There are statutes, that can be changed at any time if the Lords agree, and over time if they do not I hope that applies to companies too? > Constant surveillance of all people at all times. A camera in every bathroom, In general every bedroom. My point is a line must be drawn somewhere. At no point did I disagree with that. I have refused to visit the UK multiple times because of the nightmarish CCTV surveillance there. I do not agree with what they are doing but I disagree that civil disobedience can be invoked every time a law you disagree is passed, especially when tech people like you are lying about what is and isn't possible instead of boycotting the UK market or finding alternate solutions to CSAM abuse and other tech abuses and also when the government's actions will materially and provably reduce actual harm but mass surveillance has no actual proven and physical harm to anyone. I am all ears for solutions and I do not support mass surveillance but don't pretend your human right was violated when you don't even need to use smartphones (or rather smartphone and tech dependency itself is the violation of rights).

Hizonner 3y ago

My point is that she is appropriately characterizing what she's being asked to do. > Real harm is happening ... and these proposals would be very unlikely to materially reduce that harm. They WOULD, however, create a bunch of other harm. Including harm to children. In fact even including sexual harm to children. > boogeymen You said it, I didn't. > Technical people are supposed to find optimal technical solutions, not pretend to be technocrats or underdogs fighting against governments who are all unjust and out there to get us. Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter.

_8j50 3y ago
> and these proposals would be very unlikely to materially reduce that harm. They WOULD, however, create a bunch of other harm. Including harm to children. In fact even including sexual harm to children I would want to hear your explanation for that but more importantly, you should convince lawmakers about this instead of claiming the tech is impossible. > You said it, I didn't. Yes I did, hope you got my point then. > Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter. I fully support tech people opoposing this law, so long as they don't claim apps can't scan messages before transmission which is obviously a lie. Of course the apps security is reduced and they can have opinions by how much, but so long as the security property and risks are communicated to policy makers and users honestly I have no problem with it. What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law. But if you read my comment, apple and google should do this, not Signal, but then again them or telcos pushing code that modifies appls like Signal would be much more insecure than Signal itself doing it nice and neat.
- Hizonner 3y ago
  > I would want to hear your explanation for that but more importantly, The people who want it need to prove that it will help. I had started in to list paragraphs and paragraphs of failure modes, unintended consequences, and directly bad effects, but then I realized that that implicitly accepted an inappropriate burden of proof. I am tired of hearing "Something must be done. This is something. Therefore this must be done". Tell me, in detail, how any of these proposals will help. Include all of the steps from the initial scanning through the final removal of harm. Do not stop at "Authority(TM) will know about X, so they can fix it". Tell me how they will fix it, and how they will do that without doing harm. Not how they theoretically could. How they actually will. And make it plausible. After you've given me that, I'll be happy to rip it to shreds for you. Otherwise, if you can't figure out for yourself how it's harmful to give platforms massive incentives to shut down anybody who raises costs by triggering too many false positives, how it's equally harmful to give them massive incentives to broaden their definition of what's a "true" positive, how it's harmful to have thousands of random people viewing false "hits", how it's damaging to enable Authority(TM) to come down on kids for communicating among themselves, how it's dangerous to create a massive database of blackmail material on potentially vulnerable people, how it's trivial to repurpose a spying infrastructure for different targets, or how it's useless to give more reports to law enforcement that's overwhelmed with the reports it already has, then you'll have to content yourself with reading the vast volume of stuff other people have written up about the OSB and all the related proposals. > you should convince lawmakers about this Many of us have been trying. The OSB has not in fact passed yet. The EU and US proposals still less. > instead of claiming the tech is impossible. Nobody, not me, not Meredith Whittaker, not anybody, has claimed that client side scanning is impossible, or that you can't turn around and encrypt a copy of a message after you've spied on it. That is a straw man. It is entirely your fantasy. What they've said is that it's stupid and contrary to the whole point of having the encryption in the first place. It leaks information that's supposed to be private, including false positives, and paints a target on the most sensitive stuff. It creates infrastructure for abuse. Those are the "security properties" being "communicated". And that is 100 percent true. When she says "back doors", she's talking about system back doors, not necessarily protocol back doors. Although the protocol would have to have some way to report the data. Anybody with a remotely clear-headed view of the situation understands that sending off plaintext copies of the stuff you then turn around and encrypt is in tension with the purpose of doing the encryption. They also understand that once you have either the scanning or the reporting system in place, there's nothing that controls how it can be used. And they understand that the proponents of this stuff have no detailed story at all about how the leaked plaintext is supposed to be secured after the leaking is done... especially if it's actually going to be used for the stated purposes. That is a VAST technical and organizational problem that's constantly handwaved. > What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law. That's another fantasy of yours. She's been very clear that if the UK does this, Signal will exit the UK market. However, that's her and her corporation. It's not binding on the rest of us. The fact is that "lawmakers" do not have infinite legitimate power. It is sometimes right and maybe even morally required to directly break the law. Personally, I'm looking forward to the widespread use of P2P tools that will make Signal look like an open book... whether they're legal or not. At this point, laws even in the "free world" are descending into insanity.