4 ms·

I have now spent 5 minutes on the EFF site and am now qualified to hold forth at length. More seriously, that depends on the terms of "opt-in" and "sharing" an

I have now spent 5 minutes on the EFF site and am now qualified to hold forth at length. More seriously, that depends on the terms of "opt-in" and "sharing" and "security", yes? Such details make nice real estate for the Devil. I'm by no means convinced that the people writing these laws understand the implications and possibilities -- I don't trust their values because I don't think they have the understanding to even have values. Or understand how those values are advanced or eroded. What opinions I have of their values are formed by the SOPA episode. To _my_ mind, I would need to see the compelling argument for why we need legislation in the first place. At which time I'd have to go to school on this more than I have. And most of the security problems I've read about have more to do with corporations doing a terrible job configuring their own equipment than with some remarkable threat that can only be met through government-organized action. So in general, I'm against any law without some compelling need. I don't see one here, and that might be ignorance, but that's my view at the moment. How would I relate that to Facebook? If my view were valid, my first stab would be, "They are supporting over-broad legislation, without a stated need, that could easily go wrong. That bespeaks a centralized-solution attitude contrary to the values that have built the 'net we have today, and unlikely to found the trust needed to make the 'net work best going forward." But even if that withstood scrutiny I'm not sure their business is going to live or die based on what is essentially a question of corporate culture. If they don't die of something else, they'll get opportunities to change their approach on this stuff.

tptacek 14y ago
Your time would be better spent reading the CISPA bill itself, which goes to some length to define "sharing" and "security". I can summarize, but the firsthand sources are surprisingly readable: http://www.govtrack.us/congress/bills/112/hr3523 http://www.govtrack.us/congress/bills/112/hr3523 As regards "opt-in": it's inherently opt-in, because it provides no mechanism for the government to demand information from any provider. Obviously, the government can already use court orders to get access to information. Beyond that, the bill explicitly prevents the government from making such demands; for instance: "Nothing in this section shall be construed to permit the Federal Government to... ‘(A) require a private-sector entity to share information with the Federal Government;". As regards "security": the bill actually defines this term (a novel twist in "cyber security" legislation): ‘(i) a vulnerability of a system or network of a government or private entity; ‘(ii) a threat to the integrity, confidentiality, or availability of a system or network of a government or private entity or any information stored on, processed on, or transiting such a system or network; ‘(iii) efforts to deny access to or degrade, disrupt, or destroy a system or network of a government or private entity; or ‘(iv) efforts to gain unauthorized access to a system or network of a government or private entity, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting a system or network of a government or private entity.
- chernevik 14y ago
  Probably right, if I had reason to take interest in fixing this corner of the law. But like refactoring code, I don't see why I'd even discuss changing law without having some very good reason. And I still don't see why this is a good place to run the risks of unintended consequences and / or malign legislators.
  - 18pfsmt 14y ago
    Without diving in even as far as you have, my main problem with the proposed law is that it would remove FB's liability in complying, so the default will be to simply hand over any information related to any investigation. "Opt-in" is the obvious answer for a corporate entity wishing to mitigate its financial liability.

tptacek 14y ago

Your time would be better spent reading the CISPA bill itself, which goes to some length to define "sharing" and "security". I can summarize, but the firsthand sources are surprisingly readable: http://www.govtrack.us/congress/bills/112/hr3523 http://www.govtrack.us/congress/bills/112/hr3523 As regards "opt-in": it's inherently opt-in, because it provides no mechanism for the government to demand information from any provider. Obviously, the government can already use court orders to get access to information. Beyond that, the bill explicitly prevents the government from making such demands; for instance: "Nothing in this section shall be construed to permit the Federal Government to... ‘(A) require a private-sector entity to share information with the Federal Government;". As regards "security": the bill actually defines this term (a novel twist in "cyber security" legislation): ‘(i) a vulnerability of a system or network of a government or private entity; ‘(ii) a threat to the integrity, confidentiality, or availability of a system or network of a government or private entity or any information stored on, processed on, or transiting such a system or network; ‘(iii) efforts to deny access to or degrade, disrupt, or destroy a system or network of a government or private entity; or ‘(iv) efforts to gain unauthorized access to a system or network of a government or private entity, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting a system or network of a government or private entity.

chernevik 14y ago
Probably right, if I had reason to take interest in fixing this corner of the law. But like refactoring code, I don't see why I'd even discuss changing law without having some very good reason. And I still don't see why this is a good place to run the risks of unintended consequences and / or malign legislators.
- 18pfsmt 14y ago
  Without diving in even as far as you have, my main problem with the proposed law is that it would remove FB's liability in complying, so the default will be to simply hand over any information related to any investigation. "Opt-in" is the obvious answer for a corporate entity wishing to mitigate its financial liability.