3 ms·

> The aim should be to engineer the system so that you don't (and can't) have access to the information So when law enforcement and/or a three-letter agency ro

> The aim should be to engineer the system so that you don't (and can't) have access to the information So when law enforcement and/or a three-letter agency rocks up with the legal paperwork (whether it be a National Security Letter or a local equivalent) and demands that "the system" be changed to start collecting the information they require, how should managers and engineers respond?

withinboredom 2y ago
Generally, in my experience, people want to help "catch the criminal" -- note these are usually the worst of the worst at first. Then you start getting less and less information and starts becoming a process rather than an event/discussion. At least, that was my experience.
xethos 2y ago
In a perfect world? The same way Apple did in ~2015. Argue that code is equivalent to speech, compelling them to write code to change the way the system works is compelling speech, and making that demand is unconstitutional. Apple gets lots of shit for a multitude of reasons, but their stance of "We built it to be securely encrypted from everyone but the owner; if you want to change that then fuck you, make me" is something everyone involved with should be proud of Realistically, we can't all be one of the richest companies in the modern era. Not every corporation has both morals, and pockets deep enough to pick a fight with not just a government, but the government of the country they're headquartered in. Frankly, shutting down like Lavabit is one of the better realistic scenarios if you're making promises of guaranteed privacy
- taurknaut 2y ago
  > Not every corporation has both morals I think this is easier: there isn't a single corporation on the earth with morals. Morality and profit-chasing are not generally coherent principles. Nobody doing any good on this earth has a need for an LLC.
  - xethos 2y ago
    Calling them "morals" was meant flippantly, though I suspect should have used quotation marks to call that out a bit more. "Multiple ad campaigns and a marketing posture based around privacy" is probably better.
  - bsenftner 2y ago
    I generally agree with your posts/comments, but anyone trying to "do good" in the USA absolutely needs to have liability protection, such as an LLC or a corporation shell of some kind. The moment one starts to make a difference in this corporate controlled nation, the full legal power of both the corporations and their owned government minions will rain down on you. I've seen it. If you're trying to make any kind of a difference, get liability shells around your activities, or you'll be ended the moment you gain traction.
madeforhnyo 2y ago
https://signal.org/bigbrother/ https://signal.org/bigbrother/
- logifail 2y ago
  > https://signal.org/bigbrother/ https://signal.org/bigbrother/ > "When legally forced to provide information to government or law enforcement agencies, we'll disclose the transcripts of that communication here" Sure, except if there's a nondisclosure provision... "A national security letter is an administrative subpoena issued by the United States government to gather information for national security purposes. NSLs do not require prior approval from a judge. NSLs typically contain a nondisclosure requirement forbidding the recipient of an NSL from disclosing the FBI had requested the information." https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter
parliament32 2y ago
By pointing to your repo and inviting them to make a PR. Because your system is open source, uses reproducible builds, and attestation so users can directly verify the binaries you're running come from the open code they can audit. This is the same reason a three-letter agency approaching Linux and asking for a backdoor won't work.

withinboredom 2y ago

Generally, in my experience, people want to help "catch the criminal" -- note these are usually the worst of the worst at first. Then you start getting less and less information and starts becoming a process rather than an event/discussion. At least, that was my experience.

xethos 2y ago

In a perfect world? The same way Apple did in ~2015. Argue that code is equivalent to speech, compelling them to write code to change the way the system works is compelling speech, and making that demand is unconstitutional. Apple gets lots of shit for a multitude of reasons, but their stance of "We built it to be securely encrypted from everyone but the owner; if you want to change that then fuck you, make me" is something everyone involved with should be proud of Realistically, we can't all be one of the richest companies in the modern era. Not every corporation has both morals, and pockets deep enough to pick a fight with not just a government, but the government of the country they're headquartered in. Frankly, shutting down like Lavabit is one of the better realistic scenarios if you're making promises of guaranteed privacy

taurknaut 2y ago
> Not every corporation has both morals I think this is easier: there isn't a single corporation on the earth with morals. Morality and profit-chasing are not generally coherent principles. Nobody doing any good on this earth has a need for an LLC.
- xethos 2y ago
  Calling them "morals" was meant flippantly, though I suspect should have used quotation marks to call that out a bit more. "Multiple ad campaigns and a marketing posture based around privacy" is probably better.
- bsenftner 2y ago
  I generally agree with your posts/comments, but anyone trying to "do good" in the USA absolutely needs to have liability protection, such as an LLC or a corporation shell of some kind. The moment one starts to make a difference in this corporate controlled nation, the full legal power of both the corporations and their owned government minions will rain down on you. I've seen it. If you're trying to make any kind of a difference, get liability shells around your activities, or you'll be ended the moment you gain traction.

madeforhnyo 2y ago

https://signal.org/bigbrother/ https://signal.org/bigbrother/

logifail 2y ago
> https://signal.org/bigbrother/ https://signal.org/bigbrother/ > "When legally forced to provide information to government or law enforcement agencies, we'll disclose the transcripts of that communication here" Sure, except if there's a nondisclosure provision... "A national security letter is an administrative subpoena issued by the United States government to gather information for national security purposes. NSLs do not require prior approval from a judge. NSLs typically contain a nondisclosure requirement forbidding the recipient of an NSL from disclosing the FBI had requested the information." https://en.wikipedia.org/wiki/National_security_letter https://en.wikipedia.org/wiki/National_security_letter

parliament32 2y ago

By pointing to your repo and inviting them to make a PR. Because your system is open source, uses reproducible builds, and attestation so users can directly verify the binaries you're running come from the open code they can audit. This is the same reason a three-letter agency approaching Linux and asking for a backdoor won't work.