5 ms·

Unite with Namecheap in the fight against CISPA

86 points by ted0 14y ago

clicks 14y ago
> For each Tweet or Facebook share about this threat, using the buttons below, you will increase the amount donated to the EFF foundation by $0.10. My god they are working this thing to their benefit. That is just really really good marketing.
meomix 14y ago
This has been all over HN the past 24 hours [1]. Namecheap (and I use them) is starting to get known for this sort of marketing. They were ALL over reddit when SOPA was the big thing. Maybe drop a marketing person and improve their email/mobile experience? [1] http://www.hnsearch.com/search#request/all&q=namecheap http://www.hnsearch.com/search#request/all&q=namecheap
gesman 14y ago
Short version: "Buy my stuff and I'll donate to a good cause". Disclaimer: I love and use namecheap and think they're one of the best registrars. But this is cheap marketing pitch.
- deleted 14y ago
  [deleted]
- StavrosK 14y ago
  It's actually "spread my stuff" rather than "buy my stuff".
Wazowski 14y ago
This is something new; a combination of marketing, propaganda, and demagoguery. Namecheap says that "If CISPA is passed, the US government gains the power to shut off Internet traffic." That wrong, and so provably wrong that it may be a lie. The bill is here. http://www.govtrack.us/congress/bills/112/hr3523/text http://www.govtrack.us/congress/bills/112/hr3523/text There isn't a word in there about shutting off Internet traffic. More reputable sources--like EFF, for whom Namecheap is fundraising--don't make that outrageous claim. Namecheap is trying to make a buck off the gullible.
- busterarm 14y ago
  It's not any different than the marketing that companies on the other side of these bills use to get public support for them. It's a game of lies and honesty doesn't pay. I'm just glad to be using a company that is consistently (thus far) on the right side of this issue.
  - tptacek 14y ago
    My 13 year old son, who is not exactly a lodestar of ethical and moral judgement at this point in his development, understands intuitively that other people's lies do not actually build a space for him to comfortably fill with his own lies.
    - busterarm 14y ago
      If you think I'm approving of the practice, you're wrong. They're doing it though because it works and because there is no likelihood that they will actually be held accountable in a way that affects their bottom line. We're talking about marketing here. Truth has no place in marketing. If your truth has any impact, you wouldn't need to market.
- tptacek 14y ago
  EFF made a series of outrageous claims about CISPA. If all your information about CISPA came from EFF, you might indeed think that CISPA was an attempt to reintroduce SOPA. EFF is not a trustworthy source of information about CISPA. I believe they're using it as a vector for fundraising. They're certainly not trying to educate about it.
  - gojomo 14y ago
    Can you provide more detail about the "outrageous claims about CISPA" made by the EFF? (That's a strong accusation without details.)
    - tptacek 14y ago
tptacek 14y ago
Wait, is this year's CISPA dramatically different than last year's? Because if it's basically the same bill, this is a profoundly dishonest campaign. 2012's CISPA: * Did not provide the government with any capability to shut down traffic * Explicitly rejected enforcement of intellectual property, going so far as to remove IP from a list of assets protected by the bill * Created an entirely voluntary opt-in mechanism for companies to share information about attacks * Limited the information shared to attack data, and provided a definition in the law for what "attack" meant that did not include piracy CISPA 2012 was not a "warmed over SOPA". SOPA was so much more intrusive than CISPA 2012 that it is strange to even compare them. So, is CISPA 2013 much worse?
- gojomo 14y ago
  Organizations ranging from Mozilla and the ACM, to the EFF and ACLU, to grassroots activist groups of the left and right didn't share your casual confidence in the reasonableness of 2012 CISPA. http://en.wikipedia.org/wiki/Cyber_Intelligence_Sharing_and_Protection_Act#Opposition http://en.wikipedia.org/wiki/Cyber_Intelligence_Sharing_and_... Their analysis was that once a determination of a 'cyber threat' was made and shared, private communications and other data that would usually require stronger cause could (and probably would) then be handed over ('shared') on government request. The words "voluntary opt-in" are not reassuring, if it's a service provider opting-in customer data to law-enforcement, disregarding traditional expectations of privacy or even explicitly agreed terms. When you say 2012 CISPA "remove[d] IP from a list of assets protected by the bill", they could only 'remove' it because the original draft had it in. And, that's the sort of insider-wishlist-item that can be re-added as the bill progresses, or perhaps even interpreted-back-in when the bill contains vague language. The 2013 language includes in its definition of covered 'cybersecurity crimes': "a violation of any provision of title 18, United States Code, created or amended by the Computer Fraud and Abuse Act of 1986 (Public Law 99-474)." That's the same CFAA as used in the recent prosecutions of Swartz and Aurenheimer. It has the open-ended "exceeding authorized access" and "obtains anything of value" language that lets the violation of terms-of-service and unauthorized acquisition of commercially-valued copyrighted material become serious federal crimes. Advocates of new security powers tend to portray their scope as small and reasonable, before passage, but then manage to find a more expansive interpretation, when it behooves them after passage. Because such bills keep changing and stretching, I tend to trust the EFF and ACLU, who will actually litigate cases under the enacted legal regime, about the bill's likely effects.
drucken 14y ago
This bill is nothing like SOPA and whoever is campaigning on this basis is doing a massive disservice to themselves because people can tell the difference. CISPA is just a continuation of clear "wiretapping" landgrabs by the US Federal Government, in this case using the basis of "cybersecurity". The US government have been trying to do this for decades and they will almost certainly succeed, no matter the resistance. What is new is that it seeks to indemnify specific third parties who wiretap or even hack on their behalf. As for the current version of the bill (H.R.3523.RFS), apart from the obviously broad language, there is only one section, on the use of information, that I would be greatly concerned with if I were a US resident, Section 2.C.1 (specifically part A): LIMITATION- The Federal Government may use cyber threat information shared with the Federal Government in accordance with subsection (b)-- `(A) for cybersecurity purposes; `(B) for the investigation and prosecution of cybersecurity crimes; `(C) for the protection of individuals from the danger of death or serious bodily harm and the investigation and prosecution of crimes involving such danger of death or serious bodily harm; `(D) for the protection of minors from child pornography, any risk of sexual exploitation, and serious threats to the physical safety of such minor, including kidnapping and trafficking and the investigation and prosecution of crimes involving child pornography, any risk of sexual exploitation, and serious threats to the physical safety of minors, including kidnapping and trafficking, and any crime referred to in 2258A(a)(2) of title 18, United States Code; or `(E) to protect the national security of the United States. What does "(A)" mean and why is it present when both "(B)" and "(E)" are already present? Without further highly specific legal binding, "for cybersecurity purposes" is far too broad an entry for the use at which the information may be put!
- tptacek 14y ago
  Exactly how would CISPA indemnify a company that hacked on its behalf? Obviously I'm asking because I think there is no way that it does.
  - drucken 14y ago
    Section 2.B.1: SELF-PROTECTED ENTITIES- Notwithstanding any other provision of law, a self-protected entity may, for cybersecurity purposes-- (i) use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property of such self-protected entity; and `(ii) share such cyber threat information with any other entity, including the Federal Government. Section 2.B.4: EXEMPTION FROM LIABILITY- No civil or criminal cause of action shall lie or be maintained in Federal or State court against a protected entity, self-protected entity, cybersecurity provider, or an officer, employee, or agent of a protected entity, self-protected entity, or cybersecurity provider, acting in good faith-- `(A) for using cybersecurity systems to identify or obtain cyber threat information or for sharing such information in accordance with this section; or `(B) for decisions made based on cyber threat information identified, obtained, or shared under this section. 1. The key phrase "Notwithstanding any other provision of law" allows those parts of the bill to ignore all other laws. 2. "EXEMPTION FROM LIABILITY" subsection could not be any more clear. 3. "use cybersecurity systems to identify and obtain cyber threat information" is such broad language as to mean almost anything, especially in context of software. But we're getting side-tracked, imo. At this point, I would not even try to prevent the US government getting whatever information it wanted, however it wanted - third party or not. The key is what they are allowed to do with it after they have it...
clark-kent 14y ago
Namecheap is beginning to look bad in my eyes with all this.
- EduardoBautista 14y ago
  I don't know how they are even that popular. They are just a reseller, rode the anti-godaddy circlejerk campaign, and just try to go with whatever internet "freedom" circlejerk they can find to add customers. There are much better domain registrars out there.

86 points by ted0 14y ago

> For each Tweet or Facebook share about this threat, using the buttons below, you will increase the amount donated to the EFF foundation by $0.10. My god they are working this thing to their benefit. That is just really really good marketing.

meomix 14y ago

This has been all over HN the past 24 hours [1]. Namecheap (and I use them) is starting to get known for this sort of marketing. They were ALL over reddit when SOPA was the big thing. Maybe drop a marketing person and improve their email/mobile experience? [1] http://www.hnsearch.com/search#request/all&q=namecheap http://www.hnsearch.com/search#request/all&q=namecheap

gesman 14y ago

Short version: "Buy my stuff and I'll donate to a good cause". Disclaimer: I love and use namecheap and think they're one of the best registrars. But this is cheap marketing pitch.

deleted 14y ago
[deleted]
StavrosK 14y ago
It's actually "spread my stuff" rather than "buy my stuff".

Wazowski 14y ago

This is something new; a combination of marketing, propaganda, and demagoguery. Namecheap says that "If CISPA is passed, the US government gains the power to shut off Internet traffic." That wrong, and so provably wrong that it may be a lie. The bill is here. http://www.govtrack.us/congress/bills/112/hr3523/text http://www.govtrack.us/congress/bills/112/hr3523/text There isn't a word in there about shutting off Internet traffic. More reputable sources--like EFF, for whom Namecheap is fundraising--don't make that outrageous claim. Namecheap is trying to make a buck off the gullible.

busterarm 14y ago
It's not any different than the marketing that companies on the other side of these bills use to get public support for them. It's a game of lies and honesty doesn't pay. I'm just glad to be using a company that is consistently (thus far) on the right side of this issue.
- tptacek 14y ago
  My 13 year old son, who is not exactly a lodestar of ethical and moral judgement at this point in his development, understands intuitively that other people's lies do not actually build a space for him to comfortably fill with his own lies.
  - busterarm 14y ago
    If you think I'm approving of the practice, you're wrong. They're doing it though because it works and because there is no likelihood that they will actually be held accountable in a way that affects their bottom line. We're talking about marketing here. Truth has no place in marketing. If your truth has any impact, you wouldn't need to market.
tptacek 14y ago
EFF made a series of outrageous claims about CISPA. If all your information about CISPA came from EFF, you might indeed think that CISPA was an attempt to reintroduce SOPA. EFF is not a trustworthy source of information about CISPA. I believe they're using it as a vector for fundraising. They're certainly not trying to educate about it.
- gojomo 14y ago
  Can you provide more detail about the "outrageous claims about CISPA" made by the EFF? (That's a strong accusation without details.)
  - tptacek 14y ago

tptacek 14y ago

Wait, is this year's CISPA dramatically different than last year's? Because if it's basically the same bill, this is a profoundly dishonest campaign. 2012's CISPA: * Did not provide the government with any capability to shut down traffic * Explicitly rejected enforcement of intellectual property, going so far as to remove IP from a list of assets protected by the bill * Created an entirely voluntary opt-in mechanism for companies to share information about attacks * Limited the information shared to attack data, and provided a definition in the law for what "attack" meant that did not include piracy CISPA 2012 was not a "warmed over SOPA". SOPA was so much more intrusive than CISPA 2012 that it is strange to even compare them. So, is CISPA 2013 much worse?

gojomo 14y ago
Organizations ranging from Mozilla and the ACM, to the EFF and ACLU, to grassroots activist groups of the left and right didn't share your casual confidence in the reasonableness of 2012 CISPA. http://en.wikipedia.org/wiki/Cyber_Intelligence_Sharing_and_Protection_Act#Opposition http://en.wikipedia.org/wiki/Cyber_Intelligence_Sharing_and_... Their analysis was that once a determination of a 'cyber threat' was made and shared, private communications and other data that would usually require stronger cause could (and probably would) then be handed over ('shared') on government request. The words "voluntary opt-in" are not reassuring, if it's a service provider opting-in customer data to law-enforcement, disregarding traditional expectations of privacy or even explicitly agreed terms. When you say 2012 CISPA "remove[d] IP from a list of assets protected by the bill", they could only 'remove' it because the original draft had it in. And, that's the sort of insider-wishlist-item that can be re-added as the bill progresses, or perhaps even interpreted-back-in when the bill contains vague language. The 2013 language includes in its definition of covered 'cybersecurity crimes': "a violation of any provision of title 18, United States Code, created or amended by the Computer Fraud and Abuse Act of 1986 (Public Law 99-474)." That's the same CFAA as used in the recent prosecutions of Swartz and Aurenheimer. It has the open-ended "exceeding authorized access" and "obtains anything of value" language that lets the violation of terms-of-service and unauthorized acquisition of commercially-valued copyrighted material become serious federal crimes. Advocates of new security powers tend to portray their scope as small and reasonable, before passage, but then manage to find a more expansive interpretation, when it behooves them after passage. Because such bills keep changing and stretching, I tend to trust the EFF and ACLU, who will actually litigate cases under the enacted legal regime, about the bill's likely effects.

drucken 14y ago

This bill is nothing like SOPA and whoever is campaigning on this basis is doing a massive disservice to themselves because people can tell the difference. CISPA is just a continuation of clear "wiretapping" landgrabs by the US Federal Government, in this case using the basis of "cybersecurity". The US government have been trying to do this for decades and they will almost certainly succeed, no matter the resistance. What is new is that it seeks to indemnify specific third parties who wiretap or even hack on their behalf. As for the current version of the bill (H.R.3523.RFS), apart from the obviously broad language, there is only one section, on the use of information, that I would be greatly concerned with if I were a US resident, Section 2.C.1 (specifically part A): LIMITATION- The Federal Government may use cyber threat information shared with the Federal Government in accordance with subsection (b)-- `(A) for cybersecurity purposes; `(B) for the investigation and prosecution of cybersecurity crimes; `(C) for the protection of individuals from the danger of death or serious bodily harm and the investigation and prosecution of crimes involving such danger of death or serious bodily harm; `(D) for the protection of minors from child pornography, any risk of sexual exploitation, and serious threats to the physical safety of such minor, including kidnapping and trafficking and the investigation and prosecution of crimes involving child pornography, any risk of sexual exploitation, and serious threats to the physical safety of minors, including kidnapping and trafficking, and any crime referred to in 2258A(a)(2) of title 18, United States Code; or `(E) to protect the national security of the United States. What does "(A)" mean and why is it present when both "(B)" and "(E)" are already present? Without further highly specific legal binding, "for cybersecurity purposes" is far too broad an entry for the use at which the information may be put!

tptacek 14y ago
Exactly how would CISPA indemnify a company that hacked on its behalf? Obviously I'm asking because I think there is no way that it does.
- drucken 14y ago
  Section 2.B.1: SELF-PROTECTED ENTITIES- Notwithstanding any other provision of law, a self-protected entity may, for cybersecurity purposes-- (i) use cybersecurity systems to identify and obtain cyber threat information to protect the rights and property of such self-protected entity; and `(ii) share such cyber threat information with any other entity, including the Federal Government. Section 2.B.4: EXEMPTION FROM LIABILITY- No civil or criminal cause of action shall lie or be maintained in Federal or State court against a protected entity, self-protected entity, cybersecurity provider, or an officer, employee, or agent of a protected entity, self-protected entity, or cybersecurity provider, acting in good faith-- `(A) for using cybersecurity systems to identify or obtain cyber threat information or for sharing such information in accordance with this section; or `(B) for decisions made based on cyber threat information identified, obtained, or shared under this section. 1. The key phrase "Notwithstanding any other provision of law" allows those parts of the bill to ignore all other laws. 2. "EXEMPTION FROM LIABILITY" subsection could not be any more clear. 3. "use cybersecurity systems to identify and obtain cyber threat information" is such broad language as to mean almost anything, especially in context of software. But we're getting side-tracked, imo. At this point, I would not even try to prevent the US government getting whatever information it wanted, however it wanted - third party or not. The key is what they are allowed to do with it after they have it...

clark-kent 14y ago

Namecheap is beginning to look bad in my eyes with all this.

EduardoBautista 14y ago
I don't know how they are even that popular. They are just a reseller, rode the anti-godaddy circlejerk campaign, and just try to go with whatever internet "freedom" circlejerk they can find to add customers. There are much better domain registrars out there.