3 ms·

Agreed. There are valid reasons for the bill(mostly around giving agencies the ability to do their jobs in the digital age without unnecessary restrictions). Al

by deelowe 14y ago

Agreed. There are valid reasons for the bill(mostly around giving agencies the ability to do their jobs in the digital age without unnecessary restrictions). Also, there's that whole issue of having the ability to do something about cyberterrorism(which is happening today by the way). The implementation may not be sound, but something does need to be done. The CIA and FBI need to be able to research and distribute malware. The government needs to have a way to do something in cyber warefare scenarios. This is why the bill has so many supporters. My guess is that big businesses are supporting this(Google) due to them having been bit by state sponsored attacks in the past(http://world.time.com/2012/06/06/google-warns-gmail-users-of-state-sponsored-attacks/ http://world.time.com/2012/06/06/google-warns-gmail-users-of...).

cygwin98 14y ago
Do you see the contradiction here? Google pulled out of China a few years ago because Chinese government was supposedly doing shits like this. Google followed its unofficial "Do not Evil" motto. That's cool. Then this time it is OK for the US to do the same?
- deelowe 14y ago
  I think you misunderstood me. I wasn't saying the govt. should be allowed to conduct cyberwarfare. However, they should be allowed to conduct investigations into cyberwarfare and protect it's citizens against it. That's one of the major intents here. The FBI and CIA can not work together on investigations when it involves doing something like working with private entities to share maleware or explore attack vectors. To be clear, they can't even do whitehat things today that private citizens are allowed due to regulatory restrictions. I'm not saying this justifies cispa. It doesn't. But, it does help frame the discussion in a productive way.
  - cygwin98 14y ago
    No problem. Maybe just me (perhaps quite some people here as well) had a high expectation over Google. I thought Google pulled off that stunt from a human right stand, rather than from simply being patriotic to the USA. GOOG has much more resources than Elon Musk to do lots of stuffs meaningful for the greater good of human being.
    - deelowe 14y ago
      Well. Ideally, I'm sure they'd like to do both. Pull out of the country(for human rights reasons) and then turn the data over to the feds(for investigative purposes). Goog doesn't have the power to protect the nation or other businesses from similar activities, but they could certainly help the CIA do that, if needed.
AnthonyMouse 14y ago
>something does need to be done. Can you elaborate on why that is? "Something must be done" is the refrain of private defense contractors seeking new revenue streams following the tapering off of our most recent foreign excursions. "Cyber war" is total B.S. It's just taking the same industrial espionage issues that have existed forever and adding "on a computer" to it in order to increase the hype level. There are a ton of things the government could actually do to help with information security. Some of them are even in the bill -- I don't think anyone has a problem with government providing threat information to the private sector. Or how about more funding for security research. Incentives to implement protocols like DNSSEC. But there is no excuse for exempting corporations from all privacy laws using extremely vague language. The problem with this bill is very much the implementation rather than the intent, but "good intentions" are no justification for bad legislation.
- tptacek 14y ago
  Incidentally, not to get me started on another topic that will result in 18,000 new comments from me, but DNSSEC is a boondoggle that won't help the Internet and is a massive favor to the largest registrars. We should be thankful that we dodged the bullet of a bill that mandated DNSSEC.
  - icebraining 14y ago
    That's interesting. Have you (or someone else) written about the issues with DNSSEC somewhere? It always seemed to me that the role of the registrars wouldn't change much.
    - tptacek 14y ago
      I've written a lot about DNSSEC, but we tore the blog down so I can't cite it; the best I can do is: https://news.ycombinator.com/item?id=4071178 https://news.ycombinator.com/item?id=4071178
  - AnthonyMouse 14y ago
    It seems like your argument is that TLS is better than DNSSEC, so use that instead. But how is that better than using both? I'll give you that DNSSEC is imperfectly designed, but given that it hasn't been widely deployed, why not just make DNSSECv2 which addresses the concerns (like have the end user device verify the signature)?
betterunix 14y ago
"giving agencies the ability to do their jobs in the digital age without unnecessary restrictions" Personally, I would happy to see less power given to law enforcement agencies. Maybe a quid pro quo: we let them access communications more easily if they stop using soldiers to do police work. "that whole issue of having the ability to do something about cyberterrorism" Something like this? https://en.wikipedia.org/wiki/Operation_Sundevil https://en.wikipedia.org/wiki/Operation_Sundevil Do you really think we need another E911 document prosecution in this country? "The CIA and FBI need to be able to research and distribute malware" They already do that. What does CISPA add?

by deelowe 14y ago

cygwin98 14y ago

Do you see the contradiction here? Google pulled out of China a few years ago because Chinese government was supposedly doing shits like this. Google followed its unofficial "Do not Evil" motto. That's cool. Then this time it is OK for the US to do the same?

deelowe 14y ago
I think you misunderstood me. I wasn't saying the govt. should be allowed to conduct cyberwarfare. However, they should be allowed to conduct investigations into cyberwarfare and protect it's citizens against it. That's one of the major intents here. The FBI and CIA can not work together on investigations when it involves doing something like working with private entities to share maleware or explore attack vectors. To be clear, they can't even do whitehat things today that private citizens are allowed due to regulatory restrictions. I'm not saying this justifies cispa. It doesn't. But, it does help frame the discussion in a productive way.
- cygwin98 14y ago
  No problem. Maybe just me (perhaps quite some people here as well) had a high expectation over Google. I thought Google pulled off that stunt from a human right stand, rather than from simply being patriotic to the USA. GOOG has much more resources than Elon Musk to do lots of stuffs meaningful for the greater good of human being.
  - deelowe 14y ago
    Well. Ideally, I'm sure they'd like to do both. Pull out of the country(for human rights reasons) and then turn the data over to the feds(for investigative purposes). Goog doesn't have the power to protect the nation or other businesses from similar activities, but they could certainly help the CIA do that, if needed.

AnthonyMouse 14y ago

>something does need to be done. Can you elaborate on why that is? "Something must be done" is the refrain of private defense contractors seeking new revenue streams following the tapering off of our most recent foreign excursions. "Cyber war" is total B.S. It's just taking the same industrial espionage issues that have existed forever and adding "on a computer" to it in order to increase the hype level. There are a ton of things the government could actually do to help with information security. Some of them are even in the bill -- I don't think anyone has a problem with government providing threat information to the private sector. Or how about more funding for security research. Incentives to implement protocols like DNSSEC. But there is no excuse for exempting corporations from all privacy laws using extremely vague language. The problem with this bill is very much the implementation rather than the intent, but "good intentions" are no justification for bad legislation.

tptacek 14y ago
Incidentally, not to get me started on another topic that will result in 18,000 new comments from me, but DNSSEC is a boondoggle that won't help the Internet and is a massive favor to the largest registrars. We should be thankful that we dodged the bullet of a bill that mandated DNSSEC.
- icebraining 14y ago
  That's interesting. Have you (or someone else) written about the issues with DNSSEC somewhere? It always seemed to me that the role of the registrars wouldn't change much.
  - tptacek 14y ago
    I've written a lot about DNSSEC, but we tore the blog down so I can't cite it; the best I can do is: https://news.ycombinator.com/item?id=4071178 https://news.ycombinator.com/item?id=4071178
- AnthonyMouse 14y ago
  It seems like your argument is that TLS is better than DNSSEC, so use that instead. But how is that better than using both? I'll give you that DNSSEC is imperfectly designed, but given that it hasn't been widely deployed, why not just make DNSSECv2 which addresses the concerns (like have the end user device verify the signature)?

betterunix 14y ago

"giving agencies the ability to do their jobs in the digital age without unnecessary restrictions" Personally, I would happy to see less power given to law enforcement agencies. Maybe a quid pro quo: we let them access communications more easily if they stop using soldiers to do police work. "that whole issue of having the ability to do something about cyberterrorism" Something like this? https://en.wikipedia.org/wiki/Operation_Sundevil https://en.wikipedia.org/wiki/Operation_Sundevil Do you really think we need another E911 document prosecution in this country? "The CIA and FBI need to be able to research and distribute malware" They already do that. What does CISPA add?