6 ms·

In this case I was mostly referring to the inclusion of certificate pinning (ex: https://github.com/moxie0/AndroidPinning https://github.com/moxie0/AndroidPinni

by moxie 13y ago

In this case I was mostly referring to the inclusion of certificate pinning (ex: https://github.com/moxie0/AndroidPinning https://github.com/moxie0/AndroidPinning) in the mobile apps, which would theoretically prevent them from using a UAE or Saudi controlled CA to do the interception. In addition to iOS and Android, we also refused to compromise with low-end platforms like MediaTek, and made sure those clients were also all-TLS and that they employed certificate pinning. We also did common sense stuff like including assertions in all the platforms that would prevent accidental HTTP leakage. More generally, a lot of common sense effort was put into the general TLS posture of the website. From certificate pinning baked into the browsers, to HSTS headers, to making sure the links in search results are https. There was a bunch of generally nice TLS stuff in the pipe as well, but I'm not sure if it shipped yet.

ComputerGuru 13y ago
If you really want the world to be a more secure place, can I please ask that you relicense the AndroidPinning code as BSD or something less viral than GPLv3? I don't see Instagram, Facebook, etc. using that code to secure their apps, they won't license their Android clients as GPLv3 just to use the Android pinning library. While it is easy enough to re-create your code (though I have not looked at it), given that we're talking encryption libs, it's always nicest to have secure, vetted libs that just work. (As a matter of fact, I'm sure you had to relicense it for Twitter to use it in their app.)
- tedks 13y ago
  From the README: >Please contact me if this license doesn't work for you. I see no reason why Moxie should give Facebook and Instagram this valuable feature for free. When did open-source hackers become the unpaid laborers for silicon valley? If they want it, they can either release the source code for their applications and liberate their users, or they can pay (hopefully) through the nose for it. Maybe that'll buy a few more months of TextSecure development, or whatever other cool things Moxie is doing now.
  - ianlevesque 13y ago
    Facebook or Instagram will just reimplement it themselves if they care. Smaller developers will just remain insecure. GPLv3 harms adoption of something like this.
    - tptacek 13y ago
      If you think that, go implement a MIT-licensed variant.
      - tomjen3 13y ago
        Not that simple, you have often stated that normal programmers shouldn't be near security and now you are stating that they should go implement something that is specifically to enhance the security of the web. The gp isn't asking for a change of license because he hate the GPL, he is (properly correctly) predicting what will happen if that license isn't changed: specifically, the thing that Moxie is trying to prevent won't be.
        tptacek 13y ago
        I don't say normal developers shouldn't be near "security"; I say they shouldn't be implementing cryptographic primitives.
        cantankerous 13y ago
        Note: AndroidPinning is not a cryptographic primitive.
        tptacek 13y ago
        No, it isn't.
    - forgottenpaswrd 13y ago
      Facebook or Instagram could PAY for getting a license better than GPLv3. That something is GPL does not mean that could not be also licenced as proprietary for those that pay if they don't want the limitations of GPL.
- tptacek 13y ago
  If he hadn't taken the time to publish this code, you wouldn't have even known to try to zing him for using the "wrong" license. Perhaps the most rational solution for people like Moxie would simply be to never publish their code, and simply continue to write forcefully and effectively about technical controls and privacy. Then they wouldn't have to jump through silly hoops to prove whether they "really want the world to be a more secure place". Or, how about this: if you really want the world to be a more secure place, why don't you take the time to learn how to implement certificate pinning for Android apps and publish your own MIT-licensed implementation? I'm sure Moxie would join the rest of us in cheering you on.
  - ComputerGuru 13y ago
    You don't have to be such an ass. I asked nicely enough. I fully acknowledge Moxie is better at security than I ever will even dream of being. I just hoped he might see the value in releasing it under a more-amicable license. I don't have the numbers, but more-liberal licenses are by a wide margin the choice for open-source crypto. I'm not speaking from the armchair, I've released open-source code under BSD/MIT myself. I don't have Moxie's skill for security, is it so wrong to point out the obstacle the license represents? He did release it to help secure the web, did he not? Why don't you let him reply.
    - gnu8 13y ago
      There's more value in forcing vendors to work with Free Software licenses than in compromising the ideals of open source to allow vendors to benefit without contributing back. You should be asking yourself how you can change your project so that GPL3 licensed code will be acceptable, rather than asking others to relicense their code.
      - GHFigs 13y ago
        I humbly contend that forcing people to do anything in the name of an preserving the purity of an ideology is a Bad Idea.
- JabavuAdams 13y ago
  > I don't see Instagram, Facebook, etc. using that code to secure their apps, they won't license their Android clients as GPLv3 They might license the code under a non-exclusive license with different terms. I.e. the copyright holder is free to license the same source code under various licenses. So, e.g. I could license some code to the community under GPL, but I could also license it closed-source to a corp for a fee.

by moxie 13y ago

ComputerGuru 13y ago

If you really want the world to be a more secure place, can I please ask that you relicense the AndroidPinning code as BSD or something less viral than GPLv3? I don't see Instagram, Facebook, etc. using that code to secure their apps, they won't license their Android clients as GPLv3 just to use the Android pinning library. While it is easy enough to re-create your code (though I have not looked at it), given that we're talking encryption libs, it's always nicest to have secure, vetted libs that just work. (As a matter of fact, I'm sure you had to relicense it for Twitter to use it in their app.)

tedks 13y ago
From the README: >Please contact me if this license doesn't work for you. I see no reason why Moxie should give Facebook and Instagram this valuable feature for free. When did open-source hackers become the unpaid laborers for silicon valley? If they want it, they can either release the source code for their applications and liberate their users, or they can pay (hopefully) through the nose for it. Maybe that'll buy a few more months of TextSecure development, or whatever other cool things Moxie is doing now.
- ianlevesque 13y ago
  Facebook or Instagram will just reimplement it themselves if they care. Smaller developers will just remain insecure. GPLv3 harms adoption of something like this.
  - tptacek 13y ago
    If you think that, go implement a MIT-licensed variant.
    - tomjen3 13y ago
      Not that simple, you have often stated that normal programmers shouldn't be near security and now you are stating that they should go implement something that is specifically to enhance the security of the web. The gp isn't asking for a change of license because he hate the GPL, he is (properly correctly) predicting what will happen if that license isn't changed: specifically, the thing that Moxie is trying to prevent won't be.
      - tptacek 13y ago
        I don't say normal developers shouldn't be near "security"; I say they shouldn't be implementing cryptographic primitives.
        cantankerous 13y ago
        Note: AndroidPinning is not a cryptographic primitive.
        tptacek 13y ago
        No, it isn't.
  - forgottenpaswrd 13y ago
    Facebook or Instagram could PAY for getting a license better than GPLv3. That something is GPL does not mean that could not be also licenced as proprietary for those that pay if they don't want the limitations of GPL.
tptacek 13y ago
If he hadn't taken the time to publish this code, you wouldn't have even known to try to zing him for using the "wrong" license. Perhaps the most rational solution for people like Moxie would simply be to never publish their code, and simply continue to write forcefully and effectively about technical controls and privacy. Then they wouldn't have to jump through silly hoops to prove whether they "really want the world to be a more secure place". Or, how about this: if you really want the world to be a more secure place, why don't you take the time to learn how to implement certificate pinning for Android apps and publish your own MIT-licensed implementation? I'm sure Moxie would join the rest of us in cheering you on.
- ComputerGuru 13y ago
  You don't have to be such an ass. I asked nicely enough. I fully acknowledge Moxie is better at security than I ever will even dream of being. I just hoped he might see the value in releasing it under a more-amicable license. I don't have the numbers, but more-liberal licenses are by a wide margin the choice for open-source crypto. I'm not speaking from the armchair, I've released open-source code under BSD/MIT myself. I don't have Moxie's skill for security, is it so wrong to point out the obstacle the license represents? He did release it to help secure the web, did he not? Why don't you let him reply.
  - gnu8 13y ago
    There's more value in forcing vendors to work with Free Software licenses than in compromising the ideals of open source to allow vendors to benefit without contributing back. You should be asking yourself how you can change your project so that GPL3 licensed code will be acceptable, rather than asking others to relicense their code.
    - GHFigs 13y ago
      I humbly contend that forcing people to do anything in the name of an preserving the purity of an ideology is a Bad Idea.
JabavuAdams 13y ago
> I don't see Instagram, Facebook, etc. using that code to secure their apps, they won't license their Android clients as GPLv3 They might license the code under a non-exclusive license with different terms. I.e. the copyright holder is free to license the same source code under various licenses. So, e.g. I could license some code to the community under GPL, but I could also license it closed-source to a corp for a fee.