12 ms·

Why we can't go back to business as usual post-PRISM

471 points by nullc 13y ago

ericHosick 13y ago
This may seem a bit off topic, but I do agree that we can't go back. So, I'm asking here. We are building out a software development framework "from scratch" and would like to make security a core aspect of the framework. Where would be a good place to start looking at encryption solutions? For example, would PGP be a good option?
- SoftwareMaven 13y ago
  Assuming you trust it (e.g. Google), Keyczar[1] is a good starting point. If you don't trust it and you can deal with the GPL, GPG[2] is probably a reasonable way to go, but key management is still a bitch. Of course, these are very high level answers, and neither may actually work for you project, since you don't really talk about what making "security a core aspect" actually means. Cryptography is insanely hard to get right. The more you can leave up to the peer-reviewed experts, the better. 1. http://www.keyczar.org/ http://www.keyczar.org/ 2. http://www.gnupg.org/ http://www.gnupg.org/
  - ericHosick 13y ago
    Thanks. We'll check these out. We're creating a development environment based on a visual object language using a fully composable framework. The output of the development environment is blobs of "hooked up" objects. The user's programs are stored on host servers and, in real time, propagated to all people working on the project. Meta-data and data are also part of a program the user is creating. We would like to encrypt the blobs of objects so behavior can not be injected into the program (logic can be injected anywhere - think something like Aspect oriented programming to an extreme). We would like to encrypt any data (program - blobs of objects, meta-data and private user data) that is being persisted and/or propagated.
    - stock_toaster 13y ago
      Also check out http://nacl.cr.yp.to http://nacl.cr.yp.to there is a more library friendly version called sodium[1]. I don't know how much review has been done of that so far yet though.... [1]: http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-cryptographic-library/ http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-...
      - ericHosick 13y ago
        Sodium looks really interesting. Thank you.
- einhverfr 13y ago
  Here's my view. I recently wrote an article on my blog (http://ledgersmbdev.blogspot.com/2013/06/tangent-design-thougths-about-next-gen.html http://ledgersmbdev.blogspot.com/2013/06/tangent-design-thou...) which was on the front page of HN for a while. I want to summarize both my thoughts again and things that have occurred to me after writing it. All of our existing key interchange systems are amazingly brittle. With X509, there's no reason to assume the NSA couldn't order verisign to produce a certificate for any given individual or site which they could then use to orchestrate a MITM attack. Purely synchronic protections (i.e. focused exclusively at the moment of exchange) are obsolete in my view. Similarly purely diachronic protections have problems too, and often aren't well implemented. Suppose you need to rotate ssh host keys. This becomes a problem. I think we need something a lot better. Regarding PGP, the question is what they can break. Could they get a court order to force MIT to help them present that your key on their directory is visible to you but their key is visible to everyone else (allowing them to step in between and conduct another MITM attack of another variety? Even if you add endorsements (web of trust model), how easily can that be attacked? It might be harder but not that much harder. So my thinking is this. Start with a standard PKI model and extend it to require evidence of continuity. The assumptions required to do this are: 1. No external authority issues private keys, and 2. You must retain and continue to use an old private key for an unspecified transition period (possibly spanning several keys). This shows a chain of issuance, and evidence that the same entity controls the same internally issued private keys over time. So suppose you define a transition period of 2 years and a key rotation period of one year. This means that anyone you have been in communication with over the last three years will be able to check that the continuity of key possession has not changed, and three keys would have to be compromised to force a certificate believably (two of those keys can be stored somewhere else and only used for the certificate resigning process) If a MITM attack starts, anyone who has been in contact in that period knows instantly that something is wrong. Newcomers get alerted when the MITM attack stops. I would recommend looking into what we can do to implement a system like that. I am thinking of trying to write it up as an RFC and submit it to the various bodies.
  - ericHosick 13y ago
    I did a search in google for the HN post but couldn't find it. Could you give me the link to that HN post?
- deleted 13y ago
  [deleted]
- coldpie 13y ago
  Since the story broke last week, I've been thinking about a PKI-based message program (think email, but not actually email) built on top of Freenet, to remove the need of any central server. I think I have a reasonable idea of how it would work, but I'm not convinced it would help anything. Tools already exist to securely send messages. Someone who truly cares about their security will learn how to use them. People who don't care about security won't bother. Hell, people already put all of their information on the Internet for effectively everybody to view. What would an easy-to-use, secure crypto app help with? I don't know.
  - dpatru 13y ago
    > Someone who truly cares about their security will learn how to use them. Needs are relative. People have a lot of cares in this world and for most people, online anonymity and confidentiality don't rank very high. That's why convenient, cheap solutions are important. Solutions that require people too much won't be used. Think of digital cameras. Most people will use them if they're included free on a phone, but they're not willing to pay $3000 for "quality." Think
deleted 13y ago
[deleted]
whatevenisthis 13y ago
This whole thing is so bizarre to me. The NSA has been doing this sort of thing since at least the early 90s. Who knows, probably earlier. What exactly did people think the NSA was doing? The only difference is that, before digital cell service, it was more difficult to monitor phones conversations because the infrastructure simply didn't support it. Everyone's all riled up over a few PowerPoint slides (which may ver well be fake). I don't get. No mainstream company or consumer has ever given two shits about encryption. You send data in plaintext and are surprised that the NSA might be reading/logging it? The public overwhelmingly supported the PATRIOT Act back when it was passed. Black box rooms in telecom facilities were exposed what, 10 years ago? No one gave a shit. Why do people seem to suddenly care? You can't say it's because, "We have more information," because we really don't. People suddenly care about privacy? I do not understand what those who are outraged thought the NSA did. Honestly, how can you be so ignorant?
- deleted 13y ago
  [deleted]
- microb 13y ago
  What I'm about to say is absolutely nuts, but it could be that this is something the NSA leaked intentionally and the media is running with it for reasons we are not aware of. Despite twitter and the like, the mainstream media is still largely in control of what occupies the "news" and therefore what the otherwise apathetic public is concerned about.
  - cdvonstinkpot 13y ago
    Ok, I'll bite. What sort of hypothetical could warrant such an action, intentionally leaking this story? Do they want to reassure us of their best efforts in protecting us from terrorism? I can't imagine a scenario existing where the tables might eventually turn & those who were once appalled & angry that the NSA was so into everything change their minds and become reassured that the gov't is actually on their game & has the means to get some outrageous terrorist threat we couldn't have imagined under control again because of their broad wiretapping capabilities.
general_failure 13y ago
And yet we will all go back to work. Just wait for wwdc and e3
- samstave 13y ago
  >And yet we will all go back to work. Just wait for ww3 FTFY
general_failure 13y ago
And yet we will all go back to work. Just wait for wwdc and e3
noerps 13y ago
Welcome to counterintelligence, have a nice day. Sorry I forgot to point out https://en.wikipedia.org/wiki/Perfect_forward_secrecy https://en.wikipedia.org/wiki/Perfect_forward_secrecy
b6 13y ago
I'm a peaceful person, but this issue has been simmering in my head for years, and I find myself actually looking forward to some kind of meaningful conflict. I'm sick, sick, sick to death of the president issuing denials while they keep building more and more infrastructure against humanity. I think the article is right, that it'll get worse from here, and in a way, I'm glad.
- rurounijones 13y ago
  "Infrastructure Against Humanity"... That is a really really nice term for it. Also very memorable, I shall be appropriating this term for future use.
  - pvdm 13y ago
    Turnkey tyranny is the other.
    - Andrenid 13y ago
      Interesting that TurnkeyTyranny.com redirects to an article about the NSA issue on the Guardian.
  - onedev 13y ago
    IAH (Infra Against Humanity) Nice, memorable, and accurate. Let's make it an official euphamism.
    - deleted 13y ago
      [deleted]
- fargolime 13y ago
  "Looking forward to conflict" comment auto-logged, reference #391Z328. Report to the proper authorities within 24 hours for interrogation. You've been auto-added to the no-fly list. That's likely what will happen from here, because only a small percentage of American voters care about this issue.
bayesianhorse 13y ago
For me, this incident is an example where the U.S. democracy failed, pure and simple. Obama made campaign promises to not do surveillance. He was elected and then did it anyway. It's frankly impossible now to change this issue in a democratic fashion. From the outside it often looks as if American politicians are overly busy with a very expensive "game", rather than using the game for the greater good.
- obstacle1 13y ago
  This problem is systemic. It has little to do with Obama or Clinton or X, Y, Z individual. Individuals are irrelevant here. What you have is a runaway state.
  - georgemcbay 13y ago
    For better or for worse, Obama is a good symbol for the problem though in that his entire campaign was based on hope and change, only to prove that such change isn't actually possible in a couple of election cycles, if at all.
    - pvnick 13y ago
      He really could have made some sort of progress if it was his intention
      - logn 13y ago
        If that were his intention, he'd have to make sure to never say or write that during his campaign possibly. Yup. And I'd guess there are probably people working on deciphering true intention from merely campaign promises. Welcome to our new world. If not now, then someday... unless the good of humanity prevails in coming years and we change our course.
- taktix 13y ago
  It's because the American people voted for looks over substance. Obama has no morals and no spine, but he looks and sounds like a Hollywood star. Obama is just the US population's reflection in the mirror.
kriro 13y ago
I wonder if there will be a bigger outrage if companies like Salesforce and Oracle are involved. Non-US companies might be a tad alarmed if their ERP provider is cooperating with PRISM. Since Microsoft is explicitly mentioned I wonder if the access includes their SMB-ERP stuff.
- otsuichi 13y ago
  But those companies are both American, aren't they? Regardless, I feel like the ceiling for outrage and/or concern has reached its ceiling, at least among foreign governments who can at least do a semblance of something about it, since it's way more important which companies are used the most than the nations from which the companies in question originate, and the NSA has the data of all the most popular internet companies in the world.
- einhverfr 13y ago
  From the reports I would be surprised if non-hosted ERP stuff was ever easily targeted. Hosted stuff is a bit of a different story. ideally if you are paranoid, you should run things in-house and firewalled. If you are less so, I will point out I help run a British-registered hosting company for an open source ERP (the company can be found at http://www.efficito.com http://www.efficito.com). Everyone wants to talk about how the cloud will change ERP and while I am involved in a startup that is operating in this space, I have to say that it is extremely important for users to know that they give up a lot of control over security when they make that choice. We do our best but we cannot compare to a well-run internal installation.
- Zigurd 13y ago
  Don't bet against it. There are supposedly 50 participants. Expect a continuing drop of revelations.
logn 13y ago
The innocent days of building software and having fun are probably over. Let's get our kicks before the whole shithouse goes up in flames. Then we can figure out how to teach the next generation to build software in the brave new world we'll give them.
kllrnohj 13y ago
Of course we can go back to business as usual post-PRISM, because PRISM turned out to be absolutely nothing. It's a mundane, boring data storage & analysis system for data obtained through FISA requests about specific individuals. It's not a data dump from major tech companies, it's not a warrant-less spy program, etc...
- flyinRyan 13y ago
  You don't have a clue what it is. What you should realize, though is that a lot of people are up in arms about this. Do you think you're smarter than all of them? From this post alone, I see a resounding no.
  - kllrnohj 13y ago
    Here: http://usnews.nbcnews.com/_news/2013/06/08/18850035-intelligence-chief-declassifies-prism-details-slams-reckless-disclosures http://usnews.nbcnews.com/_news/2013/06/08/18850035-intellig... The people up in arms aren't thinking logically, they are thinking emotionally. That's a terrible way to make any sort of decision.
    - flyinRyan 13y ago
      Oh, so one of the people involved in this immoral, illegal spying program says it's not that bad? Well never mind then! I guess it must all be ok. No oversight needed.
raverbashing 13y ago
"Why would you use AES/RSA/etc. when the NSA employs more mathematicians than anyone else and may well have cracked them?" Well, because of everybody else seems to be a good reason. And one thing a bunch of good mathematicians is not better than is math. And as far as we know, they may still be good systems. The construct of encryption systems today is so complex I think the last part they would address would be the algorithms themselves (but they certainly can factor the product of two primes in record time)
- Spearchucker 13y ago
  Assuming for a minute, hypothetically, that the NSA can crack AES and RSA, then the way to combat that is for more people to use it more often, and to create meaningless encrypted spam. Cracking requires huge computing resources. If there's an overwhelming amount of data to crack, with little guarantee of any useful yield, then we can reasonably expect it that negates the ability to crack it.
  - wisty 13y ago
    4Chan is https. So there is a fair amount of meaningless encrypted spam out there already.
    - jafaku 13y ago
      They don't need to crack 4chan, it's in the US.
- waps 13y ago
  Keep in mind that it is a verified fact [1] that the NSA knew about differential cryptanalysis in 1976, when they reinforced DES against it (it turns out that they did not build in a weakness, rather the reverse). That technique was discovered in 1990 ... it seems lots of mathematicians does help. [1] http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27...
fpp 13y ago
Also read the reply by Aaron Greenspan in the thread: https://mailman.stanford.edu/pipermail/liberationtech/2013-June/008839.html https://mailman.stanford.edu/pipermail/liberationtech/2013-J...
Nursie 13y ago
We can't... but we will. Never underestimate the apathy of the general public, their faith in authority, and their general willingness to write this stuff off as 'stuff that affects someone else'. Yeah I know, I'm a cynic.
- jafaku 13y ago
  How can apathy be cured?
  - Nursie 13y ago
    I'm not sure it can. Human history is full of examples of people tolerating the most awful oppression from their leaders. That said there seems to be less and less tolerance of this crap on both sides of the atlantic, I'm just not sure what can be done about it, as most people won't do anything other than have a bit of a moan, and then attempt to vote for the least-worst candidate again next time.
robomartin 13y ago
I know a couple of people that, for as long as I've known them, have been consumed by this idea of having to be able to defend yourself from an intrusive government. They, as one would expect, have gun safes full of guns of all types, piles of ammunition and other survivalist tools and equipment. When the Newtown school massacre happened I actually called a friend in the Sheriff's department to ask if I should "drop a dime" on these guys. My argument was that, while they had never hurt anyone in their lives, perhaps they could one day blow a fuse and use their arsenal to kill innocent people. This was a troubling call for me. I am not anti-gun at all. I don't happen to own any. Yet, I don't have any fundamental objections to law-abiding people owning them. The Newtown event rattled me as much as it probably did lots of people. To my surprise my friend, the Sheriff, said not to worry. He went on to tell me that this sort of thing (stock-piling weapons and ammo) is very common. He said lots of cops do it. He went further and told me "we can find most of these people because they are being tracked one way or the other, whether they know it or not". I didn't think much of that last statement until the latest government scandals started to surface, from the IRS targeting political groups (regardless of alignment, would you like it to happen to you in the future?) to this PRISM/surveillance mess. You now have to wonder where else the government is tracking us. Or, perhaps, the right question could very well be the opposite: Where are you safe? All of a sudden these "nut-cases" who stockpile weapons and wake up every day thinking the government is out to get them actually have something to point to and say: "See, I told you so". I already got that call, BTW. No, I am not going out to buy guns. Not interested. I have enough fun shooting them at the range. I don't feel I need to own any of them for any reason. But, you know, how can I now tell these guys they are insane for thinking the way they do?
- tokenizer 13y ago
  You can't, because a rebellion/revolution is a potentiality. Sure, it seemed unlikely, but now not so much. Would I criticize someone for not locking their front door? No. Locks only keep honest people honest, and the chances of your property being broken into are fairly slim. Would I criticize someone for preparing themselves for a collapse/rebellion/revolution of some kind? Absolutely not. The cost of not doing so is much higher than lost possessions. Rights, Your life, etc... The main thing to take away from this, is that you can't know for sure, and everybody reacts to those percentages differently. It's better to be safe than sorry, or you can live fast and die young without worries. I should note that the duality above can be taken in both contexts.
fnordfnordfnord 13y ago
"And so—before the capability was made public, it _likely_ wouldn't have been used against mere political nuisances," Wasn't this type of data mining the source of the data leading to the expose' of Eliot Spitzer's bad habits; ultimately leading to his political demise? Exposing philandering politicians, or prostitution, are both far away from what I'd consider an appropriate use of technology.

471 points by nullc 13y ago

This may seem a bit off topic, but I do agree that we can't go back. So, I'm asking here. We are building out a software development framework "from scratch" and would like to make security a core aspect of the framework. Where would be a good place to start looking at encryption solutions? For example, would PGP be a good option?

SoftwareMaven 13y ago
Assuming you trust it (e.g. Google), Keyczar[1] is a good starting point. If you don't trust it and you can deal with the GPL, GPG[2] is probably a reasonable way to go, but key management is still a bitch. Of course, these are very high level answers, and neither may actually work for you project, since you don't really talk about what making "security a core aspect" actually means. Cryptography is insanely hard to get right. The more you can leave up to the peer-reviewed experts, the better. 1. http://www.keyczar.org/ http://www.keyczar.org/ 2. http://www.gnupg.org/ http://www.gnupg.org/
- ericHosick 13y ago
  Thanks. We'll check these out. We're creating a development environment based on a visual object language using a fully composable framework. The output of the development environment is blobs of "hooked up" objects. The user's programs are stored on host servers and, in real time, propagated to all people working on the project. Meta-data and data are also part of a program the user is creating. We would like to encrypt the blobs of objects so behavior can not be injected into the program (logic can be injected anywhere - think something like Aspect oriented programming to an extreme). We would like to encrypt any data (program - blobs of objects, meta-data and private user data) that is being persisted and/or propagated.
  - stock_toaster 13y ago
    Also check out http://nacl.cr.yp.to http://nacl.cr.yp.to there is a more library friendly version called sodium[1]. I don't know how much review has been done of that so far yet though.... [1]: http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-cryptographic-library/ http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-...
    - ericHosick 13y ago
      Sodium looks really interesting. Thank you.
einhverfr 13y ago
Here's my view. I recently wrote an article on my blog (http://ledgersmbdev.blogspot.com/2013/06/tangent-design-thougths-about-next-gen.html http://ledgersmbdev.blogspot.com/2013/06/tangent-design-thou...) which was on the front page of HN for a while. I want to summarize both my thoughts again and things that have occurred to me after writing it. All of our existing key interchange systems are amazingly brittle. With X509, there's no reason to assume the NSA couldn't order verisign to produce a certificate for any given individual or site which they could then use to orchestrate a MITM attack. Purely synchronic protections (i.e. focused exclusively at the moment of exchange) are obsolete in my view. Similarly purely diachronic protections have problems too, and often aren't well implemented. Suppose you need to rotate ssh host keys. This becomes a problem. I think we need something a lot better. Regarding PGP, the question is what they can break. Could they get a court order to force MIT to help them present that your key on their directory is visible to you but their key is visible to everyone else (allowing them to step in between and conduct another MITM attack of another variety? Even if you add endorsements (web of trust model), how easily can that be attacked? It might be harder but not that much harder. So my thinking is this. Start with a standard PKI model and extend it to require evidence of continuity. The assumptions required to do this are: 1. No external authority issues private keys, and 2. You must retain and continue to use an old private key for an unspecified transition period (possibly spanning several keys). This shows a chain of issuance, and evidence that the same entity controls the same internally issued private keys over time. So suppose you define a transition period of 2 years and a key rotation period of one year. This means that anyone you have been in communication with over the last three years will be able to check that the continuity of key possession has not changed, and three keys would have to be compromised to force a certificate believably (two of those keys can be stored somewhere else and only used for the certificate resigning process) If a MITM attack starts, anyone who has been in contact in that period knows instantly that something is wrong. Newcomers get alerted when the MITM attack stops. I would recommend looking into what we can do to implement a system like that. I am thinking of trying to write it up as an RFC and submit it to the various bodies.
- ericHosick 13y ago
  I did a search in google for the HN post but couldn't find it. Could you give me the link to that HN post?
deleted 13y ago
[deleted]
coldpie 13y ago
Since the story broke last week, I've been thinking about a PKI-based message program (think email, but not actually email) built on top of Freenet, to remove the need of any central server. I think I have a reasonable idea of how it would work, but I'm not convinced it would help anything. Tools already exist to securely send messages. Someone who truly cares about their security will learn how to use them. People who don't care about security won't bother. Hell, people already put all of their information on the Internet for effectively everybody to view. What would an easy-to-use, secure crypto app help with? I don't know.
- dpatru 13y ago
  > Someone who truly cares about their security will learn how to use them. Needs are relative. People have a lot of cares in this world and for most people, online anonymity and confidentiality don't rank very high. That's why convenient, cheap solutions are important. Solutions that require people too much won't be used. Think of digital cameras. Most people will use them if they're included free on a phone, but they're not willing to pay $3000 for "quality." Think

deleted 13y ago

[deleted]

whatevenisthis 13y ago

This whole thing is so bizarre to me. The NSA has been doing this sort of thing since at least the early 90s. Who knows, probably earlier. What exactly did people think the NSA was doing? The only difference is that, before digital cell service, it was more difficult to monitor phones conversations because the infrastructure simply didn't support it. Everyone's all riled up over a few PowerPoint slides (which may ver well be fake). I don't get. No mainstream company or consumer has ever given two shits about encryption. You send data in plaintext and are surprised that the NSA might be reading/logging it? The public overwhelmingly supported the PATRIOT Act back when it was passed. Black box rooms in telecom facilities were exposed what, 10 years ago? No one gave a shit. Why do people seem to suddenly care? You can't say it's because, "We have more information," because we really don't. People suddenly care about privacy? I do not understand what those who are outraged thought the NSA did. Honestly, how can you be so ignorant?

deleted 13y ago
[deleted]
microb 13y ago
What I'm about to say is absolutely nuts, but it could be that this is something the NSA leaked intentionally and the media is running with it for reasons we are not aware of. Despite twitter and the like, the mainstream media is still largely in control of what occupies the "news" and therefore what the otherwise apathetic public is concerned about.
- cdvonstinkpot 13y ago
  Ok, I'll bite. What sort of hypothetical could warrant such an action, intentionally leaking this story? Do they want to reassure us of their best efforts in protecting us from terrorism? I can't imagine a scenario existing where the tables might eventually turn & those who were once appalled & angry that the NSA was so into everything change their minds and become reassured that the gov't is actually on their game & has the means to get some outrageous terrorist threat we couldn't have imagined under control again because of their broad wiretapping capabilities.

general_failure 13y ago

And yet we will all go back to work. Just wait for wwdc and e3

samstave 13y ago
>And yet we will all go back to work. Just wait for ww3 FTFY

general_failure 13y ago

And yet we will all go back to work. Just wait for wwdc and e3

noerps 13y ago

Welcome to counterintelligence, have a nice day. Sorry I forgot to point out https://en.wikipedia.org/wiki/Perfect_forward_secrecy https://en.wikipedia.org/wiki/Perfect_forward_secrecy

b6 13y ago

I'm a peaceful person, but this issue has been simmering in my head for years, and I find myself actually looking forward to some kind of meaningful conflict. I'm sick, sick, sick to death of the president issuing denials while they keep building more and more infrastructure against humanity. I think the article is right, that it'll get worse from here, and in a way, I'm glad.

rurounijones 13y ago
"Infrastructure Against Humanity"... That is a really really nice term for it. Also very memorable, I shall be appropriating this term for future use.
- pvdm 13y ago
  Turnkey tyranny is the other.
  - Andrenid 13y ago
    Interesting that TurnkeyTyranny.com redirects to an article about the NSA issue on the Guardian.
- onedev 13y ago
  IAH (Infra Against Humanity) Nice, memorable, and accurate. Let's make it an official euphamism.
  - deleted 13y ago
    [deleted]
fargolime 13y ago
"Looking forward to conflict" comment auto-logged, reference #391Z328. Report to the proper authorities within 24 hours for interrogation. You've been auto-added to the no-fly list. That's likely what will happen from here, because only a small percentage of American voters care about this issue.

bayesianhorse 13y ago

For me, this incident is an example where the U.S. democracy failed, pure and simple. Obama made campaign promises to not do surveillance. He was elected and then did it anyway. It's frankly impossible now to change this issue in a democratic fashion. From the outside it often looks as if American politicians are overly busy with a very expensive "game", rather than using the game for the greater good.

obstacle1 13y ago
This problem is systemic. It has little to do with Obama or Clinton or X, Y, Z individual. Individuals are irrelevant here. What you have is a runaway state.
- georgemcbay 13y ago
  For better or for worse, Obama is a good symbol for the problem though in that his entire campaign was based on hope and change, only to prove that such change isn't actually possible in a couple of election cycles, if at all.
  - pvnick 13y ago
    He really could have made some sort of progress if it was his intention
    - logn 13y ago
      If that were his intention, he'd have to make sure to never say or write that during his campaign possibly. Yup. And I'd guess there are probably people working on deciphering true intention from merely campaign promises. Welcome to our new world. If not now, then someday... unless the good of humanity prevails in coming years and we change our course.
taktix 13y ago
It's because the American people voted for looks over substance. Obama has no morals and no spine, but he looks and sounds like a Hollywood star. Obama is just the US population's reflection in the mirror.

kriro 13y ago

I wonder if there will be a bigger outrage if companies like Salesforce and Oracle are involved. Non-US companies might be a tad alarmed if their ERP provider is cooperating with PRISM. Since Microsoft is explicitly mentioned I wonder if the access includes their SMB-ERP stuff.

otsuichi 13y ago
But those companies are both American, aren't they? Regardless, I feel like the ceiling for outrage and/or concern has reached its ceiling, at least among foreign governments who can at least do a semblance of something about it, since it's way more important which companies are used the most than the nations from which the companies in question originate, and the NSA has the data of all the most popular internet companies in the world.
einhverfr 13y ago
From the reports I would be surprised if non-hosted ERP stuff was ever easily targeted. Hosted stuff is a bit of a different story. ideally if you are paranoid, you should run things in-house and firewalled. If you are less so, I will point out I help run a British-registered hosting company for an open source ERP (the company can be found at http://www.efficito.com http://www.efficito.com). Everyone wants to talk about how the cloud will change ERP and while I am involved in a startup that is operating in this space, I have to say that it is extremely important for users to know that they give up a lot of control over security when they make that choice. We do our best but we cannot compare to a well-run internal installation.
Zigurd 13y ago
Don't bet against it. There are supposedly 50 participants. Expect a continuing drop of revelations.

logn 13y ago

The innocent days of building software and having fun are probably over. Let's get our kicks before the whole shithouse goes up in flames. Then we can figure out how to teach the next generation to build software in the brave new world we'll give them.

kllrnohj 13y ago

Of course we can go back to business as usual post-PRISM, because PRISM turned out to be absolutely nothing. It's a mundane, boring data storage & analysis system for data obtained through FISA requests about specific individuals. It's not a data dump from major tech companies, it's not a warrant-less spy program, etc...

flyinRyan 13y ago
You don't have a clue what it is. What you should realize, though is that a lot of people are up in arms about this. Do you think you're smarter than all of them? From this post alone, I see a resounding no.
- kllrnohj 13y ago
  Here: http://usnews.nbcnews.com/_news/2013/06/08/18850035-intelligence-chief-declassifies-prism-details-slams-reckless-disclosures http://usnews.nbcnews.com/_news/2013/06/08/18850035-intellig... The people up in arms aren't thinking logically, they are thinking emotionally. That's a terrible way to make any sort of decision.
  - flyinRyan 13y ago
    Oh, so one of the people involved in this immoral, illegal spying program says it's not that bad? Well never mind then! I guess it must all be ok. No oversight needed.

raverbashing 13y ago

"Why would you use AES/RSA/etc. when the NSA employs more mathematicians than anyone else and may well have cracked them?" Well, because of everybody else seems to be a good reason. And one thing a bunch of good mathematicians is not better than is math. And as far as we know, they may still be good systems. The construct of encryption systems today is so complex I think the last part they would address would be the algorithms themselves (but they certainly can factor the product of two primes in record time)

Spearchucker 13y ago
Assuming for a minute, hypothetically, that the NSA can crack AES and RSA, then the way to combat that is for more people to use it more often, and to create meaningless encrypted spam. Cracking requires huge computing resources. If there's an overwhelming amount of data to crack, with little guarantee of any useful yield, then we can reasonably expect it that negates the ability to crack it.
- wisty 13y ago
  4Chan is https. So there is a fair amount of meaningless encrypted spam out there already.
  - jafaku 13y ago
    They don't need to crack 4chan, it's in the US.
waps 13y ago
Keep in mind that it is a verified fact [1] that the NSA knew about differential cryptanalysis in 1976, when they reinforced DES against it (it turns out that they did not build in a weakness, rather the reverse). That technique was discovered in 1990 ... it seems lots of mathematicians does help. [1] http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27...

fpp 13y ago

Also read the reply by Aaron Greenspan in the thread: https://mailman.stanford.edu/pipermail/liberationtech/2013-June/008839.html https://mailman.stanford.edu/pipermail/liberationtech/2013-J...

Nursie 13y ago

We can't... but we will. Never underestimate the apathy of the general public, their faith in authority, and their general willingness to write this stuff off as 'stuff that affects someone else'. Yeah I know, I'm a cynic.

jafaku 13y ago
How can apathy be cured?
- Nursie 13y ago
  I'm not sure it can. Human history is full of examples of people tolerating the most awful oppression from their leaders. That said there seems to be less and less tolerance of this crap on both sides of the atlantic, I'm just not sure what can be done about it, as most people won't do anything other than have a bit of a moan, and then attempt to vote for the least-worst candidate again next time.

robomartin 13y ago

I know a couple of people that, for as long as I've known them, have been consumed by this idea of having to be able to defend yourself from an intrusive government. They, as one would expect, have gun safes full of guns of all types, piles of ammunition and other survivalist tools and equipment. When the Newtown school massacre happened I actually called a friend in the Sheriff's department to ask if I should "drop a dime" on these guys. My argument was that, while they had never hurt anyone in their lives, perhaps they could one day blow a fuse and use their arsenal to kill innocent people. This was a troubling call for me. I am not anti-gun at all. I don't happen to own any. Yet, I don't have any fundamental objections to law-abiding people owning them. The Newtown event rattled me as much as it probably did lots of people. To my surprise my friend, the Sheriff, said not to worry. He went on to tell me that this sort of thing (stock-piling weapons and ammo) is very common. He said lots of cops do it. He went further and told me "we can find most of these people because they are being tracked one way or the other, whether they know it or not". I didn't think much of that last statement until the latest government scandals started to surface, from the IRS targeting political groups (regardless of alignment, would you like it to happen to you in the future?) to this PRISM/surveillance mess. You now have to wonder where else the government is tracking us. Or, perhaps, the right question could very well be the opposite: Where are you safe? All of a sudden these "nut-cases" who stockpile weapons and wake up every day thinking the government is out to get them actually have something to point to and say: "See, I told you so". I already got that call, BTW. No, I am not going out to buy guns. Not interested. I have enough fun shooting them at the range. I don't feel I need to own any of them for any reason. But, you know, how can I now tell these guys they are insane for thinking the way they do?

tokenizer 13y ago
You can't, because a rebellion/revolution is a potentiality. Sure, it seemed unlikely, but now not so much. Would I criticize someone for not locking their front door? No. Locks only keep honest people honest, and the chances of your property being broken into are fairly slim. Would I criticize someone for preparing themselves for a collapse/rebellion/revolution of some kind? Absolutely not. The cost of not doing so is much higher than lost possessions. Rights, Your life, etc... The main thing to take away from this, is that you can't know for sure, and everybody reacts to those percentages differently. It's better to be safe than sorry, or you can live fast and die young without worries. I should note that the duality above can be taken in both contexts.

fnordfnordfnord 13y ago

"And so—before the capability was made public, it _likely_ wouldn't have been used against mere political nuisances," Wasn't this type of data mining the source of the data leading to the expose' of Eliot Spitzer's bad habits; ultimately leading to his political demise? Exposing philandering politicians, or prostitution, are both far away from what I'd consider an appropriate use of technology.