9 ms·

Tools For Treason

132 points by llambda 13y ago

noonespecial 13y ago
Just like in medicine, if its not strong enough to kill, its not strong enough to cure either.
- mistercow 13y ago
  Of course, in medicine that's not actually true. Where do people come up with these silly sayings?
  - noonespecial 13y ago
    I think it was supposed to be a "rule of thumb" not a law of nature. I heard it used in response to "snake oil" cures that were supposed to be completely harmless but cure everything from cancer to pancreatitis. If you carry it out to the point of absurdity, even water can kill people if too much is ingested too fast.
- dllthomas 13y ago
  Yup, if you're starting to suffer from the onset of scurvy, don't bother with vitamin C - no way it's strong enough to cure.
  - cjp 13y ago
    http://en.wikipedia.org/wiki/Vitamin_C#Overdose http://en.wikipedia.org/wiki/Vitamin_C#Overdose
    - andrewcooke 13y ago
      https://en.wikipedia.org/wiki/Water_intoxication https://en.wikipedia.org/wiki/Water_intoxication
    - dllthomas 13y ago
      "The mechanism of death from such doses (1.2% of body weight, or 0.84 kg for a 70 kg human) is unknown, but may be more mechanical than chemical. The LD50 in humans remains unknown, given lack of any accidental or intentional poisoning death data." That seems an awfully low threshold for "strong enough to kill".
venomsnake 13y ago
I am a bit disturbed of him calling virtualized hardware safe. It by definition is not. I think that every person should have personal encryption router from whih to access the cloud services
- saraid216 13y ago
  > whih I thought this was some technology I wasn't aware of until I realized it was just missing a 'c'. :P
- grugq 13y ago
  You got that so close, but wrong. Cloud services are inherently insecure because you don't have physical control over the devices containing your data. You have to trust that the remote end is secure, and exploiting trust is what intelligence agencies do best. For an encrypted router, here is my script for making a RaspberryPi into a PORTAL: https://github.com/grugq/PORTALofPi https://github.com/grugq/PORTALofPi And an older blog post on why encryption and tradecraft only get you so far: http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/ http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/ Here is the Ruckus Society's manual on "security culture" which has some brief info on why you need physical control over your data storage devices. Includes also some pointers on how to establish strong(er) physical security for your data. http://ruckus.org/article.php?id=789 http://ruckus.org/article.php?id=789
- devindotcom 13y ago
  I don't think that just any virtualized hardware is safe fundamentally or anything, I just meant it as a practical option instead of multiplying machines. Obviously trust, as I wrote, can't enter the equation. But if you are sure (in the mathematical sense) that the virtualized machine cannot be doing anything but running tangential software and relaying your info without the possibility of decrypting, it seems safe to me. Obviously if I'm wrong let me know, but I just meant it as a general alternative to people having their own entirely isolated physical server, local or remote.
smoyer 13y ago
Excellent article ... The comments on the article's page are interesting. He's obviously not advocating treason, but one of the comments goes to great lengths explaining that those controlling the data collection are duly elected. I was tempted to compare this type of end-to-end security to the second amendment (the right to bear arms), which was a right given to the people (in part) to ensure they could overthrow a corrupt government should one form - I don't think we're to that point and overreaching by the government has contracted back to reasonable levels before. But thinking about this issue from a constitutional level, we have indeed (as the article states) given away our fourth amendment rights, and I don't see how developing the systems described in the article could be construed as treason - I'm simply making myself personally responsible for enforcing my fourth amendment rights. My steps: - Replace Google Apps for domains with my own servers. - Stop using drop-box - Establish private communications channels for IM (and perhaps something like Twitter. Then I'll only use public infrastructure for data/messages I want to be public. Unfortunately, the list above represents a lot of work and is exactly the reason we seeded control of our data to outside corporations. We gave them our data as a means to simplify our lives or to gain greater "connectivity". It won't be so easy to go back.
- temphn 13y ago
  one of the comments goes to great lengths explaining that those controlling the data collection are duly elected. And how powerless are they? The unelected Clapper did anything, while the elected Wyden could do nothing. The technologist Snowden did everything. Democracy didn't bell the cat of the government bureaucracy. Technology did. Technology is more powerful than both democracy and bureaucracy, as it is not subject to dilution and co-optation.
  - steveklabnik 13y ago
    > Technology is more powerful than both democracy and bureaucracy, as it is not subject to dilution and co-optation. How many web sites do you visit with ads compared to the ones you don't, again? I mean, the whole "eternal September" concept is predicated on certain technologies being diluted/coopted.
  - 13y ago
rainsford 13y ago
I found the almost throw away shot the article took at Spideroak to be kind of odd. While I'm sure they comply with the law, their service would not seem to allow them to very easily "decrypt on command". In fact services like Spideroak would seem to be a reasonable tradeoff between convenience and security. A service you run on your own server from open source code reviewed by experts could be more secure, but it's a lot more of a hassle to set up.
- devindotcom 13y ago
  I don't think that Spideroak would just decrypt your data if someone said pretty please, but the fact is that they retain the ability to do so if they are legally obligated to. It follows that they may do so if they are not legally obligated to, though I don't mean to imply that they would (and I don't think I do in the article, sorry if it comes across that way). It does mean that they can decrypt on command, though. If they have access theoretically, they have it practically, in this case. There's a difference between them and other cloud services but it's more like the difference between varieties of apple than between apples and oranges, I think.
Zigurd 13y ago
Hopefully this article describes the outcome: That spying eventually makes us more free by making people truly secure their documents and communications against all intrusion short of the government running a black bag job on them. That provides a natural restraint on government intrusion.
rch 13y ago
Freenet has been around for a long time. I wonder about it having been compromised though.

Tools For Treason

132 points by llambda 13y ago

noonespecial 13y ago

Just like in medicine, if its not strong enough to kill, its not strong enough to cure either.

mistercow 13y ago
Of course, in medicine that's not actually true. Where do people come up with these silly sayings?
- noonespecial 13y ago
  I think it was supposed to be a "rule of thumb" not a law of nature. I heard it used in response to "snake oil" cures that were supposed to be completely harmless but cure everything from cancer to pancreatitis. If you carry it out to the point of absurdity, even water can kill people if too much is ingested too fast.
dllthomas 13y ago
Yup, if you're starting to suffer from the onset of scurvy, don't bother with vitamin C - no way it's strong enough to cure.
- cjp 13y ago
  http://en.wikipedia.org/wiki/Vitamin_C#Overdose http://en.wikipedia.org/wiki/Vitamin_C#Overdose
  - andrewcooke 13y ago
    https://en.wikipedia.org/wiki/Water_intoxication https://en.wikipedia.org/wiki/Water_intoxication
  - dllthomas 13y ago
    "The mechanism of death from such doses (1.2% of body weight, or 0.84 kg for a 70 kg human) is unknown, but may be more mechanical than chemical. The LD50 in humans remains unknown, given lack of any accidental or intentional poisoning death data." That seems an awfully low threshold for "strong enough to kill".

venomsnake 13y ago

I am a bit disturbed of him calling virtualized hardware safe. It by definition is not. I think that every person should have personal encryption router from whih to access the cloud services

saraid216 13y ago
> whih I thought this was some technology I wasn't aware of until I realized it was just missing a 'c'. :P
grugq 13y ago
You got that so close, but wrong. Cloud services are inherently insecure because you don't have physical control over the devices containing your data. You have to trust that the remote end is secure, and exploiting trust is what intelligence agencies do best. For an encrypted router, here is my script for making a RaspberryPi into a PORTAL: https://github.com/grugq/PORTALofPi https://github.com/grugq/PORTALofPi And an older blog post on why encryption and tradecraft only get you so far: http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/ http://grugq.github.io/blog/2013/03/12/anonymity-is-hard/ Here is the Ruckus Society's manual on "security culture" which has some brief info on why you need physical control over your data storage devices. Includes also some pointers on how to establish strong(er) physical security for your data. http://ruckus.org/article.php?id=789 http://ruckus.org/article.php?id=789
devindotcom 13y ago
I don't think that just any virtualized hardware is safe fundamentally or anything, I just meant it as a practical option instead of multiplying machines. Obviously trust, as I wrote, can't enter the equation. But if you are sure (in the mathematical sense) that the virtualized machine cannot be doing anything but running tangential software and relaying your info without the possibility of decrypting, it seems safe to me. Obviously if I'm wrong let me know, but I just meant it as a general alternative to people having their own entirely isolated physical server, local or remote.

smoyer 13y ago

Excellent article ... The comments on the article's page are interesting. He's obviously not advocating treason, but one of the comments goes to great lengths explaining that those controlling the data collection are duly elected. I was tempted to compare this type of end-to-end security to the second amendment (the right to bear arms), which was a right given to the people (in part) to ensure they could overthrow a corrupt government should one form - I don't think we're to that point and overreaching by the government has contracted back to reasonable levels before. But thinking about this issue from a constitutional level, we have indeed (as the article states) given away our fourth amendment rights, and I don't see how developing the systems described in the article could be construed as treason - I'm simply making myself personally responsible for enforcing my fourth amendment rights. My steps: - Replace Google Apps for domains with my own servers. - Stop using drop-box - Establish private communications channels for IM (and perhaps something like Twitter. Then I'll only use public infrastructure for data/messages I want to be public. Unfortunately, the list above represents a lot of work and is exactly the reason we seeded control of our data to outside corporations. We gave them our data as a means to simplify our lives or to gain greater "connectivity". It won't be so easy to go back.

temphn 13y ago
one of the comments goes to great lengths explaining that those controlling the data collection are duly elected. And how powerless are they? The unelected Clapper did anything, while the elected Wyden could do nothing. The technologist Snowden did everything. Democracy didn't bell the cat of the government bureaucracy. Technology did. Technology is more powerful than both democracy and bureaucracy, as it is not subject to dilution and co-optation.
- steveklabnik 13y ago
  > Technology is more powerful than both democracy and bureaucracy, as it is not subject to dilution and co-optation. How many web sites do you visit with ads compared to the ones you don't, again? I mean, the whole "eternal September" concept is predicated on certain technologies being diluted/coopted.
- 13y ago

rainsford 13y ago

I found the almost throw away shot the article took at Spideroak to be kind of odd. While I'm sure they comply with the law, their service would not seem to allow them to very easily "decrypt on command". In fact services like Spideroak would seem to be a reasonable tradeoff between convenience and security. A service you run on your own server from open source code reviewed by experts could be more secure, but it's a lot more of a hassle to set up.

devindotcom 13y ago
I don't think that Spideroak would just decrypt your data if someone said pretty please, but the fact is that they retain the ability to do so if they are legally obligated to. It follows that they may do so if they are not legally obligated to, though I don't mean to imply that they would (and I don't think I do in the article, sorry if it comes across that way). It does mean that they can decrypt on command, though. If they have access theoretically, they have it practically, in this case. There's a difference between them and other cloud services but it's more like the difference between varieties of apple than between apples and oranges, I think.

Zigurd 13y ago

Hopefully this article describes the outcome: That spying eventually makes us more free by making people truly secure their documents and communications against all intrusion short of the government running a black bag job on them. That provides a natural restraint on government intrusion.

rch 13y ago

Freenet has been around for a long time. I wonder about it having been compromised though.