7 ms·

If anything, I think this should be a wakeup call for those of us who have the capability to change things. I'm not talking about lobbying or raising attention

If anything, I think this should be a wakeup call for those of us who have the capability to change things. I'm not talking about lobbying or raising attention to the issue, but the technical challenges of designing a network that is immune to all forms of surveillance. Let's treat this as an issue of computer science, not politics. Now I'm not claiming that this will be easy (and it may not even be possible), but this whole episode has made me seriously reconsider my long-term career direction in terms of the type of research I want to be doing. Pioneers like Vint Cerf and Bob Kahn created the "Internet 1" so to speak, and everything since then has been building on that. There's been plenty of projects that have worked towards getting around these surveillance measures (Tor for example), and I think we need more things like this. We need to fundamentally rethink the design of the Internet, because the current design is broken. Just like TCP/IP provides the infrastructure to abstract over different networking technologies and physical links (and the failure/slowness of individual links), we need something that abstracts over the basic, unencrypted (or encrypted but subject to centralised sabotage, like SSL) communication layer. Something that third parties can't intercept, at least not with anything like the ease with which they do today. It never ceases to amaze me, for example, that email is still unencrypted by default, and we don't have public-key cryptography built in to every mail client and turned on by default. Most importantly, we need more distribution, and to stop relying on centralised service providers, who are necessarily subject to the laws of the country in which they operate (see: recent articles discussing impacts of the issue on US cloud firms operating in foreign markets). Facebook should be a protocol, not a service. Twitter should be a protocol, not a service. And so forth. This of course completely upends the business model these technologies are based on, and would need to be approached by people with a completely different perspective. I certainly don't have the answers to these questions. But it's made me curious and it's something I'll be giving a great deal of thought to in the coming years. As Albert Einstein once said: "We can not solve our problems with the same level of thinking that created them".

codexon 13y ago
While we're talking about rewriting the Internet, please fix ddos attacks. The current internet is especially prone to ddos attacks to the point where it costs 100x more money to defend than to start an attack of the same size. http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack http://blog.cloudflare.com/deep-inside-a-dns-amplification-d...
- zanny 13y ago
  Change your egress traffic queue discipline. fq_codel was mainlined in the last two years to solve buffer bloat and has the side effect of helping to alleviate ddos. It flags bad traffic flows (ie, ddos attacks) as bad queues and prioritizes other traffic around it. See : https://en.wikipedia.org/wiki/CoDel https://en.wikipedia.org/wiki/CoDel Note, this doesn't help at the endpoint under attack. It requires a qos shift on the infrastructure leading to that thin last mile pipe, so the last mile packets they get are the the good flows. Also, a warning: CoDel itself is pretty experimental still. It is only just being deployed as the default in proprietary routing hardware this year. Other queueing disciplines are an option, but the default (fifo) is a sack of garbage that causes a lot of these issues in its simplicity and inability to bias bad traffic from the good.
  - codexon 13y ago
    I'm talking about 10GE overflowing 20+ gbps attacks for $5. http://www.hackforums.net/forumdisplay.php?fid=232 http://www.hackforums.net/forumdisplay.php?fid=232
GrantS 13y ago
This is completely outside my areas of expertise, and there may already be a name for it, or it may be the dumb thing every rookie thinks of, but what about this: ignoring issues of bandwidth and power consumption (!), if every communications device broadcast a constant stream of data and every other communications device received every bit of data and ignored the (nearly 100%) of it that it didn't care about at the moment, you would eliminate the ability to know who was communicating with whom and when, right? The metadata is gone. If that's true, then now you just need to solve two problems: (1) how to keep the stuff (which you know is being broadcast to absolutely everyone) secret, and (2) how to coordinate the communication. Isn't that just cryptography and synchronizing watches while exchanging secrets in meatspace, stuff that's been known since before computers were part of it? (The point of ignoring power and bandwidth is to determine if this is ever possible in any universe, not just if it's possible for us right now.)
- zanny 13y ago
  Thus is a sledgehammer proposition, because while the minute power utilization to move packets across fiber or coax is insignificant, running the entire Internet at peak throughout all the time would be a huge electrical burden. You know how your phone runs out juice really fast on 4g? Do that, all the time, on everything. Data centers would melt.
  - GrantS 13y ago
    I do completely realize this, but if that's truly the only barrier then we're left in the interesting position in which we can increase society's freedom of communication by increasing energy efficiency. Or maybe then someone could prove that real freedom is impossible due to the physics of the situation, or that freedom is possible today for exactly X people because we must limit ourselves to X devices in the world for the system to work, or that we need to harness the power of 1000 suns to achieve true freedom -- whatever, to me it still seems an interesting thought experiment to establish the boundaries of the problem. I can see why more practical minds may hate this approach. EDIT: Ah, or maybe there is a bitrate at which free communication is possible today -- if everyone sends only 96 bits per day or 8 bits per day at equal intervals, would this keep the internet from melting down. Over time, that bitrate would increase.
syncerr 13y ago
> Let's treat this as an issue of computer science, not politics. To be clear: for those that are able, advocating for a permanent policy change is the better solution. Government access to all user data could become a requirement to run a legitimate business. Even if we were able to convert everything to an anonymous P2P traffic-flooded web, we would still live in fear (will the 5th protect you?).
- ekianjo 13y ago
  You need both legal protection and technical solutions. So that the legal contact can allow for the technical solutions for full secure traffic to operate. That is why we need both activists and engineers.
- ForrestN 13y ago
  This cannot be overstated. As a practical matter, and in any kind of near term, political solutions are drastically more likely to bear fruit. But more radical, long term solutions are still important! An exciting prospect.
  - jaekwon 13y ago
    I disagree somewhat. I see politics as merely trailing behind actual physical surveillance ability. The politics are introduced as post-facto justification to lubricate the process, but aren't needed. We can slow the expanding encroachment by introducing say the Amash bill, but the real solution must come first from defensive technology, secondarily protected by policy.
- ferdo 13y ago
  > advocating for a permanent policy change is the better solution. Policy changes come about because of technical reality. Better technology is always superior to government policy. By all means, pursue both the technical and political solutions. But creating and distributing tools has proven to be the better method of change than depending on governments.
  - 13y ago
zanny 13y ago
So what is wrong with shared ssl / gpg keys? You could establish your own web of trust with local peers and grow a web that one could traverse to find someone who "friends" a foreign public key you want. Since you can get all the keys from all your trusted peers up through that person, you can establish a secure link. The only problem is getting that first key into the network, like is the issue with all man in the middle and cert attacks. But I think it is more reasonable to get a physical copy of a key (or get it over a lan where nobody can intercept or manipulate) over a local net. For example, I imagine Linux distros could include the public keys to sign network communications the same way they sign packages. Microsoft could have centralized easily exploited public keys by governments for their OS, but that is what you sign up for. You link into a massive web of trust sharing public keys but never private ones, and nobody except the endpoints can decrypt it, and you have no public trusted certs to exploit (everyone is a certificate authority). You would have to use a web of confidence approach like bitcoin, where you confirm against multiple peers the validity of a provided public key until you have a satisfactory confidence threshold if you want to be really thorough.
- jaekwon 13y ago
  Nothing wrong with them. You're addressing the issue of authentication, but there are more systemic problems to the internet than just authentication. Such as, preventing network timing attacks to figure out which internet subscriber is communicating with another subscriber, by routing more directly between two peers, thus bypassing surveillance points as much as possible. It should also be possible to defend against nationstate enforced network splits by introducing adhoc connections, as easily as deploying a pair of devices across borders. There might ideally be a method of compensating routers in real time with some distributed currency, to incentivize the growth of this network. It's really difficult to bypass surveillance efforts by global telecoms, when most people get their internet channeled through central systems.
- markvdb 13y ago
  https://en.wikipedia.org/wiki/Key_signing_party https://en.wikipedia.org/wiki/Key_signing_party http://www.youtube.com/watch?v=ljK1MoLJ_Dg http://www.youtube.com/watch?v=ljK1MoLJ_Dg https://en.wikipedia.org/wiki/CAcert.org https://en.wikipedia.org/wiki/CAcert.org
jaekwon 13y ago
The internet, which largely runs on IP and extended by NAT, appears to have been constructed poorly in terms of privacy. There are protocols like ICE/STUN/TURN (which is what WebRTC is built on) that supposedly try to bridge the gap to enable true P2P connectivity, but I believe even ICE appears limited in that it doesn't actually solve the hairpin problem, where two peers are behind multiple levels of NAT routers. I'm still investigating this issue, so correct me if I'm wrong. What we need are better routing systems. Take a look at CJDNS which has a novel routing protocol. I don't know what the scaling limitations there are, there doesn't appear to be documentation on empirical or theoretical performance guarantees; but it's a start, and there's a growing community behind it. With ever-cheaper devices, it should become possible to create a new family of router hardware that connects devices in a mesh fashion, scalable to the world at large. It's not going to be easy to design, and it sure as hell won't be easy to get physical adoption for (considering that the current internet is "good enough" for most), but it's possible. P.S. I've created a subreddit at /r/fourthtech if anybody wants to get into deep technical discussions about various topics on better internet/communication protocols.
- woah 13y ago
  Is this mesh stuff really the answer? Sure, it can stop collection at a central point, but doesn't it still leave open the possibility for any data to be collected from spying nodes throughout the network?
  - jaekwon 13y ago
    The CJDNS whitepaper has a good writeup: https://github.com/cjdelisle/cjdns/blob/master/rfcs/Whitepaper.md https://github.com/cjdelisle/cjdns/blob/master/rfcs/Whitepap... Node to node encryption would make packet inspection rather difficult, for one. BTW, I don't think CJDNS is necessarily going to win. See: http://www.mail-archive.com/liberationtech@lists.stanford.edu/msg05979.html http://www.mail-archive.com/liberationtech@lists.stanford.ed... But soon, somebody will to come up with a mesh protocol that is simple and scalable.
    - wslh 13y ago
vertex-four 13y ago
> If anything, I think this should be a wakeup call for those of us who have the capability to change things. I'm not talking about lobbying or raising attention to the issue, but the technical challenges of designing a network that is immune to all forms of surveillance. I don't agree with this as the first step. The first step is decentralising the control of people's identities. This doesn't necessarily mean brand new protocols or ways of doing things. All that would be necessary as a first step would be a movement to set up a number of independent non-profits to provide basic Internet services; email, media sharing, chat, and Facebook-style "wall" systems being possibly the minimal viable subset. Each non-profit could cover a defined geographical area; a small city or county, etc. This would allow them to target marketing and fund-raising locally, and prevent the problem of there being too much choice for consumers within this new ecosystem (possibly eventually ending up with a subset of organisations having the majority of the users). The non-profits could link in with each other easily through an OpenID Connect based network, so that you can follow someone's feeds just by entering your email address, even if they're on another organisation's system. Users who don't have an account on this network could still follow users on the network, using email as a fallback delivery method. The best bit? The technology to do this is mostly based on off-the-shelf systems and standards. Very little that's entirely new has to be written, nobody has to change the way they use the Internet, and all of a sudden, it'd be much harder for a Government agency to coerce every single organisation into giving up keys, passwords, or automated user data access. Once Governments have eventually figured it out, hopefully the movement will be in full swing and the people participating in it will be able to effectively develop and market a properly decentralised, cryptographic system that doesn't depend on a network of authoritative nodes, if that becomes necessary and generally useful.
pron 13y ago
> I'm not talking about lobbying or raising attention to the issue, but the technical challenges of designing a network that is immune to all forms of surveillance. Let's treat this as an issue of computer science, not politics. Absolutely not! That's precisely why technologists and scientists have always been easily manipulated. Any technology, any technology, can always be turned on its head and abused. If technologists really have the power they've come to believe they possess, it must be used politically. Politics cannot be avoided. Trying to eschew politics is merely following a policy of not caring, and yielding power to those who openly espouse politics. > Facebook should be a protocol, not a service. Twitter should be a protocol, not a service. And so forth. This of course completely upends the business model these technologies are based on, and would need to be approached by people with a completely different perspective. Yes! But this could only be done by raising political awareness. The biggest problem with the internet is not government control. You can see how government control, when exposed (and it will always be exposed as it always has been), creates an uproar. When people are aware and upset, things will be kept in check. The biggest problem is that articles such as this claim that "US cloud services cannot be trusted" only when government surveillance is in play. But services couldn't have been trusted beforehand. People give up information — and information is power — to private corporations. Those corporations are under far less scrutiny and oversight than the government, but that's not the worst of it. The worst of it is that people surrender information voluntarily; possibly because they don't care, and possibly because the corporations have been able, through far more effective propaganda than any government could ever hope to produce, convinced the people that the corporations have their best interest in mind. The worst form of exploitation happen when people voluntarily surrender power. People actively support the abuse, then they don't mind, and then it may be too late. The solution must be politics and laws. Just like antitrust laws try to prevent corporations from amassing too much power, so too new information laws must prevent them from doing the same.
- kintamanimatt 13y ago
  Politics plays a role, but it's secondary to creating a secure network. Today's network and its core protocols are trivial to abuse, and the trouble lies in the fact that the people that were its original creators couldn't see the future. Jon Postel created SMTP at a time when governments were more trusted to act in the interests of the people (whether this was true in practice or not), and also only ~200 hosts were connected to the internet with a total of ~20,000 people actually using the internet.[0] Nobody thought that SMTP would be used by a large chunk of the world's population, that spam would be an issue, that traffic could be sniffed and intercepted, or that governments would start programs of virtually indiscriminate en masse surveillance of the world's electronic communications. The idea of a Room 614A would have been regarded as ridiculous and excessively paranoid. Cloud services are an entirely different issue, and the issue isn't necessarily resolved politically, but by mass decentralization. Things like OwnCloud are a great starting point and people today generally have the bandwidth to run their own micro-servers at home, or, possible, if battery life improves, on their phones. Some things are impossible to decentralize, for example search, at least until technology and storage advances sufficiently that we can all host our own Google search product on our phones, and Google search becomes an app that can be paid for and downloaded, with live changes to the index being streamed to the device. It sounds absurd in today's world, but tomorrow could be different. [0] http://education.illinois.edu/wp/commercialism/history-of-the-internet.htm http://education.illinois.edu/wp/commercialism/history-of-th...
mtgx 13y ago
It sounds like you're think about something like http://projectmeshnet.org/ http://projectmeshnet.org/
northwest 13y ago
> Let's treat this as an issue of computer science, not politics. No, let's fight the abuse with whatever we can get our hands on. There is strictly no reason for this to be an either/or question. Everyone should become active with what's their expertise, education, equipment, resources.
pasbesoin 13y ago
In my opinion (for lack of producing a thorough argument), one has to control the physical layer. Along with your advice, I would keep this in mind. Whether it's mesh, or neutrinos, or a "black box" technical and legal jurisdiction that sufficiently isolates inbound and outbound messages (which can in turn be encrypted for travel over more compromised segments). Sneakernet (perhaps in conjunction with a resurgence in NNTP or the like). Or something else. You have to continue to ensure that there is a route -- a physical route -- around the "damage". And I'm not speaking foremost nor particularly to piracy, something that gets too often pushed to the for as a... "false flag" issue. I'm speaking to freedom of communication, as a human right and a basis (although not the only) for a complete and healthy society.
foobarqux 13y ago
CurveCP, CryptoSphere, Tor and Pond would get most of the way without recreating the Internet. The other major problem, centralized unencrypted services, isn't helped by rewriting basic Internet protocols.

codexon 13y ago

While we're talking about rewriting the Internet, please fix ddos attacks. The current internet is especially prone to ddos attacks to the point where it costs 100x more money to defend than to start an attack of the same size. http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack http://blog.cloudflare.com/deep-inside-a-dns-amplification-d...

zanny 13y ago
Change your egress traffic queue discipline. fq_codel was mainlined in the last two years to solve buffer bloat and has the side effect of helping to alleviate ddos. It flags bad traffic flows (ie, ddos attacks) as bad queues and prioritizes other traffic around it. See : https://en.wikipedia.org/wiki/CoDel https://en.wikipedia.org/wiki/CoDel Note, this doesn't help at the endpoint under attack. It requires a qos shift on the infrastructure leading to that thin last mile pipe, so the last mile packets they get are the the good flows. Also, a warning: CoDel itself is pretty experimental still. It is only just being deployed as the default in proprietary routing hardware this year. Other queueing disciplines are an option, but the default (fifo) is a sack of garbage that causes a lot of these issues in its simplicity and inability to bias bad traffic from the good.
- codexon 13y ago
  I'm talking about 10GE overflowing 20+ gbps attacks for $5. http://www.hackforums.net/forumdisplay.php?fid=232 http://www.hackforums.net/forumdisplay.php?fid=232

GrantS 13y ago

This is completely outside my areas of expertise, and there may already be a name for it, or it may be the dumb thing every rookie thinks of, but what about this: ignoring issues of bandwidth and power consumption (!), if every communications device broadcast a constant stream of data and every other communications device received every bit of data and ignored the (nearly 100%) of it that it didn't care about at the moment, you would eliminate the ability to know who was communicating with whom and when, right? The metadata is gone. If that's true, then now you just need to solve two problems: (1) how to keep the stuff (which you know is being broadcast to absolutely everyone) secret, and (2) how to coordinate the communication. Isn't that just cryptography and synchronizing watches while exchanging secrets in meatspace, stuff that's been known since before computers were part of it? (The point of ignoring power and bandwidth is to determine if this is ever possible in any universe, not just if it's possible for us right now.)

zanny 13y ago
Thus is a sledgehammer proposition, because while the minute power utilization to move packets across fiber or coax is insignificant, running the entire Internet at peak throughout all the time would be a huge electrical burden. You know how your phone runs out juice really fast on 4g? Do that, all the time, on everything. Data centers would melt.
- GrantS 13y ago
  I do completely realize this, but if that's truly the only barrier then we're left in the interesting position in which we can increase society's freedom of communication by increasing energy efficiency. Or maybe then someone could prove that real freedom is impossible due to the physics of the situation, or that freedom is possible today for exactly X people because we must limit ourselves to X devices in the world for the system to work, or that we need to harness the power of 1000 suns to achieve true freedom -- whatever, to me it still seems an interesting thought experiment to establish the boundaries of the problem. I can see why more practical minds may hate this approach. EDIT: Ah, or maybe there is a bitrate at which free communication is possible today -- if everyone sends only 96 bits per day or 8 bits per day at equal intervals, would this keep the internet from melting down. Over time, that bitrate would increase.

syncerr 13y ago

> Let's treat this as an issue of computer science, not politics. To be clear: for those that are able, advocating for a permanent policy change is the better solution. Government access to all user data could become a requirement to run a legitimate business. Even if we were able to convert everything to an anonymous P2P traffic-flooded web, we would still live in fear (will the 5th protect you?).

ekianjo 13y ago
You need both legal protection and technical solutions. So that the legal contact can allow for the technical solutions for full secure traffic to operate. That is why we need both activists and engineers.
ForrestN 13y ago
This cannot be overstated. As a practical matter, and in any kind of near term, political solutions are drastically more likely to bear fruit. But more radical, long term solutions are still important! An exciting prospect.
- jaekwon 13y ago
  I disagree somewhat. I see politics as merely trailing behind actual physical surveillance ability. The politics are introduced as post-facto justification to lubricate the process, but aren't needed. We can slow the expanding encroachment by introducing say the Amash bill, but the real solution must come first from defensive technology, secondarily protected by policy.
ferdo 13y ago
> advocating for a permanent policy change is the better solution. Policy changes come about because of technical reality. Better technology is always superior to government policy. By all means, pursue both the technical and political solutions. But creating and distributing tools has proven to be the better method of change than depending on governments.
- 13y ago

zanny 13y ago

So what is wrong with shared ssl / gpg keys? You could establish your own web of trust with local peers and grow a web that one could traverse to find someone who "friends" a foreign public key you want. Since you can get all the keys from all your trusted peers up through that person, you can establish a secure link. The only problem is getting that first key into the network, like is the issue with all man in the middle and cert attacks. But I think it is more reasonable to get a physical copy of a key (or get it over a lan where nobody can intercept or manipulate) over a local net. For example, I imagine Linux distros could include the public keys to sign network communications the same way they sign packages. Microsoft could have centralized easily exploited public keys by governments for their OS, but that is what you sign up for. You link into a massive web of trust sharing public keys but never private ones, and nobody except the endpoints can decrypt it, and you have no public trusted certs to exploit (everyone is a certificate authority). You would have to use a web of confidence approach like bitcoin, where you confirm against multiple peers the validity of a provided public key until you have a satisfactory confidence threshold if you want to be really thorough.

jaekwon 13y ago
Nothing wrong with them. You're addressing the issue of authentication, but there are more systemic problems to the internet than just authentication. Such as, preventing network timing attacks to figure out which internet subscriber is communicating with another subscriber, by routing more directly between two peers, thus bypassing surveillance points as much as possible. It should also be possible to defend against nationstate enforced network splits by introducing adhoc connections, as easily as deploying a pair of devices across borders. There might ideally be a method of compensating routers in real time with some distributed currency, to incentivize the growth of this network. It's really difficult to bypass surveillance efforts by global telecoms, when most people get their internet channeled through central systems.
markvdb 13y ago
https://en.wikipedia.org/wiki/Key_signing_party https://en.wikipedia.org/wiki/Key_signing_party http://www.youtube.com/watch?v=ljK1MoLJ_Dg http://www.youtube.com/watch?v=ljK1MoLJ_Dg https://en.wikipedia.org/wiki/CAcert.org https://en.wikipedia.org/wiki/CAcert.org

jaekwon 13y ago

The internet, which largely runs on IP and extended by NAT, appears to have been constructed poorly in terms of privacy. There are protocols like ICE/STUN/TURN (which is what WebRTC is built on) that supposedly try to bridge the gap to enable true P2P connectivity, but I believe even ICE appears limited in that it doesn't actually solve the hairpin problem, where two peers are behind multiple levels of NAT routers. I'm still investigating this issue, so correct me if I'm wrong. What we need are better routing systems. Take a look at CJDNS which has a novel routing protocol. I don't know what the scaling limitations there are, there doesn't appear to be documentation on empirical or theoretical performance guarantees; but it's a start, and there's a growing community behind it. With ever-cheaper devices, it should become possible to create a new family of router hardware that connects devices in a mesh fashion, scalable to the world at large. It's not going to be easy to design, and it sure as hell won't be easy to get physical adoption for (considering that the current internet is "good enough" for most), but it's possible. P.S. I've created a subreddit at /r/fourthtech if anybody wants to get into deep technical discussions about various topics on better internet/communication protocols.

woah 13y ago
Is this mesh stuff really the answer? Sure, it can stop collection at a central point, but doesn't it still leave open the possibility for any data to be collected from spying nodes throughout the network?
- jaekwon 13y ago
  The CJDNS whitepaper has a good writeup: https://github.com/cjdelisle/cjdns/blob/master/rfcs/Whitepaper.md https://github.com/cjdelisle/cjdns/blob/master/rfcs/Whitepap... Node to node encryption would make packet inspection rather difficult, for one. BTW, I don't think CJDNS is necessarily going to win. See: http://www.mail-archive.com/liberationtech@lists.stanford.edu/msg05979.html http://www.mail-archive.com/liberationtech@lists.stanford.ed... But soon, somebody will to come up with a mesh protocol that is simple and scalable.
  - wslh 13y ago

vertex-four 13y ago

> If anything, I think this should be a wakeup call for those of us who have the capability to change things. I'm not talking about lobbying or raising attention to the issue, but the technical challenges of designing a network that is immune to all forms of surveillance. I don't agree with this as the first step. The first step is decentralising the control of people's identities. This doesn't necessarily mean brand new protocols or ways of doing things. All that would be necessary as a first step would be a movement to set up a number of independent non-profits to provide basic Internet services; email, media sharing, chat, and Facebook-style "wall" systems being possibly the minimal viable subset. Each non-profit could cover a defined geographical area; a small city or county, etc. This would allow them to target marketing and fund-raising locally, and prevent the problem of there being too much choice for consumers within this new ecosystem (possibly eventually ending up with a subset of organisations having the majority of the users). The non-profits could link in with each other easily through an OpenID Connect based network, so that you can follow someone's feeds just by entering your email address, even if they're on another organisation's system. Users who don't have an account on this network could still follow users on the network, using email as a fallback delivery method. The best bit? The technology to do this is mostly based on off-the-shelf systems and standards. Very little that's entirely new has to be written, nobody has to change the way they use the Internet, and all of a sudden, it'd be much harder for a Government agency to coerce every single organisation into giving up keys, passwords, or automated user data access. Once Governments have eventually figured it out, hopefully the movement will be in full swing and the people participating in it will be able to effectively develop and market a properly decentralised, cryptographic system that doesn't depend on a network of authoritative nodes, if that becomes necessary and generally useful.

pron 13y ago

> I'm not talking about lobbying or raising attention to the issue, but the technical challenges of designing a network that is immune to all forms of surveillance. Let's treat this as an issue of computer science, not politics. Absolutely not! That's precisely why technologists and scientists have always been easily manipulated. Any technology, any technology, can always be turned on its head and abused. If technologists really have the power they've come to believe they possess, it must be used politically. Politics cannot be avoided. Trying to eschew politics is merely following a policy of not caring, and yielding power to those who openly espouse politics. > Facebook should be a protocol, not a service. Twitter should be a protocol, not a service. And so forth. This of course completely upends the business model these technologies are based on, and would need to be approached by people with a completely different perspective. Yes! But this could only be done by raising political awareness. The biggest problem with the internet is not government control. You can see how government control, when exposed (and it will always be exposed as it always has been), creates an uproar. When people are aware and upset, things will be kept in check. The biggest problem is that articles such as this claim that "US cloud services cannot be trusted" only when government surveillance is in play. But services couldn't have been trusted beforehand. People give up information — and information is power — to private corporations. Those corporations are under far less scrutiny and oversight than the government, but that's not the worst of it. The worst of it is that people surrender information voluntarily; possibly because they don't care, and possibly because the corporations have been able, through far more effective propaganda than any government could ever hope to produce, convinced the people that the corporations have their best interest in mind. The worst form of exploitation happen when people voluntarily surrender power. People actively support the abuse, then they don't mind, and then it may be too late. The solution must be politics and laws. Just like antitrust laws try to prevent corporations from amassing too much power, so too new information laws must prevent them from doing the same.

kintamanimatt 13y ago
Politics plays a role, but it's secondary to creating a secure network. Today's network and its core protocols are trivial to abuse, and the trouble lies in the fact that the people that were its original creators couldn't see the future. Jon Postel created SMTP at a time when governments were more trusted to act in the interests of the people (whether this was true in practice or not), and also only ~200 hosts were connected to the internet with a total of ~20,000 people actually using the internet.[0] Nobody thought that SMTP would be used by a large chunk of the world's population, that spam would be an issue, that traffic could be sniffed and intercepted, or that governments would start programs of virtually indiscriminate en masse surveillance of the world's electronic communications. The idea of a Room 614A would have been regarded as ridiculous and excessively paranoid. Cloud services are an entirely different issue, and the issue isn't necessarily resolved politically, but by mass decentralization. Things like OwnCloud are a great starting point and people today generally have the bandwidth to run their own micro-servers at home, or, possible, if battery life improves, on their phones. Some things are impossible to decentralize, for example search, at least until technology and storage advances sufficiently that we can all host our own Google search product on our phones, and Google search becomes an app that can be paid for and downloaded, with live changes to the index being streamed to the device. It sounds absurd in today's world, but tomorrow could be different. [0] http://education.illinois.edu/wp/commercialism/history-of-the-internet.htm http://education.illinois.edu/wp/commercialism/history-of-th...

mtgx 13y ago

It sounds like you're think about something like http://projectmeshnet.org/ http://projectmeshnet.org/

northwest 13y ago

> Let's treat this as an issue of computer science, not politics. No, let's fight the abuse with whatever we can get our hands on. There is strictly no reason for this to be an either/or question. Everyone should become active with what's their expertise, education, equipment, resources.

pasbesoin 13y ago

In my opinion (for lack of producing a thorough argument), one has to control the physical layer. Along with your advice, I would keep this in mind. Whether it's mesh, or neutrinos, or a "black box" technical and legal jurisdiction that sufficiently isolates inbound and outbound messages (which can in turn be encrypted for travel over more compromised segments). Sneakernet (perhaps in conjunction with a resurgence in NNTP or the like). Or something else. You have to continue to ensure that there is a route -- a physical route -- around the "damage". And I'm not speaking foremost nor particularly to piracy, something that gets too often pushed to the for as a... "false flag" issue. I'm speaking to freedom of communication, as a human right and a basis (although not the only) for a complete and healthy society.

foobarqux 13y ago

CurveCP, CryptoSphere, Tor and Pond would get most of the way without recreating the Internet. The other major problem, centralized unencrypted services, isn't helped by rewriting basic Internet protocols.