6 ms·

>We need an army of software developers on the look out for potential NSA back doors — to borrow a phrase, if you see something, say something. And if you can't

>We need an army of software developers on the look out for potential NSA back doors — to borrow a phrase, if you see something, say something. And if you can't see anything because you can't get the source code... well, who knows that they might hiding? Of course this rules out all 'cloud' software other than simple dumb data storage. RMS was right again[1]. [1] "Cloud computing is a trap, warns GNU founder Richard Stallman" http://www.theguardian.com/technology/2008/sep/29/cloud.computing.richard.stallman http://www.theguardian.com/technology/2008/sep/29/cloud.comp...

cperciva 13y ago
Cloud software is fine as long as you don't need to trust it. I use Google Calendar, for example, because it's convenient and I really don't care if the NSA knows when my next dentist appointment is.
- eliasmacpherson 13y ago
  They might care when everyone's birthdays are though.
  - zrail 13y ago
    That information is already in many, many places. In particular, if you have a passport or drivers license it's already available to the government.
    - aestra 13y ago
      @derefr, my sister had a similar thing happen. In the public records department someone possibly mistook a 7 for a 1 and my sister's original birth certificate got issued with the wrong date and was filed wrong. When my parents called about the error, they issued a new one, but never requested the old one back. She has two official birth certificates with two different birth dates. I'm not sure which one the government believes is "correct" but she's been using her real birthday birth certificate on all documents (drivers license, passport...) since.
      - girvo 13y ago
        I have a birth certificate with a different last name, as my Dad adopted me (natural father and mother, got married a year later, born with mum's name but now have dad's once I turned about 1.5yrs). I even am pretty certain I have a second birth certificate with mt dad's name, but I'm not certain. I also have my adoption papers, and I left the country I was born in when I was young (7 years). As far as the country I live in is concerned I'm my Father's last name, but have legitimate primary ID with my mother's pre marriage last name. Always wanted to get my spy on and build up a second identity with that. Of course that's highly illegal, so itw only ever been a fun thought exercise :)
    - derefr 13y ago
      In fact, practically, your birth date is only your birth date inasmuch as the government believes that that's the date it is. If a nurse in the pregnancy ward makes a typo, and that's what gets submitted to the government, then that's your birth date, and no arguing. (I say this from a position somewhere in-between: I was born in British Columbia, and my birth date is right on my birth certificate, but wrong on the public-health-plan card you also get issued at birth. I had a very strange time bootstrapping my first credit card...)
      - maxerickson 13y ago
        I like the linguistic ambiguity here. Of course, you are talking about a legal birth date and how in practice that is what matters, but really, what the government thinks has no bearing on your actual birth date.
- alan_cx 13y ago
  No, but the NSA might care about your movements, who you know, who you deal with, and so on. Remember that video that was posted of a Lawyer given a talk to law students about never speaking to policemen? Remember how innocent things can be completely twisted and used against you? Yeah, I'd worry about the NSA snooping in my calendar.
  - ihsw 13y ago
    This cannot be understated, especially when it's not just the NSA snooping -- it's the entirety of the US Government. The DEA and the IRS revelations about using NSA-sourced information are just the tip of the iceberg, and it should be clear and obvious that there are use-cases for this data in a variety of other areas. Unless the government puts explicit restrictions (not secret restrictions!) on how their resources (not just stored data!) can be used and actively punishes those using it improperly, then it should be assumed that all the resources at the NSA's disposal will be used for the convenience of the rest of the government.
  - beachstartup 13y ago
    the sad truth of the matter is it's a cultural thing, not a technology thing. sharing your calendar can be twisted against you. not sharing your calendar can also be twisted against you ("you don't seem to be sharing your calendar like most of your fellow citizens, what are you hiding?") see: mccarthyism.
    - alan_cx 13y ago
      Yeah, indeed. I remember some thing posted here a while ago about about a prospective employer assuming something is wrong with a candidate with out a facebook profile for the prospective employer to snoop over prior to hiring. Perhaps we should exercise our little grey cells more. Granted for a busy sales man or something that's impractical, but Im sure we could generally commit more exclusively to memory.. I posted this before, but to repeat... I think the legacy here is that we move more and more as a matter of habit or routine to a more secure way of living. No, we cant ever fully insulate ourselves from the NSA, but I think more and more of us will commit less to the internet, choose HTTPS via automatic extensions, use more secure software as a default, self censor, and so on.
- anonymfus 13y ago
  It's very convenient for NSA to know your next dentist appointment because they can search your home at that time. Or install/remove bugs. BTW it's a major trope in spy movies. Literally dentist appointment in "The Tall Blond Man with One Black Shoe" ("Le Grand Blond avec une chaussure noire").
- TsiCClawOfLight 13y ago
  Did you read "The silicon jungle"? You Should. Holds for all of you, btw.
alan_cx 13y ago
I never liked the "cloud" from the start. To me it was simply dumb terminals all over again, which had the potential to shift everything to a server which was not mine. Security was an issue, but also it meant being reliant on the connection and service being up and running. In my experience, web sites were down more often than my desk top. And that's just on a personal level. Why a business would do such a thing was even more beyond me. Personal or business owned clouds for limited scope use, fine. But handing all that control over to a 3rd parts, over the net, in a foreign country? I see the marketed advantages, useful as a throwaway extra, but over all? No way.
- davidw 13y ago
  > Why a business would do such a thing was even more beyond me. Mostly the same reason they rely on third party infrastructure like electricity and plumbing: economics.
  - belorn 13y ago
    Both electricity and plumbing has immense regulations, and historical perspective of being neutral and non-threatening to businesses. Cloud services has none of that, and can cut off service for any reason. Work on any competing services that "the company" dislike, or do anything disruptive to people in power, and instant see your future, your business, you speech be taken down to a 404 not found. Any logs, any files, any property at all confiscated. Even pure money is not safe from "indefinite suspension of the account". Maybe this is a lesson that if you ever want to legally produce a scam, steal, or do anything that normally would land you in jail, all you need to do is go into producing third-party digital infrastructure. There is basically nothing a cloud service can do that would lend the owners to go to jail except tax evasion.
    - deleted 13y ago
      [deleted]
    - saosebastiao 13y ago
      The regulation has to do with the fact that plumbing and electricity are Natural Monopolies. If they were not Natural Monopolies, they would have competition (as Cloud providers do), which acts as a form of regulation.
Zigurd 13y ago
There are a lot of places the "cloud" can be zero-knowledge for payloads in storage, email, and real time communications, but most services are not set up that way, and they would have to charge a subscription fee to replace their ad revenue. It is possible to make cloud services where trust is not needed. It remains to be seen if cloud services will have to change to remain in business.
- derefr 13y ago
  People say email can be zero-knowledge, but I'm not quite sure--ever since Gmail pushed us from organizing everything into folders, to one giant Archive + labels, I find server-side search to be an essential attribute of my email service. I don't want to pull my entire mail history down onto my phone just to find one message; even the index would be ridiculous.
  - Fargren 13y ago
    But the server-side could be a desktop computer at your house instead of Google's servers. Seems harder for the NSA to access
    - navait 13y ago
      That sounds like a lot of work. You have to set up the server, get a domain, update it, back it up etc; What do you get out of it? An email server. Google will give you all of that in a few seconds. Google's uptime is way better than what I could hope to get. When my laptop had water spilled on it, there was no need to worry about my thesis. I went to a lab and started working on it again 10 minutes later. No work lost. My own backup solutions would be far worse, and likley involve losing some work. When using these services, I have to ask myself, how much do I value my privacy? I think I get more from google's services than I lose. For me, and a lot of people, it's not worth the time to set up an email server, let alone maintain one.
      - gyepi 13y ago
        Yes, for some people, it's too much work. However, there are many for whom it would not be at all. I have always run my own servers both for personal and business use and I don't find it the least bit onerous. Honestly, I think it only seems like too much work until one learns more about it. Just like anything else, I suppose. I'm not trying to change your mind; not everyone is meant to run their own systems. But I certainly want to counter your discouragement against doing so.
devx 13y ago
I wonder if stuff like this could help, but it could be years away from deployment anyway (and that's if the companies are even willing to do it - so all the more reason to avoid current cloud services): http://www.theregister.co.uk/2013/09/10/boffins_propose_more_spookproof_crypto/ http://www.theregister.co.uk/2013/09/10/boffins_propose_more...
pyre 13y ago
> Of course this rules out all 'cloud' software other than simple dumb data storage. This is pretty much the conclusion that I've come to as well. Using cloud storage to keep thing in sync, but only doing decryption on the client. Even doing something like storing a SQLite database and encrypting all of the fields seems like it would be leaking information rather than just encrypting/syncing the entire database.

cperciva 13y ago

Cloud software is fine as long as you don't need to trust it. I use Google Calendar, for example, because it's convenient and I really don't care if the NSA knows when my next dentist appointment is.

eliasmacpherson 13y ago
They might care when everyone's birthdays are though.
- zrail 13y ago
  That information is already in many, many places. In particular, if you have a passport or drivers license it's already available to the government.
  - aestra 13y ago
    @derefr, my sister had a similar thing happen. In the public records department someone possibly mistook a 7 for a 1 and my sister's original birth certificate got issued with the wrong date and was filed wrong. When my parents called about the error, they issued a new one, but never requested the old one back. She has two official birth certificates with two different birth dates. I'm not sure which one the government believes is "correct" but she's been using her real birthday birth certificate on all documents (drivers license, passport...) since.
    - girvo 13y ago
      I have a birth certificate with a different last name, as my Dad adopted me (natural father and mother, got married a year later, born with mum's name but now have dad's once I turned about 1.5yrs). I even am pretty certain I have a second birth certificate with mt dad's name, but I'm not certain. I also have my adoption papers, and I left the country I was born in when I was young (7 years). As far as the country I live in is concerned I'm my Father's last name, but have legitimate primary ID with my mother's pre marriage last name. Always wanted to get my spy on and build up a second identity with that. Of course that's highly illegal, so itw only ever been a fun thought exercise :)
  - derefr 13y ago
    In fact, practically, your birth date is only your birth date inasmuch as the government believes that that's the date it is. If a nurse in the pregnancy ward makes a typo, and that's what gets submitted to the government, then that's your birth date, and no arguing. (I say this from a position somewhere in-between: I was born in British Columbia, and my birth date is right on my birth certificate, but wrong on the public-health-plan card you also get issued at birth. I had a very strange time bootstrapping my first credit card...)
    - maxerickson 13y ago
      I like the linguistic ambiguity here. Of course, you are talking about a legal birth date and how in practice that is what matters, but really, what the government thinks has no bearing on your actual birth date.
alan_cx 13y ago
No, but the NSA might care about your movements, who you know, who you deal with, and so on. Remember that video that was posted of a Lawyer given a talk to law students about never speaking to policemen? Remember how innocent things can be completely twisted and used against you? Yeah, I'd worry about the NSA snooping in my calendar.
- ihsw 13y ago
  This cannot be understated, especially when it's not just the NSA snooping -- it's the entirety of the US Government. The DEA and the IRS revelations about using NSA-sourced information are just the tip of the iceberg, and it should be clear and obvious that there are use-cases for this data in a variety of other areas. Unless the government puts explicit restrictions (not secret restrictions!) on how their resources (not just stored data!) can be used and actively punishes those using it improperly, then it should be assumed that all the resources at the NSA's disposal will be used for the convenience of the rest of the government.
- beachstartup 13y ago
  the sad truth of the matter is it's a cultural thing, not a technology thing. sharing your calendar can be twisted against you. not sharing your calendar can also be twisted against you ("you don't seem to be sharing your calendar like most of your fellow citizens, what are you hiding?") see: mccarthyism.
  - alan_cx 13y ago
    Yeah, indeed. I remember some thing posted here a while ago about about a prospective employer assuming something is wrong with a candidate with out a facebook profile for the prospective employer to snoop over prior to hiring. Perhaps we should exercise our little grey cells more. Granted for a busy sales man or something that's impractical, but Im sure we could generally commit more exclusively to memory.. I posted this before, but to repeat... I think the legacy here is that we move more and more as a matter of habit or routine to a more secure way of living. No, we cant ever fully insulate ourselves from the NSA, but I think more and more of us will commit less to the internet, choose HTTPS via automatic extensions, use more secure software as a default, self censor, and so on.
anonymfus 13y ago
It's very convenient for NSA to know your next dentist appointment because they can search your home at that time. Or install/remove bugs. BTW it's a major trope in spy movies. Literally dentist appointment in "The Tall Blond Man with One Black Shoe" ("Le Grand Blond avec une chaussure noire").
TsiCClawOfLight 13y ago
Did you read "The silicon jungle"? You Should. Holds for all of you, btw.

alan_cx 13y ago

I never liked the "cloud" from the start. To me it was simply dumb terminals all over again, which had the potential to shift everything to a server which was not mine. Security was an issue, but also it meant being reliant on the connection and service being up and running. In my experience, web sites were down more often than my desk top. And that's just on a personal level. Why a business would do such a thing was even more beyond me. Personal or business owned clouds for limited scope use, fine. But handing all that control over to a 3rd parts, over the net, in a foreign country? I see the marketed advantages, useful as a throwaway extra, but over all? No way.

davidw 13y ago
> Why a business would do such a thing was even more beyond me. Mostly the same reason they rely on third party infrastructure like electricity and plumbing: economics.
- belorn 13y ago
  Both electricity and plumbing has immense regulations, and historical perspective of being neutral and non-threatening to businesses. Cloud services has none of that, and can cut off service for any reason. Work on any competing services that "the company" dislike, or do anything disruptive to people in power, and instant see your future, your business, you speech be taken down to a 404 not found. Any logs, any files, any property at all confiscated. Even pure money is not safe from "indefinite suspension of the account". Maybe this is a lesson that if you ever want to legally produce a scam, steal, or do anything that normally would land you in jail, all you need to do is go into producing third-party digital infrastructure. There is basically nothing a cloud service can do that would lend the owners to go to jail except tax evasion.
  - deleted 13y ago
    [deleted]
  - saosebastiao 13y ago
    The regulation has to do with the fact that plumbing and electricity are Natural Monopolies. If they were not Natural Monopolies, they would have competition (as Cloud providers do), which acts as a form of regulation.

Zigurd 13y ago

There are a lot of places the "cloud" can be zero-knowledge for payloads in storage, email, and real time communications, but most services are not set up that way, and they would have to charge a subscription fee to replace their ad revenue. It is possible to make cloud services where trust is not needed. It remains to be seen if cloud services will have to change to remain in business.

derefr 13y ago
People say email can be zero-knowledge, but I'm not quite sure--ever since Gmail pushed us from organizing everything into folders, to one giant Archive + labels, I find server-side search to be an essential attribute of my email service. I don't want to pull my entire mail history down onto my phone just to find one message; even the index would be ridiculous.
- Fargren 13y ago
  But the server-side could be a desktop computer at your house instead of Google's servers. Seems harder for the NSA to access
  - navait 13y ago
    That sounds like a lot of work. You have to set up the server, get a domain, update it, back it up etc; What do you get out of it? An email server. Google will give you all of that in a few seconds. Google's uptime is way better than what I could hope to get. When my laptop had water spilled on it, there was no need to worry about my thesis. I went to a lab and started working on it again 10 minutes later. No work lost. My own backup solutions would be far worse, and likley involve losing some work. When using these services, I have to ask myself, how much do I value my privacy? I think I get more from google's services than I lose. For me, and a lot of people, it's not worth the time to set up an email server, let alone maintain one.
    - gyepi 13y ago
      Yes, for some people, it's too much work. However, there are many for whom it would not be at all. I have always run my own servers both for personal and business use and I don't find it the least bit onerous. Honestly, I think it only seems like too much work until one learns more about it. Just like anything else, I suppose. I'm not trying to change your mind; not everyone is meant to run their own systems. But I certainly want to counter your discouragement against doing so.

devx 13y ago

I wonder if stuff like this could help, but it could be years away from deployment anyway (and that's if the companies are even willing to do it - so all the more reason to avoid current cloud services): http://www.theregister.co.uk/2013/09/10/boffins_propose_more_spookproof_crypto/ http://www.theregister.co.uk/2013/09/10/boffins_propose_more...

pyre 13y ago

> Of course this rules out all 'cloud' software other than simple dumb data storage. This is pretty much the conclusion that I've come to as well. Using cloud storage to keep thing in sync, but only doing decryption on the client. Even doing something like storing a SQLite database and encrypting all of the fields seems like it would be leaking information rather than just encrypting/syncing the entire database.