5 ms·

I love the discussions on this topic: "It will probably cost more in the long run." "The NSA will just crack it and spy anyway." So many people with the attit

I love the discussions on this topic: "It will probably cost more in the long run." "The NSA will just crack it and spy anyway." So many people with the attitude that countries that find out their tech partners are actually performing espionage on behalf of the US government (and US security partners) should just tolerate it rather than do something about it.

outside1234 13y ago
I agree, but what they should do about it is attack the policies, not swap out the stack for another stack. Motion is not necessarily progress.
- moocowduckquack 13y ago
  I don't think they are swapping the stack for a tech upgrade, they are swapping it because at the moment they are in the position of directing state funds towards an organisation that is seen to be under the control of a government that is acting aggressively towards them, which is not a tenable position politically for the people signing off on the budgets, especially since it is all so very public.
CurtHagenlocher 13y ago
To the best of my knowledge, no one has alleged that the NSA had Microsoft's help in intercepting Petrobras-related email. This is more about the possibility of such a threat than anything else. Disclaimer: I work at Microsoft, so eh.
- devx 13y ago
  Why take the chance? From the leaks, the companies have "cooperated enough", especially when we're talking about "foreigners". We don't need proof for absolutely everything and for every single case, to stop trusting American companies, until there's a dramatic change in laws, and surveillance policy in US.
  - stfu 13y ago
    This is going to be the main issue behind that argument. The burden of proof has shifted. The tech industries reaction to the Snowden seems to the outside very lukewarm. Sure, they are giving all sorts of "trust us" statements, but truth is we don't have the slightest clue if this is their honest opinion or just an opinion that a secret court forces them to uphold. Reality might be much more nuanced, but to the outside there is very little reason to give anyone any longer the benefit of the doubt.
    - barista 13y ago
      There is nothing that singles Microsoft out here as every other operator of email and other software complied as well. This is something the US government should come clean on and something that the tech companies should push the government to do.
      - stfu 13y ago
        Absolutely. There is nothing that singles out Microsoft as better or worse, but it is a looming issue for the whole US tech industry.
- neves 13y ago
  BTW: Petrobras uses, argh!, Lotus Notes. There were a lot allegations that Microsoft and IBM cooperated with the NSA and inserted backdoors in their products.
  - CurtHagenlocher 13y ago
    Sure; I guess I should have said "credible allegations" meaning that a former NSA employee with specific claims is very credible, speculation based on a single exported symbol name in an older version of Windows is quite a bit less so. I was a bit amused to read that "The Expresso platform will also be used as the base of the Hotmail-like system that the government is also planning to offer to citizens." Are Brazil's citizens that trusting of its government? I certainly can't imagine Americans trusting their email to the government even before Snowden-gate.
    - mc32 13y ago
      Well, what better excuse to push a product ready for local government control but to sell it as the antidote to the specter of American/foreign spying. Brazil, as some other LAm countries, love using the American scapegoat to distract from many local issues (the economy is bad, it's the IMF and the Americans' faults, etc.) I mean to say this appears to be primarily a political reaction with nice governmental side-benefits.
marcosdumay 13y ago
It's more of a practical concern. Migrating the government to Linux and using a free mail infrastructure would be cheaper (saving money in the long term, instead of costing), easier, and way more effective than using a non-standard internal email protocol and keep using Windows everywhere. Why bother when Microsoft still has access to all your data? About using that proprietary protocol AND migrating to a free software environment, that could be better than just migrating, or worse, depends of the actual quality* of the protocol. But while the government frames it as a XOR option, migrating to an open stack is the only sane option. * The fact that the protocol isn't public isn't good, the fact that it's Serpro creating it makes this worse - they've already done quite a few bad decisions about security.
walshemj 13y ago
It sounds a lot like a Brazilian version of the secure intranet (GSI) that the UK has rolled out for lower level stuff. And from a security perspective (sorry linux fanbois and microsft haters) the choice of MTA/MUA isn't as important as the rest of the security. Would be interesting if due to this that OSI and X.400 makes a comeback for more secure email - though presumably with all the security enhancement proposed for the later standards - hmm I wonder if you could use quantum networking with x.400/500
malandrew 13y ago
If they opted for an entirely open source system (possibly open-sourcing the one in question) that several governments with the same concern could collaborate on, then they would probably be much safer. Going with a bespoke system that will be deployed widely is a recipe for problems. It's likely to have limited documentation and lots of setup edge-cases that are easy to compromise.
- kenjackson 13y ago
  For any interesting open source project, why would you think that the NSA wouldn't be deeply involved? If I were a spy agency and an open source project was being spun up that several countries would use, I'd get at least a dozen devs on it. And if I'm thinking that, then you know they all must be...

outside1234 13y ago

I agree, but what they should do about it is attack the policies, not swap out the stack for another stack. Motion is not necessarily progress.

moocowduckquack 13y ago
I don't think they are swapping the stack for a tech upgrade, they are swapping it because at the moment they are in the position of directing state funds towards an organisation that is seen to be under the control of a government that is acting aggressively towards them, which is not a tenable position politically for the people signing off on the budgets, especially since it is all so very public.

CurtHagenlocher 13y ago

To the best of my knowledge, no one has alleged that the NSA had Microsoft's help in intercepting Petrobras-related email. This is more about the possibility of such a threat than anything else. Disclaimer: I work at Microsoft, so eh.

devx 13y ago
Why take the chance? From the leaks, the companies have "cooperated enough", especially when we're talking about "foreigners". We don't need proof for absolutely everything and for every single case, to stop trusting American companies, until there's a dramatic change in laws, and surveillance policy in US.
- stfu 13y ago
  This is going to be the main issue behind that argument. The burden of proof has shifted. The tech industries reaction to the Snowden seems to the outside very lukewarm. Sure, they are giving all sorts of "trust us" statements, but truth is we don't have the slightest clue if this is their honest opinion or just an opinion that a secret court forces them to uphold. Reality might be much more nuanced, but to the outside there is very little reason to give anyone any longer the benefit of the doubt.
  - barista 13y ago
    There is nothing that singles Microsoft out here as every other operator of email and other software complied as well. This is something the US government should come clean on and something that the tech companies should push the government to do.
    - stfu 13y ago
      Absolutely. There is nothing that singles out Microsoft as better or worse, but it is a looming issue for the whole US tech industry.
neves 13y ago
BTW: Petrobras uses, argh!, Lotus Notes. There were a lot allegations that Microsoft and IBM cooperated with the NSA and inserted backdoors in their products.
- CurtHagenlocher 13y ago
  Sure; I guess I should have said "credible allegations" meaning that a former NSA employee with specific claims is very credible, speculation based on a single exported symbol name in an older version of Windows is quite a bit less so. I was a bit amused to read that "The Expresso platform will also be used as the base of the Hotmail-like system that the government is also planning to offer to citizens." Are Brazil's citizens that trusting of its government? I certainly can't imagine Americans trusting their email to the government even before Snowden-gate.
  - mc32 13y ago
    Well, what better excuse to push a product ready for local government control but to sell it as the antidote to the specter of American/foreign spying. Brazil, as some other LAm countries, love using the American scapegoat to distract from many local issues (the economy is bad, it's the IMF and the Americans' faults, etc.) I mean to say this appears to be primarily a political reaction with nice governmental side-benefits.

marcosdumay 13y ago

It's more of a practical concern. Migrating the government to Linux and using a free mail infrastructure would be cheaper (saving money in the long term, instead of costing), easier, and way more effective than using a non-standard internal email protocol and keep using Windows everywhere. Why bother when Microsoft still has access to all your data? About using that proprietary protocol AND migrating to a free software environment, that could be better than just migrating, or worse, depends of the actual quality* of the protocol. But while the government frames it as a XOR option, migrating to an open stack is the only sane option. * The fact that the protocol isn't public isn't good, the fact that it's Serpro creating it makes this worse - they've already done quite a few bad decisions about security.

walshemj 13y ago

It sounds a lot like a Brazilian version of the secure intranet (GSI) that the UK has rolled out for lower level stuff. And from a security perspective (sorry linux fanbois and microsft haters) the choice of MTA/MUA isn't as important as the rest of the security. Would be interesting if due to this that OSI and X.400 makes a comeback for more secure email - though presumably with all the security enhancement proposed for the later standards - hmm I wonder if you could use quantum networking with x.400/500

malandrew 13y ago

If they opted for an entirely open source system (possibly open-sourcing the one in question) that several governments with the same concern could collaborate on, then they would probably be much safer. Going with a bespoke system that will be deployed widely is a recipe for problems. It's likely to have limited documentation and lots of setup edge-cases that are easy to compromise.

kenjackson 13y ago
For any interesting open source project, why would you think that the NSA wouldn't be deeply involved? If I were a spy agency and an open source project was being spun up that several countries would use, I'd get at least a dozen devs on it. And if I'm thinking that, then you know they all must be...