6 ms·

Rsync.net Warrant Canary

99 points by jcsalterego 17y ago

alain94040 17y ago
Funny... But it probably wouldn't work anyway. If a judge agrees that there is a need for a secret warrant, it's serious enough (aka national security) that the judge will tell you to continue doing business as usual, including posting your weekly canary. There is no harm to you of posting an incorrect warrant canary and if that's the only objection you have, the judge will be happy to give you immunity on that point. If you refuse to do so, expect to be held in contempt or similar coercion technique. Bottom line: it doesn't work. Too bad.
melito 17y ago
When I saw this on the front page I assumed a warrant had been served.
- jcsalterego 17y ago
  Guess they should have called it a warrant-free canary, huh.
bcl 17y ago
Looks good. gpg: Signature made Mon Jul 13 08:44:56 2009 PDT using DSA key ID 7D6F806C gpg: Good signature from "rsync.net <info@rsync.net>"
- mjgoins 17y ago
  You realize that unless you have a trust path via keys that you've signed (preferably by meeting the people holding them) that that verification isn't verifying much, right? It's pretty easy to create a key that has that key id (since it's only the last few hex digits of the full 40 digit fingerprint) and the user id is freeform. If you don't believe it's easy to pick your own key id, check the keyservers for the number of keys with DEADBEEF as their key id ;)
  - bcl 17y ago
    yes. And if I were a customer of theirs I'd work to obtain a more trusted copy of their key. But, FYI, I've had this copy of their key in my keyring for several years, I didn't just pull it off their website today.
callahad 17y ago
Rsync.net is a fantastically awesome service. Check out their FAQ: Will you support my use of X ? Yes. If you are using X with an rsync.net filesystem, we will support and troubleshoot your use of it, regardless of how complex or esoteric that usage or application is. All such support will be handled by a real live Unix engineer, and will never be dealt with by a ticket system, autoresponder, or first level / junior "technician". Really ?! Yes. We are not just providing offsite filesystems, we are providing complete, end to end, personal customer support. I can't even get that level of support ("real live Unix engineer") at my current workplace when things go pear-shaped.
- boundlessdreamz 17y ago
  How well will this scale? Isn't this setting the expectations too high and if the company grows well this promise might be difficult to adhere to.
  - icey 17y ago
    I used to host with johncompanies.com (started by the same group or person), and support was always excellent with them as well. I didn't have to use it often, but whenever I did it was a fantastic experience. It seems like they've got a pretty good idea about what things cost them and can scale by charging the right price for their business. I think they'll do fine.
  - lsc 17y ago
    they've been around for a while. I had an account with johncompanies before I started prgmr.com. My experience was quite positive. I've heard this 'it doesn't scale' argument many times, and I think the source is that the sort of skills it takes to maintain support infrastructure of that quality are quite different from and rarely present in the same individual (or management of a company) as the skills required to scale out a product to the mass market. Also, I don't believe the mass market doesn't really want a unix nerd on the level 1 support line. they want someone who speaks 'normal person.'
  - lanaer 17y ago
    They are quite costly compared to other online backup services — and money tends to help with scalability.
dexen 17y ago
Looks like a pretty decent law hack to me; they are going to comply with the warrant and just not update a particular file anymore. Still, I assume a skilled lawyer would be able to convince a judge that the net effect is that users effectively obtain information about rsync.net being served a warrant quite closely around some specific date, and thus the service broke the law anyway (assuming secret warrants are lawful in the first place).
- dkarl 17y ago
  It seems transparently, wishful-thinkingly illegal. If everyone can find out when a warrant was served by watching what rsync.net says, then how can rsync.net claim they kept the existence of the warrant secret?
  - hvs 17y ago
    I'm not sure that the government can legally force you to lie, though. Anyway, I'm sure the authors of the law didn't consider this possibility (they are politicians after all) so it would ultimately be decided by a judge. I would bet 50/50 on the result.
    - dkarl 17y ago
      There's nothing really novel here, though, except a little bit of cryptography to prevent the government from faking the messages, and the authors of the law were almost certainly not politicians. As far as I'm aware, laws are normally drafted by the people who want them passed -- lobbyists, usually, but in this case I would guess the law was written by DOJ or FBI lawyers.
  - tc 17y ago
    The law takes the idea of forcing a person to speak much more seriously than the idea of forcing him to remain silent, particularly if you would be forcing him to make a knowingly false declaration. I can't think of an instance off-hand where a US judge has forced a civilian by injunction to make a known-false public statement.
pronoiac 17y ago
Heh. This is likely based on similar technically legal signs: http://www.librarian.net/technicality.html http://www.librarian.net/technicality.html This has been around around a year: http://www.reddit.com/r/programming/comments/2ygi6/warrant_canary_circumventing_secret_isp_warrants http://www.reddit.com/r/programming/comments/2ygi6/warrant_c... Edit: HTML. Another edit: reddit.
defen 17y ago
> In opening remarks, a Democratic senator emphasized Judge Sonia Sotomayor's upbringing, while a Republican senator expressed concerns about activism on the bench. I don't know, that probably could have been written a week ago. Should we be worried? :-P
- jsteele 17y ago
  > I don't know, that probably could have been written a > week ago. No, it couldn't have, unless you have a time machine and a friend on the NYT's national desk, because it was in the Times today, not last week: http://lmgtfy.com/?q=In+opening+remarks%2C+a+Democratic+senator+emphasized+Judge+Sonia+Sotomayor%27s+upbringing%2C+while+a+Republican+senator+expressed+concerns+about+activism+on+the+bench http://lmgtfy.com/?q=In+opening+remarks%2C+a+Democratic+sena....
  - defen 17y ago
    It was a joke - my point was that anyone who pays attention to politics would have known that the Democrats would emphasize her upbringing, and Republicans would express concerns about judicial activism.
    - benatkin 17y ago
      That reminds me of a podcast by The Economist called "The Week Ahead", where each Friday they try to guess what the major news stories in the next week will be. I agree with you that they could have found a story that would have been harder to guess. http://video.economist.com/index.jsp?fr_chl=157a3251a697e23eab5b3766efed94162aedc245&rf=podcast http://video.economist.com/index.jsp?fr_chl=157a3251a697e23e...
      - jsteele 17y ago
        I hate to belabor the point, and I'm pretty sure you get it anyway, but it's not the general subject or tone of the story that matters, it's the exact wording, which would be very hard to guess, especially for longer excerpts. It's not a matter of finding a "story" that's hard to guess, it's a matter of finding exact wording. I'll guess there's going to be some kind of trouble with the space shuttle next week, but that doesn't help defeat rsync.net's scheme.
iigs 17y ago
While I admire the spirit of this, unfortunately I believe it's of limited use: Once word gets out that these guys are LEA "unfriendly", it will start to attract the kinds of people that get LEA attention, and then they'll have to respond to a court order / subpoena / warrant / lawful intercept, and it's all over. Large ISPs routinely get subpoena requests all the time (i.e. they have teams that do only that). I think rsync.net is setting themselves up for a lot of undesired press when they finally have to do it.
- lsc 17y ago
  /Large ISPs routinely get subpoena requests all the time/ sure, but I don't think they are secret very often.
luckyland 17y ago
Here's where the warrant will first be served: http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=255+G+Street+%23597+San+Diego,+CA&sll=37.0625,-95.677068&sspn=64.153332,69.960938&ie=UTF8&ll=32.712534,-117.162334&spn=0.008495,0.00854&t=h&z=17&iwloc=A&layer=c&cbll=32.712533,-117.162448&panoid=9yxfjRw3Wvkozp89sj1Rhg&cbp=12,182.07,,0,10.65 http://maps.google.com/maps?f=q&source=s_q&hl=en&#38...
reconbot 17y ago
Couldn't the fbi just use their upstream provider?
- pert 17y ago
  http://www.rsync.net/resources/faq.html#2 http://www.rsync.net/resources/faq.html#2
forsaken 17y ago
Nobody has pointed out how easily the "news story" of today could be faked and updated. It's a simple script that would be able to read google news, pick out a random story, and throw it in the PGP signed message. How can that not be automated?
- enneff 17y ago
  If the signing can be done without a human providing the key/passphrase, then the whole thing is worth nothing anyway.
lanaer 17y ago
Kind of amusing, but dubious legality. This is better: http://rsync.net/products/encrypted.html http://rsync.net/products/encrypted.html

99 points by jcsalterego 17y ago

Funny... But it probably wouldn't work anyway. If a judge agrees that there is a need for a secret warrant, it's serious enough (aka national security) that the judge will tell you to continue doing business as usual, including posting your weekly canary. There is no harm to you of posting an incorrect warrant canary and if that's the only objection you have, the judge will be happy to give you immunity on that point. If you refuse to do so, expect to be held in contempt or similar coercion technique. Bottom line: it doesn't work. Too bad.

melito 17y ago

When I saw this on the front page I assumed a warrant had been served.

jcsalterego 17y ago
Guess they should have called it a warrant-free canary, huh.

bcl 17y ago

Looks good. gpg: Signature made Mon Jul 13 08:44:56 2009 PDT using DSA key ID 7D6F806C gpg: Good signature from "rsync.net <info@rsync.net>"

mjgoins 17y ago
You realize that unless you have a trust path via keys that you've signed (preferably by meeting the people holding them) that that verification isn't verifying much, right? It's pretty easy to create a key that has that key id (since it's only the last few hex digits of the full 40 digit fingerprint) and the user id is freeform. If you don't believe it's easy to pick your own key id, check the keyservers for the number of keys with DEADBEEF as their key id ;)
- bcl 17y ago
  yes. And if I were a customer of theirs I'd work to obtain a more trusted copy of their key. But, FYI, I've had this copy of their key in my keyring for several years, I didn't just pull it off their website today.

callahad 17y ago

Rsync.net is a fantastically awesome service. Check out their FAQ: Will you support my use of X ? Yes. If you are using X with an rsync.net filesystem, we will support and troubleshoot your use of it, regardless of how complex or esoteric that usage or application is. All such support will be handled by a real live Unix engineer, and will never be dealt with by a ticket system, autoresponder, or first level / junior "technician". Really ?! Yes. We are not just providing offsite filesystems, we are providing complete, end to end, personal customer support. I can't even get that level of support ("real live Unix engineer") at my current workplace when things go pear-shaped.

boundlessdreamz 17y ago
How well will this scale? Isn't this setting the expectations too high and if the company grows well this promise might be difficult to adhere to.
- icey 17y ago
  I used to host with johncompanies.com (started by the same group or person), and support was always excellent with them as well. I didn't have to use it often, but whenever I did it was a fantastic experience. It seems like they've got a pretty good idea about what things cost them and can scale by charging the right price for their business. I think they'll do fine.
- lsc 17y ago
  they've been around for a while. I had an account with johncompanies before I started prgmr.com. My experience was quite positive. I've heard this 'it doesn't scale' argument many times, and I think the source is that the sort of skills it takes to maintain support infrastructure of that quality are quite different from and rarely present in the same individual (or management of a company) as the skills required to scale out a product to the mass market. Also, I don't believe the mass market doesn't really want a unix nerd on the level 1 support line. they want someone who speaks 'normal person.'
- lanaer 17y ago
  They are quite costly compared to other online backup services — and money tends to help with scalability.

dexen 17y ago

Looks like a pretty decent law hack to me; they are going to comply with the warrant and just not update a particular file anymore. Still, I assume a skilled lawyer would be able to convince a judge that the net effect is that users effectively obtain information about rsync.net being served a warrant quite closely around some specific date, and thus the service broke the law anyway (assuming secret warrants are lawful in the first place).

dkarl 17y ago
It seems transparently, wishful-thinkingly illegal. If everyone can find out when a warrant was served by watching what rsync.net says, then how can rsync.net claim they kept the existence of the warrant secret?
- hvs 17y ago
  I'm not sure that the government can legally force you to lie, though. Anyway, I'm sure the authors of the law didn't consider this possibility (they are politicians after all) so it would ultimately be decided by a judge. I would bet 50/50 on the result.
  - dkarl 17y ago
    There's nothing really novel here, though, except a little bit of cryptography to prevent the government from faking the messages, and the authors of the law were almost certainly not politicians. As far as I'm aware, laws are normally drafted by the people who want them passed -- lobbyists, usually, but in this case I would guess the law was written by DOJ or FBI lawyers.
- tc 17y ago
  The law takes the idea of forcing a person to speak much more seriously than the idea of forcing him to remain silent, particularly if you would be forcing him to make a knowingly false declaration. I can't think of an instance off-hand where a US judge has forced a civilian by injunction to make a known-false public statement.

pronoiac 17y ago

Heh. This is likely based on similar technically legal signs: http://www.librarian.net/technicality.html http://www.librarian.net/technicality.html This has been around around a year: http://www.reddit.com/r/programming/comments/2ygi6/warrant_canary_circumventing_secret_isp_warrants http://www.reddit.com/r/programming/comments/2ygi6/warrant_c... Edit: HTML. Another edit: reddit.

defen 17y ago

> In opening remarks, a Democratic senator emphasized Judge Sonia Sotomayor's upbringing, while a Republican senator expressed concerns about activism on the bench. I don't know, that probably could have been written a week ago. Should we be worried? :-P

jsteele 17y ago
> I don't know, that probably could have been written a > week ago. No, it couldn't have, unless you have a time machine and a friend on the NYT's national desk, because it was in the Times today, not last week: http://lmgtfy.com/?q=In+opening+remarks%2C+a+Democratic+senator+emphasized+Judge+Sonia+Sotomayor%27s+upbringing%2C+while+a+Republican+senator+expressed+concerns+about+activism+on+the+bench http://lmgtfy.com/?q=In+opening+remarks%2C+a+Democratic+sena....
- defen 17y ago
  It was a joke - my point was that anyone who pays attention to politics would have known that the Democrats would emphasize her upbringing, and Republicans would express concerns about judicial activism.
  - benatkin 17y ago
    That reminds me of a podcast by The Economist called "The Week Ahead", where each Friday they try to guess what the major news stories in the next week will be. I agree with you that they could have found a story that would have been harder to guess. http://video.economist.com/index.jsp?fr_chl=157a3251a697e23eab5b3766efed94162aedc245&rf=podcast http://video.economist.com/index.jsp?fr_chl=157a3251a697e23e...
    - jsteele 17y ago
      I hate to belabor the point, and I'm pretty sure you get it anyway, but it's not the general subject or tone of the story that matters, it's the exact wording, which would be very hard to guess, especially for longer excerpts. It's not a matter of finding a "story" that's hard to guess, it's a matter of finding exact wording. I'll guess there's going to be some kind of trouble with the space shuttle next week, but that doesn't help defeat rsync.net's scheme.

iigs 17y ago

While I admire the spirit of this, unfortunately I believe it's of limited use: Once word gets out that these guys are LEA "unfriendly", it will start to attract the kinds of people that get LEA attention, and then they'll have to respond to a court order / subpoena / warrant / lawful intercept, and it's all over. Large ISPs routinely get subpoena requests all the time (i.e. they have teams that do only that). I think rsync.net is setting themselves up for a lot of undesired press when they finally have to do it.

lsc 17y ago
/Large ISPs routinely get subpoena requests all the time/ sure, but I don't think they are secret very often.

luckyland 17y ago

Here's where the warrant will first be served: http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=255+G+Street+%23597+San+Diego,+CA&sll=37.0625,-95.677068&sspn=64.153332,69.960938&ie=UTF8&ll=32.712534,-117.162334&spn=0.008495,0.00854&t=h&z=17&iwloc=A&layer=c&cbll=32.712533,-117.162448&panoid=9yxfjRw3Wvkozp89sj1Rhg&cbp=12,182.07,,0,10.65 http://maps.google.com/maps?f=q&source=s_q&hl=en&#38...

reconbot 17y ago

Couldn't the fbi just use their upstream provider?

pert 17y ago
http://www.rsync.net/resources/faq.html#2 http://www.rsync.net/resources/faq.html#2

forsaken 17y ago

Nobody has pointed out how easily the "news story" of today could be faked and updated. It's a simple script that would be able to read google news, pick out a random story, and throw it in the PGP signed message. How can that not be automated?

enneff 17y ago
If the signing can be done without a human providing the key/passphrase, then the whole thing is worth nothing anyway.

lanaer 17y ago

Kind of amusing, but dubious legality. This is better: http://rsync.net/products/encrypted.html http://rsync.net/products/encrypted.html