4 ms·

> Starting with 0-249 I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 reques

by nacs 13y ago

> Starting with 0-249 I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company you're fine. Might as well start sending 249 requests to every company they can think of.

deleted 13y ago
[deleted]
chimeracoder 13y ago
> I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company you're fine. I think you just answered your own question. The difference between 0 and 1 is pretty important. Think of it this way: until relatively recently, Github would return either a 500 or a login page (I forget which) if a logged-out user tried to access a private repo, whereas they would return a 404 if a logged-out user tried to access a nonexistent repo. If someone thought that you were working on a secret project and they had an idea what the project name might be, they would be able to confirm this with a simple HTTP request. They don't even need to see the contents of the repository in order to obtain what could be potentially damaging information (the mere existence of the project). This way, one can never be sure whether a company has received any letters, which is itself a rather valuable piece of information, until they have already received a large number (and presumably for a large number of targets).
- lstamour 13y ago
  Couldn't a service employ a warrant canary and effectively create a 0 bucket and a 0-249 bucket? I wonder... http://arstechnica.com/tech-policy/2013/11/apple-takes-strong-privacy-stance-in-new-report-publishes-rare-warrant-canary/ http://arstechnica.com/tech-policy/2013/11/apple-takes-stron...
gojomo 13y ago
Most likely neither the DoJ/DNI, nor any company that has received more than one request, wants a distinction that makes the first request stand out.
benologist 13y ago
The cynic in me thinks the publicity associated with reporting anything is going to make it impossible to tell who got any at all once it's a marketing tool.
dmn757 13y ago
The usage of a 0-249 block also keeps that sense of fear for the user base of the service(s). A sort of government scare tactic, you could say. If a service was allowed to say that they had 0 requests, perhaps more users would flock to that service as a less surveilled alternative to a competitor that is in the 1-249 bracket(or higher).
- deleted 13y ago
  [deleted]

by nacs 13y ago

deleted 13y ago

[deleted]

chimeracoder 13y ago

> I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company you're fine. I think you just answered your own question. The difference between 0 and 1 is pretty important. Think of it this way: until relatively recently, Github would return either a 500 or a login page (I forget which) if a logged-out user tried to access a private repo, whereas they would return a 404 if a logged-out user tried to access a nonexistent repo. If someone thought that you were working on a secret project and they had an idea what the project name might be, they would be able to confirm this with a simple HTTP request. They don't even need to see the contents of the repository in order to obtain what could be potentially damaging information (the mere existence of the project). This way, one can never be sure whether a company has received any letters, which is itself a rather valuable piece of information, until they have already received a large number (and presumably for a large number of targets).

lstamour 13y ago
Couldn't a service employ a warrant canary and effectively create a 0 bucket and a 0-249 bucket? I wonder... http://arstechnica.com/tech-policy/2013/11/apple-takes-strong-privacy-stance-in-new-report-publishes-rare-warrant-canary/ http://arstechnica.com/tech-policy/2013/11/apple-takes-stron...

gojomo 13y ago

Most likely neither the DoJ/DNI, nor any company that has received more than one request, wants a distinction that makes the first request stand out.

benologist 13y ago

The cynic in me thinks the publicity associated with reporting anything is going to make it impossible to tell who got any at all once it's a marketing tool.

dmn757 13y ago

The usage of a 0-249 block also keeps that sense of fear for the user base of the service(s). A sort of government scare tactic, you could say. If a service was allowed to say that they had 0 requests, perhaps more users would flock to that service as a less surveilled alternative to a competitor that is in the 1-249 bracket(or higher).

deleted 13y ago
[deleted]