4 ms·

Doesn't that apply equally to any shared hosting?

SideburnsOfDoom 13y ago
It applies to any shared hosting with servers in in the US that operates above a certain scale; yes. What that certain scale is who knows, but github the most visible hosting service so is certain to be above it. Github is great for my open source work. Everyone's allowed to see that code, even the NSA. However you can find source to LOIC on github. I'm sure that who put that there and who worked on it when would be of interest to them and form a suitable pretext for a dragnet.
- danielweber 13y ago
  Yeah, because the NSA can't do anything about the service run by 2 guys in Germany. </s>
  - ef4 13y ago
    It's not a question of "can't", it's a question of economics. People keep confusing targeted attacks with bulk data collection. Nobody doubts the NSA can successfully launch a targeted attack against nearly any organization. But that's not economical to do against everyone all the time. Whereas bulk collection of unencrypted or poorly-encrypted data from the handful of biggest cloud providers and network operators is cheap and easy. So yes -- leaving the big providers in favor of competently-managed small-scale, lesser-known providers is probably a step up in privacy.
    - mpyne 13y ago
      Except that legally speaking bulk collection is even easier for NSA overseas where the Fourth Amendment doesn't apply. Given the way cloud computing works all they'd have to do is "target" the top 3 or 4 cloud-based source code hosts and get everything, and there'd be no legal defense against it. For U.S.-based cloud infrastructure it's at least possible to take it to court (as Levison did). So it's a pick your poison thing unfortunately. If you think you can outwit targeted surveillance then by all means use an overseas hosting provider but if they would be targeting you either way then it might actually be safer doing what The Guardian does, and using U.S. law as a shield.
      - SideburnsOfDoom 13y ago
        > Except that legally speaking bulk collection is even easier for NSA overseas where the Fourth Amendment doesn't apply Treating notionally allied countries as free-fire zones is a curious definition of "easy". You run this kind of risk: http://en.alalam.ir/news/1528560 http://en.alalam.ir/news/1528560 And for that reason, anyone with regard to the long term would deploy that kind of thing cautiously, if at all. But I have no idea if that applies to the NSA. It's curious, I have seen this kind of comment on HN before, essentialy saying "US law doesn't apply in other countries therefore the NSA can do anything that they want there" ignoring that other countries have their own laws, often stricter in terms of privacy. My suspicion is that this is a particularly USAian myopia, which does not bode well for the NSA. Clearly they have gotten away with for a decade or more; but it relies on goodwill and secrecy; and those reservoirs are looking very low lately.
        mpyne 13y ago
        > My suspicion is that this is a particularly USAian myopia, which does not bode well for the NSA. I am telling you literally like it is. Whether or not you want the Fourth Amendment to apply outside of the U.S. (keeping in mind that amendment is the only part of U.S. constitutional law restricting electronic surveillance by the U.S. government anywhere in the world), the fact is that legally speaking it doesn't. I'm not telling you how the world should be here, I'm telling you how it actually is. This is not specific to the U.S. though. Does Germany have constitutional laws forbidding them to collect intelligence from networks in France?
        SideburnsOfDoom 13y ago
        > Whether or not you want the Fourth Amendment to apply outside Now you have changed the subject. The original assertion was that it was "easier" for the NSA to collect bulk data outside of the USA. If the 4th amendment was the only factor then it might be so. My point was that the 4th is not the only factor. For another example of this, how seriously would someone like Lavabit take a US court order to hand over keys and shut up if they were based in Reykjavík?
    - SideburnsOfDoom 13y ago
      Quite right. Even better is hosting your git yourself so that the data never leaves the premises. it is more work; but from a security point of view it's even better.
- dobbsbob 13y ago
  That's why evil github exists, GitTor where all your low orbit ion cannon dev trees can be uploaded without metadata. You can also use Tor to sync small github projects through ssh. Employee internal communications should all be done away from Github and encrypted if you're working on something like p2p software and worried your flippant piracy jokes might be held up in a court room one day as "proof" your project is criminal. I would always assume all comms are stored forever and available to anybody who requests them, like lawyers looking to sue you and would like all your HipChat logs.
  - SideburnsOfDoom 13y ago
    What is "evil github" ?
    - dobbsbob 13y ago
      https://wzrtr6gpencksu3d.tor2web.org/ https://wzrtr6gpencksu3d.tor2web.org/ It's just a .onion github clone to pseudoanon share booters/LOIC and other "evil" code. It was called GitTor but I guess they recently changed the name.
cbsmith 13y ago
Actually, it applies equally to private hosting too.
- SideburnsOfDoom 13y ago
  But no so much to on-premises self-hosting. I am talking about the danger of bulk data collection here, as per https://news.ycombinator.com/item?id=7410794 https://news.ycombinator.com/item?id=7410794

It applies to any shared hosting with servers in in the US that operates above a certain scale; yes. What that certain scale is who knows, but github the most visible hosting service so is certain to be above it. Github is great for my open source work. Everyone's allowed to see that code, even the NSA. However you can find source to LOIC on github. I'm sure that who put that there and who worked on it when would be of interest to them and form a suitable pretext for a dragnet.

danielweber 13y ago
Yeah, because the NSA can't do anything about the service run by 2 guys in Germany. </s>
- ef4 13y ago
  It's not a question of "can't", it's a question of economics. People keep confusing targeted attacks with bulk data collection. Nobody doubts the NSA can successfully launch a targeted attack against nearly any organization. But that's not economical to do against everyone all the time. Whereas bulk collection of unencrypted or poorly-encrypted data from the handful of biggest cloud providers and network operators is cheap and easy. So yes -- leaving the big providers in favor of competently-managed small-scale, lesser-known providers is probably a step up in privacy.
  - mpyne 13y ago
    Except that legally speaking bulk collection is even easier for NSA overseas where the Fourth Amendment doesn't apply. Given the way cloud computing works all they'd have to do is "target" the top 3 or 4 cloud-based source code hosts and get everything, and there'd be no legal defense against it. For U.S.-based cloud infrastructure it's at least possible to take it to court (as Levison did). So it's a pick your poison thing unfortunately. If you think you can outwit targeted surveillance then by all means use an overseas hosting provider but if they would be targeting you either way then it might actually be safer doing what The Guardian does, and using U.S. law as a shield.
    - SideburnsOfDoom 13y ago
      > Except that legally speaking bulk collection is even easier for NSA overseas where the Fourth Amendment doesn't apply Treating notionally allied countries as free-fire zones is a curious definition of "easy". You run this kind of risk: http://en.alalam.ir/news/1528560 http://en.alalam.ir/news/1528560 And for that reason, anyone with regard to the long term would deploy that kind of thing cautiously, if at all. But I have no idea if that applies to the NSA. It's curious, I have seen this kind of comment on HN before, essentialy saying "US law doesn't apply in other countries therefore the NSA can do anything that they want there" ignoring that other countries have their own laws, often stricter in terms of privacy. My suspicion is that this is a particularly USAian myopia, which does not bode well for the NSA. Clearly they have gotten away with for a decade or more; but it relies on goodwill and secrecy; and those reservoirs are looking very low lately.
      - mpyne 13y ago
        > My suspicion is that this is a particularly USAian myopia, which does not bode well for the NSA. I am telling you literally like it is. Whether or not you want the Fourth Amendment to apply outside of the U.S. (keeping in mind that amendment is the only part of U.S. constitutional law restricting electronic surveillance by the U.S. government anywhere in the world), the fact is that legally speaking it doesn't. I'm not telling you how the world should be here, I'm telling you how it actually is. This is not specific to the U.S. though. Does Germany have constitutional laws forbidding them to collect intelligence from networks in France?
        SideburnsOfDoom 13y ago
        > Whether or not you want the Fourth Amendment to apply outside Now you have changed the subject. The original assertion was that it was "easier" for the NSA to collect bulk data outside of the USA. If the 4th amendment was the only factor then it might be so. My point was that the 4th is not the only factor. For another example of this, how seriously would someone like Lavabit take a US court order to hand over keys and shut up if they were based in Reykjavík?
  - SideburnsOfDoom 13y ago
    Quite right. Even better is hosting your git yourself so that the data never leaves the premises. it is more work; but from a security point of view it's even better.
dobbsbob 13y ago
That's why evil github exists, GitTor where all your low orbit ion cannon dev trees can be uploaded without metadata. You can also use Tor to sync small github projects through ssh. Employee internal communications should all be done away from Github and encrypted if you're working on something like p2p software and worried your flippant piracy jokes might be held up in a court room one day as "proof" your project is criminal. I would always assume all comms are stored forever and available to anybody who requests them, like lawyers looking to sue you and would like all your HipChat logs.
- SideburnsOfDoom 13y ago
  What is "evil github" ?
  - dobbsbob 13y ago
    https://wzrtr6gpencksu3d.tor2web.org/ https://wzrtr6gpencksu3d.tor2web.org/ It's just a .onion github clone to pseudoanon share booters/LOIC and other "evil" code. It was called GitTor but I guess they recently changed the name.

cbsmith 13y ago

Actually, it applies equally to private hosting too.

SideburnsOfDoom 13y ago
But no so much to on-premises self-hosting. I am talking about the danger of bulk data collection here, as per https://news.ycombinator.com/item?id=7410794 https://news.ycombinator.com/item?id=7410794