tptacek

8 ms·

211.
by tptacek 2mo ago
Again: in every system there's always some kind of sleuthing you could do to attempt to identify a user. That's not the legal standard. The complaint against A/I is that they knowingly and deliberately assisted the PKK.
212.
by tptacek 2mo ago
I feel like people just think they should be doing all sorts of complicated stuff, and if they're not, they're somehow slacking off on security. You used to see the same thing with password hashes where people would write paragrap
213.
by tptacek 2mo ago
It's neither an explanation nor a tautology; it's an element of US law.
214.
by tptacek 2mo ago
I don't think US cares about the PKK either, but that's not my point.
215.
by tptacek 2mo ago
Not at all clear why this is a better setup than a launcher shim that pulls secrets from a secret store and injects them into the environment as the program launches --- which is a pretty normal shape for these things to take. I guess you c
216.
by tptacek 2mo ago
Only in the sense that everything is technically a kind of a file given access to proc.
217.
by tptacek 2mo ago
It's pretty normal to keep secrets in a dedicated secret store, and then have the service launcher inject them from the secret store into the environment.
218.
by tptacek 2mo ago
It's not a secret store. It's an IPC mechanism. Secret stores are built on top of it.
219.
by tptacek 2mo ago
It's not my intuition that materializing secrets to files is a better way to protect them than just injecting them into the environment, where they don't persist.
220.
by tptacek 2mo ago
It's more accurate to describe it as a "premise", not an assumption. It may not be true of every environment, but it's a very common norm (for instance, secrets management systems inject tokens and such through the envir
221.
by tptacek 2mo ago
This OFAC action isn't based on "antifa", though the press release predictably takes shots at it. It's based on three designated foreign terrorist organizations, notably the PKK.
222.
by tptacek 2mo ago
Right, I'm only moved to comment by the implications being drawn on this thread that Signal and WhatsApp are next. Different fact patterns and different legal standards.
223.
by tptacek 2mo ago
There's all sorts of things any service provider could do to sleuth out who its users are. The implication of this OFAC determination is that A/I didn't need to sleuth anything out; they are accused of knowingly and deliberat
224.
by tptacek 2mo ago
Right, I get that. I'm also not taking a position on this (in particular, the PKK seems like a Europe problem, not a US problem, and if Europe doesn't care I don't see why we should.) But the analysis isn't based on &q
225.
by tptacek 2mo ago
Wait, is this the right analysis? WhatsApp doesn't enter into any kind of agreement with organizations using it about their political alignment or objectives. The allegation (I have no idea how valid it is) is that A/I does.
226.
by tptacek 2mo ago
If you have real operational security concerns, your provider shouldn't know anything about you; should in fact have bilateral shielding between themselves and you to prevent either counterparty from learning stuff. That's how Sig
227.
by tptacek 2mo ago
I feel much more confident saying that regardless of the validity of the underlying legal argument, this administration's messaging (on everything) is unhinged and partisan. I'm purposefully not reading into or out of what they&#x
228.
by tptacek 2mo ago
I have no idea, but --- non-normatively --- there is some signal to be gleaned from this particular provider being targeted and not other, better-known and more systemically important ones.
229.
by tptacek 2mo ago
I share most HN'ers priors about this administration and its motives and am commenting positively, not normatively, and only about the specific claim the Treasury Department made. Signal doesn't knowingly and deliberately provide
230.
by tptacek 2mo ago
Without judging this or trying to axiomatically derive the logic, I think the claim here is that a/I knowingly and deliberately provides services to the PKK, which the US and the EU designate as a terrorist organization.
231.
by tptacek 2mo ago
The Twitter-competitive social site is moribund, so I think maybe what you're seeing more and more of is the pivot towards infrastructure --- always planned, but not before such a big part of the messaging.
232.
by tptacek 2mo ago
In which European countries?
233.
by tptacek 2mo ago
Lots of countries have temporary worker status. The requirement to leave the country to re-up it appears to be a distinctively American thing.
234.
by tptacek 2mo ago
OK, ok, my bad, carry on! :)
235.
by tptacek 2mo ago
Not really. The opposing vibes in this case seem really weak?
236.
by tptacek 2mo ago
You're entitled to whatever policy preferences you might have (within reason, I guess; this housing position is within reason). Whether your surrounding community should honor that preference is a different question. Depending on where
237.
by tptacek 2mo ago
A PAKE is more complicated than Noise. Noise is fussy (for good reasons) but relatively simple.
238.
by tptacek 2mo ago
NIMBYism isn't a fixed group of people; it's a policy position. Policy positions can be bad or good or all points in between. What they're not is analogous to religions, or even political parties. They do not need to be enter
239.
by tptacek 2mo ago
Not a huge lift to stick a PAKE in this protocol, though I'm dubious that it'd be much of a win. The PAKE + nameplate system in Wormhole makes a lot of sense, because you're doing one very specific thing with that system (mov
240.
by tptacek 2mo ago
LVT : housing :: guaranteed income policy : labor. It's not a bad idea, but it doesn't moot the underlying questions, because it will never be deployed at the scale where it would be dispositive.

More ›