Hacker News Reader

Comment by avar | Hacker News Reader

This is getting ridiculous. Why doesn't Wikileaks just host all their content in a Git repository and use GPG to sign their releases?

Then it would be impossible to take down the site, and anyone could easily spin up a mirror.

Instead there's one monolithic distribution site which isn't decoupled from their submission network. The site is frequently down during a fundraiser, and due to how they run it other people can't easily directly contribute resources to run mirrors of the site.

I'm beginning to think that Wikileaks is not as interested in actually getting leaks out as it is furthering Julian Assange's personal indispensability.

View on HN

Seriously. Take a page from the various illegal groups out there; use torrents, use filesharing, so on and so forth. Release snapshots of the website, let other people do the hosting and hide the true source.

People have been successfully hiding behind clever distribution techniques for as long as the internet existed. You'd think Wikileaks'd be able to think of something.

Indeed. It seems like there are plenty of alternatives to a vulnerable website (such as Freenet).

In that sense Assange role would be reduced to authenticating and releasing, and wouldn't have a lot of control over the publishing side of things. And that's the side which gets the most press coverage and attention (including from powerful governments).

Switching to that type of system would likely reduce his exposure to trouble... but that's probably the opposite of what he'd like.

I also have difficulty imagining journalists figuring out how to set up freenet.

Why wouldn't they just get a technical person to do it?

random journalist or insider: "hi, geek squad? can you set up some encryption software that allows me to perform covert communication across the internet? i don't know, freenet or freenode or firefox or something. what? no no, i'm definitely doing nothing suspicious. don't tell anyone, ok?"

Do you know any journalists? The ones I know are resourceful enough to know people with a variety of skills and connections. It's the nature of the job.

i'm sure they could get it done, but its much easier to get found out. better to have a simple method you don't rely on anyone else for.

I really share this feeling especially during the past 7 months while the fund-raising was ongoing.

Now, to be more practical and maybe start an implementation of a distributed Wikileaks. There are two processes : the submission process and the distribution process. I think the distribution process is easy with Git or any distributed VCS. The submission process is more tricky as this is involving a human/social process to merge content into the distribution "branch".

The submission process could be "à la" HN where there is a way to up/down vote a submission. When the submission is reaching a defined level, the submission is released for distribution. In this is case, the submission network is still centralized but the distribution part is really decentralized.

For submission process decentralization, distributed ticketing (e.g. http://ditz.rubyforge.org/ ) could be used to show status of a submission within a same git repository but showing/merging only submission reaching a level in its ticket. Just an idea...

Update : my humble comment is just on some technical aspect. The social/legal/human aspect of Wikileaks is something much more complex...

Submission for leaks (usually) also involves some sort of authentication, however. And that authentication needs to be kept confidential.

The result is that there's no way around a 'trusted' provider who signs releases, and that will inherently be a personality like Assange.

Simply relying on a reddit-style submission method would lead to a worse form of reddit. Currently you can evaluate whether or not you 'trust' content submitted to reddit by looking at the site hosting it (is the content from the NYT or a random blog?). For a wikileaks-reddit, all submissions would have to be anonymous, and you'd have no idea what is a real leak or not.

There's no need for a trusted singular provider. You can just implement this sort of thing as a circle of trust.

A leak could be made by anyone. But content would only be published on somerandomsite.com if it has been digitally signed by someone.

Who that someone is could be configurable. wikileaks.com would be things that are only signed by Assange, but you could spin up your own site with your own signing policies.

Emphatically agreed. Wikileaks lost my interest after their "Collateral Murder" campaign and then later threatening to take their ball (data) and go home if they didn't meet fundraising targets.

Compare that to how Wikipedia runs their affairs-- between the open and transparent editorial process and making their entire data corpus available from the get-go.

If they really wanted to be an eternal pain in the ass they'd have taken a page from that Anonymous group.

Don't you think subversion (pun intended) would be a more appropriate VCS?

Perhaps they should use the SVN interface to github?

No, it's centralized. Making it pretty much useless for this application.

It was a joke, jeez.

It's kind of funny that of all the post-CVS version control systems, the one that calls itself "subversion" is the one that hews the closest to the traditional paradigm.

>not as interested in actually getting leaks out as it is furthering Julian Assange's personal indispensability.

I agree, which is why it's hard for me to care if his adversaries squish him like a bug. Not a good way to get funding.

Reply on news.ycombinator.com