Comment by 3pt14159 | Hacker News Reader

Comment by 3pt14159 | Hacker News Reader

Here is what I don't understand:

On my website I can make every path resolve. I.e., I can have

www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad

Render a page that says:

> I haven't been paid off by the Mossad

Easy peasy. Then, if I take a grubby payment to fuck over a client (with an NDA, of course) I don't write about it, I just make that one path fail to resolve.

It's writing by omission.

This is why I'm ideologically against these canaries. They paper over a real problem and they expose a new one without really solving the first.

Tech naturally centralizes while politicians naturally push the limits of governmental power to enact their objectives to the furthest degree possible, and these things come into conflict. But some information should not be shared and, at times, we need to allow the government to decide when. Sometimes we need to pushback too. It's not an all or nothing thing, but these canaries are inherently anarchistic and, to me, distasteful.

To make the path stop resolving, you'd have to perform an action (update the server, etc.).

These canaries are not automatically updated: they are manually updated (that's the whole point).

If you receive a gag order you just do nothing.

They are just good for business.

No company is going to defy an order from a secret court or a NSL that states they are not to modify statements on their website until further notice. People will dispute the legality of such orders, but companies know how long they can be off the internet before going out of business. At least, that is based on conversations I have had with a corporate legal executive.

> order from a secret court or a NSL that states they are not to modify statements on their website until further notice

That's the point. The theory is that a NSL can compel you to not speak, but it can't compel you to speak. Not updating a canary is the latter, not the former.

If a canary isn't updated in the period it is expected to update it is considered "dead" or "tripped".

Assuming they can't compel speech, this would require the canary to be updated and PGP signed daily by someone that can represent the company. Perhaps a principal officer or a board member?

Even then, unless your contract states that the canary is managed in a particular way, they can simply lie. I can put a "canary" on a site and update it daily, even if every three letter agency were logged in and watching you real time. A recent example of this was that VPN provider that stated they don't log anything. Turned out they did and someone got nailed.

A canary in itself does not offer any cryptographic proof. The entire foundation is that the government cannot legally compel speech.

The canary does not protect you against the service provider and nobody has claimed that. The theory is that it protects you against NSLs that would otherwise force the service provider to not disclose the NSL.

Sometimes a canary is attached to a public financial report or something else that it is already illegal to lie in, so that would require the government to compel you to break a separate law.

It seems like you are thinking of canaries in the engineering, cryptographic or social sense, in which case the are useless. They only have purpose in a legal sense as a literal "canary in the coalmine".

That is basically what I am saying. Unless all of this is tied into a counter-signed contract, it is all rather meaningless. I would suggest that almost nobody has such an agreement with their end user service providers.

I am no lawyer, but I don't see a problem with putting a lie into a financial statement that is in no way related to financial data. It would just be disregarded as unrelated to financial reporting. I am also not aware of any companies doing this. I could see this causing a deeper dive into an audit however.

> But some information should not be shared and, at times, we need to allow the government to decide when.

I agree with the first part of your statement but not the second. I don't trust the government with that absolute power.

That's why we have an adversarial legal system: to challenge the government when we think they're doing wrong. Unfortunately, the government has effectively created a shadow legal system where challenges are ineffective. This is why things like warrant canaries are necessary, when the government tries to do an end run around checks on its power.

> www.zachaysan.com/I-havent-been-paid-off-by-the-Mossad

Well, it doesn't resolve for me... The only conclusion is that you've been paid off by the Mossad.

Reply on news.ycombinator.com