Signal president says company will not comply with U.K. ‘mass surveillance’ law
fortune.com
fortune.com
It also seems like there’s a tendency to relitigate battles that are lost. I assume the UK had some equivalent to the 90s crypto wars in the US where attempts to weaken and backdoor crypto by legal means were pretty decisively defeated.
It’s sad that precedents should only accrue to one side’s benefit.
I'm thinking of the fact that GCHQ invented RSA in 1973, four years before Ron Rivest, Adi Shamir and Leonard Adleman publicly described the same system, and only got around to declassifying this in 1997.
I thought it was more like, one guy there had a pretty good idea that it was possible that he wrote about, but never developed it into anything practical.
Am I mistaken, and the whole working system was described?
* https://web.archive.org/web/20180928121748/https://www.gchq....
IANAM (mathematician), but the formulae look RSA-like, though given the compute at the time, it may have been (too) expensive to try implementing.
I would definitely say that Cocks and RSA both independently discovered what we refer to as the RSA algorithm. We should maybe call it the Cocks–RSA algorithm.
* https://en.wikipedia.org/wiki/Public-key_cryptography#Histor...
DH qua DH was invented in 1976, and RSA qua RSA in 1977.
The concept "x" as we (generally) know x is what qua means. (Because words can mean and point to potentially many concepts.)
He means DH, as in Diffie Hellman, was not the first approach to key exchange. The difference is that in the UK we did what we usually do: we squandered an amazing innovation and let some other country benefit from it.
If so it was an inept attempt, not that "inept" rules it out.
But I do generally assume that when organisations point at their mistakes, it is not a failed attempt to look good.
So I'm both? Who do I fight for?
I will remind you that fighting for the slave owners never led to anything good.
There is a reason 'it was a good idea so I wrote it all down, thought of everything, and then forced everyone to do it' has never worked.
Anything and everything I do is to satisfy my own curiosity and desires, but that's only because I got lucky. Everyone who didn't get lucky, well, they have to slave away in jobs that may not be fulfilling, or are menial, etc; and I wouldn't wish that on anyone.
PS: Have you ever considered how paternalistic your view is?
I want people to live, to be free, to enjoy the same things I am. This is literally the opposite of paternalistic.
I am also not a tankie if that's what you concluded from my first remark.
I'm honestly curious why you wrote this and if you can explain what it means, because to me it means 'people who labor for others are wasting their lives as slaves and we need to remedy this'. What have I misread?
Our utility and thus QoL is measured in how the surrounding system values us. In a capitalist society that is visible through our salaries and our income as provided by other parties. In a marxist-leninist-like society, your value depends on your connections and how much you get done for the rest of the ruling party.
Thus, because we need to survive, we are forced into working for the system in any of the different ways it materializes.
When we are no longer useful to the system as productive members, we are forced into becoming useful for it.
Rooflessness is very much a solvable problem, but the roofless' purpose within the system to exist as examples for avoidance. "Stay in life or you will end up like them". "Be productive", "work hard in this rat race", "keep grinding", or you will end up like them.
When we are old and no longer productive, we are sent to hospice care, which costs a lot of money, it involves very expensive healthcare, and thus any money we have accumulated go to our care and back to the system, recycled to be used by consumers, and recycled all over again. Our kin and their love for us gets exploited, we become money sinks.
What for? We spend 40 years working to do what, live hopefully 20 years later, old frail and weak? To become a money pit? So that our loved ones and their love for us gets exploited?
---
I am laboring for others, but that doesn't mean I see myself as a slave. I am very lucky. I get paid a relatively excellent salary, and I get to work a nice and interesting job that satisfies my curiosity.
But very few people are as lucky as I am. Most people are not living and thriving, they are surviving, and I don't want that.
It's not the fact that they labor, it's the fact that they need to do that in the first place.
So the solution is to steal from those that have. How is working for capitalists different than working for those that don't want to work? In the former, everyone has a shot at winning. In the latter, nobody does.
I think squatting land to make people rent from you to be able to live is already pretty bad, so you could easily already be a bad person, but the concepts of individual ownership over public goods is the really problem,
If you need to or had to work for a living until you could afford not to, then you are a Prole.
Whether you choose to "betray" this class - and fight in support of the people who make the rules, the slave owners, those who play god without permission - is a different thing.
People pay attention to their material interests. In most cases, you can get through to working class people despite ideology. Can’t win everyone over either and that’s ok too.
Ultimately, results matter. My country started semi feudal and it was under socialism that it industrialised, electrified, developed universal health care, built homes for every working family, etc. Sadly the coup in 89 ended that, but it doesn’t have to have been perfect to have been good.
It is worth pointing out your observation applies to lots of post-colonial societies, too. Socialism took Tanzania's literacy rate from about 10% at independence to 80%+ in a generation, and IIRC it also doubled its agricultural output in that time by organising farming along collective lines. Life expectancy rose substantially too, though I forget by how much.
(So much for empires being about spreading civilization, eh?)
FWIW I don't even think USSR and its satellite states were socialist in any meaningful sense. Socialism, after all, is the common ownership of the means of production. But most of the populace on all those states were excluded from governance, and thus from any effective ownership. So, in practice, it was collective exploitation of the workers by the elites under threat of direct physical force - strictly worse than wage slavery. Some orthodox opposition Marxists in USSR even claimed that it was the perfect example of what Marx originally called the "Asiatic mode of production".
They're very much not. Wat a complete nonsense.
In the mid- to long-term, I'm not so sure.
Remember folks, this week Boris informed the covid inquiry he has "forgotten" the pin to the phone all his WhatsApp messages from that time are on.
If it was one of us, they'd use the bit of RIPA that carries a minimum two year sentence for not giving up an encryption key or password when asked to by the police.
When the government creates a law within recorded history — something like a wiretapping law — then the spirit of the law is well-known at time of creation. Usually, that "spirit" is that it's created to explicitly grant a capability to the government to do a thing for the benefit of the public under a certain circumstance. So if technology changes, the spirit that the original law was defined under is expected to be upheld by the court when interpreting the law to suit cases outside its original scope.
The problem with "legacy" common law — things like "being able to transact anonymously using cash" — is that there is no clear "institutional memory" of the spirit that created the law. The people who invented "using gold coins as a common exchange for barter" weren't thinking about anonymity — and so it's not clear whether anonymity is a necessary or desirable part of the spirit of cash transactions, something the public would desire to be preserved in a replacement system; or whether it's just an "implementation detail" of the way cash happened to need to work given technology, something that would make no sense to port over to the new system.
I'm not saying that case law isn't also an important aspect of the 'law' and that the constitution shouldn't be amended – I'm not really a hardcore 'originalist' – I just mean that any time a SCOTUS ruling comes out, it's clear that in the public square discussion, nobody has read these very important contextual documents and it is maddening.
Legislators change the law (including, rarely, the constitution) — effectively by applying a hierarchy of "countermanding orders" — to suit the changing interests of the public. Courts interpret the law, but only downstream of legislation. The executive can make regulation and executive orders, but only in agreement with the law.
But at the founding of any given country, something else usually happens: certain rights and laws that are already recognized intuitively become enshrined into the country's constitution. Things are written down into law not as a representation of a shift in public sentiment, but as a recognition of existing sentiment, and the desirability to formalize that sentiment as law to protect it from encroachment by legislation.
Usually, this is done in the form of "representative anarchy": the people who establish a country are the people everyone rallied behind to overthrow the previous country; and because of this, they have very good knowledge of what rights their constituents were demanding that the previous government wasn't giving them.
There's no trivial way to map this "representative anarchy" process of self-evident-rights information-gathering into an equivalent process that would occur within an established continuous government. But that doesn't mean it's impossible.
For example, there could be a government department charged with 1. doing a kind of embedded journalism to figure out what issues "the people" are beginning to care about, that the law's stance on has no clear basis, because those issues were irrelevant when the constitution was enshrined; and then 2. coming up with referrendum-like polls to gather data on said public sentiment; where if the polls indicate a need, then at that point 3. the data will lead to a mandate for a constitutional amendment enshrining the public's desires to be created and put into force, which stands until this has successfully occurred; where 4. it is then up to the legislature and the supreme court to work together to draft the amendment; but 5. the ability to ratify the amendment is not in the hands of the legislature or the courts, but instead, this department will assemble a federal grand jury with participants from all states, which has a veto over each draft, and a congressional-subpoena-like ability to summon and retain the services of arbitrary legal experts to interpret the draft. (In est, this is trying to get as close as possible to having the public write the amendment themselves, with the legislature+courts being forced to "do the hard work" but not having any power over the result.)
But exactly how such a system would work isn't really my point; my point is that there is currently no such system, and that this is perhaps a problem. In fact, it is perhaps the problem — the problem that leads to governments founded with public support increasingly failing to address the interests of the people over time; and so, to governments being overthrown and new countries being founded.
The public is clearly not bound to even attempt to be consistent in its opinions from case to case, and if it's all over the place in its verdicts and might well be accepting or rejecting a verdicts for different reasons from the justices (maybe they think the legal arguments about privacy in the original Roe vs Wade were weak but also think women should have an inherent right to abortion that legislators haven't provided them with), it'ś difficult to see how lower courts can be bound by it.
There's also a big question of who gets to vote, particularly for the cases where a state law is argued to be in violation of the federal constitution, which tends to be the more controversial ones...
In my opinion, if SCOTUS is split 5/4 (or even 6/3) on anything, that should be taken as prima facie evidence that the law is unclear and needs amending. At that point we should require all the deciding judges to make a write-up for each opinion in the case detailing the requisite changes to the law that would make all judges to rule unanimously in favor of that opinion. These can then be submitted to the legislature or a referendum or whatever, but either way some decision needs to be made.
You're completely missing the point of the supreme court. It's explicitly not a democratic institution; it's purpose is to protect the constitutional rights of the minority from the tyranny of the majority. The other two branches are democratic; isn't that enough for you?
Surely you see the point of the US being a republic; rule by law, not by men. In your vision of the supreme court, if the majority decided they wanted to lock up some minorty and send them to gas chambers, the court couldn't do anything to stop them because the populace would vote for it in a referendum. That kind of thing has happened countless times in history in countries that didn't have a strong court system capable of protecting people's rights from the tyrrany of the majority.
I don't agree with the commenter you responded to, but I think this sort of view is similarly flawed. Many developed Western democracies endow the courts with much weaker powers of judicial review than the US. In the UK, for example, judicial review applies only to Orders of Council, while Acts of Parliament are exempt.
> Surely you see the point of the US being a republic; rule by law, not by men.
Men wrote the laws.
> In your vision of the supreme court, if the majority decided they wanted to lock up some minorty and send them to gas chambers, the court couldn't do anything to stop them because the populace would vote for it in a referendum. That kind of thing has happened countless times in history in countries that didn't have a strong court system capable of protecting people's rights from the tyrrany of the majority.
I agree the Supreme Court has effectively protected minority rights: the minority of wealthy property owners. I'm somewhat confident that the historical list of Supreme Court injustices that served to oppress vulnerable minorities (e.g. Dred Scott and Japanese internment) is longer than the list of times the Supreme Court has lifted those same minorities up.
The corporate media doesn’t typically like to talk about that process since it is a threat to the entrenched powers that be.
The ombudsman of the American people is their state legislatures.
We have sovereign states in the US. Let’s not add any more power to the federal apparatus to solve a perceived problem with itself
Yes, you'll note that I said "the data will lead to a mandate for a constitutional amendment." My point is that the mechanisms that create and ratify constitutional amendments are broken for this purpose; not that we need a thing other than constitutional amendments.
Given the actual way bipartite or tripartite governments (at all levels — from municipal to federal) function in the real world, constitutional amendments only happen when there's a need to use an amendment to overridingly countermand law.
Constitutional amendments are almost never used for their original designed purpose — to pre-empt the ability to create law — because the legislative process is purely reactive, never proactive. Legislatures the world over only act when either corporate lobbying interests or outraged citizens demand they act.
The thing I'm saying doesn't exist, is a proactive branch of government that turns things that are currently "known to be desirable" but not yet "outraged about being taken away", into constitutional amendments protecting those things, before some law can be made somewhere that violates the implicit, intuitional, self-evident, but previously non-applicable right that the public believes it has. Like a right to anonymity in cash transactions.
Until a decade or two ago, nobody ever considered that "being able to transact anonymously via cash" needed to be thought of as a right. It was simply the only way things worked. There were no clear examples of it not working that way elsewhere in the world to serve as object lessons on why you'd need such a law.
Or, consider prohibition. Did the US really need to issue the 18th amendment, struggle for two decades, and then issue the 21st amendment to repeal it... when anyone who lived in America at any time during the two centuries before the rise of the temperance movement, could have seen that the public actually seems to consider itself to have a self-evident right to ingest mind-altering substances — and thereby, that there should be a constitutional limitation on laws which prohibit the production and sale of mind-altering substances? Yet America still doesn't have a constitutional amendment enshrining that self-evident right. Because there's no system for discovering "latent" public sentiment and enshrining it. If everybody thinks something, but nobody says that thing, then it never becomes law.
(If you think it's dumb to care about what "everyone thinks but nobody says" — why do you think democracy is built on secret voting? The public has a lot of things they want but aren't willing to say they want in front of others, for fear of reprisal in their local social-normative environment — including who they think would best represent them democratically!)
To your other points:
> The ombudsman of the American people is their state legislatures.
Legislatures at all levels are purely reactive; and therefore can't react to latent public sentiment, only to active demands.
> We have sovereign states in the US. Let’s not add any more power to the federal apparatus to solve a perceived problem with itself
What about every other democratic nation in the world that doesn't have this problem? (I'm Canadian, myself.) While America makes a good example for the failings of the reactive model for constitutional amendment, adding a proactive pipeline from latent public sentiment to constitutional amendment would be a change applicable to every country with a constitution. Not just democracies, actually; even constitutional monarchies.
That being said — everything I'm saying also applies, in the US, to state governments and their state charters/constitutions/other founding documents. State governments could have such a proactive body just like federal governments could. City governments could have such a proactive body. Heck, even corporations could have a proactive body to enshrine the interests of shareholders into the corporation's charter! (I bet there are corporations whose employees and shareholders would all prefer the corporation be transitioned to a B Corp with certain values held above profit — just not with enough outrage to consolidate a voice to make any coherent demands of the board of directors.)
I read your whole comment tree. I used to think something like this would be nice. An incarnation of some kind of wise intelligent force that could cut through the morass of mainstream politics in an efficient and principled way.
What I have realized is that mainstream politics is exactly this. The premise of your argument is wrong. There is no more proactive or efficient mechanism for accomplish collective action than our current political process. It is ruthlessly fast and efficient when you consider how accurately it reflects general sentiment in the country. We all, moreso the more intelligent we are, operate in a bubble of assumptions about what other people believe. Whatever you see on the news is a mindbogglyly low error match tailored to what the target audience believes. And all target audiences are covered in proportion to their size. We often hear that the extremes control the narrative, and you do hear from them a lot, but the overall picture painted by popular media and politics is the most accurate reflection of what people believe or will believe.
There's nothing we could construct that would outperform it.
I think we could tweak it to lower the error rate with some different voting schemes or rules, but at the end of the day there isn't some other paradigm that will beat it.
And a system that requires a 3/4 supermajority of not even the population but the state legislatures (with the net effect that some states have a much greater say in pushing through or blocking amendments than others) is hardly a sane or sensible way to gauge public sentiment on such matters.
By the letter of the law, no. But in practice we do. The federal government is thus-far unwilling to defend their turf on this issue; they have de jure sovereignty but not de facto sovereignty. If a government finds itself politically incapable of exercising a sovereign power, then in a very real sense they no longer have it.
Try openly producing and selling. Multi-million dollar businesses operating in open plain view of the public and any federal agent. States legalize cannabis and the federal government in turn stops enforcing their laws against cannabis in those states, demonstrating that the states have de facto sovereignty to legalize drugs. They didn't just stop prosecution for "basic use" and possession, they no longer enforce their drug laws against growers and dealers either. They've essentially given up, for the time-being at least.
The fact that the same states are not also defying federal gun laws (with some interesting exceptions *cough* alaska *cough*) is another matter entirely. The federal government does seem to be more keen on exercising their sovereign powers when it comes to guns than with drugs.
The Constitution is supposed to be stable and only change in response to broad political consensus. Requiring a supermajority for amendments is entirely appropriate.
Have you seen the formation of any countries? Even one?
Have you ever seen representative anarchy? Please tell me where - I'll be there like a shot!
> embedded journalism to figure out what issues "the people" are beginning to care about
Afaik, journalists are there to tell the people what to think - what do you think propaganda is? Do you think that propaganda is something the Russians do, but your country doesn't?!?
"Representative anarchy" was my shorthand for the concept of "whoever can stand up with a megaphone and get the largest mob behind them wins." To do this, the person with the megaphone needs to understand what hot-button issues will make the mob follow them in their coup or secession attempt. In that sense of understanding the public, they are acting as a kind of representative. Not a democratic representative — but the same kind of representative that you get when someone stands up and shouts something in a bar and everyone else shouts "yeah!"
Yes, the mob can be manipulated. But the nice thing about the breakdown of law and order, is that it stays broken until someone who's good at governing actively re-establishes it. If the mob that the new guy used to depose the old guy, doesn't appreciate the new guy's first few acts in power, then said mob will still usually be riled-up enough — and the new guy's hold on power will still usually be tenuous enough — that the mob will just turn around and depose the new guy, too. (Look at the War of the Roses for many small examples of this; or for a perfect example, at Burkina Faso's two coups in one year last year, where the second one was driven precisely by the public's lack of faith in the guy who did the first coup.)
> Afaik, journalists are there to tell the people what to think
Maybe I chose the wrong word? I suppose I meant intelligence operatives — but not the secret kind. Just, people who are paid to go and watch things and talk to people, and tell their government department what they found out. Census workers, for example! Or the people who go into retail stores to get the pricing data for the central banks to calculate the Consumer Price Index.
I think you have been watching too many films. I don't think people act as a mob, overthrowing anyone.
The governance structure doesn't really accept any real inputs from you and I. They are a bloodline.
You get to vote in a 'representative democracy' where your vote every 5 years is aggregated with 100k+ of other to choose one of 2 candidates, who then purports to represent you in the thousands of decisions he makes over his term.
That's a nice alternative name for "democracy".
Anyway, the problem is that when governments get old, interests get entrenched, and it begins to act against the democratic mandate. Any stable organization with some power can not solve this problem and will only make it worse.
Ideally, elections should be a way to insert instability into the system and avoid this. But those were subverted in a series of ways and the instability just isn't there anymore.
Only reading the federalist papers gives you a stilted opinion of what caused things to be the way they are
> There remains but one other view of this matter to conclude the point. The truth is, after all the declamations we have heard, that the Constitution is itself, in every rational sense, and to every useful purpose, A BILL OF RIGHTS. The several bills of rights in Great Britain form its Constitution, and conversely the constitution of each State is its bill of rights. And the proposed Constitution, if adopted, will be the bill of rights of the Union. Is it one object of a bill of rights to declare and specify the political privileges of the citizens in the structure and administration of the government? This is done in the most ample and precise manner in the plan of the convention; comprehending various precautions for the public security, which are not to be found in any of the State constitutions. Is another object of a bill of rights to define certain immunities and modes of proceeding, which are relative to personal and private concerns? This we have seen has also been attended to, in a variety of cases, in the same plan. Adverting therefore to the substantial meaning of a bill of rights, it is absurd to allege that it is not to be found in the work of the convention. It may be said that it does not go far enough, though it will not be easy to make this appear; but it can with no propriety be contended that there is no such thing. It certainly must be immaterial what mode is observed as to the order of declaring the rights of the citizens, if they are to be found in any part of the instrument which establishes the government. And hence it must be apparent, that much of what has been said on this subject rests merely on verbal and nominal distinctions, entirely foreign from the substance of the thing. [1]
Edit: Evidently I've pissed off enough people who drink the red-white-blue kool-aid. -3 at the moment.
These newspaper publishings were expressly for the solidification of power at the federal level, and the weakening of the states. And only look closer at what the "federal" powers were about, and it was all about "secur(ing) the existence of (their) people and a future for white children." (cite: 14 words)
Hamilton/Madison/Jay and others knew if a strong federal law reigned supreme, his and other founders' slaves and their current wealth would be greatly solidified. And right he was. And all those slaves also gave 3/5'th a vote per human they enslaved. While many of you say it was for "selfless reasons", my only response is a great big belly laugh.
So perhaps, I was wrong calling these an equivalent of a Medium blog post. No, instead they'd fit right in on the Daily Stormer or Stormfront (2 neonazi publications). Those are the types of "rights" these founders were fighting for: the rights to own another human as property.
Don't get me wrong, the Federalist Papers are important historical documents and provide unique insight into the minds of the authors. But they're not laws, and treating them as if they have actual legal significance seems wrong.
You haven't pissed off anyone. People are downvoting because your comments sounds like they're coming from an edgy 14 year old who wants to shock his parents. You've clearly never given any thought to political philosophy, and your comment gets pushed to the bottom so it won't waste other's time.
I'm not American, I do not admire American nationalism or jingoism. Nor do I admire people who spew nonsense in order to look like rebels against the man.
Maybe a datapoint supporting the Flynn Effect?
Laws with no explanation about their purpose or goals are like the compiled binaries of a program. Ideally, in the future you'd like to be able to edit the source code and recompile it, not blindly patch the binaries.
In contrast, common law is more open to interpretation, changes over time, etc.
Yes, this is super generalized, but the dichotomy explains two very different approaches to how countries approach their writing and interpreting of laws.
Where "this way" includes all sorts of implementation details that may or may not be important.
Think of a baker in some kind of baker's guild, who was taught as an apprentice various techniques for how to get the best rise from their bread, before any scientific understanding of what those techniques are doing. The baker wants to keep following their various rules of thumb, because they know they'll produce the best bread. They don't know why the rules-of-thumb work; they just know that whenever they've accidentally diverged from them, they get less puffy bread.
Now, replace "baker's rules for baking bread" with e.g. "common-law rules around easements and rights-of-way in property disputes."
Something along these lines is how most modern states handled it in practice, if you look at e.g. former Warsaw Pact states.
I agree, and it mostly is. I'm pretty sure it is always recorded when a congressman speaks about a bill, plus they always show dissenting opinions of the SCOTUS.
However, one major problem is that language changes with time. Words go out of favor, and change meaning. Sometimes they change their meaning to be the exact opposite. Sometimes there are contenpary dictionaries with conflicting definitions.
I think all laws should have an expiration date, and have to be debated, and possibly reworded again and again over the generations.
Until “thou shalt not kill” gets held hostage by a senator who wants a subsidy for a coal mine.
Exempt those kinds of laws - murder, theft, false witness? Congrats, you have a de-facto theocracy.
If that was the case, we wouldn't need lawyers or court hearings. Laws are phrased vaguely on purpose because real life is far too complicated to write down every eventuality and also it's easier to build political consensus for vague laws. That's why we have courts who interpret the law based on precedent and common sense.
A succinct way to see the difference: You want your computer to do exactly what you wrote in the code and nothing else. This is not true of legislation. You want people to do anything that's not explicitly forbidden and tolerate them doing things that are technically forbidden ad long as they don't really cause too much harm, which means laws are written keeping in mind that the system has and needs slack.
Er no. The law existed long before computers did.
> Laws are phrased vaguely on purpose because real life is far too complicated to write down every eventuality and also it's easier to build political consensus for vague laws.
This doesn't discount from the code comparison at all. Anyone who has worked on a codebase for a large company knows that the feature requests never stop piling in either because the computer program will never be able to handle all the complexity of what it is trying to model either. At the end of the day, you have a function myLaw which takes four arguments, plaintiff, defendant, judge and jury. The interactions between the four and the myLaw code decide what the return value is.
> A succinct way to see the difference: You want your computer to do exactly what you wrote in the code and nothing else. This is not true of legislation. You want people to do anything that's not explicitly forbidden and tolerate them doing things that are technically forbidden as a way to introduce slack into the system.
No, because you're assuming here that the law directly controls the people. I would argue that isn't the actual purpose of the law. If this were true then there would be no crime because once a law was written, everyone would abide by it as if it had telepathic mind control and there would be no crime. Instead, people are free to ignore or read the law and then to act in concordance or discordance of their own free will. The actual purpose of the law is for evaluating the actions of people after they have done something. People are run time variables that are inserted into the law function, they are not the code themselves.
It might have been Norway though. One of these two.
The “spirit of the law” argument is bullshit here in tenuously trying to expand wiretapping to decrypting text.
What makes you say that anonymity wasn’t a concern? I have a hard time believing that claim without any substantiation.
Anonymity in market participation and transactions has been an important consideration for millennia. Anyone who has watched Jasmine put on peasant clothes and visit the market in Disney’s Aladdin can understand that
Because the inverse claim, “people using gold coins thousands of years ago for common exchange were worried about the anonymity of their transactions”, is absurd.
It’s not like the alternative to gold coins two millennia ago was a traceable currency, the technology for tracking a large population literally didn’t exist, and wouldn’t exist for almost two thousand years. People relying on gold coins couldn’t possibly conceive of a world where people’s every transaction could be reliably tracked.
Can you explain why? I have already given a historical example to the contrary (granted a fictional one but one based on similar true accounts)
The ancient Romans invented the Census to reliably track every person. It seems a little goofy to suggest that they “couldn’t possibly conceive” of a similar accounting of transactions
Not saying they didn’t see anonymity as a desirable property of transactions, but I don’t take this as proof that they definitely did.
To argue that a tally stick can be used as an effective way to track people is to also argue that any physical key can be used to track people. After all a key and Tally Stick operate on the same principle, and yet I don’t think anyone is worried about a government tracking them by their dumb metal house keys.
There actually was, predating gold coins in fact. What people did was carve notches representing quantities into sticks. The sticks were then split down the middle such that they could be lined back up to verify that both came from the original stick and the notches lined up. One of these halves would then often be entrusted to local officials for safekeeping. When people wanted to settle accounts, they could meet up with their half of the stick, light them up and make new cuts.
(Of course this doesn't prove that gold coins were created to facilitate anonymity.)
Then, when person B comes around with the other half of stick A, they won't know all the hands it passed through in the meantime, but they'll at least know that person A and person B were connected through some chain of equal-value trades that didn't require "breaking" the stick.
Notable people resorted to things like Tally sticks when actual physical currency like gold was in short supply. So the idea that people moved from Tally sticks to gold due to concerns for privacy just doesn’t hold water. Especially given gold as currency predates Tally sticks.
"You don't know what you got till its gone." - Joni Mitchell
Jefferson said all this far better than I ever could:
"We hold these truths to be self-evident, that all men are created equal; that they are endowed by their Creator with certain unalienable rights; that among these are life, liberty, and the pursuit of happiness; that, to secure these rights, governments are instituted among men, deriving their just powers from the consent of the governed; that, whenever any form of government becomes destructive of these ends, it is the right of the people to alter or abolish it."
When and where it was ever any better?
It's not like we (as the broad community) are engaging with empathy. Even if there is maybe no great solution to the whole dilemma, it would help the entire thing, if we stopped camping on one side so entirely.
Anyway is a "person" not also a legal entity in some way?
In short, I understand what you are saying but I don't think it is precise enough.
But to be pedantic, empathy is for those who are capable of expressing empathy in return.
The problem is that when one set of people get weaponized by folks who are legitimately nefarious and or criminally stupid and mentally ill, there is not no moral stance which is effectively 'I don't like some people on one side so I will let the demonstrably dangerous people take the power and do what they want'.
Do you have a solution to this? Because otherwise giving 'both sides are just as bad' speech is borderline negligent.
But if I don't have any alternatives, I'd much rather have the "you can't burn wood in your fireplace" people in charge than the "force people to live as the gender assigned at birth" people.
One of those people is pushing policy that ultimately saves the human race from making the planet uninhabitable, while the other is imposing their small-minded religious worldview on people who have nothing to do with them.
And this is the thing that bothers me so much with the "both sides are just as bad" argument. Yes, agreed, they are, when it comes to listening to each other with empathy. I totally get that frustration, and I'm sick of the left/right culture war; both sides are to blame for perpetuating it.
Further, I think it's unfair to say that these two groups have more in common with each other than people who can listen with empathy; you're just comparing two unrelated axes of commonality.
I was straining to think of a good example of the 'left-wing authoritarian' but I have definitely experienced it, and apart the location of birth they are the same exact people who are just as intolerant on right.
On aggregate all humans operate pretty much the same everywhere in the way they think and operate -- the only difference is experiences and culture. That was the the point I was making -- we are never going to be rid of the people responsible for throwing wrenches in the political works.
Tangent: I think the only way this gets fixed is by putting a benevolent AI in charge of everything.
The problem, of course, is that none of them were actually left-wing. They were all just bog-standard dictatorships, using left-wing-ism as their excuse to maintain power, but not actually doing left-wing-ism.
Besides, the Democrat party isn't left.
What rights do these people not have that others do? Rights belong to all individuals.
> and inflation would be slightly lower as most capitalists aren't as brazen as Trump when he publicly threatened to fire the Fed chair if interest rates didn't come down. If Trump won in 2020 most of the bad political things happening in Florida would be happening to the whole country.
It's hard to say. Tump loved to sirens, and I am no fan of that, but inflation has been coming since Clinton left office. I find it unlikely that Hilary would have reduced the deficit, especially given the unconstitutional business closure orders that many states enacted, which PPP and enhanced unemployment sought to make condition via addressing 5A, but which utterly failed at doing so imo.
When someone says that right/left is imaginary, what they are often really saying is that they prioritize dimensions in that space that are not strongly correlated with the right/left axis.
Or they’ve observed that policy changes after a change in government are less extreme than they hoped and chalk that up to corruption or insincerity rather than checks and balances in an adversarial system.
Tribalism being what it is, people can mistake the forest for the trees and think that the convenient shorthand we have for a correlated set of values is more strongly defined (more “real”) than it actually is.
The American right and left are very different when it comes to policy platform, and electing one or the other actually does have a measurable difference on what ends up happening to people in the country. This is especially true when we consider minority groups.
I agree that both sides are mainly interested in consolidating power and increasing the scope of government's oversight of people's lives. But even if I use your terminology, the "left wing tyrants" and "right wing tyrants", if one or the other were given complete control of the country... well, the country would look very different after some time, depending on which side were given control.
Well this is actually demonstrably false. Biden currently has the house and the senate, Trump has the house, the senate and the Supreme Court, Obama had the house and the senate… The rhetoric between these two sides is substantially different, but the governments they produce are very similar. They implement some token fraction of the policy platform they were elected on, and otherwise just plow through the same old policy agenda every time. Who’s opposing this Tory Online Safety bill in the UK? Technically Labour is, but only because they think it doesn’t go far enough…
No he doesn't, the Republicans hold the House. And while a bare majority is sufficient to pass legislation in the House, the Senate has this quasi-official filibuster nonsense which means it's hard to get a lot of things done without a supermajority. Additionally, any legislative change is typically immediately dragged into court which can slow down implementation for several years.
They didn't, and for what it's worth public opinion is overwhelmingly in favor of the law. I think anyone discussing a British law ought to keep that in mind (https://docs.cdn.yougov.com/68pn2b6b57/NSPCC_OnlineSafetyBil...). Even on the most contentious parts of the bill:
Do you believe it should or should not become a legal requirement for the following to scan messages and posts on their platforms for child sexual abuse?
[Private messaging services]
This should be a legal requirement -> 60; This should not be a legal requirement -> 21; Don’t know -> 18
[Social media sites]
This should be a legal requirement -> 79; This should not be a legal requirement -> 10; Don’t know -> 10
Likewise on E2EE over 70% of respondents agree that ability to access them is warranted. So the framing in the discussion as if this is solely the British government against technologists is completely off, it's also taking a position against the British public.
If you ask people "Should phones scan their files for CSAM?" a good part will say "yes" because it doesn't sound like it affects anyone outside of child pornographers.
If you ask people "Should phones send your photos to GCHQ to check if they're CSAM?" most people will say "no".
If you ask people "Should phones send your photos to GCHQ to check if they're CSAM, and should we send Apple executives to prison if they don't make their phones do this?" most people will still say "no".
Let's say the question was written something like this:
> Do you believe it should or should not become a legal requirement for the following to scan messages and posts on their platforms for child sexual abuse, even if such scanning would also compromise the security and privacy of all law-abiding users of the platform?
I obviously can't say for certain, but I think that 60% and 79% would drop, at least some substantial amount. Even if the "should not" positions wouldn't go up, I think it would muddy the waters enough that many new people would fall into the "don't know" camp.
The problem is that the polling just presents these questions to evoke a "oh, obviously I'd want this, to protect the children!" sort of reaction. The "but think of the children!" thing is almost a joke or cliche at this point, but it is disturbingly effective at shutting off people's critical thinking, causing them to agree with whatever the argument is. On top of that, media reporting around these issues never gives the pro-privacy angle enough consideration. And even when it does, it's usually in small "nerdy" publications that most people don't read. I'm also of the opinion that many people just can't and won't understand, adopting the fallacious "if I've done nothing wrong, I have nothing to hide" position.
I think it even goes a bit deeper. Surveillance in a democracy is a double edged sword and arguably the edge facing yourself is sharper. You want it so you can keep a close eye on your citizens and manipulate or adapt to their moods. But on the other side, adversaries are also equally capable of doing this (as NK demonstrates, software is a cheap form of warfare). Often adversaries who are more than happy to team up and pool resources. They're just sharpening the edge pointing at yourself. It really is a dangerous game to play.
I know red teaming is harder than blue teaming, but I really believe that the NSA's primary objective should be defense rather than offense. Especially as we're talking about the modern era of LLMs which will be used to convincingly sound like humans and influence people at mass scale, defense just becomes even more important. The mice are running wild and our cat is too fat and lazy to catch them. That was fine when we were ahead of everyone else, but now that they've caught up our cat needs to get off its lazy ass and do its job.
> anonymous cash transactions => ???
This was actually the first hint that I had that cryptocurrencies were a scam. That people were more interested in flashy than secure (e.g. zcash). I'd love to live in a world with fast anonymous digital _cash_ but I'm not sure that'll happen and not sure it'll be blockchain based.
Can we set up an automated monitor on all the traffic cams and licence plate readers and facial recognition systems just to catch cops and politicians breaking laws or just to track their movements and associations the way they do to everyone else? Can we access the same cam footage that the state uses to accuse you of something, to clear you instead?
Only occasionally and incompletely.
For instance you might have access to whatever they submit as their proof, but they had access to the full footage and from many sources, and if you had that same access, maybe you'd find proof that you were elsewhere at the same time, or that the subject came from somewhere that isn't your house, or see them getting dressed just before going to commit the act, or was even the very cop bringing the charge, or show the greater context that when you drove through that red light, you had already waited 10 minutes and the light was actually broken, or the lights were out but the timer/switing mechanism was still ticking over so the cam just assumed the driver was shown a red light, etc.
The surveillance already exists, and is already being used only against you, rarely for you.
If you or I shouldn't have unrestricted access to it, then neither should anyone else. If it is to exist, and anyone is to have access to it, then so should you and I.
What new words can be written that would suddenly enlighten the managers of that government and deter it from its course of fully atomizing its citizens? I'd suggest the greatest service Signal could do for the people of the UK is to suspend operations in the market preemptively. Turn into the torpedo. The thing about totalitarianism is that the longer people believe they are safe from it, the deeper its roots dig in.
UK politicians have been periodically demanding NATO engagement, though this one is from 2022:
https://www.independent.co.uk/news/uk/politics/davis-ellwood...
Ellwood seems to be the UK equivalent of Lindsay Graham and has recently made similar noises.
Channel 4 News segment:
* https://www.youtube.com/watch?v=E--bVV_eQR0
The MP, Damian Collins, "who formerly served as a junior Minister for Tech and the Digital Economy in the Department for Digital, Culture, Media and Sport":
* https://en.wikipedia.org/wiki/Damian_Collins
Reminder:
* https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...
I think the Signal president was making great points, but she definitely was avoiding a clear response when asked about "If people are sharing CSAM on your platform, you wouldn't know about it, correct?" and "If people are violating your ToS, how would you enforce that?"
Obviously, the clearest direct answer is "Correct, we would have no way of knowing what content is being shared on our service." She complained about "circling the drain on the issue", but the reason they were circling is that she didn't want to say that sentence. And I get it, in today's day and age news organizations love to take a quote out of context and make it the headline ("Signal president admits they can't enforce their ToS against illegal material!!")
But debates like this are a waste of time when both sides refuse to admit the obvious implications of the other side's points:
1. The Signal president was making very clear there is no "halfway" encryption, that it either works or it doesn't, and the bill required a back door. The government minister was pretending and talking loads of BS about what "options the regulator has", even while conceding the point that you can't have a backdoor that only "the good guys" can use. What an exercise in cognitive dissonance.
2. The Signal president obviously knew "Yes, people can share CSAM on our service and we can't directly know about that content", but (and I think for good reasons) didn't want to say that obvious point out loud.
This debate would make more sense if both sides would just admit there is no "halfway compromise" to this issue. I agree with another comment that Apple really fucked up by thinking their "fingerprinting" approach was technically viable, and that somewhat poisoned the well in this debate.
I believe Meredith Wittaker was correct to avoid addressing the Signal TOS and how it is implemented. This would open the door to the whole "client-side CSAM scanning" (chat control) discussion which would be even more tedious.
https://www.theregister.com/2022/10/13/clientside_scanning_c...
Yes, I agree it would have been best if they had just agreed on some compromise to the matter. I don't believe they ever would, though.
It's reasonable for people who want to seriously address the very real and legitimate problems with this kind of "wiretap" legislation to not want extraneous issues derailing the discussion, as having their concerns conflated with more conspiratorial-sounding ones makes them far easier to dismiss.
As demonstrated by COVID regulations in emergency the law can be changed very quickly.
Modern armies (like NATO members) have really got very little to gain by conscription. Being a modern soldier has very little to do with being cannon fodder.
Unfortunately, in Ukraine both sides are cannon fodder again because modern anti air defenses are so good that the fighting relies on 155mm howitzers again. Which NATO has just run out of and has no capacity to manufacture in sufficient quantities.
That’s scary. If 31 countries cant get their act together to manufacture basic weapons then we are in no better shape than russia. Should they win the war in ukraine and decide to attack other countries we’d be caught with our pants down.
To be fair it appears that Russia is using 10x more shells then they manufacture in a year so once they run out of their old soviet stock pile things will go south for them.
Conscripts are only good for defense - they know the area and the local language/customs. Additionally, they stand to lose their friends, family and possessions, so they're motivated to do something about that.
None of these advantages apply on the offense.
Brexit means that doing business with the UK is suddenly much more complex and expensive. Mandatory backdoors would break many products, and then products which rely on those products. The UK has 67 million people, or just under 1% of the world.
What's cheaper:
- Compliance (especially with unethical laws like this one); or
- Dumping 1% of your customers?
The flip side is that if I'm opening up a branch somewhere, will I do it somewhere where:
- A bunch of my tools don't work, and I need to jump through a whole bunch of hoops? or
- Just over the canal in France, across the Pacific in the US, or better yet, a little further over in some place like Czechia?
As with many isolationist regimes, England is also among the most despised countries in the world. Ever seen the Clockwork Orange? England has done some nasty shit to a lot of people around the world. It has no shortage of enemies, but it seems to be isolating itself from its former friends....
I'm waiting to see how this whole thing plays out, but I'm not bullish on the UK. If things go the way I think, I'd feel bad for Scotland. They'll have zero percent of the fault, and fully share in the consequences.
If things go the way I think, I'd feel bad for Scotland. They'll have zero percent of the fault, and fully share in the consequences.
Why feel bad for folks in Scotland in particular? Why not for the folks in London (a larger, more geographically concentrated group, which also voted to remain)?(Not being snarky - I'm genuinely curious.)
- Genocide against the people who lived in America
- Bring India to its knees, from one of the richest to one of the most impoverished nations in the world
- Addict China to opium
- Irish potato famine
I'd talk about Africa, but that's a lot more diverse. A lot of England's current wealth came by theft, rape, and murder. If you're living in London, both your social infrastructure and your housing prices are powered by blood money from the British Empire. If you moved to London from Algeria (and I intentionally picked a non-British colony), your children are benefiting from schools funded by interest on investments from blood.
From a policy perspective, things get very nuanced. I'd like to right historical wrongs, but I don't feel good about guilt-by-descent. If your grandparents did something bad, that shouldn't count against you. If you have stolen money and goods, they should be returned. On the other hand, simply living in London shouldn't lead to any policy consequences (and things get especially complex with e.g. Indian or African immigrants, escaping parts of the world devastated by the British).
But I wasn't talking about policy, but whom I'd feel bad for. From an emotional perspective, things are simpler:
- English museums have relics plundered from India, Nigeria, etc.
- They believe they have a moral right to other culture's most prized relics, and won't return them.
Scotland was never imperial, and has had a mixed history with England.
And building even more on the emotional component, I haven't been there a lot, but the way I was treated in Scotland was very different from how I was treated in England. I have wonderful memories from one of those visits, and bad memories from the other. As much as I've only been there briefly, I just really /like/ Scotland.
But why people think it's okay to hold the current generation responsible for things previous generations (in this case quite far back) did is just juvenile.
- Genocide against the people who lived in America
- Bring India to its knees, from one of the richest to one of the most impoverished nations in the world
- Addict China to opium
- Irish potato famine
Furthermore, the narrative that Scotland is subservient to England, and not equally complicit in the historical crimes of the *union of England and Scotland* is misleading. The 1707 Acts of Union [1] were introduced by both nations.
- Your father became rich as an inventor, creating wonderful gadgets which improved the world
- My father was a warlord
- My father murdered your father, and stole $1M from him;
- invested it; and as a result
- my family now has $1B
- your family is deeply in poverty
You're poor, uneducated, and hungry. I'm at Harvard, have a trust fund, and in connected political circles. I haven't done anything wrong myself, but I did inherit blood money.
What should happen?
It's not obvious.
Great-great-grandfather?
On the Scotland point, all I can say is that it's more complicated than you present. I did NOT present a narrative of either Scotland as subservient to England, and my exact phrasing was that it has a "mixed history with England." I stand by that. I don't think "equally complicit" is any more accurate than "subservient." The last Scottish independence vote was a 45/55 split.
As for "current citizens," you can look up more recent colonial issues, like the Mau Mau Rebellion.
Issue though is that France seems to be taking a similarly dystopian route in terms of privacy and surveillance.
And it’s not just the thought that a rogue government or police employee can access anyone’s device, nor that criminals can use the same holes to steal data, it’s the idea that we are laying out all the infrastructure needed for an authoritarian regime to control the population. Don't get me wrong, the former two are extremely worrying but the latter is beyond extreme.
It’s as if we are collectively building turn key infrastructure for an authoritarian regime.
Essentially, once the infrastructure is in place, all you need is the right political climate and the wrong person in the right place.
They wouldn't need to spend decades building a future stasi or gestapo. All they need is to adjust parameters and fine tune laws. And with europe being the powder keg it is that scenario is not as far fetched as one might think.
> I'm waiting to see how this whole thing plays out, but I'm not bullish on the UK.
On this front, the way i see it, the uk might eventually split, with England becoming a bit like the Netherlands, or perhaps Austria. A bitter former colonial power, developed, but irrelevant on the global scene. Bullying a developing country here and there, trying to maintain the image, but eventually overtaken.
An alternative is to try and force a conflict where the uk somehow ends on top - particularly since europe needs a viable alternative to germany. But hard to pull through by a country where eggs are still rationed.
What is UK trying to achieve? To maintain, as much as possible, a pretty controlling state in power. It is a country with no free speech, no significant human rights of any sort, population is at the mercy of the govern and they want to keep it that way. Apps like Signal give people some free speech - you cannot publicly say what you want to say, but at least you can say it to others without being cancelled or arrested for opinions that are not liked by the govern.
I assumed that members of the UK public could always say "_____ the prime minister". There was even a Black Mirror episode involving a pig...
Apple executives should be ashamed of their direct role in this.
Note that similar laws are being proposed in the UK, EU Australia and Canada (not sure of the latter two tbh).
Before that this sort of legislation was just straight asking for a skeleton key or a ban on e2e, many laws still do. Apple trying a thing and failing didn’t fundamentally change anything because these laws aren’t asking for a specific technology, they’re asking to be able to see all your messages no matter the method. That’s literally the politicians level of understanding “want read read messages”.
If Apple had never thought up the CSAM scanner concept they’d still be pushing to just break the encryption. Hell they may even stumble upon the “well just send us a copy or scan it for all these fingerprints before you encrypt it” concept themselves, it’s not really a tough concept.
That was an attempt to get out ahead of it and neuter the pressure for those laws. But there was so much opposition that Apple's strategy failed.
I'm assuming the Brits just don't care as much about privacy.
Dropbox scans your images in the cloud for CSAM. Google scans your images in the cloud for CSAM. Meta scans your images in the cloud for CSAM. Microsoft scans your images in the cloud for CSAM. Apple did not (and still does not) scan your images in the cloud for CSAM.
Notice anything different here? The privacy company wanted to do what everyone else was already doing in a privacy-preserving way. They made a press release about it, and everyone got mad. But the same people are just fine using Google and MSFT which actively scans their data for the same images?
I seriously do not understand your logic behind this.
https://gizmodo.com/the-fbis-fake-encrypted-honeypot-phones-...
Those services don't know that an account belongs to a politician or that they're using it for exempt purposes.
Politicians are ALWAYS getting nailed by leaks from various computer-based communication systems that they use. Most of them don't seem to be able to get their heads around how any of this work.
Those who go into that profession are longing to control other people by means of the monopoly of violence that the government has.
That MP in the interview is what happens when you give the power to knock down doors and arrest people to somone who likes to get into argument about ethics with people in the news site comment section.
The French law that makes it legal for the government to hack your phone has a bunch of exceptions so it's not legal for the government to hack important people's phones.
No they won't. They'll never be sure if their data is secure.
https://www.dw.com/en/angela-merkel-and-hundreds-of-german-p...
Direct action, enough to be villainised by the media, seems to be the only way that politicians will actually listen — though even then its a massive uphill struggle.
God, I feel so unrepresented.
American here, but I feel the same way. I live in California, and I'm left-leaning, but I feel like I have no voice. This state -- and my city -- have so many problems, but I don't feel like I have any effect on the politicians who are failing to solve them.
And that's bad enough without getting into how powerless I feel to affect anything at a national level.
Most of us have never seen a working example of democracy. We have just sort of tacitly accepted a kind of benevolent dictatorship in most institutions, from our workplace to open-source (and please correct me if I'm wrong here, I know that there is a kind of democracy in forking and collaboration, but as I understand it, voting democracy isn't really found anywhere.)
I was just watching Car 54 where are you? the other night, and in it, you can see the members of a fictional police union voting on absolutely everything, from union dues, to where to host the christmas dinner. People voted, made speeches, and ran for office, and all of this within like a tiny local. This kind of general participatory democracy seems as quaint as the black and white film it's played on.
My advice to you is to join something. There's a number of civics activists trying to push for some local issue, like transit, or housing, or raising funds for a local hospital; all else failing, you could always volunteer for your local party and get to know the candidate. It's a really good salve to that feeling of general powerlessness.
Then, instead of feeling powerless, you'll know you're mostly powerless, but at the very least, you won't be alone.
No. Honestly, online petitions aren't worth the paper they're written on.
That's when the government decided these things are kind of a nuisance and abolished the whole concept of referenda, even advisory as they were
I love the ruling party
But anyway petitions aren't necessarily useless, also for media attention on a topic if it goes well
The Tories have been in power since the year before I could vote.
I’m not 100% on the same page as Labour by any stretch, but I’m yet to experience government as an adult that isn’t in total opposition to almost all the values I hold.
I was a teenager from a poor working class family then, I’m now a homeowner earning a comfortable wage. I still think they’re dishonest, self-serving cretins.
https://community.signalusers.org/t/add-reproducible-builds-...
This is an honest question: did she mean to say "infiltrated", or is this usage of "interpolated" a valid one that I just don't understand? I expected a [sic] or an edit from the article.
The issue now is that it’s so easy to collect circumstantial information that is constantly leaked by GPS-enabled apps, searches, card purchases, clicks, cell phone tower data, etc. that governments don’t really need the actual contents of messages any more.
I’m still glad Signal exists, but it’s part of a very complex world of privacy and not magical armor.
All this stuff is really convenient. Would we have really said “no” to turn-by-turn navigation? Avoided online purchases? Used cash for most of our transactions? Printed things out so we don’t use the internet while outside?
Rules like the US Constitution's 4th amendment, and laws like the GDPR (and to some extent, CCPA/CPRA) aim to do that, but neither goes anywhere near far enough. 4A often gets interpreted narrowly by US courts, to the benefit of law enforcement. And the GDPR enforcement mechanisms are far too clunky and -- at least from what I've seen so far -- don't work particularly well. Not to mention that, for it to be truly effective globally, the US would need a federal-level law to match it.
Encryption alone doesn't matter. If your social and political climate is not oriented toward privacy, your privacy tools can simply be made illegal.
Nothing is meaningful without the physical and social power to enforce it. When you have that then even the absurd becomes reality and common sense.
We overlook that young people with tech jobs in the 90's humiliated a lot of their peers, ones who went on to pursue messy politcal careers instead of business ones. Those peers learned to hate the knowledge that gave a lot of economic advantages to tech people, and the principles we ultimately used to morally justify it. Privacy, freedom, and anonymity separated us from the all against all power game of elite competition that ran on gossip, compromise, narrative, and mainly a lot of guile.
As art, I think the season five finale of Rick & Morty captured the dynamic pretty well, where Sanchez represents the freedom and security of competence and technology that, more concretely, allowed a lot of genX to disengage from the messy political game represented as the family life of people who didn't have the benefits those skills conferred. While he shares them, in the world of the story, they are still always his.
The evil Morty character is a millenial child politician who believes he can have all those benefits for himself immediately and today instead of waiting to develop and inherit them with time - if he just decieves and betrays Sanchez and destroys the world in which his story (history, get it) represents the ideal he has to live up to to recieve them. Evil Morty the politician doesn't want to be a steward, he wants to be his own god becase the one his grandfather represents is humiliating to him.
Where we are now is that we have these politicains who are actuated by the shame of their impostor syndromes and their envy of the true popular desire that the products of competence provide. These X'ers can't get a 100 person rally going, but some hacker in a basement can do some magic and suddenly actuate the desire of billions like some kind of rockstar without the gatekeepers.
That's what this legislation is about. It's the coup de grace by a resentful pretender elite who have been taken in by people older and much more dangerous than they could ever have percieved.
This legislation comes from politicians believing that the general populace would vote for a government that places catching criminals over having e2e encryption. I doubt those legislating have a grand surveillance of the masses plan, or much in the way of philosophical thought at all. Now we're trying to convey to the general public that will be the consequence one way or another even if it's not the intent.
Then again, Labour and almost all the major opposition parties have been quiet on this, not really doing the job of opposition, so even with that delay I'm not sure how much will change.
Sometimes I think that politicians wait for a time when weighty things are on the table to erode our rights. Who is going to be a one-issue voter for something barely understood? And yet, in terms of governance, what issue is more important than this?
The USA PATRIOT act was pretty much written and ready to go when the 9/11 attacks occurred, and would have been impassable without some sort of disaster. Politicians absolutely are prepared to take advantage of opportunities, including to erode civil liberties if that’s their bent.
But good on her for sticking with her principles.
I did decide to use Session as a result of this bill, though, since that routes through a Tor-like system.
Whether it's natural disasters, wars, or just plain old internet , I bet many people will be extremely glad to know this app exists.
[1]: It gives you an option to start a local server to share the app via hotspot and maybe bluetooth (not sure about this one). Accounts are created locally and are completely decentralized. Messages can be routed via local networks, bluetooth, and/or even carrier pigeons (via usb/sd cards).
Presumably that it won't appear in the Apple App Store or Google Play?
Presumably that's more of an issue for the iOS ecosystem... But for android you just switch from using play to FDroid or an APK, right?
I presume a sufficiently irked UK wouldn't be able to do anything more, as Signal already as ways of circumventing traffic blocking within specific states?
Doesn't this just stop less motivated or technical folk getting signal... But for anyone motivated, or with nefarious intent, I don't see how this prevents anything the bill targets as a harm.
Maybe just disable all accounts registered with +44 telephone numbers?
Of course you are correct that anyone motivated and/or technical enough could still access Signal. However, their less motivated/less technical contacts won't be using it any longer.
The government is basically asking the bad actors to self-identify through their continued use of Signal.
If Signal were really sticking it to the UK-vassal state they would be able to continue to provide end-to-end encryption and force their EU aircraft carrier to go through the public, international embarrasment of running their own version of the Great Firewall.
> Passwords: Users can now create a group to share a set of passwords. Everyone in a group can add and edit passwords to keep them up to date, and since sharing is through iCloud Keychain, it’s end-to-end encrypted.
So there goes the backdoor encryption argument, it’s possible to add another member to a group of people with on device access?
What's also impossible is ensuring the good guys don't abuse their backdoors and thus become bad guys.
We have to be clear that closed source doesn't imply vulnerabilities. It just means it is hard to check. But we are also talking about one of the most researched devices w.r.t. security. If a backdoor is ever found, boy will there be hell to pay and I'm pretty sure Apple shares will take a really big hit. Especially as they've pivoted their marketing towards privacy.
TL;DR: UK government wants to degrade public's right to privacy / encryption under the guise of "but think of the children!"
Hah, then it's the usual scaremongering that recycles the same old excuses again and again.
Hopefully the signal ban will demonstrate to enough people that they don't really own the phone in their pocket - if they don't control what's on it, they are just renting it.
Islamic terrorist, international crime rings, political dissidents all use telegram. I am not aware of any serious criminal orgs that use Signal.
- Signal could just ban all UK IP addresses from accessing its messaging servers. Your encrypted messages still pass through servers controlled by Signal, Inc.
- UK government could require ISPs to deny access to Signal's messaging servers.
Of course, one could just use a VPN, set up a VM in a third country and run a Signal Proxy Server, etc.
It was hard enough getting family/friends to download/use Signal, as its UX is sub-par compared to alternatives.
If you start telling them they have to use a VPN, or run a server, etc, that will kill the network effect in UK.
I may not be up on how Signal operates now, as I stopped using Signal as my default instant messaging app when they dropped SMS. I maybe use it to send a message every other month now.
However, when I was using it they didn't sell anything. Not even ads. How do you participate in a market if you aren't a buyer or seller? If they are in a market the UK can't threaten them with dollars, and given they aren't based in the UK why do they care what ideas the UK passes?
It would have been nice the if she said what Signal would do if the UK passed the law, but as it stands I don't have a clue what she was on about.
It's a lot harder to explain to the average voter the negative consequences this has on privacy, in a way that will actually make them upset about it. And many mainstream media agencies don't even bother to try.
More like: Is the general public really scared of terrorism?
I agree that privacy is important, but it's not absolute, by law. So what we're saying is E2E apps are more important than current law we have, and we want to invalidate the ability of the police to investigate crime.
How can that make sense?
It would not prevent legitimate crime investigations, it would only keep that specific information obscured.
What about all the in-person conversations. Seems those might be considered just a bit more traditional than phones conversations, and haven't been subject to those same search warrants.
> So what we're saying is E2E apps are more important than current law we have, and we want to invalidate the ability of the police to investigate crime. > > How can that make sense?
(*proposed* British online safety legislation)
Let's expand on that then: how can it make sense what humans can have in-person conversations that are not subject to search warrants. These e2e-private-in-person conversations prevent the state from investigating crime.
If police should be able to always access your digital information, would you support the same in the case of non-digital information. Should building codes be updated to require microphones be installed in very room?
If you're not in support of microphones in every room, then please tell me why the conversation between two parties, be they lovers or criminals, should lose it's ability to be private the moment it crosses the internet?
Alright, technical argument here. This is false and tech talking heads are spreading this lie for ideological reasons.
You don't need to backdoor the protocol, just the specific targeted client.
Now, if Signal said this is unfair because competitors won't also backdoor their app then I am with them. What the UK should probably have done is to force phone makers as opposed to app makers to facilitate a backdoor.
Signal can scan messages before encryption and report to the authorities just fine. Whatever the UK government desires, Signal should accept it as the will of the UK people, especially given that politicians' stance on this has been public and endured election cycles.
I do get their stance, people will stop using them if they cave in and the UK gov should know that as well.
I don't know UK law but dragnet surveillance is illegal in the US but targeted warrantful requests to backdoor apps is lawful.
Control of the list which is used to scan your messages has the same security properties as the code of signal itself and a threat actor that can exploit the system must control both that and access the match reporting system (signal servers). An actor that controls these does not need to abuse this system, it would be easier to just push a rat alongside signal.
> "You cannot create a back door that only the good guys can go through"
Perhaps for crypto protocols. Software systems do this all the time in form of software updates, usage monitoring and even unattended remote support accounts. And also, just because it might be possible to find a vuln in a system in the future that does not mean it is vulnerable at the time of design.
Not only are clean backdoors possible, software engineers can design them cleanly and make them sound nice and fluffy when they are the ones accessing the backdoor.
Distinction without a difference. Either way, the total system is delivering the same plaintext to the same third parties.
On edit: and, just to be clear, they want the apps to scan for specific hashes from a master list, and/or apply ML to find "suspicious" material that's NOT in any lists, on EVERY client, not just "targeted" ones. That's true for the UK "Online Safety Bill", for the EU "chat control" or "anti-CSA" proposal, and in fact for the practical effect they're trying to get in the US with the "Earn It Act", "Stop CSAM Act", and to some degree with the "Kids Online Safety Act".
Find a better way for govs to have an advantage against CSAM and other boogeymen. Technical people are supposed to find optimal technical solutions, not pretend to be technocrats or underdogs fighting against governments who are all unjust and out there to get us.
Nope. If what the government is trying to do is unjust in my own ethical judgment, then I have no obligation to help them find an "optimal technical solution" to do it - on the contrary, I have a moral duty to make it as hard as possible for them to do that.
The usual argument is that if we don't "help" them, the regime that's actually enacted will be much worse all around. Which is likely true, but also exactly the point - let them be heavy-handed and incite more popular resistance that way. We'll see how much of the public still supports all this stuff when the "for CSAM only, pinky promise" tech will start being routinely used to bust them for stuff like drug use.
No, just be honest about technical matters. You can refuse to publish your software entirely or ideally in this case, make it available only outside the UK and let UK users seek it out on their own or use vpns. You can also protest the measure and try to prevent the law from being passed on ideological grounds.
> on the contrary, I have a moral duty to make it as hard as possible for them to do that.
So long as you are not being dishonest because then why would anyone trust you with anything else. You can comply with laws by doing it well or simply refuse to participate in publishing software there. What is happening now is they want to publish software there but refuse to obey the law of the land. What kind of law do you get to follow, only when you agree with it?
> We'll see how much of the public still supports all this stuff when the "for CSAM only, pinky promise" tech will start being routinely used to bust them for stuff like drug use.
That's sort of my point. You can disagree with it ideologically, saying it will be abused. But if the people trust the government and think preventing CSAM is more important then it is their right to self-determine and find out for themeselves and repeal the law later on. You are not the people's nanny, they made their bed.
Perhaps we can talk about phones without app stores and OSes people can use whatever unbackdooree app they want then?
Please follow your own advice.
> Alright, technical argument here. This is false and tech talking heads are spreading this lie for ideological reasons.
That is not true. The "lie" is that if you allow a back channel into secure communications then you cannot be sure who will use it. You have gone from trusting the other party (whom you probably know) to trusting them and a third party, who's identity is a bit of a mystery.
> You don't need to backdoor the protocol, just the specific targeted client.
Somebody else has pointed out this is nonsense. It makes no difference. Whilst it is a fact, it is also a lie. Well done.
> Signal can scan messages before encryption and report to the authorities just fine.
That too is a lie. Signal offers secure communications. If it scans messages and sends hem to third parties that is not "Signal", that is something else.
> Whatever the UK government desires, Signal should accept it as the will of the UK people
Extraordinarily naive about the habits, morals, and actions of the English state. That is so untrue it transcends "lie".
> I don't know UK law...
No shit!
> ...but dragnet surveillance is illegal in the US but targeted warrantful requests to backdoor apps is lawful.
Not under English law. There are no rights, as Americans know them, under English law. There are statutes, that can be changed at any time if the Lords agree, and over time if they do not
> Find a better way for govs to have an advantage against CSAM and other boogeymen
Constant surveillance of all people at all times. A camera in every bathroom, In general every bedroom. My point is a line must be drawn somewhere. The English, and Australian, states do not care at all for the personal liberty of the subjects of the English crown. Some very good people in England doing very good work, but the state there is very deep.
No one is asking that! The communication channel is untampered. The app is where the backdoor is, before the communication channel.
> Somebody else has pointed out this is nonsense. It makes no difference. Whilst it is a fact, it is also a lie. Well done
Bullshit! You damn well know it does! A network adversary and an ondevice adversary are completely different. If you don't know that, you are clueless or a liar. There is security in transit and security on device. The backdoor applies to on device security before any transport crypto is applied. This is the same as your keyboard app being backdoored or a rat infecting your phone.
> That too is a lie. Signal offers secure communications. If it scans messages and sends hem to third parties that is not "Signal", that is something else
You know, just because you say words, that doesn't mean they mean things. How can that possibly in a logical universe be a lie when I said "can"? Are you claiming Signal by law would be forced to change its name or disband if it started scanning messages before encryption? Would there be a tear in timespace if that happened? Please do explained why I was called a liar for pointing out that possibility.
> Extraordinarily naive about the habits, morals, and actions of the English state. That is so untrue it transcends "lie".
Wth does that even mean. Are you saying corporations in the UK do not have to folloe the law or can pick and choose what laws to follow?
I think yours and others problem is you don't get the absurdity of companies acting as if they were individual participants in political discourse. They are not. They have no right. Companies don't vote, they have privileges and reaponsibilities and never rights of any kind.
> There are statutes, that can be changed at any time if the Lords agree, and over time if they do not
I hope that applies to companies too?
> Constant surveillance of all people at all times. A camera in every bathroom, In general every bedroom. My point is a line must be drawn somewhere.
At no point did I disagree with that. I have refused to visit the UK multiple times because of the nightmarish CCTV surveillance there. I do not agree with what they are doing but I disagree that civil disobedience can be invoked every time a law you disagree is passed, especially when tech people like you are lying about what is and isn't possible instead of boycotting the UK market or finding alternate solutions to CSAM abuse and other tech abuses and also when the government's actions will materially and provably reduce actual harm but mass surveillance has no actual proven and physical harm to anyone. I am all ears for solutions and I do not support mass surveillance but don't pretend your human right was violated when you don't even need to use smartphones (or rather smartphone and tech dependency itself is the violation of rights).
Why? The other side isn't playing fair by any metric.
> What kind of law do you get to follow, only when you agree with it?
I don't particularly care about "dura lex sed lex", so - all of them. Of course, if you get caught, that's unfortunate - but ethics and law are two different things, and in my book the former always wins when they are in conflict. I believe that it's always moral to break unjust laws, and it's always moral to help other people to do so.
> But if the people trust the government and think preventing CSAM is more important then it is their right to self-determine
"The people" are not a singular entity with rights. Even if there's a majority that wants this, it's not "their right" morally - not when it imposes surveillance on the rest of us. They will do it anyway, of course, because the most fundamental principle of any government is that might makes right. But I don't intend to make it any easier for them, majority or not. Let them work hard for every such law they pass, and then work even harder trying to deal with all the tech that makes those laws so difficult to enforce.
Because now I know you are full of shit. Everything you touch is sus now.
> I believe that it's always moral to break unjust laws, and it's always moral to help other people to do so.
Are unjust laws just laws you don't like? Are you saying it is a violation of your religion?
> "The people" are not a singular entity with rights. Even if there's a majority that wants this, it's not "their right" morally - not when it imposes surveillance on the rest of us
You are living under rule of law. If you don't like the rules, vote or get a gun. The victims of CSAM and many other crimes disagree with you. So why should your surveillance worries trump their actual victimization concerns? Instead of solving that, you lie and deceive politicians to keep the status quo and pretend you are the one fighting for justice.
> Let them work hard for every such law they pass, and then work even harder trying to deal with all the tech that makes those laws so difficult to enforce.
Yes they should work hard but if all of you tech people are a bunch of liars the you no longer get to claim how clueless politicians are on tech law, because when they turned to you for technical advice, you lied!
Unjust laws are those that, upon evaluating them from a moral perspective, are found unjust. This is inherently subjective, of course, as is all morality. I am an atheist.
> You are living under rule of law. If you don't like the rules, vote or get a gun.
The laws I am living under are imposed on me without my consent, so why should I consider them binding? If you don't like me breaking your rules, catch me breaking them - if you can.
> The victims of CSAM and many other crimes disagree with you. So why should your surveillance worries trump their actual victimization concerns?
Because the scale of surveillance enabled by these laws exceeds the scale of CSAM by many orders of magnitude.
> when they turned to you for technical advice
They didn't. What they want is for us to rubber-stamp their desired solution, with CSAM as an excuse. I'm treating them accordingly.
> Real harm is happening
... and these proposals would be very unlikely to materially reduce that harm. They WOULD, however, create a bunch of other harm. Including harm to children. In fact even including sexual harm to children.
> boogeymen
You said it, I didn't.
> Technical people are supposed to find optimal technical solutions, not pretend to be technocrats or underdogs fighting against governments who are all unjust and out there to get us.
Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter.
I would want to hear your explanation for that but more importantly, you should convince lawmakers about this instead of claiming the tech is impossible.
> You said it, I didn't.
Yes I did, hope you got my point then.
> Nobody's job disqualifies them from having political opinions. Technical expertise MAY, on the other hand, give one a better than average understanding of the actual impact of making a technology change. As may actually running an affected system and knowing how things play out on it, for that matter.
I fully support tech people opoposing this law, so long as they don't claim apps can't scan messages before transmission which is obviously a lie. Of course the apps security is reduced and they can have opinions by how much, but so long as the security property and risks are communicated to policy makers and users honestly I have no problem with it. What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law.
But if you read my comment, apple and google should do this, not Signal, but then again them or telcos pushing code that modifies appls like Signal would be much more insecure than Signal itself doing it nice and neat.
The people who want it need to prove that it will help.
I had started in to list paragraphs and paragraphs of failure modes, unintended consequences, and directly bad effects, but then I realized that that implicitly accepted an inappropriate burden of proof.
I am tired of hearing "Something must be done. This is something. Therefore this must be done".
Tell me, in detail, how any of these proposals will help. Include all of the steps from the initial scanning through the final removal of harm. Do not stop at "Authority(TM) will know about X, so they can fix it". Tell me how they will fix it, and how they will do that without doing harm. Not how they theoretically could. How they actually will. And make it plausible.
After you've given me that, I'll be happy to rip it to shreds for you.
Otherwise, if you can't figure out for yourself how it's harmful to give platforms massive incentives to shut down anybody who raises costs by triggering too many false positives, how it's equally harmful to give them massive incentives to broaden their definition of what's a "true" positive, how it's harmful to have thousands of random people viewing false "hits", how it's damaging to enable Authority(TM) to come down on kids for communicating among themselves, how it's dangerous to create a massive database of blackmail material on potentially vulnerable people, how it's trivial to repurpose a spying infrastructure for different targets, or how it's useless to give more reports to law enforcement that's overwhelmed with the reports it already has, then you'll have to content yourself with reading the vast volume of stuff other people have written up about the OSB and all the related proposals.
> you should convince lawmakers about this
Many of us have been trying. The OSB has not in fact passed yet. The EU and US proposals still less.
> instead of claiming the tech is impossible.
Nobody, not me, not Meredith Whittaker, not anybody, has claimed that client side scanning is impossible, or that you can't turn around and encrypt a copy of a message after you've spied on it. That is a straw man. It is entirely your fantasy.
What they've said is that it's stupid and contrary to the whole point of having the encryption in the first place. It leaks information that's supposed to be private, including false positives, and paints a target on the most sensitive stuff. It creates infrastructure for abuse. Those are the "security properties" being "communicated". And that is 100 percent true.
When she says "back doors", she's talking about system back doors, not necessarily protocol back doors. Although the protocol would have to have some way to report the data.
Anybody with a remotely clear-headed view of the situation understands that sending off plaintext copies of the stuff you then turn around and encrypt is in tension with the purpose of doing the encryption. They also understand that once you have either the scanning or the reporting system in place, there's nothing that controls how it can be used.
And they understand that the proponents of this stuff have no detailed story at all about how the leaked plaintext is supposed to be secured after the leaking is done... especially if it's actually going to be used for the stated purposes. That is a VAST technical and organizational problem that's constantly handwaved.
> What I would have a problem with is if Signal as a corporation chooses to remain in the UK market and refuse to comply with UK law.
That's another fantasy of yours. She's been very clear that if the UK does this, Signal will exit the UK market.
However, that's her and her corporation. It's not binding on the rest of us.
The fact is that "lawmakers" do not have infinite legitimate power. It is sometimes right and maybe even morally required to directly break the law.
Personally, I'm looking forward to the widespread use of P2P tools that will make Signal look like an open book... whether they're legal or not. At this point, laws even in the "free world" are descending into insanity.
Rip this to shreds: if at least one victim of a crime can be prevented by catching a witless criminal then it is worth it. Also this: Homomorphic encryption and differential privacy are a thing, if certificate transparency logs can prove no certs are issued maliciously then similar logs can be published publicly to prove that the scanning list (similar to a CRL) does not contain hashes/patterns that haven't gone through appropriate legal/regulatory checks and balances. E2EE can also be used to secure the message between the gov agency and the device. Certificate authorities already have similar exposure that can compromise all your traffic (including the signal app download/install), "shred" this and show me why a similar risk model is inapplicable to gov scan lists.
> Nobody, not me, not Meredith Whittaker, not anybody, has claimed that client side scanning is impossible, or that you can't turn around and encrypt a copy of a message after you've spied on it. That is a straw man. It is entirely your fantasy. > What they've said is that it's stupid and contrary to the whole point of having the encryption in the first place. It leaks information that's supposed to be private, including false positives, and paints a target on the most sensitive stuff. It creates infrastructure for abuse. Those are the "security properties" being "communicated". And that is 100 percent true.
No, the message you have been spreadning is that it is impossible to secure a message and spy in it which you just admitted there. That is false, that is not a strawman on my end, you just admitted it! The infrastructure can be abused? So can signal's source code repo infrastructure. Your lie is that of omission and context framing while fully knowing how non-technical policymakers will interpret what you are saying. It is absolutley possible to implement a scanning infrastructure that has the same security properties as the app's code or app store download/signature security. If you are claiming the gov end can be abused by malicious humans then that is beyond your exertise to police humans breaking laws, so long as transparency logs can be produced to criminally punish violators.
> Anybody with a remotely clear-headed view of the situation understands that sending off plaintext copies of the stuff you then turn around and encrypt is in tension with the purpose of doing the encryption.
That is not what was suggeste and I am sure you are aware that it is possible to scan for messages without sending off a copy of the message off device and also without informing anyone of false positive hits. Or even contents of true positive hits (requiring them to get a proper warrant and target the device for intrusive collection).
> That's another fantasy of yours. She's been very clear that if the UK does this, Signal will exit the UK market.
It's not a fantasy, it is possibility and I am glad signal will exit the UK if this happens. I support this kind of boycotting.
> It is sometimes right and maybe even morally required to directly break the law.
Maybe, but not everytime you don't like a law, that undermimes the rule of law. Only active and imminent harm to humans is a reason for civil disobedience not mere speculation and disagreement. You spoke of burden of proof, the other side has proof of harm to humans you are on the opposite side of civil disobedience here. You are on the side of the oblivious technocrats profiting from harming people.
> Personally, I'm looking forward to the widespread use of P2P tools that will make Signal look like an open book... whether they're legal or not. At this point, laws even in the "free world" are descending into insanity.
Me too, but for opposite reasons: so that you people finally get that technocrats and civil disobedience is not a thing. You cannot solve politics with technical rebellion. You have to actually convince your peers. Here I am as your peer engaging with you while being aware of most of the technical facts and you are not convincing me. Your strategy of using technical expertise to deceive people will backfire too and so will downvoting people like me attempting to engage in civil discourse with you in good faith. I think you will just end up facilitating the building of "GFW" level national firewalls in the west with your techniques. They are not going to stop trying to find a solution to reduce CSAM and other illicit crimes, a privacy preserving solution is possible and fighting it is a lose-lose scenario.
You didn't come close to what I asked for. You gave no details on how even one crime would be prevented. But I'll give you that it probably would prevent a few.
It's still crazy to say that outweighs any other consideration.
You have to prevent more evil than you cause. That includes the opportunity cost of the resources you put into it, by the way.
"If it saves just one child" is a childish argument and I'm not going to engage with it any further.
... and if you think no children will be sexually blackmailed using the reports you're trying to generate, you are insane.
> Also this: Homomorphic encryption and differential privacy are a thing,
You seem to have slipped from the idea of client-side scanning into using homomorphic encryption to run ML in zero knowledge on the server side. That won't work.
There's a sharp limit on how many operations you can do on the encrypted data before you lose the ability to recover the result. That limit is NOWHERE NEAR the number you need for any useful ML. Plus of course the incredible compute, communication and storage load.
Although I have a general feel for what you can and can't really do in zero knowledge, I am not an actual expert on that technology. So here's a link to an actual expert: https://blog.cryptographyengineering.com/2023/05/11/on-ashto...
I have no IDEA how you'd expect to use differential privacy for any of this. And I very much doubt that you do either.
So let's stick to client-side scanning, since we at least know how to build that. Anyway, the fatal problems are with scanning in general, not with any particular way of going about it.
> if certificate transparency logs can prove no certs are issued maliciously then similar logs can be published publicly to prove that the scanning list (similar to a CRL) does not contain hashes/patterns that haven't gone through appropriate legal/regulatory checks and balances.
I think you may now have moved again, to perceptual hashes. But I guess maybe you could do something like that for an ML model too.
The "checks and balances" I've seen so far have been not so much crappy as nonexistent. Including having private groups create the lists with no real oversight.
Once the infrastructure was in place, I'd expect some countries to PUBLICLY AND OPENLY expand the scope, so auditing is irrelevant anyway. In fact, the OSB already covers more than CSA and would probably require scanning for more than CSA.
> E2EE can also be used to secure the message between the gov agency and the device.
These proposals, especially the OSB, generally call for platforms to manually vet the "hits" before they go to any government agencies, or even to the private advocates.
They kind of have to, since--
1. Most of the government agencies are too swamped to actually follow up on most of the reports they already get, and
2. The bills all demand going beyond looking for specific, already known and vetted files, into looking for things that "look suspicious". Once you go there, the number of false positives will be more than the number of true positives. Especially when you make them terrified to have any false negatives.
But sure, you can encrypt the stuff at each in-motion hop. Which has nothing to do with the main exposures.
> Certificate authorities already have similar exposure that can compromise all your traffic (including the signal app download/install),
That's one reason high-security applications don't trust CAs. Signal doesn't, for instance, but Signal's not special in that way.
> No, the message you have been spreadning is that it is impossible to secure a message and spy in it which you just admitted there.
Well, yes, it is. At least to any reasonable standard.
> So can signal's source code repo infrastructure.
One risk doesn't justify taking on another risk. Especially not a much greater risk.
> It is absolutley possible to implement a scanning infrastructure that has the same security properties as the app's code or app store download/signature security.
OK, this is truly insane.
One system tries to keep messages tightly compartmented, exposing them only to their senders and recipients. It keeps the messages encrypted except on the senders' and recipients' devices, and actually being read.
Another system does the same, except that it also sends some of those messages into a central database. It does so for the purpose of having them read by third parties, and by this I mean humans. In practice, that database has to have a long retention time and a huge number of authorized users. If those users decide that the messages were true positives, they get forward into yet another database.
The second system has every exposure the first system has, plus a bunch of other, worse exposures. It vastly expands the spatial and temporal areas where sensitive data are kept. It puts all users and devices' data into the same compartment. It has probably more than twice the total code of the first system. It trusts thousands more people. And the database is not only huge, but rich in abusable material, so it's a gigantic target that will attract attackers.
Those two systems do not have "the same security properties". They don't have anything close to "the same security properties". Using the phrase "the same security properties" anywhere near those two systems shows that you know nothing about what you're raving about.
And, yes, that second system is what you will get.
> If you are claiming the gov end can be abused by malicious humans then that is beyond your exertise to police humans breaking laws, so long as transparency logs can be produced to criminally punish violators.
Not only am I entitled to my opinions as a member of the (world) polity, but that as an actually competent security specialist, I do have real expertise in designing security systems around how humans actually act.
Unlike you, obviously.
> I am sure you are aware that it is possible to scan for messages without sending off a copy of the message off device and also without informing anyone of false positive hits.
It's a false positive because you don't know it's not a true positive. You therefore have to treat it exactly the same as a true positive.
> Or even contents of true positive hits (requiring them to get a proper warrant and target the device for intrusive collection).
You won't meet a probable cause standard with those hits. I'm sure you could get a warrant in Iran.
Nor do most law enforcement agencies have the resources to get warrants and raid people "on spec" like that.
... but in fact nobody's going to try to build that. The "workflow" you will actually get with this stuff is
1. Device gets a hit.
2. Device sends the data the hit was based on to the platform
3. Optional, but likely to be common because it limits risk for the platform: automation disables the user's account until the platform gets around to reviewing the hit. This may take weeks, especially if some score is borderline.
4. Platform employee reviews the hit (with little context, which matters a lot especially for the text scanning people are demanding)
5. If the hit looks criminal, platform employee forwards it to law enforcement or whoever. With all the data unless legally prevented.
6. If the hit looks borderline, or the user looks like they "might be a risk", or maybe even like they "might generate a bunch more false positives we have to review", platform employee ends the business relationship with the user.
7. If the hit looks completely false, platform employee reenables the user's account.
On hits with very low scores, you might have the device just refuse to send the message or whatever. In that case, either the innocent user is screwed, or the guilty user tries other ways until one works.
> Only active and imminent harm to humans is a reason for civil disobedience not mere speculation and disagreement.
We're seeing people disappeared constantly in a bunch of countries (not the UK so far). I'm OK with calling that active harm.
We're seeing stuff like teenagers jailed for sexting in the US... which this nonsense would definitely greatly increase. And we're people worldwide driven off of platforms. They "look too much like" abusive users to a computer, you see... especially to a computer programmed by some clueless whitebread idiot.
> You are on the side of the oblivious technocrats profiting from harming people.
That stupid bullshit again. News flash: CSA is not profitable for platforms. They don't get paid for it, and if it's visible it drives away profitable users. At MOST it's profit-neutral, usually negative.
> Here I am as your peer engaging with you while being aware of most of the technical facts and you are not convincing me.
That's because you're an obvious fanatic.
> Your strategy of using technical expertise to deceive people
Nobody's tried to deceived anybody. Except maybe you.
> downvoting people like me attempting to engage in civil discourse with you in good faith.
I haven't downvoted you. I have wasted my time engaging with you. I'm not going to waste any more, though.
> I think you will just end up facilitating the building of "GFW" level national firewalls in the west with your techniques.
I'm sure that'll be good for your agenda.
So how are you backdooring the client that -- where ever you download it from -- can be dumped from the phone and compared against self compiled client with a cryptographic hash?
Introducing intentional, ubiquitous vulnerabilities is also a terrible idea, because exploits for those can leak or be stolen (that has already happened, see Shadow Brokers case), and that's catastrophic in operating systems, because they're massively scalable.
Rootkits injected via such vulnerabilities can covertly make systems so that the vulnerability and backdoor are unpatchable, and that would be a catastrophic scenario.
>Signal can scan messages before encryption and report to the authorities just fine
Writing a script that comments out the lines of code for such scanning, and that compiles the application from source is trivial.
People write E2EE layers on top of existing messaging apps. One example is OTR plugin for Pidgin/Gaim, another is CryptoCat that at one point had a system that operated on top of Facebook web UI.
The genie is out of the bottle, and the bad guys are willing to go the distance to get secure comms. Bin Laden was using airgaps. Criminals are buying crypto phones (that ANOM case was fun example of smart targeted attack though, maybe that can be used to catch some criminals in future too). What's left is the security of normal people from banana dictatorships, mass surveillance tools etc. When you backdoor privacy tools, that's who you'll get, and if that's who you're going after, then you have no right to wield such power.
No e2ee app has compromised device part of their threat model. People get ratted all the time on their phones bu criminals. This is the same thing except the gov is nice enough to not look ar everything, just scan for content
> Writing a script that comments out the lines of code for such scanning, and that compiles the application from source is trivial. People write E2EE layers on top of existing messaging apps. > One example is OTR plugin for Pidgin/Gaim, another is CryptoCat that at one point had a system that operated on top of Facebook web UI.
Doesn't matter. Those apps can be backdoored too. The whole OS can. And the gov doesn't mind playing whack-a-mole. You can disagree with their policy but I disagree with openly collaborating on lying to policy makers on technical facts.
Oh really, here's one I made earlier https://github.com/maqp/tfc :-)
>The whole OS can.
So how are you backdooring a bash script that comments out lines of code from Linux source before compiling it?
You lying to policy makers with "it can be done" mindset sound like a stupid con that burns a lot of money and time in the process.