Hacker News Reader

Comment by StavrosK | Hacker News Reader

The entire purpose of a canary is to get manually updated. Automating it would defeat the purpose. If the person (or people, but you'd want to keep them as few as possible) was sick, unavailable, etc, it obviously wouldn't get updated.

A canary also fails open by design. There's no way for the canary to fail on the side of getting your data compromised. If we forget to update it, you should just be more cautious, until we update it again (if we do).

View on HN

I may be persuaded that the individual tasked with signing and updating the canary got drunk over the Holidays and forgot.

Nobody is going to convince me that same individual went on a twenty day bender and sobered up on Christmas morning.

Of course it needs to be manually. Fail open? A warrant canary system setup for the sole purpose of telling the whole world (and the clients, of course) that they were hit by not posting "a declaration that, up to that point, no warrants have been served, nor have any searches or seizures taken place".

Can there really be a fail-open or fail-safe here?

Edit: "not posting" fixed.

Yes, forgetting to update the canary = safe. If you had a system that signed stuff until you stopped it, it would fail unsafe, i.e. it would keep telling people they're safe when they weren't.

You realize, that forgetting to update the canaray gives the same message as "we were hit by a big fucking NSL, don't trust us and our software and systems ever again as their security has been compromised."?

From the outside, there is just no way of knowing that it was just a forgotten update or if it was a strong message.

Hey, I'm not any happier about this than you are. I'm just saying that at least it doesn't lull users into a false sense of security, which would have been disastrous.

What's your threshold to "disastrous" in terms of a missing warrant canary then? 3 weeks? 1 month? 2 months? longer?

Not missing the canary when you were served an NSL.

Reply on news.ycombinator.com