justcommenting

Brian Smith, Eric Rescorla, Julien Vehent... all of these individuals have dragged their feet on certain security/privacy issues in the past in ways that could have benefited intelligence agencies, particularly pre-Snowden when scrutiny was arguably far lower. They've also all done pretty positive things at one point or another: there's some nuance there.

I would encourage anyone with time/interest in these issues to get to know these people personally if possible and to think critically about their pre-Snowden attitudes toward engineering choices related to privacy/security as reflected in their code contributions or policy decisions, rather than simply wielding pitchforks..

Their new suitor is Yahoo, but since we're on the subject of Firefox defaults and funding, this reminds me that Firefox's "Show Cookies..." UI has been broken for years.

And that Mozilla refuses to merge many of Mike Perry's privacy and security-enhancing patches for Tor Browser Bundle because they make advertisers' lives more difficult.

I could trivially list at least a dozen default Firefox preferences that could readily be explained by conflicts of interest, rather than common sense or Mozilla's commitment to user privacy or their increasingly-touted (and I'm guessing, unpublished) user studies.

It would be interesting to study which Firefox 'features' get prioritized or broken or fixed via paid staff time on a given time horizon and plot that against deals Mozilla makes with 3rd parties.

Upon considering that this talk was delivered pre-Snowden, the value and prescience of this talk is even more significant.

This article is now on the front page of WSJ.com!

Kudos to moxie and team for their work and their example of positively enabling others to speak freely, for inspiring others to build better alternatives, and for being the change they wish to see in the world.

Also wanted to share one of the most provocative moxie-isms I've heard in recent years from him, in reference to WL:

"What about the truth has helped you?"

Not an endorsement of Dell or Ubuntu, but Dell appears to offer 8 (mostly lower-end) laptop models with Ubuntu pre-installed: https://www.dell.com/us/p/laptops

as a friend reminded me, anonymity only buys you time; it does not buy anyone justice.

and david simon's recapitulation is more succinct and compelling: https://www.youtube.com/watch?v=E2Fv-nJCfrk

Given all the vitriol on another front-page thread, I wanted to note from the site that "A close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved such a break."

I'm grateful to people who disclose and fix vulnerabilities instead of leaving everyone vulnerable, and kudos especially to Nadia Heninger from this team, whose work has only grown in interesting-ness and practical implications over the past few years.

In terms of root causes, this incident should cast a spotlight on NSA/IC strategy and the balance between "Information Assurance" goals and SIGINT goals: is the NSA going to deliberately leave everyone vulnerable (including, apparently, POTUS) to enable offensive operations of questionable value, or should NSA and its partners re-emphasize their IA mission and work toward securing the systems everyone uses? I can only hope Obama is leaning toward the latter after being personally affected.

Some historical context for considering why bills proposing to compel greater collaboration or coordination or cooperation from companies storing private communications might be problematic: https://en.wikipedia.org/wiki/Gleichschaltung

The last few sentences are a great summary:

"The prison looked like an image on an old postcard, a haunting, uniquely American symbol of state power. And a thought occurred to me: the walls of the penitentiary guarding this pacifist were taller and more impenetrable than any of the fences at Y-12."

>1- tor is broken.

For what definition of "broken"?

this article points out several important aspects of uber's 'unfair advantage,' which in the labor market almost completely boils down to structural forms of tax avoidance that regulated incumbents are unable to match, but neglects to mention some of the longer-term benefits that 'real' employment brings.

for example, having a W-2 job in the united states typically means contributing to social security, which helps people build up to qualifying for certain benefits in retirement. not so with uber.

especially over a typical worker's lifetime, comments about $x/hour dramatically oversimplify and abstract away the NPV of these endeavors for employee-like participants. NPV for employee-like participants is considerably lower than many reasonable-sounding discussions would have you believe because a lot of the discounts that uber captures as profits are not as cleanly captured in $x/hr numbers....social security is one of many.

that's a lot of psychological manipulation

kinda sorta mostly beating EFF to the punch?

AWESOME! this makes the world a better, safer place....and especially after showing some love to djb the other day, this is pretty excellent news.

It usually goes something like "mom, what are the two words (short authentication strings) you see on your phone?" Sometimes she even asks me--we make jokes about the combinations.

And yeah, it's true that some of the Snowden docs reference ZRTP attacks & spoofing voice so it's not necessarily foolproof (or her phone could be owned etc.), but another one of the things my mother told me when I was a kid was "the key is to begin." And that's what moxie's done...

My mother literally did not know how to turn on a computer until a few years ago, but was able to use Signal on her iPhone after almost no explanation. My mother looked at me funny when I tried to explain GPG to her after the Snowden revelations started. But ever since I installed Signal on my mother's iPhone, I have been able to have private phone conversations with my mother. The significance of these types of distinctions between gpg and Signal are hard to underestimate when you extrapolate them to a societal level. My partner uses TextSecure/RedPhone with ease, and most of my friends use WhatsApp. I've only been able to convert a few of my non-technical friends, in contrast, into gpg users. Another way to think about this in terms of strategy: the means actually are the ends.

Almost as important as his crypto expertise, moxie's deep understanding of UX and especially barriers to entry and the network effect have concretely made the world a better place, and not just for people like us...but also (and especially) for people like my mom, my partner, and my (mostly non-programmer) friends. Thank you for understanding that their privacy is important and that their human dignity matters--and especially for meeting them where they are.

As a result, now it's not just my colleagues "in tech"--but also essentially all of my friends and family--who are with you!

I've also noticed the quality of DuckDuckGo search results has been steadily improving, especially over the past year. I would encourage anyone who tried it and went back to another search engine to consider giving DuckDuckGo another shot--you may be pleasantly surprised!

Probably just a CDN issue (https://cnn.com not found, www. shows an error, etc.), but fyi...

Cert Subject Alt Names:

Not Critical DNS Name: a.ssl.fastly.net DNS Name: .a.ssl.fastly.net DNS Name: fast.wistia.com DNS Name: purge.fastly.net DNS Name: mirrors.fastly.net DNS Name: .imgix.net DNS Name: .parsecdn.com DNS Name: .fastssl.net DNS Name: voxer.com DNS Name: www.voxer.com DNS Name: .firebase.com DNS Name: sites.yammer.com DNS Name: sites.staging.yammer.com DNS Name: .skimlinks.com DNS Name: .skimresources.com DNS Name: cdn.thinglink.me DNS Name: .fitbit.com DNS Name: .hosts.fastly.net DNS Name: control.fastly.net DNS Name: .wikia-inc.com DNS Name: .perfectaudience.com DNS Name: .wikia.com DNS Name: f.cloud.github.com DNS Name: .digitalscirocco.net DNS Name: .etsy.com DNS Name: .etsystatic.com DNS Name: .addthis.com DNS Name: .addthiscdn.com DNS Name: fast.wistia.net DNS Name: raw.github.com DNS Name: www.userfox.com DNS Name: .assets-yammer.com DNS Name: .staging.assets-yammer.com DNS Name: assets.huggies-cdn.net DNS Name: api.kinja.com DNS Name: orbit.shazamid.com DNS Name: about.jstor.org DNS Name: .global.ssl.fastly.net DNS Name: web.voxer.com DNS Name: pypi.python.org DNS Name: .12wbt.com DNS Name: www.holderdeord.no DNS Name: secured.indn.infolinks.com DNS Name: play.vidyard.com DNS Name: play-staging.vidyard.com DNS Name: secure.img.wfrcdn.com DNS Name: secure.img.josscdn.com DNS Name: .gocardless.com DNS Name: widgets.pinterest.com DNS Name: .7digital.com DNS Name: .7static.com DNS Name: p.datadoghq.com DNS Name: .plan3.se DNS Name: new.mulberry.com DNS Name: www.safariflow.com DNS Name: cdn.contentful.com DNS Name: tools.fastly.net DNS Name: .huevosbuenos.com DNS Name: .goodeggs.com DNS Name: .fastly.picmonkey.com DNS Name: .cdn.whipplehill.net DNS Name: .whipplehill.net DNS Name: cdn.media34.whipplehill.net DNS Name: cdn.media56.whipplehill.net DNS Name: cdn.media78.whipplehill.net DNS Name: cdn.media910.whipplehill.net DNS Name: .modcloth.com DNS Name: .disquscdn.com DNS Name: .jstor.org DNS Name: .dreamhost.com DNS Name: www.flinto.com DNS Name: .chartbeat.com DNS Name: .hipmunk.com DNS Name: content.beaverbrooks.co.uk DNS Name: secure.common.csnstores.com DNS Name: .vsco.co DNS Name: www.joinos.com DNS Name: staging-mobile-collector.newrelic.com DNS Name: .modcloth.net DNS Name: .foursquare.com DNS Name: .shazam.com DNS Name: .4sqi.net DNS Name: .metacpan.org DNS Name: .fastly.com DNS Name: wikia.com DNS Name: fastly.com DNS Name: kinja.com DNS Name: .gadventures.com DNS Name: www.gadventures.com.au DNS Name: www.gadventures.co.uk DNS Name: kredo.com DNS Name: cdn-tags.brainient.com DNS Name: my.billspringapp.com DNS Name: rvm.io

serial: 01:E8:7D:87:DA:D5:21:F0:05:72:28:EE:85:7A:0A:E6 sha1 fingerprint: 01:E8:7D:87:DA:D5:21:F0:05:72:28:EE:85:7A:0A:E6

Thank you also to djb for designing the salsa20 family & poly1305.

And kudos to Cloudflare for pushing the envelope in this regard!

I actually think reframing these issues as something that might necessitate a fork for corporates could be good for all involved because that hopefully would mean less egg on Mozilla's face when someone finds out they're being DPIed.

There's a lot more nuance than I've acknowledged, but I'd much rather people make a fairly consistent set of assumptions about the trustworthiness of Firefox and a second, different set of assumptions about corporate MITMfox.

Even though I'm not a fan of it, I also recognize that companies own their assets and need to protect their networks. But should Firefox stay completely quiet by default when an IT department MITMs an employee's traffic? Even if we all acknowledge the same IT department could turn those warnings off, I think it would still be a start.

This will always be a cat-and-mouse game and I agree that Mozilla may not be able to permanently 'win' on behalf of users, but I think browser vendors in general could do more to shift norms and change the 'framing' of whether users see (for example) a monkey-in-the-middle icon instead of a lock icon by default when they're being MITMed by adware or corporate DPI.

I was half expecting a Snowden acceptance speech via robot[0][1]

[0] http://www.wired.com/2014/06/inside-edward-snowdens-life-as-...

[1] https://twitter.com/robotsnowden

Browser vendors need to rethink the mostly blind eye they've been turning toward corporate DPI and silent MITM.

I don't think browser vendors are necessarily responsible for Superfish or Privdog, but I do think they play a role when they make design choices that sacrifice more than most users realize at the altar of maximum compatibility without convenient alternative configuration options.

Even today, trust agility for CAs in Firefox is still one of the hardest-to-configure parts of the software for non-technical users. In a world of HSTS, why on earth should non-programmers have to click through a kludgy GUI for each of hundreds of CAs just to avoid trusting Chinese, Turkmenistani and various other CAs with no warnings by default? This seems like an area ripe for extension development; e.g. with something like RequestPolicy's categories defined by geography, level of paranoia, etc. - or AdBlock Edge's subscription lists. Firefox could pretty easily incorporate Certificate Patrol functionality and make it more usable for less technical users. And so on.

Companies producing this sort of malware deserve to be punished for misleading their customers and putting them at risk, but perhaps another solution is to pressure browser vendors to start thinking about the way crypto gets used with a lot more nuance as a potential attack surface, and from whose vantage point MITM confers transitive risk. When vendors leave those sorts of backdoors quietly open for corporate DPI, users often lose control over who else might try to use a similar type of backdoor.

There may be a legal difference between corporate DPI and Privdog, but we should stop pretending that there's a huge technical or ethical distinction between Privdog and browser vendors turning a blind eye to silent DPI against someone who does not get a say in it, and often does not even know about it.

Browser vendors hide behind 'compatibility' excuses for crappy defaults and glaringly absent warnings in much the same way PrivDog misleads people; browser vendors just tend to commit sins of omission rather than commission.

Somewhere around 20% of nurses in the United States belong to unions--some of which exert enormous political influence over the state and federal laws governing the other 80% working in an already highly-regulated market.

Collective bargaining and organized regulatory influence seem like potentially important contributors to the 'stability' of the profession and wage growth over time.

It's easy to think of a few "not all bugs are created equal" reasons this might be misleading.

Weighted averages of CVSS by OS might have been more useful, for example, and dis-aggregating Microsoft OS versions but not the various OSX or Linux distros/kernels (and lack of Android) also paints a potentially misleading picture.

With any exercise of this type, the conclusions one draws are typically encoded a priori in the way the analysis is framed and defined.

what a great testament to her life and to its worth

This is almost a continuation of the pattern from 2013 in which senior officials made claims that were quickly and devastatingly revealed to be false or misleading in comparison to what NSA and its partners were actually doing in practice. It's not an exact continuation of the pattern, since we "just" learned that NSA and GCHQ undermined what Obama claimed were shared goals on a massive scale.

Maybe we were all supposed to infer from Obama's concerns about "a bunch of people compromising that process" that he really meant encryption was a NOBUS (No One But Us) issue for the administration. Maybe we were supposed to know that when Obama said "there’s no scenario in which we don’t want really strong encryption" that he was talking about "really strong encryption our partners can't compromise and share with us."

I would have expected the administration to become much more cautious about making falsifiable or undermine-able statements after these leaks started.

I'm glad to see Sarah's courageous acts receiving more positive attention.

Your comments seem to underscore how Google controls the debate by defining the terms on privacy issues. You seem to be saying "Concerned about privacy? You could check up on Google by acting like one of its advertising customers.." which sort of highlights the parties Google is most interested in being transparent with (for completely understandable business reasons).

But of course in order to do that, you also have to have a login, cookie, etc. for a panel that Google controls, and that exposes only a tiny subset of the information it could most obviously and trivially correlate about user activities.

These just aren't really things people trying to visit wordpress sites should have to consider..

It really depends on the relevant counterfactual; yours makes total sense from the vantage point of lots of developers, but I tend to prioritize privacy and autonomy. When I visit catphotos.wordpress.com, my intention is not to leak information to Google even though they have great fonts. My intention is just to visit the website.

So the counterfactual I would frame the discussion with would be something more like self-hosting fonts by default and prioritizing privacy over performance (different strokes for different folks, and I realize it can be a significant performance hit).

To respond to your "more common the hosting site is" comment, Wordpress is also extremely common, and they probably could have devised alternative solutions by making different trade-offs.

Cache behavior resulting in fewer requests can be a double-edged sword, too: if you cache fonts with clients, you're probably also caching a bunch of other things that may decrease your privacy in other ways. There are many layers of indirection, especially with NSA/GCHQ/Verizon.

I wouldn't argue that this and another services offered by Google don't add value for developers and even users (they absolutely do), but my argument is mainly that there are costs--maybe distant/abstract/indirect costs in terms of privacy/autonomy that are difficult to discuss in concrete terms, but costs worth considering nonetheless.

I wish WordPress had been more thoughtful about the trade-offs they made.

This particular issue has come up in previous HN discussions, but I would draw people's attention to innocuous and quite reasonable-sounding phrases like "need-to-know basis." What does that really mean for a company like Google, whose core business model fundamentally depends on extensively data-mining user information? "Need-to-know" could mean almost anything, or whatever Google wants it to mean. This is a classic Google privacy strategy: controlling the debate by defining the terms.

Despite a reassuring policy, you, as the website visitor, don't get to decide these things and to the extent possible, the fact that this is even happening is abstracted away from most non-technical users.

Another example of Google's brilliance in 'controlling the debate by defining the terms': policies like this cleverly (but wrongly) lead the reader to assume that cookies are the only way Google tracks users or correlates their activities. What about TLS-based tracking mechanisms, for example?

But this is a problem that's bigger than Google. When information accumulates in distinct places, the value of exploiting that information always increases. Eavesdroppers naturally move to those places to exploit that information, sometimes with a legal backing (NSA/GCHQ) and sometimes without one (Aurora attacks, and other NSA/GCHQ activities).

Even if you interpret Google's pronouncements charitably, it would be a mistake to assume that using the Google Fonts API can't or won't harm user privacy. Google is a massive target for essentially all eavesdroppers, and the Aurora attacks (and other breaches with lower profiles) show that the accumulation of information--even under reasonable-sounding terms like Google's--can still end up in the wrong hands, and can be an inherently dangerous thing for user privacy.