What is Digg?12 Comments
- dagnabit, on 10/12/2007, -0/+2BTW, if you need FreeBSD/Linux hosting, the same people who run rsync.net also run johncompanies.com... I hosted with them until I got my own server/cage, and they are rock solid.
- shedao, on 10/12/2007, -0/+1Being a rsync customer I'm glad to see that this issue is at least being addressed. In the warrant canary they state the inherent flaw of using it to determine if a warrant has been served (they could be coerced). So it's not an end-all but at least it's a start. I'm not sure about the secret warrants and their restrictions regarding notifying the public.
- beernutz, on 10/12/2007, -0/+1Kallahar, i think the idea is that in the ABSENCE of of the notice, you know something is wrong. Since they cant tell you they HAVE been served, they can at least NOT tell you that they have not been served. If that makes any sense.
- pvera, on 10/12/2007, -0/+1I am another former customer of JohnCompanies, very good place to host a freebdsd jail.
- kallahar, on 10/12/2007, -0/+0The warrant canary sounds interesting. However, does the law draw the distinction between telling an individual that there is a warrant vs telling everyone that "a" warrant has been used? The other drawback is that if there are 1000 sites on rsync and one gets served, all 1000 sites would want to assume they had been compromised.
- Schwa, on 10/12/2007, -0/+0Librarian Jessamyn West did something similar in her area: http://www.librarian.net/technicality.htm
- PopularEthics, on 10/12/2007, -0/+0Kallashar: "The other drawback is that if there are 1000 sites on rsync and one gets served, all 1000 sites would want to assume they had been compromised."
Good! A dragnet security policy that subjects citizens to indiscriminate surveillance deserves widespread suspicion. - dse3, on 10/12/2007, -0/+0The link for this story is to their general philosophy page, but you should follow the "warrant canary" link on that page for their very interesting (and gutsy) strategy for dealing with secret warrants, etc.
- rjdsd, on 10/12/2007, -0/+0Assuming a warrant is eventually served to rsync.net, then what? The idea (as rsync.net describes it) stops working for all those who aren't in trouble. If they don't put in place something more individualized like Schear's second model (see link provided by nonsecu), perhaps they could keep the messages coming, just add a decrementing count or something, e.g. "$Date -- To this date, $N rsync.net accounts have been created. rsync.net has never had a warrant served for ${$N-1} of them." ... Then ${$N-2}, etc. Does that work logically? (If not practically?)
- gemsling, on 10/12/2007, -0/+0It seems like a good move. Of course, to trust the canary, you have to actually verify the signed message, not just look at it. Perhaps rsync.net could add a tutorial on how to automate this. If the NSA (or similar) were interested in rsync.net, I wonder if they'd notice the canary. If so, I wonder if it might discourage them from continuing with a secret warrant.
Also of note is the way rsync.net encourages customers to use encryption. I'm not yet, as I haven't put anything sensitive there yet, but I read somewhere that a tutorial may be coming that will help people store backups within an encrypted file on rsync.net. - nonsecu, on 10/12/2007, -0/+0Your interpretation is correct. The question is, will "they" allow announcement-by-inaction to occur, or perhaps, will they even rewrite the law to make this impossible ? Only one library and (now) one ISP have ever implemented this, so it may be off the radar, but ... we'll see.
- nonsecu, on 10/12/2007, -0/+0This was originally proposed by a member of the cypherpunks mailing list here:
http://www.mail-archive.com/cypherpunks@minder.net/msg93050.html
The Digg Toolbar for Firefox lets you Digg, submit content, and keep track of Digg even when you're not on the Digg site. Download the official 
© Digg Inc. 2009
— Content created and posted by Digg users is