Hacker News Reader

Comment by mtw | Hacker News Reader

There's nothing to be proud of and writing a blog post about it.

Your users used the software to protect them, or even paid for it. Now this "Dave" can crack files generated by this shareware. Maybe "Dave" had a genuine national security situation. But was it really? What if Dave just wanted to prank the author, during a boring afternoon? What if it were a couple of guys parked outside who hijacked the phone system, so even if you call 411, it would route to their van outside? Or what if Dave already did the same demand to dozens of other security vendors, effectively having the source code of all encryption software? And even if it was a national security situation, what is the legal basis of giving up source code and keys?

What I get is "I was just a regular computer programmer and overnight, I was actually important enough to be useful for the NSA"

View on HN

The ethical implications are often not considered by software developers, thus you get cases like this where the author did not stop to push back, acting as a useful idiot for the NSA.

There are way too many people like that in tech, who don't stop to take in the bigger picture before performing the requested action.

I agree, the first thing he should have asked for is a warrant signed by a judge, and then independently verified it was real.

At the very least there are many circumstances where reporters who were reporting on pretty underhanded activities in the us were targeted by the us govt, and what if this situation happened to them. My govt is generally good here in the us, but we know plenty of cases where they didn't have good intentions, this is done to intimidate. So if you are an author of security software, you might keep this in mind. And other countries like Russia and China would definitely put pressure on people to help them.

Please. Save the moral judgement for events that happened after Edward Snowden. This happened 18 years ago. And judging his actions back then through the lens of what the NSA has done in recent history is very unfair.

Fast forward a year to 9/11, and the question would be, "What is the legal basis for not doing everything you can to help the NSA?"

For a 9/11 situation, I would ask that the case should be reviewed by a judge who'd mandate an injunction (or similar) to deliver source code. In a national security situation, I'm sure the judge will work quickly, and you will still get your NSA cup. Everyone's happy.

There are laws and a constitution, you can't just throw it out the window at the first phone call.

> ... should be reviewed by a judge who'd mandate an injunction (or similar) to deliver source code.

The NSA has been reverse engineering binaries for decades. Having the source saves them time and resources from doing that. Today, however, I would expect the NSA has their own binary decompiler.

> There are laws and a constitution, you can't just throw it out the window at the first phone call.

In pretty much most cases there are no laws preventing a private individual from fully cooperating with a government agency under your own free will. There may be professional consequences and civil damages, but it's not outright illegal. You would see this in cases of child porn, terrorist attacks, etc.

And frankly, most people would be so happy to see child pornographers locked up, that they wouldn't ask for a warrant from the investigating agency.

Let's be a bit more realistic, the title might as well have been "how I open-sourced my encryption software at the request of someone".

Yes, the author was way too quick to give up the source code, but it was just source code, not a backdoor key.

The code was not open-sourced. It was only given to one party, and presumably did not come with a license to redistribute the source code.

This means all users of the software are less safe. If the NSA can find a bug in the code, they can unlock everyone's files, but nobody else could ever uncover that bug.

Fair point.

I'm the author of the article. All common ciphers are available as open source already. I just packaged it into a product. Encryption done right does not suddenly become vulnerable if published to an open forum. I gave up nothing. I did not put any customers at risk, nor did I put my product at risk. People who think otherwise do not really know how encryption works. It works because the ciphers are public and tested by time. And for the record -- I would do it again if asked.

Thanks for your honesty.

However, I would probably respond along the lines, "I'd be happy to supply this, right after you show me a court order". Otherwise, no matter what, I cannot see how it would not be used for anything other than a nefarious purpose.

If it doesn't help them get into files used to encrypt the software, then why did they need it?

What the NSA was looking for was a mistake in implementing the encryption, or rather, for a significantly faster/easier way to find and exploit such a mistake, if one exists.

They specifically asked for the code for this purpose. If you made no mistakes, your action did not help them nor hurt your customers. But if you have made a mistake that you're not yet aware, you took a conscious step to make it easier for the NSA to exploit that.

While the availability of source code does not make a difference in theory, this falls apart once you realize that even though the NSA has lots of resources, those resources aren't infinite.

Totally agree with you, especially if they think time is the limiting factor

If it was for criminal purposes it would have been easier to bribe a janitor at their office to plug a USB drive into one of their machines for a couple minutes before tossing it.

I'm willing to bet Dave was a government employee, though I won't give up the possiblity he wasn't NSA and more likely some other government organization that needed to stop something yesterday but didn't have the clout to get the big 3 letter organizations to pay attention and help them out

Yeah, makes sense. And I planned it all out even down to timing the post to hit last night after midnight before all the pipe bomb news this morning on TV. Or, much closer to reality, maybe I just wanted to see if I could write a post that got some traction. Don't overthink it.

This is an incredibly condescending and insensitive post... Why would you attack the completely valid opinion from that person in this way?

Reply on news.ycombinator.com