Hacker News Reader

This: https://twitter.com/alfiedotwtf/status/1070047303275175936

Which is absolutely brilliant.

yes that's the thread, thanks

> modern software design processes essentially designed to stop bad stuff like this happening ... what happens when you get caught? you lose your job, get blacklisted in the industry, after all you can't tell them the govt made you do it (on your CV/resume trying to explain why you were fired)

I often wonder about this in regards to those "signed" orders in the USA, and it seems now Australia is similar.

And I wonder if we need more people going public in a very big way. i.e. Jim Smith has to put out a press release that says "I work for company X and the Government of Y country asked me to do xyz, and I refused."

Go very, very public with it, putting out press releases, etc. etc.

Obviously there are laws against that, and Jim Smith is risking a lot, but I can't imagine how things will get better until people on the front lines do stuff like this.

There's another, perhaps more insidious perspective, on this.

After the emergence of these type of laws there's going to be potential backdoors explained away with "sorry, can't tell, wink wink" and nobody will ever know for sure. What's an employer to do? Or even end users?

Every time you come across a double free bug or some complex concurrency issue that gives an attacker arbitrary write access to a process, remember that you might have been looking at a back door. Someone has an off-by-one error on an array access: is that a back door? Why do you think a backdoor is somehow noticeable in the code?

Here's what I would do: send it back to them and tell them to send it to my employer's legal department.

This might not be legal, and is one of the large problems that needs to be resolved. You individually are listed in this law as a "designated service provider", and thus you can't really pass the buck to your employer.

There is a valid question as to whether you are listed as a "designated service provider" if the only time you ever developed the relevant software under s317C(6) was as part of a job. But software developers that have done free software work outside of their job definitely would be counted.

As always, I would suggest you get legal council before doing anything in response to a notice -- even throwing it back in the face of the AG.

Good read: Reflections of trusting trust https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...

That said, this requires you to be clever and I don't think anybody can be forced to be clever with a court order, or at least what you describe offers plausible deniability

For large oss projects, accept PRs from those contributers, and outright tell the Australian government to go fuck themselves.

They have zero recourse.

I think they were trying to say "how do I know the Australians submitting PRs aren't secretly working for the govt?" Of course this raises (but does not beg) the question, "how do I ever know anybody submitting PRs isn't trying to sabatoge me?"

You just have to judge people by their fruits and hope they do the right thing or stop associating with Australians at all.

>or stop associating with Australians at all.

As an Australian, I hope people do this.

Internationally speaking, the tech community is not very good at drawing lines in the sand, we tend to want to please everyone.

I was really hoping that when it was shown how much the US was spying on traffic crossing it's borders, other countries would modify their routes to ensure their nations data didn't transit the US unless it was terminating there, but nope, didn't happen. Brazil talked about it but didn't do it.

Anyway, this is another rubicon moment. If we don't make this explode in the Australian governments face, then the US and UK will follow suit after the testing period is over. It's really important for the international software community to reject this utterly.

Start pulling out of Australia now and make it painful, or this will happen in countries it's impossible for you to pull out of.

> the US and UK will follow suit after the testing period is over

This is one case where the corporate capture of the US government works in our favor. Tech is an absolutely massive portion of the US economy (compared to Australia), and the tech companies will fight this tooth and nail. If the government couldn't do it in the 1990s (they tried) when tech companies were far less influential, they certainly won't be able to do it now.

Agreed. As an Australian, I'd also suggest that all IT staff, devs and PMs should now be treated as a plague ship for any company hiring us. At any time, our Gov can pull this new law out and coerce us into undermining your software.

This is not good for international relations at all.

The problem is that Aussie contributors of good character may find themselves forced by their government to sabotage a project they are working on - I think at the very least we have to check their work closely

> So how do I find out which software on Android Play is written in Oz?

If the above bothers you, then you should avoid any software written in the US too. The exact scenario you described can happen in the US, especially if you have a security clearance, but work in a regular tech job.

I expect they won't ask for anything crazy like that or violate the prohibition on asking for a "systemic weakness" - one of the reasons being that they want this law to be deployed as smoothly as possible to make a good case study for their 5-Eyes mates.

Why would the government ping you? Your boss can set a secondary build pipeline, that merges his brunch before producing a release build. Unless your company requires repeatable builds, you'll never notice this.