Hacker News Reader

Comment by whoitwas | Hacker News Reader

Can someone who has an accurate source post when Wikileaks cryptographic canary expired? I'm unable to find a source and it's important to know they shouldn't be trusted.

Here's when their key expired in 2007: https://wikileaks.org/wiki/WikiLeaks_talk:PGP_Keys

From another below:

vikingerik

A canary goes something like "This website has not received or acted on any government orders to disclose or modify or remove material." When they ever do, then they remove that notice. The government enforcement usually includes a gag order prohibiting the target from saying that they're under orders, so the intent is that you can infer government gag pressure by the canary having been removed. Wikileaks used to have such a notice and no longer does, so we assume government enforcement is why.

View on HN

I remember when canaries were useful as a deterrent: even with an apathetic public on balance the tech community was pretty vigilant.

These days Snowden is screaming into the void even as concerns HN readers, never mind that he was completely right at great personal cost the first time.

I still trust Moxie, and Carmack/Palmer/etc. seem to be taking a stand, there are others, but it’s getting thin.

The main problem with canaries is that it's dead easy for a government to remove them from existence, simply issue subpoenas to every website that has one.

The users could then decide to jump ship but realistically they won't.

> The main problem with canaries is that it's dead easy for a government to remove them from existence, simply issue subpoenas to every website that has one.

Why can't social media platforms implement warrant canaries per user profile?

I don’t disagree, but I’ll observe that governments used to be much less friendly with tech incumbents, at least in public.

Ten years ago it was a scandal that big tech interacted with the surveillance state at all: Zuckerberg drove an initiative around cross-DC encryption at ruinous expense because of the mere accusation that the NSA might have a tap.

Today they’re giving us the finger with NSA board members. It’s flagrant, arrogant, and anti-hacker anything: you will do nothing, because you can do nothing.

Politicians have been largely able to convince that it's tech that it's evil, with their actions always being colored through a political lens, whether it's "helping pedophiles" or "spreading misinformation" or what have you.

The vassalization of these companies was imminent, and now, it is complete.

I don’t expect much from politicians, in my lifetime the political class has mostly seemed to be pretty nakedly self-serving.

I’m sad because so many of my personal heroes, the hackers I’ve admired, are just on board past any possible argument that it’s in the public welfare.

I learn in the same month that OpenAI is satisfying their voracious appetite for data with an NSA partnership as I do that the old-school FB infra braintrust is taking the money.

I’m embarrassed by all of this. I want to be remembered as part of something else.

This isn't binary. They are both evil. Neither group is your friend nor do they have your best interests at heart.

Today they're paying for the right to have social media companies do their bidding, according to the Twitter Files Drop a little while back.

The government doesn't even have to remove them from existence. A judge most likely wont care how you leaked information you where told to keep secret and will just throw the book at you wether you used a canary to do so or not.

Palmer?

You know, the billionaire class who give money to Trump and use their techno skills to invent new and super deadly weapon systems thereby increasing their dragon-like hoard.

True patriots.

Government employee Palmer???

Palmer... Lucky? A stand? As in starting a company to sell AI and Robots to the DoD? Huh?

I remember at the time that it expired, all of the moderators on their official subreddit also got replaced.

The insurance file also got changed out at some point as the hash changed.

The wikileaks subreddit was never official, and it was a train wreck. Two very dodgy Trump supporters "volunteered to help with the increased traffic" around the time of the Podesta releases and basically took over.

Didn’t those Podesta leaks turn out to be legitimate?

Absolutely, but that doesn't mean the "volunteering" moderators weren't super-sleazy.

> This website has not received or acted on any government orders to disclose or modify or remove material.

Never understood why gag orders don't just say "You can't say you received this order. Oh and by the way if we find you removed a canary, we'll just write that up as you having said you received this order".

Because the point of a canary is for it to be known beforehand. So the government surely knows about any canary too.

There must be some backwards definition of "speech" here which doesn't include all conveying of information (such as by removing previously published information), which makes it work, at least in the US (?)

The typical canary contains a signed timestamp. Generally, the US does differentiate between forbidding an action (“do not remove your canary”) and compelling an action (“update your canary with a new timestamp” or “disclose the pass phrase for the signing key”).

I’m no expert, and I’m sure there are nuances, but the broad strokes behind the design of these canaries are that it’s harder for the government to compel an action than to forbid one.

The whole point of a canary is that it's passive, and for exactly that reason. All you do is stop updating the date.

Reply on news.ycombinator.com