[HN Gopher] PyPI Was Subpoenaed
___________________________________________________________________
PyPI Was Subpoenaed
Author : quercusa
Score : 1087 points
Date : 2023-05-24 17:28 UTC (1 days ago)
(HTM) web link (blog.pypi.org)
(TXT) w3m dump (blog.pypi.org)
| kjkjadksj wrote:
| I don't understand how the information requested is relevant at
| all for any purpose. Most users of pypi merely download through
| pip; they arent registering anything. Furthermore, I would think
| a bad actor who would register would spoof their ip and use
| burner accounts anyhow.
| caturopath wrote:
| > Most users of pypi
|
| Presumably the 5 users in question were interesting in some
| way, not just random.
|
| > I would think a bad actor who would register would spoof
| their ip and use burner accounts anyhow
|
| Maybe, but they could find that out with the information. If
| there's a 10% chance each was sloppy or un-paranoid, there's a
| 40% chance they get at least one piece of real info.
|
| The person might not have thought they were doing anything
| wrong. Some judge might have greenlit this for a piracy case
| against the five maintainaers of youtube_dl{c} or something
| silly.
| buildbot wrote:
| Correlating IP address use to something else happening at the
| same time? Like a malware author being incredibly dumb and
| using their home IP to upload PyPy packages, while IDK, using
| that same IP as a C&C server endpoint.
| shadowgovt wrote:
| They may not even need to have slipped up and direct-
| connected via their home IP. The FBI has sufficiently
| compromised subsets of Tor in the past to do correlative
| attacks on specific targets.
| fijiaarone wrote:
| It's ok, this government is perfect.
| scrum-treats wrote:
| It would be great to see this for VS Code extensions as well.
| diligence_ wrote:
| [dead]
| seventytwo wrote:
| Any bets on this being part of a broader investigation into
| software supply-chain attacks?
| aa_is_op wrote:
| By the number of malicious packages that site has hosted over the
| past few months, this was only a matter of time.
|
| I've lost track of the number of "white hats" that contact us
| with extortion requests after they used some dependency confusion
| attack.
| Mystery-Machine wrote:
| Why is it an extortion request and "white hats" if they have
| successfully found a security issue in your project and
| reported it to you, without actually exploiting it? Would you
| rather them not report it to you or even worse, exploit it?
| JadeNB wrote:
| > Why is it an extortion request and "white hats" if they
| have successfully found a security issue in your project and
| reported it to you, without actually exploiting it?
|
| Presumably because there is some demand for compensation
| before disclosure?
| dahwolf wrote:
| Pay me or I will harm you is extortion, as simple as that.
|
| There's an entire industry now of people that check known
| vulnerabilities (so they don't invent anything themselves) in
| software/packages and cross check this against outdated
| websites, at a very large scale.
|
| They have no morals or security ethics, they barely even have
| knowledge, they just want to make money with the least amount
| of effort possible.
|
| Don't ever pay them a cent. They're just as ruthless as
| spammers.
| autoexec wrote:
| If several groups of people who "barely even have
| knowledge" can profit from checking for well known
| vulnerabilities on websites and reporting them I say more
| power to them.
|
| If there is an entire industry of people doing low effort
| work which then discovers vulnerabilities on a company's
| website that company should pay them, and probably fire
| some people they've already been paying for not putting in
| even that much effort to secure their own stuff.
|
| Who is less ethical? The people reporting vulnerabilities
| and wanting to be paid for it or the companies who don't
| bother to invest in even basic security practices putting
| people's data at risk and allowing scammers and hackers to
| leverage those insecure systems to hurt others?
| dahwolf wrote:
| The word "companies" is doing a lot of work in your rant.
|
| The vast majority of websites on the internet do not have
| a team behind them. That's exactly the reason why they
| lack maintenance.
|
| So they're not intimidating well-funded companies,
| they're intimidating that nice guy that in 2003 build a
| website for the local bridge club. Volunteering his time
| and money to do so.
| cjsawyer wrote:
| Sounds like they're the ones who implemented the bad code in
| the first place, as a honeypot. That just extortion with
| extra steps.
| passion__desire wrote:
| Why can't PyPI safeguard popular packages by making sure that
| new packages are few (4 or 5) edit-distance away to make sure
| popular ones don't get intermixed with malicious packages. Is
| that difficult to implement?
| rocqua wrote:
| pip-env, pipe, pipes, sip, siv, lipo, etc Are all within an
| edit distance of 4 from pip, and would all be blocked.
|
| Besides 'dependecy confusion' is not typo-squatting at all.
| It is about having a public package that masks the name of a
| private package repo. The default behavior of pip is to then
| use the public repo, which can let outsiders who know
| internal package names totally take over those internal
| packages.
| heavyset_go wrote:
| That's certainly a way to look a gift horse in the mouth.
| accrual wrote:
| Is it still "white hat" if money or a transaction is involved?
| My understanding is it's either black hat, the exploit is sold
| for money. Red team, you paid to be exploited for your own
| benefit. Or white hat, an exploit was found and it's
| communicated to limit black hat and red team. White hat + money
| would just be gray hat or blackmail.
| rocqua wrote:
| White hats can still get bug-bounties. Though if a company
| hasn't published such a bounty and a hat 'extorts' the bounty
| by demanding payment or else they will publish, that hat has
| a tint of grey.
| Aeolun wrote:
| That's not a tint of gray, that's just plain black.
| hajimuz wrote:
| Dude I thought it's Chinese Gov. Hey, America!!!
| rendx wrote:
| Way too much unnecessary data collected and stored as usual. But
| one of the best transparency reports ever. Thanks PyPI!
| tomjen3 wrote:
| >We will not be releasing the usernames involved publicly or to
| the users themselves.
|
| They point out that they are not subject to a gag order.
| buildbot wrote:
| Yeah this is interesting, because they could in absence of the
| gag order but choose not too. Unless it's not a gag order but a
| specific don't tell these users anything?
| stjohnswarts wrote:
| I doubt any investigators worth their salt would let the
| people they're investigating know that they are investigating
| them before they're ready to charge them.
| svaha1728 wrote:
| If it takes subpoenas to get package management fixed in Python
| so be it. Can the Rust Crates.io team take over Python management
| as well?
| kgbcia wrote:
| Probably someone made a YouTube or Tor package so the state is
| after them.
| krick wrote:
| I'd say nothing but nickname and the list of packages uploaded
| (which should be public in the first place) should've been stored
| anyway.
|
| It immediately reminded me, that PyPI content is really trash as
| it is because of all the squatting and pointless unfinished toy-
| projects, and whatever they are logging clearly doesn't help, but
| I think that big problem for PyPI is one seemingly minor detail:
| lack of namespaces (as in packagist.org of pkg.go.dev). It is not
| a solution for all sorts of malicious behaviour, of course, but
| it really makes things much easier. It doesn't solve
| typosquatting and such, but, honestly, neither does the current
| system, obviously. And at least it allows to keep the actual
| package names semantic. And which one of countless "*/time"
| libraries you wanna get you just kinda have to decide separately,
| using the number of starts on the github as a reference and
| carefully copy-pastying the id to your requirements.txt
|
| The same issue I have with Cargo. I mean, really, isn't it
| obvious that making users compete for better project names just
| makes everything shit?
| firstlink wrote:
| > associated with the subpoenas received in March and April 2023.
|
| Oddly specific wording there. It would seem they have received
| additional subpoenas outside that timeframe which do have gag
| orders, and someone slipped up and failed to put the gag orders
| in these particular subpoenas.
|
| Seems like the DOJ may be doing some long-term fishing for, what,
| software developers? First the DOJ came for the conservatives,
| and I said, "go get 'em!" because I wasn't a conservative; next
| the DOJ came for ____?
| burnished wrote:
| Step one: have position and power as part of a dominant group
|
| Step two: style yourself as an oppressed minority
|
| Step three: defend any action, decision, or position as a
| persecuted martyr
| bratbag wrote:
| It's interesting how you manage to leap from what is probably a
| supply chain attack investigation straight into a pErSeCuTeD
| CoNsErVaTeS conspiracy.
| metiscus wrote:
| Across the ages, government has applied a disproportionate
| level of scrutiny to groups and people perceived as dissidents,
| minorities, and anyone else who could potentially be conceived
| as a threat to institutional power regardless of the magnitude
| of the threat or if that threat is true or false. Historically
| this is a bipartisan issue, for decades the FBI vigorously
| attacked anti-war groups, black civil rights groups, and
| various left wing groups via COINTELPRO. I guess to summarize,
| the way I think of it is that the government is coming for
| anyone they see as a potential threat and it doesn't matter
| what the politics of that group are.
| wongarsu wrote:
| > We have waited for the string of subpoenas to subside, though
| we were committed from the beginning to write and publish this
| post as a matter of transparency, and as allowed by the lack of a
| non-disclosure order associated with the subpoenas received in
| March and April 2023.
|
| That's suspiciously specific. Sounds to me like they also
| received some other subpoenas they aren't allowed to talk about.
| VWWHFSfQ wrote:
| I think it just sounds like the three subpoenas they received
| wongarsu wrote:
| I'm not sure I'd call three subpoenas "a string of subpoenas"
| even if it's technically correct. But I'm more talking about
| specifically mentioning that the subpoenas from March and
| April 2023 don't have a gag order. Why mention those months
| specifically if in the other months they didn't receive any?
| The natural thing would have been to end the sentence six
| words earlier.
| dragonwriter wrote:
| > I'm not sure I'd call three subpoenas "a string of
| subpoenas" even if it's technically correct
|
| I would if the sequence was such that the receipt of
| eachbof thr subsequebt ones delayed writeup of the overall
| incident in the interest of completeness or because there
| was some relationship between them
|
| > the subpoenas from March and April 2023 don't have a gag
| order. Why mention those months specifically if in the
| other months they didn't receive any?
|
| Because you are doing an aggregate writeup of a series of
| events and you want to convey when they occurred and why
| you are able to do a detailed writeup.
| florbo wrote:
| It sounds more like they're addressing the inevitable "why
| didn't you post as soon as it happened" party.
| Eisenstein wrote:
| It is perfectly clear that you are correct because trying
| to tell anyone about confidential subpoenas could be
| illegal.
| hunter2_ wrote:
| When it requires so much "reading between the lines" that
| even this community doesn't have a strong consensus on
| whether this is being (illegally) communicated or not, I
| think it's plausibly deniable, but IANAL. Contrast with
| well-known canaries.
| kelipso wrote:
| Canaries that are well known would just become normal
| communication and thus illegal under a non-disclosure.
| It's just going to get worse lol.
| [deleted]
| aaroninsf wrote:
| https://www.aclu.org/other/national-security-letters
| jchook wrote:
| "The lack of a non-disclosure order"
| dkga wrote:
| Seems like the non-disclosure order did not say anything
| preventing them from disclosing said non-disclosure order
| itself
| underdeserver wrote:
| I don't think you can infer that.
|
| A non-disclosure order probably does exist for other
| subpoenas.
| dragonwriter wrote:
| > That's suspiciously specific. Sounds to me like they also
| received some other subpoenas they aren't allowed to talk
| about.
|
| It could be, it could also be that they were trying to
| communicate both the timing of the subpoena string and why they
| are able to talk about it, and there aren't any others.
| smeagull wrote:
| I always wondered why you couldn't get all your subpoenas
| passed through an intermediary who is instructed to post
| about them before reading them.
| OJFord wrote:
| It already says at the beginning when they were received (not
| mentioning potential others).
|
| It's definitely unnatural to say again 'as allowed by the
| ones received in those months we already mentioned'.
| samanator wrote:
| Yep, I was thinking the same thing. What a beautiful way of
| communicating that.
| tapoxi wrote:
| Sounds like they got a National Security Letter.
| bredren wrote:
| Does not need to be an NSL to have a non-disclosure
| attached. Could be a relatively minor (not very spooky)
| federal investigation.
| ajsnigrutin wrote:
| How does that work with in combination of freedom of
| speech? Is it one of those cases, where someone has to be
| brave/foolish enough to disobey and take it to the
| supreme court?
| mike_d wrote:
| > How does that work with in combination of freedom of
| speech?
|
| The government is not preventing you from expressing your
| free thoughts and opinions. They are compelling you to
| not disclose the details of something you had no
| knowledge of before they asked you about it.
|
| Nothing is stopping you from writing a blog post about
| how it is unfair to seek records of a potential criminal,
| but you cannot write about how it is unfair to seek the
| records of Bob Jones when you had no other reason to
| believe Bob was anything but a regular user.
| itronitron wrote:
| But you could post a unique blog post such as that about
| every one of your users.
| [deleted]
| [deleted]
| mywittyname wrote:
| A judge signed off on it. Which means that the State made
| a case for the subpoena to include a non-disclosure.
| smsm42 wrote:
| And the case likely was "we swear it is very important
| for national security, trust us!" and that was enough.
| Search request is almost never refused, e.g. FISA court
| approves over 99% of them. And if the court already
| deemed the proof strong enough to do the search, surely
| it's strong enough to put a non-disclosure on it if
| asked.
| autoexec wrote:
| I'm going to go ahead and guess "signed off on" was more
| like "rubber stamped"
| tracker1 wrote:
| Most likely... but the party who was served the order can
| file for appeal if they are willing to go that route.
| That said, it doesn't mean any such appeal with favor the
| party served the gag order.
| amethyst wrote:
| > I have not received a National Security Letter.
|
| source: https://durbin.ee/ as of Wed, May 24 at 1:45 PM PDT
| Loquebantur wrote:
| What a weird way to think about such events.
|
| Such subpoenas are clandestine surveillance of citizens by
| their state. The problem with such types of surveillance in
| particular is the lack of accountability.
|
| How does the ethical use of this prolematic tool get
| ascertained? Where and how is the democratic oversight
| implemented? How is misuse treated and prevented?
| whitemary wrote:
| > _Where and how is the democratic oversight implemented?_
|
| What democratic oversight? This is the United States we're
| talking about lol.
| blibble wrote:
| as a foreigner (in terms of the US), I've never understood
| how these gag orders are compatible with the First
| Amendment
|
| often there's posts on HN about how the UK and all other
| Western European countries are totalitarian because they
| don't have unrestricted free speech
|
| but then apparently the police (FBI) can restrict the free
| speech of Americans without any court involvement at all?
|
| I really don't understand
| xupybd wrote:
| I don't like these gag orders but I can see times when
| they are needed. Each person has a right to a fair trial.
| So the courts sometimes have to suppress information from
| the public to avoid potential jurors seeing information
| about the case. They must only judge guilt based on what
| they hear in court not in the media.
| brigandish wrote:
| So the whole of society must be kept in the dark? No,
| jurors should simply judge on the evidence presented in
| court, and those looking for unwarranted (sadly, not
| literally) secrecy should look for other ways to continue
| their insidious conspiracies against people.
| xupybd wrote:
| >jurors should simply judge on the evidence presented in
| court
|
| I don't know if humans are able to ignore evidence they
| have heard outside of court. We are not good at only
| including one set of information when making judgements.
| brigandish wrote:
| Right, but you're advocating keeping the whole of society
| in the dark versus relying on twelve people to be fair,
| which is what they're told to do. I would say that the
| latter is better than the former because of the immense
| harm keeping the whole of society in the dark. It's a
| numbers game.
| xupybd wrote:
| All of society benefits from the right to a fair trial.
| But, most of the time gag orders are abused and no one
| benefits.
| xyzzy123 wrote:
| Gag orders are rarely used for this purpose.
|
| The information that so-and-so parties provided some
| information (without disclosure of that information) in
| response to a lawful request will usually not predudice a
| trial.
|
| What gag orders are for is a) avoiding tipping off the
| subject of an active investigation b) avoiding general
| knowledge or disclosure of key sources of information and
| investigative methods used by law enforcement and c)
| concealing the general scale, nature and purpose of
| surveillance activities from the general public.
| xupybd wrote:
| > Gag orders are rarely used for this purpose.
|
| I agree, but the only time I think it's justified is when
| it's to protect the right to a fair trial.
| fijiaarone wrote:
| It's voluntary. The only way they can shut you up if you
| don't agree to is to kill you.
| yrnameer wrote:
| There are plenty of laws that aren't compatible with our
| constitution. Judges will laugh a lawyer out of the
| courtroom who uses constitutional arguments, and your
| case will go nowhere.
| callalex wrote:
| Our rights are written in a document. The government is
| made up of people. There can be a large disconnect
| between the two.
| absurddoctor wrote:
| Having been on the receiving end a bit, the gag orders
| don't come from the FBI directly. The FBI can ask you not
| to say anything, but you can ignore that without any
| legal repercussions. Any gag order that matters is issued
| by a judge.
| radarsat1 wrote:
| > but then apparently the police (FBI) can restrict the
| free speech of Americans without any court involvement at
| all?
|
| are you sure about this? As far as I understand "gag
| orders" can only come from a judge. Of course the FBI
| could request strongly that you not talk about something
| but I'm not sure it would hold legal weight.
| smsm42 wrote:
| Yes, they can. They also can perform illegal searches on
| Americans, and routinely do. To the tune of hundreds
| thousands times a year:
| https://www.reuters.com/world/us/fbi-misused-
| intelligence-da...
|
| There is absolutely no consequences to anybody for this.
| If you're going to ask how US citizens tolerate such
| blatant abuse, and why they don't do something about it -
| that's a very good question. Please get back to me if you
| find any answer to it.
| vintermann wrote:
| Yes, the thing people gloss over is that laws are only as
| good as the people ruling on them, and not only is the
| process of selecting supreme court judges in the US a
| farce, one of them is openly defending his own corruption
| now.
|
| In such cases, a well written, clear law on freedom of
| speech only increases the distance between what people
| think they have, and what they actually have.
| [deleted]
| modriano wrote:
| Well, the founding fathers intended for the First
| Amendment to apply only to acts of Congress, and maybe
| not even then (for example, just six years after
| ratifying the Bill of Rights, founding father and second
| President John Adams signed the Sedition act [0], which
| criminalized false and malicious statements against the
| government).
|
| It took over 125 years before Supreme Courts started
| reinterpreting the First Amendment to apply to some
| government actions that weren't acts of Congress, but
| there are still tons of situations where regular people
| can restrict free speech. For example, in Frederick v.
| Morse, while the Olympic torch was running through some
| town in Alaska, a public high school student unfurled a
| banner that read "bong hits 4 Jesus". Despite this not
| being on school grounds and the student not going to
| school that day, the school suspended him explicitly
| because of the speech on his banner, but the SC said
| that's fine.
|
| (Sidenote: I wouldn't look to the SC for coherent
| reasoning; the SC has been an absolute dumpster fire for
| all but the Warren court and parts of FDR's court. Hell,
| three current Justices (Roberts, Kavanaugh, and Coney-
| Barrett) worked on George W Bush's legal team in the
| democracy-negating Bush v. Gore case)
|
| [0]
| https://en.m.wikipedia.org/wiki/Alien_and_Sedition_Acts
| komon wrote:
| Well, due process is a right co-equal to free speech, so
| which rights override which others in which circumstances
| will come down to legal precedent.
|
| My understanding is that the FBI or other non-judicial
| body cannot unilaterally issue a gag order. Subpoenas and
| gag orders related to them are granted by judges.
|
| (Which isn't to say that the relationship between the
| judicial branch and law enforcement bodies is always pure
| and equal)
| patrick451 wrote:
| They aren't compatible with the first amendment. But at
| this point, those rights are a joke and and all three
| branches of our government regard the constitution as
| toilet paper.
| jakeinspace wrote:
| Gag orders do require a court, just not a jury or an open
| hearing. I agree that they should be unconstitutional.
| kfrzcode wrote:
| Free speech does not equate to unlimited absolution from
| consequence
| [deleted]
| make3 wrote:
| the fbi is overseen by elected officials, and by laws
| that were voted for it. it's not perfect but that still
| makes a huge difference.
| bboygravity wrote:
| That explains the whole Trump Russia ties investigation
| by the FBI I guess?
|
| Doesn't seem to healthy for any nation that is supposedly
| democratic?
| sibramalisi wrote:
| Are you still like first amendement don't you number
|
| @_sib_ra10
| Loquebantur wrote:
| Look at this thread.
|
| People engage in childish fantasies featuring themselves
| in imaginary subversive behavior.
|
| It's unresolvable cognitive dissonance leading to
| repressing and reinterpreting the cause.
| wolverine876 wrote:
| Civil rights, including those in the First Amendment, are
| not absolute. Regarding speech, you also can't harass
| people, threaten them, defraud them, incite violence,
| distribute copyrighted information that isn't yours,
| interfere with others' activities (sing loudly in a movie
| theater), etc. Private entities such as your employer can
| restrict your speech in many ways.
|
| > often there's posts on HN about how the UK and all
| other Western European countries are totalitarian because
| they don't have unrestricted free speech
|
| I haven't seen these posts. Do you have an example handy?
| blibble wrote:
| > I haven't seen these posts. Do you have an example
| handy?
|
| here's one from earlier in the week:
| https://news.ycombinator.com/item?id=36000459
|
| they're pretty common, here's another one:
| https://news.ycombinator.com/item?id=35617773
| wolverine876 wrote:
| In the GGP you wrote,
|
| > often there's posts on HN about how the UK and all
| other Western European countries are totalitarian because
| they don't have unrestricted free speech
|
| I don't see that in the comments you cite - nothing
| related to totaliterianism, unrestricted free speech, or
| comparison to the US. The comments just look like
| critiques of some laws related to speech, similar to
| critiques of US laws. Maybe I misunderstand.
| Freedom2 wrote:
| I don't have a source handy, I can find one later if you
| desire. During Melbourne's lockdowns there was consistent
| criticism from US based commenters about the lack of
| freedoms in Australia.
|
| edit:
|
| https://news.ycombinator.com/item?id=28651811
|
| https://news.ycombinator.com/item?id=28523358 (this
| entire comment section, probably:
| https://news.ycombinator.com/item?id=28522599)
|
| https://news.ycombinator.com/item?id=35105640
| heywhatupboys wrote:
| funnily enough, the USA has much less protective laws
| against self incrimination than e.g. Denmark. In Denmark,
| you, as charged, may lie on the stand however much you
| please.
| vintermann wrote:
| Only in your own defense or in defense of your closest
| loved ones, I believe. If it's like in Norway.
| heywhatupboys wrote:
| yea, against self incrimination, as mentioned
| brewdad wrote:
| In the US you just have to shut up. It also saves you
| from getting caught in a lie.
| paledot wrote:
| Or say "I don't recall". That's a popular one with
| politicians.
| goodpoint wrote:
| The astonishing amount of people incarcerated without a
| process tells a different story.
| robertlagrant wrote:
| How many are incarcerated without a process?
| yupyup54133 wrote:
| In California "at least 1,317 people have been waiting in
| county jails for more than 3 years. For 332 of them, it's
| been longer than 5 years."
|
| Source: https://calmatters.org/justice/2021/03/waiting-
| for-justice/
| prottog wrote:
| Both the California and US constitutions guarantee a
| right to a speedy trial, and California criminal code has
| specific provisions on how quickly trials must begin. Who
| is holding the California government responsible for
| this? What an outrage.
| wolverine876 wrote:
| I'm not the GP, but here are some ways:
|
| Something like 95% of criminal cases are resolved with
| plea deals and not trials, and legal representation from
| public defenders has very limited resources.
|
| Cash bail results in many people imprisoned without
| trial: After arrest, the court requires bail. Poor people
| can't afford it, so they are jailed until trial, which
| can be over a year. The impacts go beyond the (very
| serious) loss of freedom: They lose jobs, their family
| loses income, dependents (children, elderly) lose
| caregivers.
| Meph504 wrote:
| Firstly, though I see the concept behind cash bail I
| don't agree with it. But people has a misconception of
| the likely result of removing it.
|
| Judges now, don't need or required to use cash bails,
| they choose to, they can release people without cash bail
| now. either into the person's own recognizance, or even
| into the care of others.
|
| If a judge doesn't feel the person is likely to return to
| their following court date, and they can't leverage
| financial burden as a means to insure it, they are likely
| just to forego the process and hold them.
| KSteffensen wrote:
| Shutting up and refusing to answer a question makes it
| very clear that you have something to hide, much more
| than a lie.
|
| I'm not sure whether that's good or bad. I guess it
| depends on what you are accused of.
| mschuster91 wrote:
| > Private entities such as your employer can restrict
| your speech in many ways.
|
| Fun fact: Europe actually has _better_ protections for
| free speech for employees. Even if you 're a hardcore
| Nazi taking part in actual Nazi rallies, unless you're
| wearing company clothing or are a high-ranking corporate
| official, you can't get fired for that. And when you,
| say, contribute to an open source project in your non-
| work time on your own computer, your employer doesn't get
| any rights to that code.
| rfrey wrote:
| Five comments below this one, user all2 claims that
| Canada jails people for merely criticising anyone who is
| Islamic.
| aroberge wrote:
| This is simply not true.
| nostoc wrote:
| Just to clarify : What's not true is that Canada jails
| people for criticizing islam, not that it was claimed :
|
| https://news.ycombinator.com/item?id=36061407#36064645
| hnbad wrote:
| I think while this is a popular way to think about these
| things, it doesn't offer enough explanatory power for
| when things seemingly "go wrong":
|
| Rights afforded by a state are restrictions on a state's
| power over its subjects. But as the state holds ultimate
| authority, the only way these rights are upheld in
| practice is through a system of self-imposed indirection
| and bureaucracy that mostly exists to limit the power of
| any one individual operating the state, rather than the
| state as a whole.
|
| The First Amendment means whatever the state wants it to
| mean. The Supreme Court can make a case-specific ruling
| one way or another but it intentionally holds no direct
| power. A police officer can literally get away with
| killing you if they can construct a scenario that gives
| them sufficient justification to do so. The problem with
| intelligence agency is that by necessity they have less
| red tape holding them down and they're thus in practice
| far less limited in how much power they can wield.
|
| States are authoritarian and oppressive by default.
| They're only held back by self-imposed limitations. But
| those limitations only exist at the behest of the states
| themselves. Try and openly plan to dismantle a state
| (using violence or not) and most states will abandon any
| pretense of freedom of speech in a second.
| krageon wrote:
| Summarised as "rights [...] are not absolute", this is a
| really weird statement. I confess I don't understand what
| makes a "civil right" different from an actual "right",
| to you.
| j_french wrote:
| Here's a recent example. I've seen other examples too,
| it's not at all uncommon.
| https://news.ycombinator.com/item?id=35867043
| coldtea wrote:
| > _Civil rights, including those in the First Amendment,
| are not absolute. Regarding speech, you also can 't
| harass people, threaten them, defraud them, incite
| violence, distribute copyrighted information that isn't
| yours, interfere with others' activities (sing loudly in
| a movie theater), etc. Private entities such as your
| employer can restrict your speech in many ways._
|
| So the First Amendment is basically just the demo. And
| other western countries, oft criticized, just didn't have
| as nice a demo as that, but offer more or less the same
| features and gameplay.
| scott_w wrote:
| That's only true if you have a very surface level
| understand of law and how it attempts to solve real-world
| problems.
|
| It's nice to say "all speech should be free!" in theory
| but then, when faced with a situation where a mob boss
| says "please go kill that person" or ringleader whips up
| a mob into a riot. Should a judge just say "well, he was
| just exercising his First Amendment rights!" and ensure
| no consequences befall that person?
|
| A person enters my home and says things I find offensive.
| Should the First Amendment prevent me from removing that
| person from my home for that reason?
|
| I decide to leak trade secrets of my employer for profit.
| Should the First Amendment protect me from being fired
| and sued for this?
| ndsipa_pomu wrote:
| I thought that the First Amendment was about not allowing
| government to restrict speech and doesn't cover private
| issues such as between individuals or between an employer
| and an employee?
|
| With the mob boss example, wouldn't the charge be
| something like conspiracy to commit murder rather than
| prosecuting the instruction itself? i.e. saying the words
| is not in itself illegal, but the intention to conspire
| to get the person to commit crime on your behalf is the
| illegal part and the instruction is evidence.
| scott_w wrote:
| > I thought that the First Amendment was about not
| allowing government to restrict speech and doesn't cover
| private issues such as between individuals or between an
| employer and an employee?
|
| Absolutely, it is. However, I interpreted the comment I
| replied to as suggesting the First Amendment is not
| sufficient free speech protection.
| coldtea wrote:
| > _when faced with a situation where a mob boss says
| "please go kill that person" or ringleader whips up a mob
| into a riot. Should a judge just say "well, he was just
| exercising his First Amendment rights!" and ensure no
| consequences befall that person?_
|
| Isn't that covered by actual murder (or conspiracy to
| commit murder if it isn't seen through) charges,
| unrelated to free speech?
|
| > _A person enters my home and says things I find
| offensive. Should the First Amendment prevent me from
| removing that person from my home for that reason?_
|
| Isn't that covered by the right to invite (or throw out)
| whatever guest you want at your home? You have the same
| right even if they don't say things you find offensive,
| heck, even if they just tell you pleasant things...
|
| > _I decide to leak trade secrets of my employer for
| profit. Should the First Amendment protect me from being
| fired and sued for this?_
|
| Isn't that covered by copyright law (or similar)?
|
| The point wasn't "practical limits to free speech"
| regarding a "mob hit" request or some non-existant and
| never argued obligation to let people in your house if
| they speak lest you prevent them from expression (?), but
| how more abstract (or open to interpretation)
| restrictions can be used to effectively limit actual free
| speech.
|
| Not to mention "private entities such as your employer
| can restrict your speech in many ways", like a not so
| uncommon case of you saying something they don't like on
| your (unrelated to work) personal social media, in which
| they can just fire you. Or the social medium itself can
| censor you.
|
| Making the FA protections kind of moot, in a time when it
| isn't the government that has to do the censoring
| anymore, while the public just gathers on 3-4 tech
| behemoths platforms.
| scott_w wrote:
| > Isn't that covered by actual murder (or conspiracy to
| commit murder if it isn't seen through) charges,
| unrelated to free speech?
|
| > Isn't that covered by the right to invite (or throw
| out) whatever guest you want at your home?
|
| > Making the FA protections kind of moot, in a time when
| it isn't the government that has to do the censoring
| anymore, while the public just gathers on 3-4 tech
| behemoths platforms.
|
| I don't understand your points. You're both mixing
| concerns and splitting them, seemingly at random.
| coldtea wrote:
| > _I don 't understand your points._
|
| Here's the Cliff Notes version:
|
| The examples you brought up as arguments to why free
| speech can't be absolute (which I didn't argue for in the
| first place) are contrived and unrelated to free speech.
|
| They are also already covered by existing laws, such as
| laws against conspiracy to commit murder, about the right
| of exclusion, etc. If anything I'm separating concerns,
| mixed up for no good reason.
|
| As for my statement about FA, it's pointing how its
| protections are rendered moot, since they don't apply to
| private businesses and thus don't protect speech (the
| kind that matters, not mob hits) in places where the
| public discourse really happens nowadays. So, it's not
| "sufficient free speech protection" anymore.
|
| I added it to further the discussion, what with FA being
| the very topic of this subthread, and not some randomly
| "mixed concern"...
| scott_w wrote:
| > They are also already covered by existing laws
|
| The First Amendment supersedes law by determining whether
| it can be law at all, so whether it's covered by "law" is
| actually only half the story.
|
| > The examples you brought up as arguments to why free
| speech can't be absolute
|
| I started with deliberately stupid examples to make my
| point: Free Speech was always clearly limited, by
| necessity.
|
| > it's pointing how its protections are rendered moot
|
| That in itself is debatable. What evidence do you bring
| that this is somehow worse than it used to be? It used to
| be the case that, to get _any_ significant speech, you
| had to get your work published. Now you can just shoot it
| off on Twitter, Reddit, HN, take your pick.
| coldtea wrote:
| > _I started with deliberately stupid examples to make my
| point: Free Speech was always clearly limited, by
| necessity._
|
| Which is neither here, nor there. Conspiracy to commit
| murder, as per the "mob boss gives an order example"
| would always be illegal regarless of our "free speech"
| stance, and the First Amendment didn't come into play
| determining whether that "[could] be law at all".
|
| It was rather the other way around: the First Amendment
| was drafted with the certainty that such a thing isn't
| about free speech and will always be illegal.
| scott_w wrote:
| > It was rather the other way around: the First Amendment
| was drafted with the certainty that such a thing isn't
| about free speech and will always be illegal.
|
| This isn't really backing up your point that the First
| Amendment isn't sufficiently protecting free speech.
| oreilles wrote:
| Not so much, there is plenty of other type of speech that
| is protected by the first amendment and is illegal in
| countries that don't have such thing in their
| constitution. For exemple, in France, saying "Macron is
| trash" can get you to jail
| (https://rmc.bfmtv.com/actualites/police-
| justice/insultes-con...,
| https://www.lepoint.fr/societe/une-quinquagenaire-jugee-
| pour...)
| sofixa wrote:
| _Technically_ not jail, there 's only a fine allowed for
| the crime of "outrage a personne depositaire de
| l'autorite publique" (insulting a public authority
| figure) and "injure au president de la Republique"
| (insulting the president of the republic).
|
| Not great, but not terrible (jail).
| echelon wrote:
| > interfere with others' activities (sing loudly in a
| movie theater)
|
| This is more about private property rights, is it not?
| You can sing loudly in a park until local ordinances
| (noise, curfew) kick in.
|
| The "movie theater" example I'm familiar with is that you
| can't scream "fire" in a crowded place.
| [deleted]
| gremlinsinc wrote:
| you absolutely can sing loudly in a theater, but you
| don't have a right to demand you can keep on doing it.
| It's a private location, so they have every right to
| throw you out and ban you. similarly to how you don't
| have a right to say whatever you want without being
| moderated on Twitter or Reddit.
|
| the fire one is basically anything that incites panic can
| get you into legal hot water, and if there are injuries
| or death as a result some form of manslaughter charges
| probably because ultimately you were responsible.
| wolverine876 wrote:
| > you absolutely can sing loudly in a theater, but you
| don't have a right to demand you can keep on doing it.
|
| good point
| cryptonector wrote:
| > Civil rights, including those in the First Amendment,
| are not absolute. Regarding speech, you also can't harass
| people, threaten them, defraud them, incite violence,
| distribute copyrighted information that isn't yours,
| interfere with others' activities (sing loudly in a movie
| theater), etc. Private entities such as your employer can
| restrict your speech in many ways.
|
| That's all true and should be true, but it's also
| possible to take these limitations too fare, and we have.
| thebigwinning wrote:
| It appears absolute to me if you sharpen the definition.
|
| Free speech means you can express and advocate for any
| view point, not that you can make any sounds with your
| mouth in any context.
| wolverine876 wrote:
| You cannot express or advocate viewpoints that "harass
| people (beyond a some limits), threaten them, defraud
| them, incite violence, distribute copyrighted information
| that isn't yours, interfere with others' activities (sing
| loudly in a movie theater), etc."
|
| For example, someone could not express the viewpoint that
| 'thebigwinning sexually assaulted coworkers and stole
| money at their last job'. It would slander you (an
| exception to free speech that I omitted in the GP) and
| you would be entitled to damages.
|
| Nor could someone express to an angry crowd the viewpoint
| that 'the bigwinning should be assaulted', nor could
| someone selling cryptocurrency express the viewpoint that
| 'cryptocurrency is a safe, stable investment for
| unsophisticated investors', etc.
| thebigwinning wrote:
| That's exactly what I'm not saying. These contrived
| examples only strengthen my view.
|
| > sing loadly in a movie theatre.
|
| Perfect example. Inappropriately making sounds with your
| mouth, not holding an illegal belief.
|
| > express to an angry crowd the viewpoint
|
| The issue is the context of the angry crowd, not the
| content of beliefs. Do you believe the US will penalize
| me for believing crypto currency is safe and stating that
| publically?
|
| > thebigwinning sexually assaulted coworkers and stole
| money at their last job'
|
| They are indeed allowed to believe that. They can't be
| taken to jail for holding that view of me. Now if they
| tried to get me fired with false evidence that would be a
| problem. If they caused damage to my business reputation
| without evidence that could result in civil damages.
| wolverine876 wrote:
| The examples are not contrived, they are commonplace
| legal issues (though any such issue is rare in any one
| person's life).
|
| We are talking about speech, not thought - expression,
| not belief. You said "you can express and advocate for
| any view point", not that 'you can believe any
| viewpoint'.
|
| Yes, all speech depends on context. The significance of
| speech is its impact on other people; it is
| communication. You can say whatever you want in the
| shower.
| weinzierl wrote:
| Then following up on blibble's question: What _is_ the
| difference to the UK and other western countries that
| mostly also have free speech with what looks to me very
| similar restrictions?
|
| Honest question, like blibble, I don't really understand
| it either?
| tomrod wrote:
| A ready example: though it is clearly not appropriate to
| do so, in the US you can express Nazi-isms that are
| verboten or illegal in parts of Europe.
| damiankennedy wrote:
| In New Zealand where we don't have a specific
| constitution or amendments we have a set a laws ^1 that
| end up in the same place. An example is libel, which both
| countries have laws against. In NZ such laws are debated
| in parliament and voted on just as in the US. However in
| the US there was an additional objection based on it
| violating the first amendment but then the law was made
| anyway so it seems politicians in the US can make laws
| that override amendments in specific situations. The US
| also has their Supreme Court which seems to play a far
| more active role than NZ's and also more powerful in that
| it can creates precedents in the interpretation of laws
| for example allowing students to wear items of symbolic
| protest in school.
|
| ^1 In 1990 we got a law called the Bill of Rights Act
| which included freedom of expression.
|
| Edit: added ^1
| all2 wrote:
| The US's first amendment is rather unique amongst Western
| nations. Basically it says "the government cannot
| infringe on this inalienable right", that is the
| government cannot govern speech. Here's the actual
| language Congress shall make no law
| respecting an establishment of religion, or prohibiting
| the free exercise thereof; or abridging the freedom of
| speech, or of the press; or the right of the people
| peaceably to assemble, and to petition the Government for
| a redress of grievances.
|
| The key phrase "or abridging the freedom of speech, or of
| the press".
|
| As far as I know, this kind of language is absent from
| other Western nations. For example, Canada jails people
| for criticizing those of Islamic persuasion. [0] Note,
| the article doesn't record what the accused actually
| said. Here's a wikipedia overview of hate speech laws by
| country [1], though it is wikipedia, so take it with a
| grain of salt. Here's a somewhat relevant piece from
| _Reason_ that takes an anti-hate-speech stance [2] where
| the author details the unconstitutionality of hate speech
| laws.
|
| "Free speech" as we understand it in the US is unique in
| the world.
|
| As far as the restrictions at state and federal level,
| these are considered unconstitutional, and you'll see a
| large number of them struck down in various courts across
| the country. Those in power definitely seek to expand
| their powers and fortunately we have a law that allows
| the citizenry to push back against that.
|
| [0] https://www.cbc.ca/news/canada/hamilton/muslim-
| hate-1.614516...
|
| [1]
| https://en.wikipedia.org/wiki/Hate_speech_laws_by_country
|
| [2] https://reason.com/2021/05/20/teen-arrested-under-
| connecticu...
| 0x706B wrote:
| Hm, not quite sure I can follow the _unique_ part.
|
| E.g. german constitution is quite similar:
|
| ``` Article 5 [Freedom of expression, arts and sciences]
|
| (1) Every person shall have the right freely to express
| and disseminate his opinions in speech, writing and
| pictures and to inform himself without hindrance from
| generally accessible sources. Freedom of the press and
| freedom of reporting by means of broadcasts and films
| shall be guaranteed. There shall be no censorship.
|
| (2) These rights shall find their limits in the
| provisions of general laws, in provisions for the
| protection of young persons and in the right to personal
| honour.
|
| (3) Arts and sciences, research and teaching shall be
| free. The freedom of teaching shall not release any
| person from allegiance to the constitution. ```
|
| (2) notes that there _are_ limits, but if I understood
| the concept of gag orders and also wolverine876's answer
| correct, thats the same for the US:
|
| ``` Civil rights, including those in the First Amendment,
| are not absolute. Regarding speech, you also can't harass
| people, threaten them, defraud them, incite violence, ```
| Brybry wrote:
| I was under the impression that Germany bans Nazi symbols
| (with some exceptions for education/art). [1]
|
| In comparison, Nazi symbols are protected hate speech in
| the US. [2]
|
| The US _has_ tried to ban political parties in the past
| but eventually courts find that sort of thing
| unconstitutional. [3]
|
| [1]
| https://en.wikipedia.org/wiki/Strafgesetzbuch_section_86a
|
| [2] https://en.wikipedia.org/wiki/Bans_on_Nazi_symbols#Un
| ited_St...
|
| [3] https://en.wikipedia.org/wiki/Communist_Control_Act_o
| f_1954
| weinzierl wrote:
| In Germany Nazi symbols are strictly banned but you are
| allowed to name soldiers killers. My hunch is that
| calling a veteran or active member of the armed forces of
| the US a killer would not go so well and might very well
| end in a slander suit.
|
| When you free speech is restricted still seems pretty
| arbitrary to me [shrug].
| microtherion wrote:
| You could get sued, but you would almost certainly win,
| as evidenced by the Westboro Baptist Church who won a
| Supreme Court case after being sued for witnessing their
| Christian faith with messages like "Thank God for Dead
| Soldiers" and "You Are Going to Hell" at a soldier's
| funeral:
|
| https://en.wikipedia.org/wiki/Snyder_v._Phelps
| monocasa wrote:
| You can call US service members killers all you want. In
| fact "baby killer" is a relatively common refrain during
| protests aimed at the military. Maybe in the UK with
| their asinine slander laws you'd have to be more quiet
| but that's pretty clearly first amendment protected
| territory in the US.
| janalsncm wrote:
| SLAPP suits are a thing in the US. You might not go to
| prison for your speech but that doesn't mean you can do
| it.
| monocasa wrote:
| SLAPP suits come from massive sources of capital which
| have enough counsel either on retainer or simply have
| enough money that they don't miss ~$50k on a whim to get
| back at someone who they think besmirched them that one
| time. That doesn't really apply to US service members.
| skissane wrote:
| > The US's first amendment is rather unique amongst
| Western nations.
|
| > As far as I know, this kind of language is absent from
| other Western nations. For example, Canada jails people
| for criticizing those of Islamic persuasion.
|
| The US is not unique in having constitutional protections
| of free speech. For example part of the Canadian
| constitution is the "Canadian Charter of Rights and
| Freedoms", which forms part of the Constitution Act 1982.
| Section 2 of which says "Everyone has the following
| fundamental freedoms: (a) freedom of conscience and
| religion; (b) freedom of thought, belief, opinion and
| expression, including freedom of the press and other
| media of communication;" - that's essentially saying the
| same thing as the US First Amendment.
|
| In Europe, article 9 of the European Convention on Human
| Rights (ECHR) protects "Freedom of thought, conscience
| and religion". The Convention is quasi-constitutional in
| nature - while it is an international treaty whose
| members are _in theory_ free to leave at any time, _in
| practice_ quitting it is impossible for many European
| countries-membership in the ECHR is a requirement for EU
| membership, so no EU country is going to get away with
| denouncing it. And many national constitutions have
| equivalent provisions, such as articles 4 and 5 of the
| Basic Law of Germany.
|
| One difference - the text of the US constitution doesn't
| contain any exceptions to the 1st Amendment, whereas the
| Canadian constitution, the ECHR, Germany's Basic Law,
| etc, explicitly state that freedom of speech/etc can be
| subject to limitations. However, in practice, even though
| the US constitution never explicitly says that the 1st
| Amendment has exceptions, the Supreme Court has always
| held that it does, although the scope of these exceptions
| has varied due to the evolving opinions of the Supreme
| Court - for the first century of the US's existence,
| SCOTUS allowed sweeping exceptions to the 1st Amendment;
| in the 20th century, it narrowed the allowed exceptions
| significantly, and developed some highly complex case law
| on which exceptions are allowed.
|
| The real difference is actually nothing to do with the
| text itself, it is all about case law - since the 20th
| century, SCOTUS has been very strict in only allowing
| quite limited exceptions to the 1st Amendment. Courts in
| Canada, Europe, etc, have always been much more liberal
| in allowing exceptions to the right of free speech. Now,
| possibly the difference between a text which provides no
| explicit exceptions versus a text which does may have
| influenced that, but I don't think it was decisive. It
| was not historically inevitable that SCOTUS would start
| interpreting the 1st Amendment much more strictly in the
| 20th century, if different justices had been appointed,
| it easily could have decided to stick with its 19th
| century case law which allowed greater exceptions to it.
| Conversely, even though Canadian/European/etc texts
| explicitly mention exceptions, their courts could have
| chosen to interpret those explicit exceptions far more
| narrowly, producing a result much closer to that of the
| US, if they had wished to do so.
| x1ph0z wrote:
| This is what the article says for [0]
|
| "Police say the man targeted people on social media and
| promoted hatred against them after an attack in London,
| Ont., in June, where four members of a family were
| killed."
|
| Does that sound like criticism to you? It reads like
| harassment to me.
| all2 wrote:
| I don't know what the man said, only what the authorities
| reported. This is part of the danger of "hate speech"
| laws; if speech is deemed dangerous, discourse can be
| hidden behind public safety concerns and then wholly
| dismissed. It is then left to those who police speech to
| determine what is acceptable public discourse and what is
| not.
| andrepd wrote:
| Wow, American exceptionalism claims have now gone so
| farad to claim that freedom of speech is unique to
| America!
|
| Not even the historical claim holds, as constitutional
| protections for free speech in France and Sweden predate
| the American constitution.
|
| > For example, Canada jails people for criticizing those
| of Islamic persuasion
|
| He was arrested, presented to court, and acquited.
| Therefore he was not "jailed". Also: the charge was
| inciting/organising a hate crime, in the wake of a
| killing of a Muslim father and his 15-year old daughter,
| not "criticising those of Islamic persuasion".
|
| Don't be a liar, it doesn't help your argument.
| all2 wrote:
| > Also: the charge was inciting/organising a hate crime
|
| True, but we don't know what the man actually said. So
| whether the charge was true or not remains solely decided
| by those policing speech.
|
| > He was arrested, presented to court, and acquited.
|
| Thank you for pointing this out. I should have been more
| careful in my reading of the source material.
| sebosp wrote:
| Could it be possible to illustrate with an example just
| for clarity? How does this compare to, say, the
| Netherlands? For example what are things that are
| possible in the United States that are not possible in
| the Netherlands? I would assume there are things that are
| not legal but not penalised in the latter but under
| certain conditions would be addressed and penalised and
| there's no way around it, but would like to know of an
| example just to make it super clear for me. Thanks!
| alwayslikethis wrote:
| In the US it is legal to advocate hate, such as denying
| Holocaust or promoting National Socialism or white
| supremacy. The courts have repeatedly struck down bans on
| hate speech. Not sure about the Netherlands, but this is
| illegal in many European countries.
| fijiaarone wrote:
| Why is denying or promoting something considered hate?
| Where is the list of things we are allowed to deny or
| approve of?
| warkdarrior wrote:
| Because denying a group of people (say, based on
| ethnicity or skin color) the right to exist is equivalent
| to hating them.
| concordDance wrote:
| Take a person who believes that "there needs to be a
| country for white people and white people are innately
| better able to form productive societies". This person
| would clearly be a white nationalist and a white
| supremacist, right?
|
| But they may also have no hate towards other ethnicities
| or desire their deaths. If pressed, they might even say
| that their vision of a "pure" society isn't worth the
| deaths of minorities that would come about if they tried
| to implement it.
|
| I think too often we confuse the stereotypical example
| with the definition. The stereotypical white supremacist
| hates minorities, but the definition itself doesn't
| require it (I know of no surveys that would tell us what
| proportion of white supremacists match the stereotype).
| temptemptemp111 wrote:
| [dead]
| drekk wrote:
| You can't be a white supremacist without thinking other
| races are inferior. That's hateful by definition. They
| are stereotyping an entire race in a negative manner.
| They are denying the _basic humanity_ of billions for
| what end? The Third Reich didn 't immediately start
| throwing Jewish people into death chambers. They had to
| build up to that moment by _dehumanizing their victims_.
| concordDance wrote:
| > That's hateful by definition.
|
| My whole point is that you (and many others) are using a
| new definition of "hate" which doesn't match the old one.
| "Hate" used to be an emotion, a feeling, a dislike of
| something and a wish to see it destroyed.
|
| One can feel superior to something without having any
| dislike of it or a wish to see it destroyed. I consider
| myself superior in many respects to the rocks in my back
| garden, but I neither dislike them nor wish them
| destroyed.
|
| A supremacist may consider themselves smarter or prettier
| or taller than some other group, but that does not
| necessarily mean they want to destroy the other group.
| skripp wrote:
| I kind of get your point (i think?) but maybe you
| shouldn't try to belittle the use of the word
| "supremacists" in the context of modern language. Try
| looking up a definition if you are unsure. Maybe you
| disagree on the definition but that is probably the
| mainstream one...
| nunobrito wrote:
| That is simple.
|
| Any left-wing should be allowed, any right-wing stuff
| should be denied.
|
| Few exceptions exist on the western side, Spain is
| probably the most remarkable case. Reason why you
| wouldn't often hear much about what happens there, unless
| it is something negative to bash the right-wing people
| there.
| germandiago wrote:
| Idk the US specifics but hate speech in Spain is
| something govt has used to prosecute others in the name
| of so many things and in so many situations that to me,
| it means nothing. Just having a negative opinion is "hate
| speech" if the right person gets annoyed and goes for
| you.
|
| It is a very powerful tool to shut up adversaries and it
| is extremely harmful for real opinions and real free
| speech.
| all2 wrote:
| If you're itching to speak freely, we'd love to have you
| in the US. :D
| krustymeathead wrote:
| Radiolab has a great episode about how this more broad
| application of the first amendment sort of came about due
| to Oliver Wendell Holmes changing his mind about what
| actually constitutes a "clear and present danger" between
| two Supreme Court cases in 1919.
|
| https://radiolab.org/podcast/what-holmes
| concordDance wrote:
| Note that including denying the Holocaust under
| "advocating hate" is basically making up a new concept
| and using an existing word (hate) for that concept.
|
| It comes across as very dishonest.
|
| There are people who genuinely think the Holocaust was
| exaggerated or didn't happen at any substantial scale who
| bear no ill will to Jews, seeing it simply as a question
| of historical fact of limited relevance to the modern
| day.
| drekk wrote:
| Denying that a targeted genocide happened or saying it's
| exaggerated is absolutely hateful. I'm not sure how it's
| of limited relevance when it's within living memory. When
| (some) Americans start to chant "The Jews will not
| replace us!" I think it's very relevant to our modern
| era.
|
| I would really recommend doing a cursory, bare-minimum
| reading of the associated Wikipedia page [0] and
| citations. Plenty of historians revise the events
| surrounding the Holocaust to provide less biased and more
| nuanced information. Very different from taking an
| assumption as fact (the holocaust did not happen) and
| working backwards from that.
|
| [0] https://en.wikipedia.org/wiki/Holocaust_denial
| robertlagrant wrote:
| I think, as ever with these things, the name is
| misleading. It's not "hate". We've no idea what people
| are feeling. Why do we a) think someone feeling "hate" is
| enough to suspend speech, and b) think if we want to
| justify censorship, we can't just say it out loud?
|
| Why not just say "we ban speech that says the Holocaust
| didn't happen"? Why get it classified as hate and then
| because somehow hate is censorable get it autocensored?
| It seems somehow disingenuous.
| concordDance wrote:
| You're missing my point.
|
| What does the word "hateful" mean? The old meaning is
| "full of the emotion of hate". Someone who thinks the
| Holocaust wasn't real could in theory have no strong
| feelings about it and think it has no relevance to their
| lives.
|
| It is not required by definition that Holocaust denial is
| hateful (using traditional definition of the word
| "hate"). Nor is it required by human psychology (for
| example, you could have someone who read an unfortunate
| sampling of books as a child and took "disbelieve
| anything the victors of a war say about their enemies" as
| gospel and never got educated on the details).
| all2 wrote:
| It's a useful label to categorize and marginalize speech.
| This is a common tactic used in propaganda.
| Scarblac wrote:
| A politician in the Netherlands got a crowd chanting "Do
| you want more or fewer Moroccans?" "Fewer! Fewer! Fewer!"
| [0].
|
| A court found him guilty for "groepsbelediging",
| insulting a part of society, which is a crime. He did not
| get a punishment.
|
| That's the only example that comes to my mind of
| something that the courts found not allowed in the
| Netherlands.
|
| [0]: https://www.youtube.com/watch?v=BaB75uznT8o
| [deleted]
| amatecha wrote:
| Rather than posting a poorly-worded, short-on-facts news
| story about the guy in Hamilton saying some hate speech,
| you could cite the actual Canadian Criminal Code which is
| far more specific and worthy of discussion:
| https://www.criminal-code.ca/criminal-code-of-canada-
| section...
|
| This is what the guy was charged with violating (as per
| https://hamiltonpolice.on.ca/news/hamilton-police-charge-
| mal... )
|
| Framing it as "Canada jails people for criticizing those
| of Islamic persuasion" is disingenuous, as if Canada
| specifically has laws about some specific religion or
| faith.
| account42 wrote:
| Without knowing what was actually said that the courts
| deemed to be promoting hatred, "Canada jails people for
| criticizing those of Islamic persuasion" is a valid
| interpretation. Citing vague laws doesn't make this any
| more reasonable.
| amatecha wrote:
| IMO the worthwhile fact to share on an HN thread is "in
| Canada there are specific laws against inciting hatred
| through speech etc." and linking that criminal code
| entry, rather than mentioning and linking a specific news
| case that we have no real details on. At least the
| criminal code is a clearly-defined thing we can learn
| from and internalize, rather than a specific case where
| the public was not given enough information to make an
| informed judgement about (as per most news stories, IMO).
| contrarian1234 wrote:
| It seems kinda arbitrary
|
| Earlier it was listed "..you also can't harass people,
| threaten them, defraud them, incite violence, distribute
| copyrighted information.."
|
| So where are these exceptions innumerated? Just purely
| from a technical point of view, why can defrauding be
| made illegal, but hate speech can not?
|
| It actually seems the number of exceptions is quite
| limited - so I never understood why they were not spelled
| out explicitly (like in an subsequent constitutional
| amendment for instance). It seems to undermine the
| authority of the bill of rights. The original text makes
| no provision for exceptions...
| sclarisse wrote:
| It's not strictly about the words in those exceptions.
|
| In the case of fraud, it's not the speech itself, it's
| the part where someone gives you money (or other
| consideration) under some agreement or understanding, and
| doesn't actually get what was promised. There's nothing
| intrinsically wrong with what you promised, it's your
| failure to deliver.
|
| Threatening people? The illegal part is not that you used
| words at them specifically, it's that you caused them to
| credibly fear for their life and safety. You could just
| as well do that without words, just standing outside
| their place with a baseball bat making menacing gestures.
| Harassment similarly may use words, but the objectionable
| part is often subjecting them to your words or actions or
| presence directly, to cause distress, instead of leaving
| them alone in peace.
|
| "Hate speech" as a problem generally is about the content
| of the speech itself. You might wish to convince people
| that others in a group are bad and worthy of being
| considered bad. Your audience is typically people like
| yourself, or third parties who you wish to sway, and if
| you are in a public place you are mostly not following
| around an individual to be hated, or telling them you are
| about to do them violence. (If you do, it may in fact be
| harassment or intimidation.)
| danaris wrote:
| Given that some things that don't use words--for
| instance, art, money--have been ruled as being considered
| equivalent to speech for the purposes of First Amendment
| protections, I don't think the rationale you give there
| is likely to be the one used to justify the listed
| exceptions to the First Amendment.
|
| In all the cases listed, the speech in question is being
| used to directly and (at least usually) intentionally
| harm or interfere with another person. I believe this is
| a case where looking to the Framers' intent rather than
| the strict wording of the amendment is worthwhile in
| determining how best to apply it. It seems obvious that
| they did not intend to make all forms of fraud and
| threats legal with no recourse (and I imagine there is
| some jurisprudence that cites specifics to this effect).
| all2 wrote:
| The specifics have been determined in case law. I'm not a
| lawyer, so I can't give a more detailed example. I can,
| however, give some examples (Mass Media Law at Utah State
| comes bubbling back into my mind, what a fun class).
|
| Yelling "fire" in a crowded theater, for example [0].
| Another comment in this thread talks about the "clear and
| present danger" doctrine that came from the case. That
| case was followed by the _Brandenburg v. Ohio_ [2] case
| in 1969, which instituted the current methodology used
| for determining what is "allowed" speech. That
| rule/methodology is called the "imminent lawless action"
| rule.
|
| [0] https://supreme.justia.com/cases/federal/us/249/47/
|
| [1] https://en.wikipedia.org/wiki/Shouting_fire_in_a_crow
| ded_the...
|
| [2] https://supreme.justia.com/cases/federal/us/395/444/
| fijiaarone wrote:
| Case law doesn't exist in the United States of America.
| You might be thinking about medieval England, or ancient
| Persia, where a king or judge's word becomes law. In the
| USA, people are judged individually and are equal before
| the law. One exception, that is traditional, but not
| enumerated in law, is that the Supreme Court can strike
| down a law that it deems unconstitutional, but may not
| amend or make new laws itself. Lower courts havee Ed no
| such power.
| afthonos wrote:
| That's completely wrong.
|
| First, every court of appeal can strike down a law as
| unconstitutional. The Supreme Court is only special in
| that there is _no further_ appeal.
|
| Second, case law absolutely determines the interpretation
| of each text, and each court is mildly bound by its own
| precendent (via _stare decisis_ ), and completely bound
| by the precedent of superior courts.
|
| Third, there is no tension between these facts and people
| being judged individually and being equal before the law.
| The law must (in principle) be applied equally to
| everyone.
| dragonwriter wrote:
| > First, every court of appeal can strike down a law as
| unconstitutional.
|
| Any federal court, not just the courts of appeal.
| afthonos wrote:
| Mostly right, but [0] is out-of-date, was overturned, and
| is a zombie free speech trope that is resistant to any
| headshot ever tried:
| https://www.theatlantic.com/ideas/archive/2019/08/free-
| speec...
| nearbuy wrote:
| I find the debunkers of this myth to be overzealous, or
| at least confusing.
|
| You can be charged with a crime if you knowingly, falsely
| yell "fire!" in a crowded theater and someone gets hurt
| as a result.
|
| The case you linked is not actually a ruling on whether
| you can do this.
| microtherion wrote:
| The biggest problem with the trope is that it plants in
| people's heads the idea that there was EVER a Supreme
| Court case where the defendant was accused of yelling
| "fire!" in a crowded theater.
|
| In reality, the phrase was an analogy used to justify the
| conviction of a man who committed the heinous crime of...
| making and distributing leaflets opposing the draft in
| World War I. So for all the high minded rhetoric in the
| First Amendment, it may not provide all that much
| protection if your speech inconveniences the government
| sufficiently.
|
| One might also be tempted to draw inferences from the
| fact that Schenk, the man whose speech was considered not
| worth protecting, was a socialist pacifist, while
| Brandenburg, whose free speech was considered more worthy
| of protection, was a KKK leader promoting violence
| against Blacks and Jews. In the US, protecting the civil
| rights of Nazis has become a litmus test of civic virtue
| across the political spectrum. Unfortunately, that
| protection is extended far less vigorously and
| consistently to other political views.
|
| https://en.wikipedia.org/wiki/Schenck_v._United_States
|
| https://en.wikipedia.org/wiki/Brandenburg_v._Ohio
|
| https://en.wikipedia.org/wiki/National_Socialist_Party_of
| _Am...
| contrarian1234 wrote:
| Yeah, I'm not a lawyer but the system seems honestly
| nonsensical. They found the law inconvenient, so the
| court just effectively added a "clear and present danger"
| clause to the law. If there were problems with people
| abusing their freedom of speech, then you'd think the
| natural response would be to amended the bill of rights -
| and not just a bunch of unelected judges dreaming up
| something that seems "reasonable"
| all2 wrote:
| I honestly can't speak to "reasonable", but this format
| of jurisprudence has been common for the better part of
| 4000 years (see Jewish law and case law that pops up in
| the Bible's old testament, especially the tanach).
| andrepd wrote:
| Hmm it sure sounds like "government abridging the freedom
| of speech of individuals" to me
| ztrww wrote:
| The UK is especially bad because of its very restrictive
| libel laws, since it puts the burden of proof on the
| defendant.
| blitzar wrote:
| There isnt one.
| nceqs3 wrote:
| You seem to be misunderstanding the First Amendment.
| CSMA, classified information, defamation, copyright, etc.
| are all not permitted under the first amendment. Not to
| mention that gag orders are approved by a court and can
| be appealed.
| fijiaarone wrote:
| The first amendment must be a lot longer than I thought.
| blibble wrote:
| > Congress shall make no law respecting an establishment
| of religion, or prohibiting the free exercise thereof; or
| abridging the freedom of speech, or of the press; or the
| right of the people peaceably to assemble, and to
| petition the Government for a redress of grievances.
|
| seems pretty clear to me, at least for gag orders
|
| less so for the other stuff you mentioned (could you
| argue pirated Disney movies are speech? probably not)
| skissane wrote:
| In the constitutions of many other countries, you will
| find an explicit clause saying (to effect) "rights and
| freedoms granted by this constitution are not absolute
| and exceptions can be made to them for sufficiently grave
| reasons".
|
| Unlike those other countries, the US Constitution never
| contained such an explicit clause, but the Supreme Court
| has always read it as if it did. The Supreme Court feels
| quite justified in doing that, because if you go back and
| look at the debates in Congress and the state
| legislatures over the proposal and ratification of the
| Bill of Rights, it is clear that its proponents always
| intended it to be interpreted as if such an "exception
| clause" existed, even though (for whatever reason) they
| chose to leave it as implicit rather than explicitly
| putting it in the text.
| dragontamer wrote:
| And the writers of the 1st Amendment went on to pass the
| Sedition act of 1798.
|
| > That if any person shall write, print, utter. Or
| publish, or shall cause or procure to be written,
| printed, uttered or published, or shall knowingly and
| willingly assist or aid in writing, printing, uttering or
| publishing any false, scandalous and malicious writing or
| writings against the government of the United States, or
| either house of the Congress of the United States, or the
| President of the United States, with intent to defame the
| said government, or either house of the said Congress, or
| the said President, or to bring them. or either of them,
| into contempt or disrepute; or to excite against them, or
| either or any of them, the hatred of the good people of
| the United States, or to excite any unlawful combinations
| therein, for opposing or resisting any law of the United
| States, or any act of the President of the United States,
| done in pursuance of any such law, or of the powers in
| him vested by the constitution of the United States, or
| to resist, oppose, or defeat any such law or act, or to
| aid, encourage or abet any hostile designs of any foreign
| nation against the United States, their people or
| government, then such person, being thereof convicted
| before any court of the United States having jurisdiction
| thereof, shall be punished by a fine not exceeding two
| thousand dollars, and by imprisonment not exceeding two
| years.
|
| Welcome to America. Our laws contradict each other and
| its all about politics. The Supreme Court figures out
| where the line is drawn and what is, or isn't, legal
| according to the Constitution.
|
| With regards to 1st Amendment, the limit is drawn today
| at Libel, Slander, "Fire in a Crowded Theater",
| pornography, and many other restrictions upon "free
| speech". Gag orders included.
| blibble wrote:
| surely that Act is by definition unlawful?
|
| I still don't really understand
|
| in the UK: Parliament has unlimited power and people talk
| quite a bit about formal constitutions being a good model
| to be followed
|
| it seems a bit sad the attempt to protect the population
| against government using a formal constitution doesn't
| seem to work in reality (even when the wording is as
| clear as day)
| damiankennedy wrote:
| You do have a King though. What would happen if the PM
| went to see him to form a government and they disagreed?
| The King is the one with armed guards, military rank and
| a fortress.
| samus wrote:
| As part of his coronation, the King has sworn an oath to
| uphold the Law and to respect the primacy of Parliament.
| Not appointing the PM and his government has serious
| consequences as the PM is the leader of Parliament, which
| is the institution that has actually restored monarchy
| after the Glorious Revolution and which actually
| bankrolls the armed forces, and which was ultimately
| elected according to the Law by the citizens.
| Randomizer42 wrote:
| The king is the de facto ruler, to say otherwise is being
| pedantic.
| afthonos wrote:
| No, this is pedantic::
|
| _De facto_ means in fact. Given that the king does no
| governing no, he is not, in fact, the ruler. You may be
| looking for _de jure_ , though I question even that.
| samus wrote:
| The king of the UK still has to respect the Law. Being
| king does not mean that one can do as one pleased, or
| that there are no checks and balances. The last English
| king who tried to become an absolute ruler caused the
| English Civil War and was put on the chopping block by
| Parliament, as a matter of fact.
| dragontamer wrote:
| > surely that Act is by definition unlawful?
|
| Whose definition?
|
| Answer: The Supreme Court decides the definition of
| things. Its only unconstitutional if the Supreme Court
| says so.
|
| That's how the USA can get away with... I dunno... the
| Office of Censorship in 1941.
| (https://en.wikipedia.org/wiki/Office_of_Censorship).
| Definitions change, not only due to different members on
| the Supreme Court, but also due to different
| circumstances (WW2 meant that the Supreme Court was
| willing to ignore the obvious incursion into the 1st
| Amendment, at least temporarily)
|
| EDIT: I always forget that it was actually the Office of
| War Information that did the Hollywood Censorship thing (
| https://en.wikipedia.org/wiki/United_States_Office_of_War
| _In...), rather than the Office of Censorship.
| blibble wrote:
| > Whose definition?
|
| I guess that's the underlying problem
|
| I'm not sure how you fix it really, though not having
| direct political appointees as top judges might be a good
| start
|
| (maybe put an LLM in charge of a supreme court? I kid, I
| kid)
| dragonwriter wrote:
| > With regards to 1st Amendment, the limit is drawn today
| at [...] "Fire in a Crowded Theater"
|
| No, and it never was. That was an _obiter dictum_ that
| didn't accurately reflect the state of the law in the
| decision in which it appeared, and the actual holding in
| that case itself (now regarded as an intense intrusion on
| core political speech) is no longer operative.
|
| It's a catchy turn of phrase that gets stuck in the mind,
| but it was also an rhetorical device neither in a
| decision that has since been substantively overruled, not
| an actual example of an existing limit on free speech.
| dragontamer wrote:
| Well, if that particular phrase is poisoned, I guess I
| could just say "Hobbit" instead, which is owned as a
| trademark IIRC by the Tolkien estate and they're very
| litigious about it.
|
| You can't say "Hobbit" in your own stories. But you can
| say "Halfling", and that's how people tend to get around
| that problem. Blonde Thor is Disney/Marvel (Historical
| Thor was a redhead IIRC, so Blonde Thor is Disney/Marvel
| Trademark), etc. etc. Plenty of restrictions on Free
| Speech in practice.
| dragonwriter wrote:
| > You can't say "Hobbit" in your own stories
|
| You can, though.
|
| You can't use it to _market_ your stories or other
| products, and there 's some manners of use innthr body of
| a book that might run some risk of liability for dilution
| or tarnishment, but...
| RobotToaster wrote:
| >"Fire in a Crowded Theater"
|
| That one's apparently a myth.
|
| https://reason.com/2022/10/27/yes-you-can-yell-fire-in-a-
| cro...
| dragontamer wrote:
| Libertarian website argues Libertarian viewpoints. News
| at 11.
|
| I'm more inclined to believe Supreme Court Justice Alito
| over a Libertarian website. Especially because a sitting
| Supreme Court Justice literally will preside over the
| case and make a decision based on their own
| ethics/process/whatever.
|
| An entire article that starts off with "BTW: Supreme
| Court Justice is wrong on subject" is... well... that's
| not how this works. The Supreme Court justice literally
| defines (or at least, is 1/9th of the definition) of our
| country's legal interpretation.
|
| If the Supreme Court says "Obamacare is a tax", then its
| a tax. No if, and, or buts about it. It can be as
| ridiculous or contrived an argument they want, its the
| purview of the Supreme Court. They are the final say on
| any of these legal matters.
|
| And unless "reason.com" (or any other libertarian source)
| somehow manages to get the ear of the other Supreme Court
| Justices to believe their argument, I think I can safely
| ignore their article there.
|
| But they know that. I'm guessing they're just trying to
| clickbait readers and make somewhat sketchy arguments for
| more clicks + plant more articles that are aligned to
| libertarian values (as is the point of reason.com).
| Natsu wrote:
| > Libertarian website argues Libertarian viewpoints. News
| at 11.
|
| It's not just Reason or Libertarians saying that the old
| "fire in a crowded theater" trope is nonsense:
|
| https://www.popehat.com/2012/09/19/three-generations-of-
| a-ha...
|
| > An entire article that starts off with "BTW: Supreme
| Court Justice is wrong on subject" is... well... that's
| not how this works. The Supreme Court justice literally
| defines (or at least, is 1/9th of the definition) of our
| country's legal interpretation.
|
| No, a majority of the current Supreme Court is what
| defines jurisprudence on a subject.
|
| There are crazy (and non-crazy) minority opinions all the
| time that don't amount to anything. A later Supreme Court
| can even repudiate an earlier one.
|
| So it's true that this could change someday, and maybe
| Alito would even be in the majority then, but until and
| unless that happens, the "fire in a crowded theater"
| example is still dicta from an old case that's not good
| law.
| [deleted]
| SllX wrote:
| 1. It was _falsely_ shouting fire in a crowded theater,
| and it was not formative of the opinion itself (Schenck
| vs United States) but rather an aside.
|
| 2. Schenck vs United States was largely overturned by
| Brandenburg vs Ohio, but this aside was still non-
| jurisprudential.
|
| 3. I am unfamiliar with Justice Alito's opinion on the
| matter and you didn't cite it, so with no context I will
| only temporarily defer to you for the purpose of saying
| this: SCOTUS makes jurisprudence through the rulings and
| opinions they hand down when they take a majority vote in
| conference, draft opinions and sign on to them. One
| Justice does not make jurisprudence over a statement
| which itself was never jurisprudential.
|
| Reason wears their ideological stripes on their sleeves,
| but this is still essentially a myth that doesn't die and
| a fuller explanation of it isn't a matter of ideology.
|
| You still shouldn't falsely shout fire in a crowded
| theater, as people will die. You also shouldn't pretend a
| fire isn't there or part of the show either as people
| will also die. Basically, if there's a fire in a theater
| you're in, just be glad for modern building and fire
| codes.
| dragontamer wrote:
| > 2. Schenck vs United States was largely overturned by
| Brandenburg vs Ohio, but this aside was still non-
| jurisprudential.
|
| This here is the evolving nature of the court that I want
| to highlight most of all however.
|
| In 1919, the Supreme Court believed one thing. Later, in
| 1969, half-a-century later, it believed another thing and
| overturned the earlier ruling.
|
| As an organization, the Supreme Court tends to try to be
| consistent. But its not always true, and certainly in
| these days where we've had a dramatic change in the
| makeup of the court + filled it with young justices,
| we're going to see a big change in how the court writes
| opinions in the years, and decades, to come.
|
| -----------
|
| Laws are written. Constitutional Amendments are written.
| A few years ago, the 4th Amendment protected a woman's
| right to privacy and therefore Abortion. That's no longer
| true today. Etc. etc. Just a modern quickie example about
| how changing opinions can change our understanding of
| long-standing laws (or Constitutional Amendments) from
| the 1700s.
|
| Generally speaking, the Supreme Court is trying to do
| what's right for our court system. To have laws
| interpreted consistently over time, and across the
| country.
| SllX wrote:
| The goal is to be consistent over time but it must also
| still maintain a reactionary posture to the cases brought
| before it. When there is a difference in opinion between
| earlier and later jurisprudence, later jurisprudence
| takes precedent and to be blunt, sometimes earlier courts
| get it wrong and later courts recognize this.
|
| > A few years ago, the 4th Amendment protected a woman's
| right to privacy and therefore Abortion.
|
| Due process clause of the 14th amendment actually was the
| citation under the portions of Roe v Wade not overturned
| by Planned Parenthood v Casey prior to them both being
| overturned in Dobbs. The due process clause is often used
| to read into law from the bench things which are not
| written into law by Congress or the States under the
| doctrine of substantive due process, and the issue with
| that doctrine comes down to: if Congress didn't say it,
| and the States didn't agree to it (Constitution), then is
| it really actually Federal law? So far the answer seems
| to be: temporarily yes, and on shaky ground until either
| Congress addresses it or a future court does. That a
| court can overturn its own precedents is why if we wish
| for them to stick, you write them into statute.
|
| Going back to the First Amendment, most of the seeming
| contradictions in our free speech law really are
| addressed in the first 5 words of the First Amendment:
| "Congress shall make no law". Courts are not Congress,
| and our Judiciaries have habits and traditions that
| predate the Constitution and are rooted specifically in
| the English common law, especially among the States which
| is why you can be found civilly liable for defamation in
| most States, and then the standard is high and the extent
| to which it is applicable is curtailed more with the
| First Amendment than it would be without it.
| account42 wrote:
| Copyright is something the first amendmend explicitly
| carves out exactly because it is incompatible with free
| speech.
| runsWphotons wrote:
| It doesn't seem that clandestine.
| ajross wrote:
| > Such subpoenas are clandestine surveillance of citizens
| by their state. The problem with such types of surveillance
| in particular is the lack of accountability.
|
| I never know how to interpret statements like this. The
| fourth amendment guarantees court oversight over search and
| seizures. A court signs off on every subpoena issued
| anywhere in the USA. Are you making this argument from the
| perspective of "I didn't know courts were involved" or "I
| don't view courts as sufficient oversight".
|
| If it's the latter... what's your alternative? Eliminate
| gag orders (which is all this is) entirely? You realize
| that there's a lot of stuff that happens in courts that we
| all agree should not be public, both for privacy and law
| enforcement reasons. Why get upset over this one particular
| thing?
| benlivengood wrote:
| FISA judges are the oversight on foreign surveillance, but
| there is no (public?) oversight of national security
| letters.
| smsm42 wrote:
| FISA judges are not oversight of anything, as we learned,
| they almost never refuse a request, and even if there's a
| threat of such refusal, FBI could just lie to them, and
| they would stamp it, and when the lie comes out, nothing
| happens. FISA court is just a smokescreen to provide an
| illusion of oversight.
| proxiful-wash wrote:
| Except for other "states" they don't even have the ability
| to communicate about subjects like this.
| lynx23 wrote:
| "Ethics" and "democracy", as if they were a real thing...
| Both are a tool to fights your adversaries, but they are
| not something you can assume as given.
| raxxorraxor wrote:
| A theoretical case were an attacker leveraged some package
| hosted on PyPI could maybe become aware of investigations
| and destroy left-over evidence. But I guess a huge packet
| manager like this is too generic a target for such
| contraint to really work.
|
| > How does the ethical use of this prolematic tool get
| ascertained?
|
| It probably doesn't get ascertained, sadly. I think the
| advantages for investigations that might occur if people
| communicate more strategically is not worth the risk of
| political procecussions, which I believe are on the rise
| for a while now.
| smohare wrote:
| [dead]
| riazrizvi wrote:
| The USA is a country of laws. It's possible that people
| submitting packages are submitting illegal malware;
| spyware, ransomware, software to steal crypto money, or run
| illegal ticket-buying bots. Ethical oversight is baked into
| the institutions through governance structures.
| Institutions aren't perfect. Also there tend to be more
| complaints in the media about a country's institutions than
| in regions where there is not a free press. So the voices
| complaining online don't necessarily correlate with where
| the problems most lie.
| [deleted]
| Loquebantur wrote:
| Describing the US as a country of laws is a little funny.
| The mere existence of laws does not imply much.
|
| Your examples are even weirder. How would such
| malfeasance justify clandestine observations? That is
| clearly disproportional, thus unethical.
|
| Claiming governance structures were "baked into"
| institutions is pure hopium. Democratic oversight means,
| there must be transparency enabling you as a citizen to
| detect and react to misconduct, at least by proxy.
|
| The "free press" isn't free to report and investigate
| such subpoenas, obviously.
| anigbrowl wrote:
| In a lot of ways, being 'a nation of laws' means the
| officeholders can evade any kind of personal
| responsibility by asserting that they're just one cog in
| the legal gear wheel. Which one? Well that can take years
| of litigation to establish.
|
| Of course, the idea is that people are corruptible
| whereas laws are clear and neutral, but reality falls far
| short of this ideal. Any system can be gamed and
| ultimately captured; the more widely accountability is
| distributed, the less the probability of its timely
| application.
| williamcotton wrote:
| If law enforcement was never allowed to engage in
| clandestine operations then it would hamper their ability
| to build a case against and/or apprehend criminals. Case
| in point, organized crime syndicates.
|
| This is why the majority of your fellow citizens disagree
| with you and are fine with the current state of affairs.
| pksebben wrote:
| That seems like kind of a fabricated boogeyman, though. I
| have an extremely hard time thinking of anyone I know
| whose been affected by an organized crime syndicate, but
| I can immediately bring to mind a whole host of
| injustices suffered at the hands of government agencies,
| from bogus tickets to civil forfeiture to imprisionment
| for victimless 'crimes' (and that's not even accounting
| for blanket stuff like xkeyscore or spending my tax
| dollars on nonsense like the iraq war - all arguably way
| worse than any criminal organization without government
| backing could ever hope to inflict)
| ztrww wrote:
| > whose been affected by an organized crime syndicate
|
| I can't think of anyone I know who has been affected by
| holes in the ozone layer. Must be a fabricated government
| boogeyman designed to force me to buy an inferior fridge.
|
| Law enforcement agencies have been quite effective in
| controlling them over the last few decades (that and
| they've been replaced by foreign drug cartels..). It was
| probably quite different back in the 60s or 70s
| pksebben wrote:
| > I can't think of anyone I know who has been affected by
| holes in the ozone layer. Must be a fabricated government
| boogeyman designed to force me to buy an inferior fridge.
|
| There are many [1] counties in California that come
| immediately to mind - but I digress.
|
| I'll readily admit that things have changed - organized
| crime was indeed a much bigger problem in the past - but
| I might argue that even then the fault lay not with a
| lack of enforcement, but the existence of really, really
| dumb laws (prohibition). I might further argue that what
| organized crime is still problematic, is also a
| legislative rather than an enforcement issue (current
| prohibition, which we euphamize as the 'war on drugs').
|
| Even _if_ it 's enforcement that's doing the work of
| eliminating the effects of organized crime on actual
| citizens - the potential for harm is way bigger from an
| organization with a monopoly on violence, a state
| mandate, and practically unlimited coffers.
|
| 1 - https://en.wikipedia.org/wiki/List_of_California_wild
| fires
| williamcotton wrote:
| This is my high school buddy's dad:
|
| https://www.democratandchronicle.com/story/watchdog/2013/
| 12/...
|
| Three of my teenage friends were in his basement when the
| FBI kicked down the door and stormed in armed to the
| teeth.
|
| Perhaps you're fine letting thieves and murderers get the
| upper hand but the rest of us are not.
|
| Consider yourself lucky that criminals haven't had much
| of an impact on your life.
| pksebben wrote:
| I think where you and I might be diverging here is in our
| definitions of 'thief' and 'murderer'.
|
| I don't see a difference between, say, a capo that orders
| a hit, and a member of congress who votes for a foreign
| 'police action' - save for that the congressmember has
| much, much higher numbers.
|
| Same goes for a bank robber vs. a bank exec who gets a
| multimillion $ payout from bailout funds - we're
| impressed if the bank robber cracks a million - but it's
| like "that makes sense" when the exec walks away with
| eight figures of tax dollars.
|
| I don't know anyone whose been killed by a mob hit, but I
| know soldiers who have lost their lives to bullshit
| foreign wars, and literally everyone who pays taxes lost
| money to the villains in 2008.
|
| I believe criminals have had a huge impact on my life -
| they just all got there through 'legitimate' channels,
| which IMO makes no difference to whether I'm poorer or
| people are dead.
| Obscurity4340 wrote:
| Sorry, what point are you trying to make?
| williamcotton wrote:
| A very basic one: organized crime does in fact exist
| (contra to claims of bogeymen) and law enforcement
| benefits from clandestine investigations.
|
| It is a trade-off. The downsides have been enumerated ad
| nauseam on hacker forums for decades and compared to the
| reality of organized crime comprise just a small
| percentage of the ill effects experienced in a relatively
| low corruption society like the United States.
| danaris wrote:
| No one is trying to claim organized crime does not exist.
| They are claiming that the harms from organized crime may
| not be as bad _on the whole_ as the harms from some of
| these laws intended (at least in part) to combat it.
|
| This does not, of course, mean that the harms to certain
| individuals from organized crime aren't worse. But
| governing based on a small number of emotional anecdotes,
| and ignoring the broader harms being perpetrated to
| placate that vocal minority, is deeply irresponsible.
| williamcotton wrote:
| What is deeply irresponsible is ignoring the benefits of
| clandestine operations by law enforcement in a vain
| attempt to adhere to some kind of free and open source
| information ideology.
| sjy wrote:
| What about a ransomware, phishing or data breach victim?
| Cybercrimes are often committed by organised criminals
| and investigating them seems like the most obvious reason
| for the DOJ to issue a subpoena to PyPI.
| yrnameer wrote:
| > Ethical oversight is baked into the institutions
| through governance structures.
|
| Kind of a shocking assumption to make. Over the past
| several decades it has become increasingly apparent how
| our governing structures have no inherent relationship
| with ethics.
| riazrizvi wrote:
| You're extrapolating incidents that are being called out
| in the press to improve the system onto vast legislative
| infrastructure that is operating day after day for 100's
| millions of people in this country.
| dools wrote:
| > How does the ethical use of this prolematic tool get
| ascertained?
|
| Via the judicial system
|
| > Where and how is the democratic oversight implemented?
|
| In congress
|
| > How is misuse treated and prevented?
|
| Through the judicial system and congress
| cto_of_antifa wrote:
| [dead]
| lazide wrote:
| At least they get to subtly communicate they can't talk,
| instead of being Jack Ma'd.
|
| The constitutional justification is the same one behind not
| being allowed to yell 'fire' in a crowded theatre if there
| is none, or not being able to go on TV and threaten the
| Judge overseeing your case - 'the constitution is not a
| suicide pact'. [https://en.wikipedia.org/wiki/The_Constitut
| ion_is_not_a_suic...]
|
| As to if it is being abused? Guaranteed. Being prevented?
| Not effectively. Only the occasional leak of the abuse and
| corresponding consequences (if any) seem to be
| counteracting it, and even then not well.
|
| Sunlight is the best disinfectant, and most of the national
| security apparatus is solidly in the dark, and has been for
| a long time.
| mike_d wrote:
| > How does the ethical use of this prolematic tool get
| ascertained? Where and how is the democratic oversight
| implemented? How is misuse treated and prevented?
|
| I can't speak specifically to this case, but in general
| when asking a judge for the warrant they also provide
| compelling evidence that harm would come from disclosure.
| The judges weigh the rights of the targeted and other
| parties that would be subject to a gag order against the
| greater good.
|
| To answer your last two questions, all gag orders
| eventually expire. It isn't a prohibition against the
| impacted party speaking out, just a delay. They can go
| directly to the judge or appeal to a higher court.
| yunohn wrote:
| > It isn't a prohibition against the impacted party
| speaking out, just a delay.
|
| It's exactly this "it's totally fair, surely it's not
| ridiculous" attitude that shows how the powers control
| the people.
|
| Gag orders and secrecy agreements can definitely be
| indefinite and regularly are.
|
| https://web.archive.org/web/20220809113138/https://cdt.or
| g/i...
| rootusrootus wrote:
| Assuming it's always ridiculous doesn't seem like a
| position any more enlightened.
| JasonFruit wrote:
| Possibly safer for people's rights, though.
| tru3_power wrote:
| Is this related to that Microsoft disclosure?
| Aeolun wrote:
| Kind makes me feel like a lot of these services should just _not_
| be hosted in the US? If we'd have this hosted in Germany or
| Sweden, would the government be so casually requesting data from
| these registries?
| whimsicalism wrote:
| > as allowed by the lack of a non-disclosure order associated
| with the subpoenas received in March and April 2023.
|
| Yeah no way they haven't had other subpoenas then.
| junon wrote:
| Good on the PyPi folks. This is an incredibly well done
| disclosure, an example to be sure.
| mschuster91 wrote:
| > PyPI retains records of all changes to projects on the index,
| and has since 2002-11-01 17:11:36 UTC.
|
| Wow, I had _zero_ idea how old Python is.
| dragonwriter wrote:
| Python was released in 1991 with 1.0 in 1994, PyPI is newer
| (the date listed there appears to be when it went online.)
| jwilk wrote:
| https://www.pypa.io/en/latest/history.html#before-2013 says
| PyPI was launched in 2003.
| dragonwriter wrote:
| Wikipedia agrees with the activity history PyPI themselves
| posted in TFA and indicates the index at its original home
| under python.org went live in November 2002, and PEP 301
| was posted with present-tense descriptions of the URL where
| the index was available on 11/8/2002. But,
| jwilk wrote:
| AFAICS PEP 301 linked only to a demo site until April
| 2003:
|
| https://github.com/python/peps/commit/c773b1b2ce0a2817
| BrandoElFollito wrote:
| I wonder why such organizations that hold critical data for the
| community at large do not use an international canary system.
|
| Should one of the countries issue an order, the ones outside of
| its jurisdiction can openly disclose the information. Say if the
| US forces the US entity to not do something, the French one sees
| it and can warn all users.
| detaro wrote:
| "I've been ordered not to tell the details, but I know you will
| publish them, so I'm going to tell you the details" is not
| going to be taken as "obeyed the order" by law enforcement or
| courts.
| BrandoElFollito wrote:
| Sorry but I think I do not understand (English is not my
| first language). Who would be in trouble?
|
| In case anything happens with the content of the service, the
| detail of the changes would be made clear by someone outside
| the jurisdiction.
|
| A typical example is TrueCrypt that, one day, changed their
| page to say to use something else instead of their product.
|
| If the code was shared between several countries, the others
| could simply publish that this and that was changes out of
| band, and that it means that the code is now positively
| unsafe.
| sneak wrote:
| > _" IP download logs of any Python Package Index (PyPI) packages
| uploaded by..." given usernames_
|
| This is way overbroad. The fact that a judge granted this is very
| bad.
| duskwuff wrote:
| It's hard to say that it's "overbroad" without knowing the
| details of the situation.
|
| It's not hard at all, on the other hand, to imagine situations
| where this would be a reasonable request. Probably the most
| obvious would be if the packages contained material which was
| illegal to possess or distribute (like CSAM). Another would be
| if the packages were being used as part of a malware C&C
| operation -- knowing what IP addresses downloaded the packages
| would aid in determining the scope of the campaign.
| kjs3 wrote:
| We get "please provide the logged IP addresses of user X"
| subpoenas on a weekly if not daily basis. Which law school did
| you go to so I can tell our corp counsel they've been doing it
| wrong and stop asking?
| robryk wrote:
| Note that GP complains not about the request for IP addresses
| of user X, but the request for IP addresses of anyone who
| downloaded content uploaded by user X.
| tw-0981230981 wrote:
| You should re-read the quote. This was not a request for the
| IP addresses of the users in question, but for the everyone
| that downloaded any packages uploaded by those users.
| throw_a_grenade wrote:
| So just yesterday PyPI announced they're retiring cryptographic
| signatures: https://news.ycombinator.com/item?id=36044543.
|
| It's hard to keep those things separated. I would very much like
| the code submitted to PyPI be protected end-to-end by
| cryptographic signatures, when PyPI has either no resources, or
| no spine to stand up to a government. Any signatures, even PGP,
| which should be in place until someone provides better mechanism.
| stuaxo wrote:
| The list of things they asked for seems to be basically
| "everything" - seems like a dragnet approach.
| WiSaGaN wrote:
| How difficult is it for the US government to supply chain attack
| other countries that are using popular Python packages such as
| PyTorch given their power over these kind of global software
| infrastructure under US internal law? Are we able to assess it
| given there are gag orders as well?
| paradox242 wrote:
| When your platform is the source of malware used in supply chain
| attacks you gotta expect the Feds are going to come knocking
| eventually.
| bogwog wrote:
| It's nice that they're committed to user privacy, and this post
| really gives me confidence that my privacy will be reasonably
| protected.
|
| ...but why is that a goal for PyPi? As a publisher of packages,
| it's a nice-to-have, but as an end user it's kind of scary. I
| don't want to use software packages published by anonymous and
| potentially unaccountable people. That's probably why they have
| so many malicious packages.
|
| Maybe you live in an oppressive regime who will imprison/murder
| you for publishing some code; ok, but that's an outlier, and
| there are a lot of ways to get around that situation.
|
| I just don't see the benefit of privacy in this situation? Is it
| just to reduce the administrative overhead of
| collecting/verifying identity info? I'm genuinely curious to
| learn about a realistic use case that justifies the risks to all
| users.
|
| I know you can self host your own package index, but very few
| users have the resources to do that.
| kortex wrote:
| I think largely because the prerogative is on the code author
| to reveal as little or as much about themselves, and the
| prerogative of library users is to sufficiently vet a package.
| If folks want to publish code pseudonymously, and folks want to
| use that code, as long as it's not abusive, what's to stop
| them? You can achieve basically the same effect with github,
| gitlab, or even plain self-hosted HTTP packages (pip just uses
| a convention for listing packages in a dir, any HTTP file host
| can be a package server), without PyPI.
|
| I actually think the larger problem is Python's reliance on
| imperative code that executes at install time. Yeah you can use
| pip --download and extract it yourself, but folks rarely do
| that.
| miga wrote:
| Excellent example of how difficult it is to design privacy-
| friendly service.
|
| Any information that can be subpoenae-ed can also be hacked away.
| berkes wrote:
| > Any information that can be subpoenae-ed
|
| What if you operate from e.g. Iceland, Switzerland or even many
| EU states? Can a US Gov. agency still subpoena you?
| dvt wrote:
| Most likely caused by phishing, ransomware, or (unlikely) crypto
| mining. I'd bet someone from some agency had credentials leaked
| due to a malicious package. Honestly, PyPI is stuck between a
| rock and a hard place, but having something like a "verified"
| badge (where someone's real identity is tied to it) for certain
| packages would go a long way to ensure some level of security.
|
| The problem gets a bit hairier when dealing with dependency
| chains, however.
| snapcaster wrote:
| Really weird, anyone have some inside gossip on what this is
| about?
| paulpauper wrote:
| maybe to do with web scrapping, auto-posting spam, etc.
|
| https://www.developer-tech.com/news/2023/may/22/pypi-suspend...
| yuvadam wrote:
| Subpoenas are from March and April, predating the spamming of
| the past few weeks.
| richbell wrote:
| PyPI has had a pretty consistent spam problem for a while
| now.
| paulpauper wrote:
| it likely shows that it was an ongoing problem
| Retr0id wrote:
| The most optimistic reason would be that they were
| investigating a supply-chain attack, or something of that
| nature.
| bhouston wrote:
| I wish it was that but those people would be smart enough to
| not use their real name when signing up - those doing supply
| chain attacks are often at least somewhat professional and
| take precautions.
|
| I suspect it was more about going after software that was
| enabling piracy, those are often created by naive students
| who are not expecting the power of government to be unleashed
| on them.
| nibbleshifter wrote:
| > those doing supply chain attacks are often at least
| somewhat professional and take precautions.
|
| Not really.
|
| The vast majority of supply chain attacks in practice are
| idiots exploiting namespacing, bitflips, or typos on
| pypi/npm to drop miners or infostealers.
|
| Yes, even the shit tier supply chain attacks count :)
| commandlinefan wrote:
| This makes me wonder... it's entirely possible that the PyPI
| people would be enthusiastic about helping to track down
| offenders, and their users might agree, _if they knew what
| the offense was_. Instead, they're presented with a typically
| antagonistic demand for details, so they understandably get
| defensive on behalf of their users. I wonder if there's not a
| better, less heavy-handed way to get cooperation with law
| enforcement when the request is reasonable.
| Retr0id wrote:
| Personally I would rather not set a precedent of handing
| data over to government agencies just because they ask
| nicely, even if it seems like it's for a mutually agreeable
| good cause. That is, I would rather they go through these
| "formal" channels, even if it seems a bit heavy-handed.
|
| Further, whatever they're investigating here is probably
| "important", for some definition of important, so they
| likely value the ability to lean on non-disclosure clauses
| etc.
| jamesmurdza wrote:
| It could be related to the large number of malicious or booby-
| trapped packages that have been uploaded recently to the index.
| foota wrote:
| My guess? A hacking case against someone for typosquatting or
| malicious packages or something.
| guhcampos wrote:
| Could be anything I guess, even legitimate reasons. T Think of
| the supply-chain attacks going on in the past few years. I'd
| say investigating these would be a legitimate reason for a
| subpoena.
| [deleted]
| jehb wrote:
| Suggestion: Start slipping unique URLs into the "hidden" backend
| fields of systems where you'd like to know if your data was
| breached, improperly used, or handed over to a three letter
| agency.
|
| Suddenly getting hits at mydomain.com/[uuid]? At least you know
| somebody has looked at the data, or at the very least fed it
| through some processing tool that is extracting and visiting the
| URLs.
| krick wrote:
| How do you suggest it should've been used in this case? As a
| PyPI username (obviously pointless), or what?
| mmsc wrote:
| This is called a canary and can be used in so many places:
| https://blog.thinkst.com/2022/09/sensitive-command-token-so-...
| austinjp wrote:
| I'm pretty sure I've seen a SaaS that does this, but I can't
| remember the name.
| bl4ckneon wrote:
| "Thinkst canary" I think you're thinking about.
| https://canary.tools/
| tailspin2019 wrote:
| https://canarytokens.org
| tgbugs wrote:
| One theory that I don't see mentioned yet is that someone used an
| upload to pypi to exfiltrate data or simply as a way to upload
| arbitrary data somewhere. In a sense pypi is just a file hosting
| service, so it could have nothing to do with any actual python
| projects at all.
| rocqua wrote:
| Interesting approach to data exfil. Though it seems predictable
| that exactly this kind of subpoena would be issued. If you can
| predict it, you can probably mitigate it.
|
| Which means the subpoena would only be useful if the criminals
| made an opsec mistake. That is generally how most sophisticated
| criminals get caught, but here it feels like anyone inventive
| enough to try will probably also be prudent enough not to leave
| a trail.
| Zetice wrote:
| Dumb legal question; what's the difference, if any, between
| "We've been subpoenaed" and "Someone had a warrant for data"?
| paxys wrote:
| Warrant = we (police or other authority) have the right to come
| and search your property for evidence.
|
| Subpoena = the court compels _you_ to hand over the evidence we
| need.
| woodruffw wrote:
| Subpoenas are orders, but they're not necessarily court-
| issued. Warrants, on the other hand, _are_ court-issued --
| the police can 't issue warrants on their own in the US.
| rocqua wrote:
| A warrant for a things isn't an order to the owner of that
| thing. It's an order to (and peemission for) officers to go
| and seize the thing.
|
| You get shown the warrant to prove that they have
| permission, not to order you to comply.
| woodruffw wrote:
| Yes, I'm aware -- my other comment says that.
|
| I realize this comment is a little ambiguous: the order
| in the warrant case is an order by the court _to the
| court 's officers_ to perform an arrest, seizure, etc.
| It's not an order for you (the subject of the warrant) to
| comply.
| [deleted]
| woodruffw wrote:
| Not a dumb question: a subpoena is an order to provide
| information or access, while a warrant is a court-issued
| document authorizing the government (or an agent of the
| government) to perform an act (e.g., an arrest, or seizure of
| an item).
|
| Subpoenas can be issued by attorneys (including prosecuting
| attorneys) as part of the investigative and discovery
| processes.
| indymike wrote:
| Subpoena = "Ask firmly, but nicely"
|
| Warrant = "Back up the van and haul it away"
| schoen wrote:
| The subpoena is a command to the possessor of the data, which
| tells the possessor of the data to produce it, with a
| particular deadline. Since this deadline is in the future, the
| subpoena can be challenged legally (normally by requesting a
| court to "quash" it; more riskily, sometimes by complying
| imperfectly or not at all, and then arguing in response to an
| attempt to punish the noncompliance that this was reasonable).
| A subpoena can be issued by many entities, for example
| including some law enforcement entities themselves, or a lawyer
| actively involved in litigation. (Yes, lawyers can personally
| write and issue subpoenas.) The subpoena is, however,
| _enforced_ by a court, in the sense that the court is asked to
| punish people who fail to obey it.
|
| The warrant is a command to a law enforcement officer, which
| allows the law enforcement officer to personally go and search
| and seize things (or people), while overriding some rights that
| would normally prevent this. Normally it is issued by a court.
| Generally there is no way to challenge a warrant to prevent its
| execution, because it is not disclosed to the target before
| it's executed (i.e., a law enforcement officer shows up with
| the warrant and begins executing it immediately, by force if
| necessary).
|
| (Edit: I wrote above that it's risky to comply imperfectly with
| a subpoena and then argue in court that this was reasonable,
| but usually if _a lawyer gives a professional opinion_ that the
| subpoena is invalid or overbroad for some reason, then the
| recipient of the subpoena won 't be punished for following that
| advice. The lawyer may also attempt to negotiate directly with
| the issuer of the subpoena, for example by sending a letter
| explaining why the the subpoena appears to be invalid. The
| legal standards for issuance of subpoenas are also pretty
| broad. For civil litigation, _which is not what DoJ is doing
| here_ , they are set out in
| https://www.law.cornell.edu/rules/frcp/rule_26; notably, they
| can be issued to third parties.)
| Zuiii wrote:
| > https://www.law.cornell.edu/rules/frcp/rule_26;
|
| This url does not exist. Was this response generated by an
| LLM?
| dragonwriter wrote:
| > This url does not exist. Was this response generated by
| an LLM?
|
| No, its just that HN's automatic linkification continues
| until it breaks on whitespace, so if you type punctuation
| (here, the ";") after a link with no intervening space, it
| gets included in the URL.
|
| Strip the semicolon and its fine:
|
| https://www.law.cornell.edu/rules/frcp/rule_26
| schoen wrote:
| Thanks! I probably should also have mentioned
| https://www.law.cornell.edu/rules/frcp/rule_45 (with no
| punctuation at the end).
|
| But also I possibly shouldn't use civil litigation as the
| only example of subpoenas, again because this one arose
| in a different context.
| therein wrote:
| Really nice response, I'm not the one who asked the question
| but I learned something from your response.
| zerealshadowban wrote:
| They log too much data about their users.
|
| So they should promptly update their policies to a) stop logging
| so much, b) delete all past logs, and c) sharply limit the span
| of time until deletion of whatever logs they decide they really
| need to track for internal needs.
|
| They should avoid logging, and rapidly rotate logs, to thwart
| future subpoenas from the total surveillance state.
| dpifke wrote:
| PyPI used to be somewhat decentralized, with multiple
| independent organizations (in multiple legal jurisdictions)
| running mirrors.
|
| For $REASONS they've decided Fastly should be the only official
| mirror. This makes it a one-stop shop for malicious
| governments.
| donaldstufft wrote:
| This post is pretty misleading.
|
| PyPI still fully supports mirrors (though it is becoming
| increasingly hard to run a full mirror of PyPI, last I looked
| a full copy of PyPI is about 30TB).
|
| The only thing we ever removed was designating any particular
| mirror as official and an auto discovery protocol that was
| quite frankly extremely insecure and slow. That worked by
| giving every single mirror that wanted to be an "official"
| mirror for auto discovery a subdomain of `pypi.python.org`,
| labeled {a-z}.pypi.python.org. A client would determine what
| mirrors were available by querying last.pypi.python.org,
| which was a CNAME pointing to the last letter that we had
| assigned, that would tell it how many mirrors there were,
| then they could work backwards from that letter. So if the
| CNAME pointed to c.pypi.python.org, the client would know
| that a, b, and c existed.
|
| Immediately you should be able to see a few problems with
| this:
|
| - It is grossly insecure. Subdomains of a domain can set
| cookies on the parent domain, depending on ~things~ they can
| also read cookies.
|
| - It does not scale past having 26 mirrors.
|
| - It does not support removing a mirror, there can be no gaps
| in the letters.
|
| So we needed to remove that auto discovery mechanism, which
| raised the question of what, if anything, we should replace
| it with?
|
| Well at the time we had only ever made it up to
| g.pypi.python.org. So there was only 7 total mirrors that
| ever asked to become an official mirror. To my knowledge we
| never reused a letter, if a mirror went away we would just
| point the mirror back at the main PyPI instance. I don't
| remember exactly, but my email references there being only 4
| mirrors left.
|
| From my memory at the time, most of those 4 mirrors were
| regularly hours or days behind PyPI, would regularly go
| offline, etc.
|
| But again, we never stopped anyone from running a mirror, we
| just removed the auto discovery mechanism and required them
| get their own domain name. We even linked to a third party
| site that would index all of the servers and keep track of
| how "fresh" they were, and other stats (at least until that
| site went away).
|
| Running a mirror of PyPI is a non trivial undertaking, and
| most people simply don't want to do that. We never had many
| mirrors of PyPI running, and as it turns out once we improved
| PyPI most people decided they simply didn't care to use a
| mirror and preferred to just use PyPI, but still to this day
| we support anyone to mirror us.
| dpifke wrote:
| I misrembered the PyPI mirror system (pre-Fastly) being
| more similiar to Debian[0], I didn't realize it had so many
| problems.
|
| Debian managed to solve all of the concerns you listed,
| what makes PyPI unique?
|
| [0]: https://www.debian.org/mirror/list
| donaldstufft wrote:
| So there's a few things here:
|
| Firstly, Debian's mirror network URLs allow a mirror
| operator to attack the base Debian.org site if they rely
| on cookies on debian.org (they may not, I'm not sure).
| Specifically the `ftp.<country>.debian.org` aliases cause
| this. On PyPI we did use cookies at the base url, so this
| was a non starter for us to keep.
|
| The second thing here is that Debian and PyPI from a
| technical level about how mirrors are configured and
| hosted are generally similar. Meaning other than the
| above aliases, mirrors are expected to have their own
| domain and users are expected to configure apt or pip to
| point to a specific domain. Debian does have a command
| that will attempt to do that configuration for you to, to
| make it easier.
|
| The third thing is that Debian's mirrors are as secure as
| the main repository is against attacks from a compromised
| mirror operator. This isn't the case in PyPI where you're
| forced to trust the mirror operator to serve you the
| correct packages. There is vestigal support for a scheme
| to support this in the mirroring PEP, but nothing ever
| really implemented it except the very old version of PyPI
| (none of the clients, etc). That scheme is also very
| insecure, so it doesn't really provide the security
| levels it was intended to.
|
| The fourth thing is that a Debian mirror is easier to
| operate.
|
| Packages on Debian don't live forever, as new versions
| are released old versions get removed, and as OS releases
| move into end of life, entire chunks of packages get
| rotated out. However on PyPI we don't have the concept of
| an OS release, or any sort of phasing out of old
| packages. All packages are valid for as long as the
| author makes them available. This means that the storage
| space to run a PyPI mirror (currently ~30TB) is a lot
| more than the storage space for a Debian mirror (~4TB).
|
| On top of that the way apt and pip function are
| inherently different. Apt has users occasionally download
| the entire package set so that apt has a local copy of
| the metadata while pip asks the server for each package
| for the metadata (it does some light caching, but not a
| lot). This means that to discover what packages are
| available, apt might make one request a day while pip
| might make 100 requests _for every invocation of pip_.
| Packages on apt release a lot slower and less often than
| on pip. so many times people may not be needing to
| download more than a handful of packages, but people
| generally need to download a lot of packages from PyPI at
| a time.
|
| I believe? the Debian mirroring protocol is rsync based,
| which is generally pretty reliable, while the PyPI
| mirroring protocol is a custom one which works, but it
| sometimes has a tendency to get "stuck" every few months
| and require operators to notice and fix themselves.
|
| I suspect the differences between the strength of the
| mirror network is some combination of the two, but I
| suspect the the third and fourth things are the biggest
| differences, particularly when PyPI's CDN solved the
| problem in most users minds that would cause them to want
| to host or use a mirror.
| takeda wrote:
| For the kind of service they are providing I think the logging
| is appropriate.
|
| I mean if DOJ is interested in PyPI logs the only reason I
| could think of, is if it was used as a supply chain vector into
| breaking in into other organizations.
| alwayslikethis wrote:
| or locating the people responsible for DRM breakers like
| youtube-dl? Keeping all the data makes you susceptible to
| subpoenas like this, which costs money to comply with. There
| is no reason to keep any data that isn't necessary to the
| service.
| oxguy3 wrote:
| Which data are excessive? Everything described in the post
| seemed totally reasonable to me.
| chatmasta wrote:
| PyPi is in a tough spot because they're also getting hit with
| an onslaught of malicious packages, which got to such a bad
| point they had to disable signups. How do they mitigate that
| kind of activity without logging basic metadata like the IP
| address that published a package? Also, as a user of PyPi,
| wouldn't you prefer that a malicious package is at least
| _somewhat_ traceable to an attacker? Of course most would be
| behind a VPN but it's better than nothing (or maybe it's not,
| depending on the tradeoff).
|
| Note that the blog post doesn't say they handed the entire
| database over to the feds. They received three warrants scoped
| to specific packages and returned only the data they had
| available that was associated with those packages.
| ginto wrote:
| > How do they mitigate that kind of activity without logging
| basic metadata like the IP address that published a package
|
| An effective mitigation for abuse/spam is to increase its
| cost. One example is to require payment.
| duckmysick wrote:
| Now they need to subpoena both PyPI and the payment
| processor. It does slow them down but effectively does
| nothing to "thwart future subpoenas from the total
| surveillance state".
| mort96 wrote:
| It would not go over well if PyPI started charging people
| to host packages.
| ginto wrote:
| Charging goes well for many online services. Hosted
| email, hosted VPS, and hosted SaaS are some that come to
| mind. Apple Store and Google Play charge to host mobile
| games.
| chatmasta wrote:
| And the feds can subpoena all those services and their
| payment providers for logs including IP address that made
| the transaction.
| proto_lambda wrote:
| That's also a highly effective mitigation against
| legitimate users, especially those already disadvantaged
| everywhere else by a lack of disposable income.
| ginto wrote:
| How did you conclude payment equals parting with the
| money and not getting it back? Collateral works well for
| many problems in the world.
| pluto_modadic wrote:
| This is for package management. I want the supply chain to be
| secure and would rather know when something unusual happens.
| Not logging that data would be irresponsible on PyPi's part.
| manicennui wrote:
| [flagged]
| [deleted]
| brigandish wrote:
| I did so perhaps you could point out what we both missed?
| bigiain wrote:
| "As a result we are currently developing new data retention
| and disclosure policies. These policies will relate to our
| procedures for future government data requests, how and for
| what duration we store personally identifiable information
| such as user access records, and policies that make these
| explicit for our users and community."
| brigandish wrote:
| That's not the same as the stuff zerealshadowban
| outlined.
| einpoklum wrote:
| Here is what I consider the key section:
|
| > The privacy of PyPI users is of utmost concern to PSF and the
| PyPI Administrators, and we are committed to protecting user data
| from disclosure whenever possible. In this case, however, PSF
| determined with the advice of counsel that our only course of
| action was to provide the requested data. I, as Director of
| Infrastructure of the Python Software Foundation, fulfilled the
| requests in consultation with PSF's counsel.
|
| The first part of this section contradicts all of the rest. If
| user data privacy is of "utmost concern", then it is a concern
| above fulfilling legal obligations under US law. Plus, such
| supposed obligations must be staunchly fought before even
| considering whether or not to observe them. So, in fact, user
| data privacy is a minor concern for the Python Software
| Foundation, while swift prostration towards the US federal state
| is what's of utmost concern.
|
| Of course, they almost admit it themselves. If we carefully read
| the second clause, they don't say "we're committed to protecting
| user data from disclosure", but - the "we're committed... when
| possible". So, they're saying that if they believe it isn't
| possible to protect, they have _no_ commitment to try their
| utmost to protect. i.e. when they see fit, user data protection
| is _not_ a concern at all. ... ok, ok, it is a public relations
| concern.
| stjohnswarts wrote:
| I don't have a problem with this as it was 5 particular users and
| not "give us all the data for for all your users". They didn't
| really have much of a choice. I don't think they would have had a
| choice in any of the 5 eyes countries or their allies
| gjmacd wrote:
| I would point to Jim Jordan and all the other Republicans after
| January 6th who didn't honor a subpoena and toss them in the
| trash. Nobody in our government honors them, why should we in the
| private sector? What's going to happen, they going to raid
| offices and get a bunch of PC's and books?
| ur-whale wrote:
| > We will not be releasing the usernames involved publicly or to
| the users themselves.
|
| Emphasis on the last part: or to the users themselves.
|
| In other words: unless they actually let the users involved in
| spite of claiming the opposite, the whole article is complete
| posturing.
| burnished wrote:
| What a weird take
| asne11 wrote:
| I keep seeing people trying to assure other readers that the
| recipients of these subpoenas have some recourse to appeal.
|
| This is not the case if the subpoena is issued by the FISA court,
| otherwise known as "the court of no rejection."
| dragonwriter wrote:
| > I keep seeing people trying to assure other readers that the
| recipients of these subpoenas have some recourse to appeal.
|
| Because they do, in regular federal courts.
|
| > This is not the case if the subpoena is issued by the FISA
| court
|
| The Foreign Intelligence Surveillance Court doesn't (and courts
| in general don't) issue subpoenas.
| asne11 wrote:
| > The Foreign Intelligence Surveillance Court doesn't (and
| courts in general don't) issue subpoenas.
|
| This sounds like a matter of technicality, no? Whatever you
| call it, what they issue has the effect of a subpoena that
| you can neither appeal nor speak about.
|
| My point is not that this is what's going on here, but that
| the right to appeal is not generally a given.
| dragonwriter wrote:
| > This sounds like a matter of technicality, no?
|
| No.
|
| > Whatever you call it, what they issue has the effect of a
| subpoena that you can neither appeal nor speak about.
|
| No, it doesn't. FISC doesn't generally issue orders that
| are subpoena-like that would be presented to people outside
| of government. It provides surveillance orders to the FBI
| under which they conduct surveillance and, should someone
| later question if maybe that surveillance was a criminal
| violation of the Foreign Intelligence Surveillance Act--
| which would also be the FBI--the FBI can show the FBI the
| paper from the FISC that says its okay and then the FBI
| will not arrest the FBI for criminal violations of FISA.
|
| Or if someone somehow finds out they were surveilled and
| files civil charges, the paper serves a similar function.
|
| Where they _do_ (and this only, IIRC, occured under law
| that has now expired) issue orders that apply to external
| parties, those can be challenged directly in the FISC,
| appealed from the FISC to The Foreign Intelligence
| Surveillance Court of Review, and, from there, to the US
| Supreme Court. There is at least one such appeal to FISC-R
| by Yahoo! that has been published in redacted form.
|
| In no case does FISC issue orders that would go to an
| outside party who would then have no means or forum to
| challenge them.
| ralmidani wrote:
| Does a "subpoena" mean a judge was involved? The post says the
| subpoena was issued by the DOJ.
| tptacek wrote:
| It means a court is involved, but not a judge.
|
| _Edit_
|
| Even that is technically wrong; some DOJ subpoenas are
| apparently preauthorized by statute.
| idlewords wrote:
| There's a pretty extensive list of administrative subpoena
| authority here:
|
| https://www.justice.gov/archive/olp/rpt_to_congress.htm
|
| tl;dr: Everyone from the Appalachian Regional Commission on
| down can subpoena you without a court being involved. And of
| course Congress has inherent subpoena powers.
| tptacek wrote:
| Oh, this is so cool. Thank you!
|
| This is a step towards answering my noodly question earlier
| in the thread: authorization for NDAs and "gag orders" in
| subpoenas appears to be controlled by (varying) statutes.
| etaioinshrdlu wrote:
| Amazing how upset users here get over the very reasonable
| response to very normal police work.
| throwaway_13140 wrote:
| Agreed - how else was the DOJ supposed to do their job? They
| clearly need the data for an investigation. No need for PyPI to
| give information about how current users can alter their
| accounts to thwart future requests.
| sneak wrote:
| Normal police work doesn't go fishing for the IP addresses
| (potentially millions of users) of everyone who downloaded a
| package.
|
| > _" IP download logs of any Python Package Index (PyPI)
| packages uploaded by..." given usernames_
|
| Do you feel the same way if the cops are receiving the IPs of
| everyone who downloaded yt-dlp? IP addresses and timestamps
| resolve to physical locations and oftentimes street addresses.
| account42 wrote:
| Exactly. This is like the police going to a store with a list
| of suppliers and demanding personal data of everyone who
| bought any of those suppliers' products. That's well beyond
| "normal" but somehow for digital data its ok?
| ranger_danger wrote:
| In the US at least, it has been ruled that an IP address is
| not sufficient evidence to link activity to any particular
| person. You could have been hacked for example.
| sneak wrote:
| In the US they don't need evidence or a warrant to put
| certain people they deem surveillance-worthy under 24/7
| surveillance.
| buzzscale wrote:
| That doesn't make any sense though. What benefit would DOJ
| get from getting the IP address of everyone who downloaded
| ytp-dlp? They aren't the enforcement arm of google's terms of
| service, which is a civil matter.
|
| Even if they were, and the DOJ was going for a dragnet
| operation to go after tools that could potentially infringe
| terms of service of big corporations, they would go after
| every tool and every fork. Not just 1 package. But again,
| what court would allow such action and why?
|
| If I was in the DOJ and was investigating a malicious package
| uploaded to PyPI, I would ask for the IP's of the downloaders
| to see if the uploaders dun goofed and downloaded their
| package shortly after uploading off VPN. Or to find out if
| any major corporations were impacted by downloading the
| malicious package and to inform them.
| etaioinshrdlu wrote:
| (Deleted comment as it was wrongly assuming bias)
| ewdurbin wrote:
| no. they wanted the downloads by randoms. we don't store
| those with IPs
| subarctic wrote:
| I think you're reading it wrong too - it says "IP download
| logs of any Python Package Index (PyPI) packages uploaded
| by the given usernames". So that's anyone who downloaded
| those packages, not just the specific users' download
| activity.
| Vervious wrote:
| Yeah, I feel like this crowd sometimes forgets that the
| department of justice exists first and foremost to keep us
| safe.
|
| With PyPi hosting a ton of malicious packages and malware,
| certainly I am not morally opposed.
| winrid wrote:
| Same with the dozen street cameras at every intersection in
| China, right? Right? :)
| unethical_ban wrote:
| It's truly disheartening to see examples where someone
| (presumably a real human) thinks that all law enforcement,
| across all nations and times, and in all cases, are equal.
| willdr wrote:
| They are equal insofar as they exist for the same
| purpose.
| winrid wrote:
| I didn't say equal, did I?
| asynchronous wrote:
| Well when the convergence looks like it's on the horizon,
| call us paranoid.
| smolder wrote:
| You could reasonably argue it exists _foremost_ to keep
| wealthy, well-connected people and organizations safe, and to
| punish their adversaries.
| dark-star wrote:
| Strange that they didn't mention in 3b for how long they record
| IP addresses and logins. One has to assume that they keep this
| data indefinitely, even though they don't need it except for such
| subpoenas
| misterpigs wrote:
| I love this level of transparency.
| voynich wrote:
| Yeah, whether necessary or not, it's still nice to have such a
| level of detail in a transparency report.
| tomjen3 wrote:
| > We will not be releasing the usernames involved publicly or
| to the users themselves.
|
| Which is the most important part.
| dev_tty01 wrote:
| Releasing the user names would not be respecting the privacy
| of the users.
| tptacek wrote:
| They're not allowed to release that.
|
| _Edit_
|
| I read 'chaps as saying there was an NDA on the subpoena, but
| apparently there wasn't, so this might just be flatly wrong.
| remram wrote:
| Even in the absence of NDA, are you allowed to? Counsel has
| apparently advised them not to. Would it not carry the risk
| of being complicit to a crime?
| kevin_thibedeau wrote:
| Disclosing facts is not a crime.
| remram wrote:
| There are lots of situations in which disclosing facts is
| indeed a crime. You are answering my specific question
| with a nice sounding maxim which is obviously not true in
| general.
| rocqua wrote:
| Perhaps there is no NDA on the fact that subpoenas were
| issued, but still an NDA on whom they were issued about?
| Limiting The scope of such an NDA feels like a plausible
| result of negotiations after a motion to squash the
| subpoena.
| AnotherGoodName wrote:
| The NDA isn't the only reason you don't risk interference
| in an ongoing investigation though so regardless the basic
| point still stands.
| throwaway_13140 wrote:
| Do you still love it if it enables a terrorist or otherwise
| very bad person to evade capture?
| evandale wrote:
| Not OP but yeah. I don't buy into the whole "to protect you
| from bad people I need to erode your rights" argument.
|
| Never made sense to me. Terrorists and other very bad people
| usually aren't in the business of following laws so I don't
| know what crimes you'd prevent by weakening the rights of
| everyone else.
| M3L0NM4N wrote:
| I mean, surveillance reduces crime. Wherever you fall on
| the spectrum of surveillance/privacy, I can guarantee if
| the government read everything everyone wrote/texted/read
| and recorded their every move, there would be less crime.
| xp84 wrote:
| Is a subpoena of 5 specific users' data, presumably with
| the purpose of getting evidence about things that already
| happened, the same as 'surveillance'?
|
| > the government read everything everyone
| wrote/texted/read
|
| is this really a relevant analogy for this? And yes, I've
| heard of the mass surveillance via telco that we did find
| out (through Snowden) was happening, and do think it
| seriously crossed the line. I'm just wondering if this
| kind of case at issue has anything in common with that
| malfeasance at all.
|
| Is it your belief that they lacked any probable cause and
| are actually trying to persecute those 5 people for some
| reason?
|
| Rather than try to argue against a position I'm not fully
| understanding, I'd like to hear how you think police
| should solve crimes with a significant "cyber" component.
| menus wrote:
| Great to know that. I'll let the parents of Uvalde know
| how surveillance reduced crime on the 1 year anniversary
| of the school shooting.
|
| Surveillance does not reduce crime, tending to people's
| basics needs so that they don't need to commit crimes
| reduces crimes.
| xp84 wrote:
| I'm very unaware exactly what the issue is with this
| particular case, so be gentle, but what is the difference
| between the government agencies doing their job to stop
| criminals, and evil rights-destroying which it sounds like
| you are clearly convinced is what's going on?
|
| Let's say someone stole your identity and in the process
| they emailed all your financial documents to
| example.anon12345(at)gmail. If you contacted the police and
| the FBI subpoenaed Google to force them to give them the
| details of whatever they know about that accountholder, is
| that bad and hurting the rights of somebody, or is it
| protecting your rights?
|
| Does it change based on the despicableness level of the
| crime suspected? From one count of copyright infringement
| of a Taco Bell commercial, to organized retail theft rings,
| to identity theft, to CSAM, to terrorism?
|
| I'm not saying you're wrong, I'm just curious what the "We
| hate subpoena power" argument is so I can decide where I
| stand on it. I feel mildly like I'm not as bothered as you
| are, but I suspect I'm missing something.
|
| Also, should "online" operate under different rules than
| offline? If the "feds" have probable cause that some guy is
| a drug kingpin and they break into his office and his safe
| to seize evidence, is that equally bad as forcing Google to
| open up his Gmail account for them?
| Danjoe4 wrote:
| Yes. Truth itself stands at the top of the moral hierarchy.
| It can stand alone without any justification. "You told the
| truth" will never be immoral, consequences be damned.
| Aachen wrote:
| Climate activism is also being considered an act of terrorism
| by some now (particularly some Christian party in Germany),
| dunno if those people label themselves as 'very bad persons'.
| Probably goes for all terrorists, but this might be easier to
| relate to as it's grounded in reality and we'd likely agree
| with the change they seek
|
| Child porn and terrorism are the favorite subjects of
| politicians looking to enact a new law but idk if it's good
| to follow that thinking and use it as an example as opposed
| to a serial killer or something
| SV_BubbleTime wrote:
| Sure. But I would love if they had considered this from the
| start:
|
| >As a result we are currently developing new data retention and
| disclosure policies.
|
| "I guess we don't actually need that" should have been the idea
| from the start.
| donaldstufft wrote:
| One important thing to remember here is that PyPI was
| originally started in 2002 as a weekend hack project that
| grew overtime to become the piece of critical infrastructure
| it is today. There's a lot of stuff in PyPI that exists as
| historical baggage and cruft and reviewing them just never
| bubbled up to be a priority. Likewise a lot of the policies
| it has have been added and grown overtime as something
| happened that caused us to need one.
|
| On top of all of that, it's volunteer run and has been
| understaffed for basically it's entire life, so sitting down
| and figuring out a proper data retention policy that takes a
| holistic view of everything we have just never bubbled up.
|
| In general I think we already do a pretty good job of
| collecting a minimal amount of data, and hopefully with
| proper policies we can do an even better job.
| thih9 wrote:
| After a quick glance at the information listed in the report
| I didn't notice excessive data collection on pypi's part.
|
| I'd say they followed "I guess we don't actually need that"
| approach reasonably well so far and good for them if they
| want to improve that even more.
| itake wrote:
| I can't tell if this is sarcastic.
|
| While they are transparent the events happened, they are not
| transparent about which packages and what authors are being
| flagged, which is unfortunate.
| thih9 wrote:
| Is it possible that they can't publish that? Perhaps even not
| allowed to say that they can't publish that?
| einpoklum wrote:
| > While they are transparent the events happened
|
| Considering they are admitting they will always obey
| government commands, including regarding non-disclosure of
| actions to affected users, it is prudent to assume they are,
| in fact, not transparent about events; only about those
| events which the government has let them tell you about.
| Other events (e.g. National Security Letters) may or may not
| have occurred.
| b33j0r wrote:
| Why don't nerds get the same rights?
|
| According to US news over the past 3-4 years, you can just ignore
| subpoenas, then get a contributor job on a cable news network.
| Bonus points, the more you flout the law as arrogantly as
| possible ;p
| HeavyStorm wrote:
| There were lots of specifics asks from the court. What if Pypi
| didn't had those data, like IP addresses? I don't remember ever
| recording those in a longstanding storage.
| jacquesm wrote:
| > We will not be releasing the usernames involved publicly or to
| the users themselves.
|
| Why not to the users themselves? Have they been prohibited from
| doing so? (TFA does not say afaict)
| ruffrey wrote:
| Often subpoenas are part of an ongoing investigation, and they
| require not releasing information to those who's data was
| subpoenaed.
| stonepresto wrote:
| The why: notifying a suspect in a criminal investigation
| could allow them to flee or take measures to avoid
| prosecution, destroy evidence, etc.
| tptacek wrote:
| The subpoena probably includes a nondisclosure clause; a court
| order certainly would. The mechanics of nondisclosures on
| subpoenas is interesting and I don't totally understand it (by
| definition, a subpoena is a document authorized by someone
| other than a judge).
| jacquesm wrote:
| So is this message a way to obliquely signal to those users
| (whoever they are) that they may be under investigation
| without actual disclosure?
| can16358p wrote:
| That might get PyPI into trouble especially with a gag
| order which we can assume that they are forced to obey and
| forced not to talk about.
|
| PyPI would pretty much want to inform the users, but they
| probably simply can't (without getting into legal trouble).
| [deleted]
| tptacek wrote:
| I doubt it. Most of these investigations (really: most
| federal computer-related investigations) are super boring,
| and are about things ordinary people wouldn't object to
| seeing investigated.
|
| We're a message board and we're thus optimized for drama
| over truth-seeking (it's just human nature). The truth of
| these kinds of events is usually not all that interesting.
| If it's something more dramatic, we'll hear more about it
| in the future. In, like, a sort of Bayesian sense, you can
| predict that any given subpoena or court order is going to
| be about a case nobody would bother sending warning signals
| about.
| bredren wrote:
| > Most of these investigations (really: most federal
| computer-related investigations) are super boring, and
| are about things ordinary people wouldn't object to
| seeing investigated.
|
| This is true. The result may be so boring local news
| wouldn't even cover it. In some cases you have to find
| the investigating agency's unremarkable press release and
| then dig for related court documents to even find out
| what happened.
| chaps wrote:
| There was no NDA: "We have waited for the
| string of subpoenas to subside, though we were committed from
| the beginning to write and publish this post as a matter of
| transparency, and as allowed by the lack of a non-disclosure
| order associated with the subpoenas received in March and
| April 2023."
| steve1977 wrote:
| ... for the suppoenas received in March and April 2023
| chaps wrote:
| Yeah, that was notably strange language for sure.
| tptacek wrote:
| Interesting! (I initially read this backwards and thought
| you were saying they did have an NDA).
| [deleted]
| jsjohnst wrote:
| > by definition, a subpoena is a document authorized by
| someone other than a judge
|
| Uhm, am I misunderstanding what you wrote, because that is
| definitely not true. Subpoenas require an officer of the
| court by definition (in the US anyway), which can be a judge,
| a court clerk, or even lawyers in some jurisdictions.
| tptacek wrote:
| Can a court clerk or a lawyer unilaterally create a
| nondisclosure requirement? It is not generally that case
| that a lawyer, absent a judge, can send you a document
| you're not allowed to disclose (though certainly lots of
| C&D's try to suggest otherwise).
|
| I'm sure the NDA stuff here is ironclad! I'm just curious
| what the mechanism is.
| jsjohnst wrote:
| > Can a court clerk or a lawyer unilaterally create a
| nondisclosure requirement?
|
| If they are acting as an officer of the court, which
| they'd need to be to sign off on a subpoena, I believe
| the answer is yes. The mechanism is called a "gag order".
| tptacek wrote:
| For subpoenas authorized under the Stored Communications
| Act, there's statutory authorization for DOJ to request
| time-limited NDAs, which makes me wonder if there needs
| to be explicit authorization for other kinds of
| subpoenas. This is the kind of noodling I'm doing here;
| I'm not trying to message-board my way to a first-
| principles argument that the NDA was bogus. :)
| lazide wrote:
| It's very common for a subpeona related to an ongoing
| investigation to include a gag order. For instance, if
| someone is investigating someone for a crime, and
| requests that users search history, the last thing they
| want is for Google et al to alert the user that this
| happened, as they may not be ready to arrest them yet and
| the target would flee.
|
| Same with wiretapping orders, or frankly a subpeona for
| pretty much anything from a third party.
| jacquesm wrote:
| I don't follow you, which NDA?
| vdqtp3 wrote:
| > Subpoenas require an officer of the court
|
| That's not entirely true.
|
| https://en.wikipedia.org/wiki/Administrative_subpoena
|
| Local organizations have come up with equivalents, although
| there is less (no?) statutory support for that.
| jsjohnst wrote:
| > Subpoenas require an officer of the court ... or an
| agent working for the government
|
| I left off the second part after the ellipses because
| it's not relevant to the current discussion and because
| there's constitutional challenges against them even when
| federally issued, as your link calls out. I didn't want
| us to tangent off needlessly. The law is a messy place,
| lots to find and hate.
| toast0 wrote:
| The users themselves already know their own usernames,
| presumably. They could let the users know they were subpoenaed
| without letting them know their username. :P
| shadowgovt wrote:
| That, or they have reason to believe the investigation is
| legitimate and they would prefer not to hinder it.
| jacquesm wrote:
| They say very explicitly that they do not know what it was
| about.
| shadowgovt wrote:
| There's a wide gulf between concrete knowledge and belief.
|
| I see an ambulance going lights-and-sirens behind me. I
| don't _know_ they 're on their way to or from a hospital,
| but I pull over because I have reason to believe they are.
| junon wrote:
| Weird analogy. An ambulance has a very narrow scope of
| responsibility. Legal processes have a very wide scope.
| Clearly this is related to a legal matter and not an
| immediate medical matter. But the nature of the legal
| matter could be a _very_ wide variety of things, ranging
| from lower court civil proceedings up to treason, etc.
| CodesInChaos wrote:
| They only wrote that they weren't told what it was about.
| However it might be obvious from the packages uploaded by
| those users (e.g. if they uploaded malware).
| weaksauce wrote:
| they have five usernames... that can narrow down what
| projects they were associated with pretty quickly to infer
| if there was something nefarious about them. though it
| could be entirely unrelated to their activity on pypi and
| be a trawl for leads based on username similarity from some
| other messageboard or activity that was used for
| illegality. though, thinking about it more, that seems
| legally dubious a reason to be able to get a subpoena
| issued for. ianal
| avgcorrection wrote:
| > The privacy of PyPI users is of utmost concern to PSF and the
| PyPI Administrators, and we are committed to protecting user data
| from disclosure whenever possible.
|
| Don't lead with this.
|
| > In this case, however, PSF determined with the advice of
| counsel that our only course of action was to provide the
| requested data.
|
| If you're going to say this.
|
| I'm not judging their decision. Maybe not going to prison is a
| greater concern to them. It's fine to just say that you thought
| it was best to comply because [lawyer reasons that you don't have
| to disclose to anyone]/ _counsel_.
|
| EDIT: Or say "there are bad people out there and we trust the
| DOJ". Whatever.
| tptacek wrote:
| Lighten up. Nobody's going to federal court to stop the DOJ
| from investigating botnets, carding rings, and ransomware
| scams, which is what these things are usually about. Nobody's
| mental model of PyPI was that they had Signal's priorities.
| mrguyorama wrote:
| Then they shouldn't say protecting their users are their top
| priority, because they have shown it is not. That's called
| lying. A correct statement would have been "we will comply
| with lawful LEO requests"
| junon wrote:
| How have they shown it's not, exactly? Really curious what
| you think they could have done better aside from blatantly
| going against laws in their jurisdiction.
| adamckay wrote:
| There's a difference between abiding by lawful court orders
| that have gone through judicial process and a friend in a
| police department calling in a favour.
| x0x0 wrote:
| Helping convict scammers, typo-squatters injecting
| malicious code, etc _is_ protecting their users. Just not
| the (likely) bad actors that are the subject of the
| subpoenas.
| hgsgm wrote:
| The fact remains, that unless you are willing to break
| the law, obeying the law is your top priority.
| junon wrote:
| If you're so inclined, you're welcome to make an anarcho-
| oriented package management system yourself. PyPi has
| never claimed to be one, though.
| ewdurbin wrote:
| This assumes that all of this is binary, when in reality
| it's a complex system that takes time and effort to
| modify in a meaningful and responsible way.
| [deleted]
| avgcorrection wrote:
| Then all the less reason to roll out the "of utmost
| importance" boilerplate. So what's your point?
|
| Also I don't see how being light-hearted has anything to do
| with this submission, Thomas.
| davidguetta wrote:
| Its just they have no choice. And when they do the choose
| their "utmost priority". Its not that complicated
| paulgb wrote:
| It's a completely reasonable reading of their message to assume
| that the "possible" in "whenever possible" roughly means
| "legal". I don't think any reasonable reading of it means to
| imply that they are willing to violate federal law.
| HelloNurse wrote:
| sudo give us user data
| avgcorrection wrote:
| Fair point.
| Mystery-Machine wrote:
| Oke way to protect user data is to NOT ask/collect data in
| the first place. What's the need of person's full name and
| address for? Maybe I'm missing the point, but I see zero
| reasons to have this data in the first place.
| [deleted]
| dubbel wrote:
| You are probably reading what data the DoJ requested.
| Further down in the blogpost (in the "Details" section)
| they state that they don't have a lot of the data
| requested and exactly what kind of data they could and
| did provide. Addresses are not requested by PyPI.
| junon wrote:
| And they state very clearly they don't have this
| information. In fact, PyPi seems to retain a very
| reasonable set of information, strictly related to the
| service itself. I found this disclosure to be entirely
| refreshing.
| masto wrote:
| If you read the whole thing, it's pretty clear they don't
| have the person's full name and address, and thus did not
| provide it. They do mention that it will be needed for
| organizations that sign up for billing when that feature
| becomes available.
|
| Other than possibly IP addresses, it seems like the only
| information they had available to disclose was close to
| the bare minimum needed to operate the service.
| avgcorrection wrote:
| That's the best principle to follow. Agreed.
| duxup wrote:
| I don't see anything conflicting in what they said.
|
| They can feel that way, and comply.
| avgcorrection wrote:
| Yeah. I was probably being a little too boilerplate (what
| looked like) -intolerant. ;)
| rektide wrote:
| It'd be lovely to see better patterns emerge to aggregate and/or
| anonymize data.
|
| Great respect for the response. Reevaluating data retention is a
| great move.
| phendrenad2 wrote:
| An important aspect here is the fact that subpoenaes only share
| information one way. You are asked to provide information, and
| you get zero information about why. There is a simpler way to get
| information: Contact the person you want information from and
| make the case that they should give you the information. Using a
| subpoenae seems like something a government would do when they're
| doing something shady and don't want you to know about it.
| casey2 wrote:
| How come when PyPI hosts unwanted malware they get subpoenaed but
| when Apple or Microsoft or anyone else with a big team of lawyers
| distributes auto-installing "updates" designed to harm/scam users
| the DOJ is silent?
| account42 wrote:
| > PyPI retains records of all changes to projects on the index,
| and has since 2002-11-01 17:11:36 UTC.
|
| > submitted_from | IP Address
|
| > PyPI retains records of critical user events including account
| creation, emails sent, email address changes, logins, and login
| failures. See this list for the comprehensive set of events
| recorded.
|
| > ip_address_string | IP Address
|
| Retaining IP addresses for over a decade doesn't sound GDPR-
| compliant.
| jupp0r wrote:
| "9. IP download logs of any Python Package Index (PyPI) packages
| uploaded by the given usernames"
|
| This was the point where I was wondering if this is really about
| some malicious packages or something more along the lines of
| copyright infringement software.
| femto113 wrote:
| This definitely seems like a significant element of the ask,
| but for any popular package a list of all the downloaders would
| be pretty overwhelming in size (and I think of very limited
| utility). I'm guessing that some versions of some more obscure
| package(s) were identified as being used in an attack and
| they're either trying to identify potential attackers or other
| victims (or both) of that attack.
|
| From a 2021 article[1] about packages used to deliver malware
| "we have alerted PyPI about the existence of the malicious
| packages which promptly removed them. Based on data from
| pepy.tech, we estimate the malicious packages were downloaded
| about 30,000 times."
|
| For comparison yt-dlp has tens of millions of total downloads
| and gets downloaded over 70,000 times every day [2]
|
| [1] https://jfrog.com/blog/malicious-pypi-packages-stealing-
| cred...
|
| [2] https://pepy.tech/project/yt-dlp
| NelsonMinar wrote:
| Total speculation on my part but PyPI hosts yt-dlp, the
| unauthorized video downloader. https://pypi.org/project/yt-dlp/
| WhyNotHugo wrote:
| Unlikely, due to:
|
| > "Records of all Python Package Index (PyPI) packages uploaded
| by..." given usernames
|
| > "IP download logs of any Python Package Index (PyPI) packages
| uploaded by..." given usernames
|
| I don't think they'd want a list of packages uploaded by a
| given user if they were after yt-dlp devs. They'd be asking for
| a list of maintainers of a given package.
| phkahler wrote:
| Thanks, I was wondering what it might be about. That makes some
| sense.
| schleck8 wrote:
| No it doesn't. Noone at the government level gives a shit
| about a youtube downloader package, typosquatting would be
| way more likely. Pypi is riddled with malware AFAIK, they
| don't really moderate it.
| ewdurbin wrote:
| I took a report down within 3 minutes of upload today. We
| have regularly received comments from our 3rd-party
| reporters that we are the most responsive.
|
| You are wrong.
| ed25519FUUU wrote:
| If yt-dlp was illegal the first thing they'd do is a takedown
| request, not a subpoena but leave it online.
| [deleted]
| heavyset_go wrote:
| That's if they want to go down the DMCA route and aren't
| using a subpoena in a different case.
| NoZebra120vClip wrote:
| But what if they want records on everyone who downloaded a
| tool?
| vore wrote:
| I would think the government has bigger fish to fry than to
| spend time subpoenaing yt-dlp.
| Sparkyte wrote:
| I wouldn't be surprised if it was more of AI based
| impersonation stuff. AI in the government is big because
| people can use it impersonate people as a form of identity
| fraud.
| [deleted]
| dual_dingo wrote:
| Not a US cititzen, but "The government" is a wide term and
| any law enforcement agency would fit this, including the ones
| that are responsible to deal with things like copyright
| enforcement - that's exactly the type of fish they exist to
| fry ...
| vore wrote:
| Given the discussion around how lacking PyPI supply chain
| security is, how juicy of a target it is for attackers, and
| how critical infrastructure is probably relying on PyPI,
| yt-dlp is the last thing on my mind.
| ChuckMcM wrote:
| FYI for non US readers ...
|
| In the US, subpoenas come from the Justice Department
| (either state or federal depending on the crime for which
| evidence is being sought). The court that issued the
| subpoena is on it, and the person or entity being served,
| has the right to see _why_ some government agency felt it
| could aid in the uncovering of a crime that had _already_
| been committed. The person or entity then has the
| opportunity to challenge that in court prior to complying
| with it. This is sometimes informally called "quashing the
| subpoena." From my sister-in-law who is a defense attorney,
| the most common result of challenging a subpoena is to get
| what it asks for narrowed down to just what is plausibly
| responsive.
|
| In the article, this response: _As a result we are
| currently developing new data retention and disclosure
| policies. These policies will relate to our procedures for
| future government data requests, how and for what duration
| we store personally identifiable information such as user
| access records, and policies that make these explicit for
| our users and community._ Is good practice for limiting
| what a subpoena can request (you can 't give what you don't
| have).
|
| At Blekko we logged access records in such a way that we
| could use PII for 48 hours and then it was deleted. The
| CTO, Greg Lindahl, is a huge privacy advocate and this sort
| of architecture made it possible to get information to
| improve our ranking and service without compromising
| people's privacy. In practice I don't think any agency
| could go from "we have a suspect" to "issue a subpoena" in
| 48 hrs so it was a useful way for us to stay out of the
| crosshairs. The most interesting event was the FBI asking
| for information on IP addresses that had accessed their
| honeypot CSAM site. That turned out to be some of the
| machines in the crawling cluster. Given that the site was
| outside the crawl "horizon" and didn't rank (very few sites
| linked to it) it didn't even make it into the cache for
| rank analysis. But in that case the turn around time was
| impressive. Of course that is because they were just using
| their own logs to generate subpoena requests.
| sroussey wrote:
| You can get subpoenas that ask for data longer than your
| window, in which case you have to have a longer one, even
| if the reachback is shorter.
|
| Watch out for smaller jurisdictions that might have "you
| should have expected" laws that says your 48hr window is
| too short.
| ChuckMcM wrote:
| As I recall (and I'm not a lawyer so don't rely on this
| advice) the lawyers had advised that as long as the
| retention period was published, even if a subpoena asked
| for a longer look back you could meet your obligation by
| returning "all the data you had" which would only be
| 48hrs worth.
|
| Had a jurisdiction said, "You should have expected ..." I
| expect our response would have been, "We have published
| what we retain, me meet conform to federal and state laws
| you knew ahead of time we wouldn't have more than 48 hrs
| worth."
|
| That said, jurisdiction when it comes to the Internet is
| always kind of "weird". Did you use the web service in
| your house in Columbus OH, or did you use the web service
| on a server in a data center in California? Also as I
| recall our TOS also had a requirement that any legal
| action be brought in California but I don't think we ever
| tested that in court.
| sroussey wrote:
| I tested the court jurisdiction a few times, but had
| mixed results. I tried to quash first anyhow.
|
| The NSA and SS can get quite testy about it and make you
| wish you were dealing with the FBI.
| throwaway09223 wrote:
| Google is a pretty big fish themselves.
|
| What usually happens is the large corporation lays out a case
| like "yt-dlp is responsible for billions in damages" and they
| press the DOJ to investigate and prosecute.
| account42 wrote:
| AFAIK Google hasn't even taken any civil action against
| y(ou)t(ube)-dl(p) at all, that was all the music industry.
| sp332 wrote:
| While copyright infringement is usually a civil matter, there
| are times the DoJ gets involved. They even got a guy
| sentenced to jail for it in 2018.
| https://www.justice.gov/usao-ndga/pr/owner-sharebeastcom-
| sen...
| heavyset_go wrote:
| The FBI does sting operations to arrest homeless people who
| sell bootleg movies and bags on the street.
| sam0x17 wrote:
| One would think that yes.... but this is the U.S. :/
| astrea wrote:
| Amazingly hilarious comment given the history of copyright
| prosecution.
| vore wrote:
| Given PyPI has been a vector for distributing malware into
| dependency chains, wouldn't you think that would be a more
| likely target for the DoJ over one of HN's favorite axes to
| grind?
| lazide wrote:
| The FBI has it's own 'copyright enforcement' division who has
| as their sole job enforcing copyright, and has it's own
| dedicated funding
|
| [https://archives.fbi.gov/archives/news/testimony/intellectua
| ...]
| RobotToaster wrote:
| Isn't copyright infringement a tort not a crime? Why is the
| FBI involved at all?
| qingcharles wrote:
| Depends on the level of infringement generally.
| RoyGBivCap wrote:
| Because the people rich enough to own big copyrights can
| afford politicians.
| dmix wrote:
| https://en.wikipedia.org/wiki/No_Electronic_Theft_Act
|
| > Introduced in the House as H.R. 2265 by Bob Goodlatte
| (R-VA) on July 25, 1997
|
| > Committee consideration by United States House
| Committee on the Judiciary and United States Senate
| Committee on the Judiciary
|
| > Passed the House on November 4, 1997
|
| > Passed the Senate on November 13, 1997
|
| > Signed into law by President Bill Clinton on December
| 16, 1997
| mindslight wrote:
| Every time I'm reminded of this law, specifically the
| year of its passing, I'm newly surprised. With some
| digital authoritarian laws, I'm acutely aware that they
| are only recent history (eg FOSTA, DMCA, bank
| surveillance, "Patriot" act). But with the NETA and the
| CFAA I have to work at remembering that things weren't
| always this way, as recently as only a few decades ago.
| Like imagine the different world we could be living in if
| they had failed at becoming law and things had developed
| without them.
| lazide wrote:
| The nominal reason for the passing of the law was
| widespread use of VCRs, which allowed non-centralized and
| difficult to control recording/copying, distribution, and
| at home playing where usage couldn't be monitored (like
| at a theatre which can be audited).
|
| Before that, it would involve something like literal
| film, which didn't scale well, and was too expensive and
| difficult for a typical person to do at home. It still
| happened, but was VERY niche.
|
| With VHS/VCRs, someone could spend a couple thousand
| dollars and make hundreds of bootleg copies of any
| blockbuster video out there from their garage, and it was
| easy to literally go to Blockbuster(tm) and get an copy
| to duplicate without being tracked. Easy money. Folks
| would sell them out of the back of (literally) vans, or
| through friends, or via flea markets, etc.
|
| It's still super prevalent in Asia, using DVD/Blu-ray's.
|
| In the US, it then eventually got applied to the
| internet, because it was even easier and more scalable
| using computers, and harder to track down the culprits.
|
| It's all about money in the end of course.
| lazide wrote:
| Ah, back in the days of bipartisanship.
| lazide wrote:
| [https://www.justice.gov/archives/jm/criminal-resource-
| manual...]
|
| There is an applicable federal criminal law.
| not2b wrote:
| It seems much more likely that some typosquatter managed to
| compromise the security of government sites by uploading
| malware, and Uncle Sam wants to catch the culprit.
| stonepresto wrote:
| Or they're chasing threat actors, ransom groups, etc as part
| of a larger investigation.
| slenk wrote:
| yt-dlp is everywhere - why would they go after pypi and not the
| source at https://github.com/yt-dlp/yt-dlp
| heavyset_go wrote:
| Not that I necessarily believe this is happening, but this
| can be a case of making an example out of anyone that wants
| to distribute the software they wanted censored via chilling
| effects.
| slenk wrote:
| Ah, fair. Wouldn't be the first time the US Gov't did that
| CarbonCycles wrote:
| What an odd article and release statement. It's almost as if
| they're signaling w-out literally signaling the parties of
| interest.
|
| Surprised the doj didn't issue any gag orders.
| rossdavidh wrote:
| One gets the impression that this was an artfully crafted way
| around the specifics of the gag order, to disclose whatever
| wasn't specifically prohibited by it. IANAL.
| throwaway_13140 wrote:
| Exactly. I guess the transparency is nice but at what point are
| you potentially helping someone cover their tracks who may or
| may not actually deserve that help?
| rolph wrote:
| [In March and April 2023, the Python Software Foundation (PSF)
| received three (3) subpoenas for PyPI user data. All three
| subpoenas were issued by the United States Department of Justice.
| The PSF was not provided with context on the legal circumstances
| surrounding these subpoenas. In total, user data related to five
| (5) PyPI usernames were requested.]
|
| either a small group of users, or one user with multi aliases
| wrote a nastyapp ?
| morkalork wrote:
| Is there a way to be only contactable in public? Like say a blind
| man standing in a town square, where any subpoena would have to
| be read out loud to them in earshot of anyone walking by? Is such
| a thing possible, digitally?
| cubefox wrote:
| Apparently no plans to set up a canary.
| jrockway wrote:
| Is there any precedent for people not facing legal consequences
| for failing to update the canary? The subpoena probably says
| "and also update your warrant canary to say there were no legal
| requests." Now you're in contempt of court and in jail for 5
| years while you wait for your "compelled speech" case to go to
| the Supreme Court.
|
| In general, I think it usually goes poorly when programmers
| invent clever legal workarounds. The legal system isn't a
| computer program. It's guys with guns.
| JohnFen wrote:
| > The subpoena probably says "and also update your warrant
| canary to say there were no legal requests."
|
| I think that would be outside what can be done with a
| subpoena. It would require a court order.
| buildbot wrote:
| Isn't the idea that the (US) government can't (technically)
| compel you to lie?
| tptacek wrote:
| The US compels certain kinds of speech all the time.
| dwheeler wrote:
| The US government is not compelling speech, it's
| compelling PyPI to accurately reveal to the US government
| the contents of past speech that PyPI has access to.
| Compelling disclosure of certain kinds of data, when it's
| known, is a normal part of legal actions in the US and
| probably elsewhere.
| akerl_ wrote:
| You seem to be describing what these subpoenas have
| requested. This thread is about canaries, and whether the
| government could compel a company to keep one updated
| against their will.
| mrguyorama wrote:
| You can beat the wrap but not the arrest.
| waselighis wrote:
| I would think there are certain situations where a person
| might be compelled to lie, such as if you have a security
| clearance, have signed an NDA, or are acting as an
| informant. That is, a person may have to lie to prevent
| divulging classified or secret information through
| implication.
|
| EDIT: One situation where the government cannot compel you
| to lie is if it violates your fifth amendment rights (self
| incrimination).
| sigstoat wrote:
| those are all things you actively agreed to, in advance,
| in exchange for some sort of consideration (job, not
| going to jail for illegal things you've already done,
| etc)
| rossdavidh wrote:
| I have never heard any legally competent source say that
| the U.S. government cannot (with warrant or whatever)
| compel you to lie. I'm pretty sure that, in the case of a
| canary, they can.
| User23 wrote:
| The process is the punishment.
| linsomniac wrote:
| "Just because you're right doesn't mean you won't go
| bankrupt in a court of law proving it."
| dennis_jeeves1 wrote:
| That's real world wisdom...
| asne11 wrote:
| Please, we do it routinely. They're called "informants."
|
| At the end of the day if uncle Sam demandeth, uncle Sam
| will haveth.
| short_sells_poo wrote:
| That may be the case but if the cost of testing it is 5
| years in jail while the case works it's way through the
| courts, few people will be willing to rely on it.
| EatingWithForks wrote:
| The better question is: are you (or PyPI in this case)
| interested in a legal tussle with the US Gov?
| bitxbitxbitcoin wrote:
| Exactly. Warrant canaries are security theatre.
| actionfromafar wrote:
| Not always, if the entity has a stance to uphold and the
| money to fight back, it doesn't have to be.
|
| If a mom-and-pop shop or open source org, it's a faint hope
| at best.
| burnished wrote:
| Can a subpoena stipulate that?
| redox99 wrote:
| Can you provide any evidence of the US forcing someone to
| update their canary?
| snapcaster wrote:
| How would one even observe this evidence?
| metiscus wrote:
| The only way I can think of would be that after the case
| has ended it may be possible for a party who had been
| directed to update a canary under a court order to notify
| people that they had done that. It would probably depend
| on the court etc and I am not a lawyer.
| woodruffw wrote:
| I don't understand (genuinely, I'd like to!) what a warrant
| canary would have done here: this was a subpoena, not a
| warrant, and PyPI is a public package index.
| cubefox wrote:
| I'm obviously talking about a subpoena canary.
| Zetice wrote:
| If you can just say, "We got subpoenaed" in a blog post, isn't
| that even more effective than a canary would be?
| cubefox wrote:
| There was a delay.
| caturopath wrote:
| Canaries would be for times when they couldn't legally say
| that.
| waselighis wrote:
| Long ago, Apple included a warrant canary in their transparency
| report. One day, it disappeared. Nothing came of it.
|
| https://www.theverge.com/2014/9/18/6409575/apple-warrant-can...
|
| The problem with a warrant canary is there's too much doubt
| about why it disappeared. Did they actually receive a warrant,
| or is it just a decision from corporate to discontinue the
| practice?
| cubefox wrote:
| There can be some doubt, but too much?
| actionfromafar wrote:
| A decision from corporate to discontinue is also a signal.
| DANmode wrote:
| > why it disappeared
|
| The result is the same.
| tptacek wrote:
| Canaries probably don't work, which makes them worse than
| theater.
| skullone wrote:
| Why would they? It's a public repository, nothing confidential
| or private
| JohnFen wrote:
| Account details are confidential and private.
| __MatrixMan__ wrote:
| Kudos to PyPI for handling this professionally.
|
| That said, I think we should be working towards a world where
| they're unnecessary. As a middle party to what ought to be a
| developer/developer trust relationship, they're attack surface
| that threatens depender sometimes and dependee other times.
|
| Going peer-to-peer will be less convenient, but worth the
| investment in the long run.
| ChrisMarshallNY wrote:
| That's an excellent transparency report.
| dpifke wrote:
| Being reminded that PyPI is a target for law enforcement makes me
| even more irked that they've removed end-to-end package signing
| without providing a replacement[0].
|
| PGP signatures--even though rarely used--would allow someone to
| verify that a signed package was not modified by PyPI after being
| uploaded by its original author.
|
| Without any sort of signing mechanism, we have to trust the U.S.
| Government to never demand that PyPI insert a backdoor, via a
| National Security Letter, FISA court order, or other kangaroo
| court process. Good luck with that.
|
| The existing PGP signing mechanism had usability issues and
| security footguns[1], but was better than nothing. It's a shame
| they didn't roll out a more usable and secure alternative
| _before_ removing the existing functionality.
|
| [0]: https://news.ycombinator.com/item?id=36044543
|
| [1]: https://blog.yossarian.net/2023/05/21/PGP-signatures-on-
| PyPI...
| wokwokwok wrote:
| If you want to start with tinfoil hat theories, think about
| this:
|
| The PGP signatures were removed, nominally because few people
| used them. ...but the timing of the removals is coincidental,
| no?
|
| "You need to have a backdoor that lets us see who's downloading
| what packages and let us inject custom code to particular
| targets"
|
| "That's technically impossible because of..."
|
| "Here is a court order. Implementation is your problem. You're
| not allowed to tell anyone you even received a court order."
|
| "...well, I guess signed packages have to go then..."
|
| (:
|
| I don't actually believe that, since PGP signing was frankly,
| barely used and really there's hardly any meaningful difference
| between a PGP you can't verify (which was most of them) and not
| having it; in fact the illusion of security is probably worse
| than not having it at all.
|
| ...but still. As you say. It sucks there's no meaningful
| replacement for it.
| donaldstufft wrote:
| I would resign from PyPI before I ever allowed a backdoor to
| be installed.
|
| I haven't explicitly asked, but I would be very surprised if
| any of the other PyPI admins felt differently.
| [deleted]
| wraptile wrote:
| PyPI is clearly a passion project for the team and Python
| community in general so I can't imagine that anyone would
| allow this or die on this hill to save their salary.
|
| I've tried to dig around whether there's any history or
| potential of government stopping company from ceasing
| operation/resigning and honestly nothing came up that
| wasn't ww2 related. So, I think it's pretty safe to rule
| out PyPI from doing anything like this.
| dpifke wrote:
| My comment was not meant to imply that PyPI admins would
| be OK with this, but the sad situation in the U.S. (and
| Australia, and other places) is that they'd probably face
| jail time if they refused to comply. You can't avoid
| complying with a court order by saying, "sorry, I quit."
| (And even if "sorry, I quit" was a valid response, you'd
| be facing tens of thousands of dollars in legal fees to
| justify it, with a gag order in place that meant you
| couldn't raise a legal defense fund.)
|
| If you're looking for examples of what the NSL process is
| like, Nicholas Merrill's story[0] comes to mind.
|
| Further, the fact that admins have this power--even if
| they'd never use it--makes them an attractive target for
| black hats. If backdooring packages was easier to detect,
| it'd be a less attractive option for those that might
| want to do so.
|
| I'm still hopeful that they'll re-implement some sort of
| end-to-end signing mechanism, sooner rather than later. I
| trust PyPI and the people behind it, but I'd like to be
| able to verify.
|
| [0]: https://en.wikipedia.org/wiki/Nicholas_Merrill
| donaldstufft wrote:
| Well, AFAIK it's not clear that in the US the courts have
| the right to compel someone to modify their software in
| that way. The FBI holds that it does, but so far it's
| been fought and they've given up when they've tried it. I
| think if such a thing were to happen, the fundamental
| ability to secure any software goes out the window. Even
| package signing, etc go out the window because they can
| just compel you to produce new software, signed with your
| existing key.
|
| But let's step back a moment and presume that they do
| have that ability to compel. The first step here is that
| none of the PyPI Administrators are the legal owners of
| PyPI, so such an order would not be sent to any of us,
| but rather to the PSF itself. The PSF would then be on
| the hook to either comply or fight said hypothetical
| order, but individual members of the administration team
| would _not_ be, and would be free to quit. They may not
| be able to say _why_ they 've quit, but quitting AFAIK
| would be entirely possible.
|
| The PSF, while not having Apple's war chest, does retain
| counsel for dealing with things like this, and I can say
| personally I'd spend myself broke before I'd be willing
| to do so.
|
| We are going to be implementing signing, and I'm hoping
| we'll be able to make strong progress on that soon.
| dhx wrote:
| Perhaps look at Gentoo's model of a single monolithic Git
| repository. It is possibly the largest and most distributed
| Merkle tree of software distribution signatures in existence.
| It is updated a few times every hour by a diverse community and
| each commit has to be GPG signed so you have the opportunity to
| verify signatures by looking up developer websites, slides from
| FOSS conferences, etc to confirm whether the keys have been
| widely published.
|
| There are some caveats:
|
| * Avoid -9999 packages as you won't get any guarantee of
| authenticity of whatever will be obtained from the upstream
| repository, other than whatever trust you place in a X.509
| certificate that in all likelihood is controlled by either
| Microsoft (GitHub) or otherwise accessible to Amazon, Google,
| etc by nature of common open source project hosting
| arrangements.
|
| * When syncing your local repository, verify all changes since
| your last sync. This could be as simple as syncing to a point
| n-days ago, after which numerous developers you know have
| signed more recent commits on top (you at least know those
| developers have been impacted too if the whole repository was
| compromised and the compromise is now on the public record).
|
| * You don't really know how many people are using the packages
| you care about, and thus how many other people across the world
| are also exposed to (and possibly reporting problems with)
| signatures that Gentoo developers have committed.
|
| In addition to relying on existing sources such as the Gentoo
| Git repository, an additional way to build trust is setting up
| software "looking glass" tools in different jurisdictions to
| check that software downloaded from different carriers in
| different jurisdictions are all the same.
|
| At least with these measures the attacker has to compromise
| everyone and make this compromise a public record, rather than
| just silently compromise one target.
| woodruffw wrote:
| I'm the author of that post. There is absolutely no meaningful
| sense in which PyPI's previous PGP support was (or ever did)
| provide end-to-end package signing. At the absolute most, when
| used correctly (which, overwhelmingly, it was not), it provided
| _one half_ of package signing.
|
| The other half (key retrieval and identity binding) was never
| provided, because PGP as an ecosystem made doing so
| intractable. It was not better than nothing, because it was
| nothing; anything you could have done with it can be done with
| your own sidecar signatures.
| gardnr wrote:
| One half is better than nothing. Even if it just made users
| wonder what it was, it was better than nothing.
| omginternets wrote:
| One half of a secure system is just an insecure system.
| Attackers get to pick which half to attack.
| bombolo wrote:
| That's how security works... it's not an all or nothing
| process.
| woodruffw wrote:
| Every security design is built out of a matrix of
| factors, and some (but not all) of those factors can be
| made zero.
|
| Being unable to verify your trusted identities in a PKI
| is one such "zero factor." It makes the PKI strictly
| equivalent to (crappy) resource integrity _at the best_ ,
| which is when everything is signed. PGP on PyPI didn't
| even manage to clear that hurdle; it was worse than
| nothing by virtue of advertising properties that it was
| incapable of providing. That too is a zero-able factor in
| a security design.
| omginternets wrote:
| Actually, it very commonly _is_ an all-or-nothing
| process. It doesn 't matter how robust the lock on your
| front door is, if there is no lock on the back door, or
| if your window can be smashed. This especially true when
| it comes to cryptographic security, which is the subject
| at hand.
|
| I suspect the source of your confusion comes from the
| idea of differential security, which is approximately "I
| don't need the best lock; I just need a better lock than
| the other guy". Again, note that this does not apply to
| cryptographic signing of packages. Note also that the
| question of whether or not your system actually _is_ more
| secure than the other guy 's is very much a binary
| distinction: it either is or it isn't. You can quantify
| this quite easily by counting vulnerabilities, or by
| analyzing the degree of access gained for each
| vulnerability that is encountered.
|
| So yeah, it's one of the few things that tends to be all-
| or-nothing (up to some threat model, of course).
| brabel wrote:
| PGP didn't make it intractable, the problem is itself
| intractable... you're referring to the public key
| infrastructure (PKI)[1] problem, which many have tried to
| solve and failed.
|
| PGP can use the only known solution to the problem, which is
| letting several key servers be configured by the user to
| import keys (which can then be verified by checking the key
| fingerprint on another source which is "trusted", like the
| publisher's own website).
|
| You can still import keys by physically exchanging trusted
| keys with others (so called Key Signing Party[2]) but that
| obviously cannot scale... or using any innovative method you
| come up with, but no one has found a bullet proof way to do
| this that's usable.
|
| But saying PGP only solves half the problem is wrong. It
| solves one problem: that of how to verify a publisher's
| artifacts were not modified, which is valuable.
|
| The next problem to solve is how to obtain and vet public
| keys from publishers. The solution could work somewhat like
| TLS certificates (with certificate authorities playing the
| role of trusted key servers) or using blockchain (perhaps a
| rare problem for which blockchain could actually be helpful)
| but both of these bring their own issues with them. If you
| know of a better solution, though, do bring it up instead of
| throwing the bathwater out with the "baby"!
|
| [1] https://en.wikipedia.org/wiki/Public_key_infrastructure
|
| [2] https://en.wikipedia.org/wiki/Key_signing_party
| woodruffw wrote:
| I think it'd behoove you to read the original thread from
| yesterday: all, and more, of this was covered!
|
| PKI is indeed hard, but it's not even remotely intractable.
| The Web PKI is a functioning PKI; yesterday's thread
| explains how the codesigning scheme we're building for PyPI
| is going to look very similar to the Web PKI.
|
| At the ecosystem level, PGP was not providing resource
| integrity to PyPI: too many of the keys involved were weak,
| and only a tiny proportion of packages were even signed.
| Even if that proportion was 100%, PGP would have been the
| wrong tool for that job: PyPI _already has_ transport and
| resource integrity via the right tools: TLS and digests.
| Using an untrusted signature for resource integrity is
| using the wrong tool for the job.
|
| The original thread contains multiple references to
| Sigstore, which is the scheme we're planning on building on
| for PyPI.
| lll-o-lll wrote:
| Why sign at all? Isn't the key requirement that the
| component was not tampered with after upload? All you need
| is a hash for that...
|
| Tracing back the code to a legal entity seems unnecessary
| in the majority of cases.
| brabel wrote:
| Signing is basically hashing + proof of who created the
| hash. You need either both, or a way to find which hash
| is correct according to someone, usually the owner of the
| artifact, and signing gives you just that.
| woodruffw wrote:
| Signing is only proof of identity _if_ you (1) know the
| underlying identity, and (2) actually trust that identity
| for intelligible reasons (i.e., you can produce a formal
| description of the trust relationship).
|
| Without those two conditions, a signature is a digest
| produced by an untrusted party. For PyPI, that means that
| PGP signatures are no better than (and in some senses,
| worse) than PyPI's own digests, since PyPI at least is a
| currently trusted party.
| Groxx wrote:
| A centralized host can't ever be the only reasonable
| option for trust. They can be manipulated, technically or
| socially, and that makes everything vulnerable at once.
|
| Both are useful.
| woodruffw wrote:
| The Web PKI is built around centralized roots of trust,
| and survives because of concerted efforts to make those
| roots resilient, trustworthy (in terms of underlying
| ownership), and publicly auditable (with mechanisms like
| CT).
|
| To the best of my knowledge, there has _never_ been a
| successful decentralized PKI. Even the most successful
| uses of PGP are not decentralized; they 're essentially
| private PKIs maintained by a small set of presumed
| trustworthy maintainers.
| Groxx wrote:
| PGP absolutely is decentralized - I can trust or distrust
| key X without communicating at all with any external PKI.
|
| I agree that's not all that useful on a global scale - it
| essentially degrades to the current PKI setup then,
| because validating everything is expensive and doesn't
| need to be done by everyone every time to get nearly all
| of the benefit. But it _is_ a significant difference for
| individuals making individual decisions.
| brabel wrote:
| Did you not read the parent comments? You're just
| repeating what was already said.
| lll-o-lll wrote:
| But a hash provides proof to the actual uploader of
| subsequent tampering. As you cannot modify the hash
| without the originator being aware, I think it is enough.
| Hackbraten wrote:
| If those agencies can order PyPI to insert a backdoor, wouldn't
| they be able to coerce keyservers into updating the public key
| at the same time?
| upofadown wrote:
| Trust in PGP land is end to end. The keyservers don't matter.
| They are only a place to pick up keys. Your software verifies
| that the key is unchanged in that the fingerprint is
| unchanged. Otherwise it is treated as a separate key. Dead
| simple.
|
| The confusion here comes from the confusion in the PyPI
| article about PGP. The article complained that many keys
| could not be found on keyservers as if that mattered.
|
| The Debian web of trust is a good example of how this stuff
| actually works. Before you can submit packages to Debian you
| have to get an existing Debian developer to sign your PGP
| key. In Debian the trust flows downward from older developers
| to newer developers.
| donaldstufft wrote:
| > Before you can submit packages to Debian you have to get
| an existing Debian developer to sign your PGP key. In
| Debian the trust flows downward from older developers to
| newer developers.
|
| This is not how signing works in Debian at a technical
| level. At at technical level uploading to Debian requires
| them to add your key to a list of keys maintained by the
| archive administrators. As a matter of policy those
| administrators ask you to get your key signed by an
| existing Debian Developer, but at no point does their
| upload infrastructure check that or use the Web of Trust.
| upofadown wrote:
| That list of keys maintained by the archive
| administrators are signed by debian developers. That is
| how the archive admins can be sure that the key is in
| some sense legit. Otherwise where would be the root of
| trust?
| donaldstufft wrote:
| The root of trust for uploads is the listed of signatures
| maintained by the archive administrators, flat out.
|
| The requirement for having individual keys signed by
| Debian Developers just makes it easier for the archive
| administrators to decipher which keys they want to add to
| their root of trust. The upload system does not check
| those signatures _at all_ , they do not need to exist in
| the slightest as far as the upload system is concerned.
| mistrial9 wrote:
| this seems motivated ulterior to the topic, or making a
| mountain out of a small hill for other reasons. The act
| of approval is done approximately manually at first, with
| automation supporting that decision over time. Perfect
| machines are in short-supply, so to this day there is
| some manual aspect to this, which is faulted with a tone
| that is dire ... doesn't add up based on my understanding
| of this
| froh wrote:
| the original uploaders key? without anybody noticing? I don't
| think so.
| [deleted]
| LordShredda wrote:
| I'm guessing some poor typosquatter managed to hit a gov agency
| and is about to get alphabet soup all over him.
| quickthrower2 wrote:
| Putting my conspiracy hat back in the closet, I guess there is
| plausible reason to believe that someone used PyPI for fraud,
| CP distribution or some other crime.
| mistrial9 wrote:
| accusations and planting evidence are everyday things in some
| security circles.. plus idiots abuse open systems.. not proof
| of malfeasance, maybe just a "setup"
| paulddraper wrote:
| > poor typosquatter
|
| :/
| fmajid wrote:
| More likely it is DRM-cracking packages.
| eur0pa wrote:
| That or fairly unlucky bug bounty hunters
| [deleted]
| nonrepeating wrote:
| "Get alphabet soup all over him"
|
| This is my new favorite alternative to "vanned" (or "v&")
| tenpies wrote:
| > "vanned" (or "v&")
|
| Also note that the noun associated with being "vanned" would
| be a "party van", not just a "van".
|
| To be vanned/V& is to have the glowies inside the party van
| take the vanned party away.
|
| https://knowyourmeme.com/memes/4chan-party-van
| the_jesus_villa wrote:
| lots of nostalgia for partyvan.org during the chanology
| days
| greggh wrote:
| Feeling the same.
| flyinghamster wrote:
| I think I'm gonna snarf that one too. It's just too good.
| techbro92 wrote:
| Think I'm gonna snarf snarf. Actually I just looked it up
| and apparently that word means to eat or drink greedily.
| Not sure why you used it here
| GrinningFool wrote:
| Also, https://en.wikipedia.org/wiki/Snarf_(ThunderCats)
| codetrotter wrote:
| https://youtu.be/ikiuMXuueL4
| nonethewiser wrote:
| Well you certainly snarfed it up
| pjbeam wrote:
| As in eagerly consume into poster's lexicon I think.
| lagniappe wrote:
| it means copy http://acme.cat-v.org/readme
| MisterTea wrote:
| All of plan 9 uses "snarf" in place of "copy".
| techbro92 wrote:
| Wow, that's insane
| labster wrote:
| Do they follow the Berne Convention on Snarfright?
| NoZebra120vClip wrote:
| Only if there aren't many Trekkies going that year!
| valleyer wrote:
| http://www.catb.org/jargon/html/S/snarf.html
| [deleted]
| stonepresto wrote:
| I'd like to put $5 on "ransomeware threat actors"
| Liberonostrud wrote:
| How can you pronounce this word?
___________________________________________________________________
(page generated 2023-05-25 23:01 UTC)