Brexit deal mentions Netscape browser and Mozilla Mail

https://www.bbc.co.uk/news/technology-55475433

by spzb • 6 years ago

338 171 6 years ago

bbc.co.uk

notRobot2• 6 years ago

Politicians should consult with experts. They almost never actually do. We shouldn't tolerate this. And yet, we always will.

dt3ft• 6 years ago

Shouldn't experts be more politically active?

notRobot2• 6 years ago

It's on the people making the laws to make sure that said laws are up-to-date and appropriate. It's literally their job. Blame them for not doing it well.

kristopolous• 6 years ago

It's the politicians responsibility.

If you are say, writing IP and finance code, is it your responsibility to seek legal counsel or is it the legal profession's responsibility to somehow find you, discover what you are doing, and then impose themselves upon you?

fogihujy3• 6 years ago

Why? Expertise within a specific field does not equal political ambitions.

Lio• 6 years ago

Hard to be more active when the architects of Brexit have strongly made clear that they’ve “had enough of experts” when they failed to find a single expert economist who thought Brexit was a good idea[1].

I don’t know which is sadder that our current leaders are so incompetent or that people must have known that and voted them in with a big majority anyway. Speaks to how poor the opposition were too.

A pox on both your houses! :P

1. https://www.indy100.com/people/coronavirus-advice-experts-mi...

jeofken• 6 years ago

Politics is for those who want to control other people

elygre• 6 years ago

Likewise, experts (here: we, the people of hackernews) should consult with other experts. Like those diplomats that write agreements like this.

It seems to me that the purpose of ANNEX LAW-1 is to incorporate existing EU law into this agreement. It seems like they wanted to avoid creating a new text, just because the old one was, well, old.

We probably have something similar in our programming professions: If I am to split a monolith into microservices, I'd avoid rewriting the business logic at the same time. Reuse the existing business logic, and then revisit it once the architecture itself is stable.

Stevvo• 6 years ago

The professional consequences can be dire if your advice isn't what the politicians want to hear. E.g. David Nutt in the UK.

pfortuny• 6 years ago

Seems taken from wikipedia (an earlier redaction probably). Today wikipedia says “ S/MIME functionality is built into the majority of modern email software and interoperates between them. Since it is built on CMS, MIME can also hold an advanced electronic signature”, which is the same as in the OP but without NS/Outlook, etc.

Deukhoofd• 6 years ago

Pretty sure it's copied from here:

https://www.legislation.gov.uk/eudn/2008/616/annex/chapter/1...

Still not really a good showing to just copy and paste previous laws without considering whether or not its out of date.

jcelerier• 6 years ago

Still not really a good showing to just copy and paste previous laws without considering whether or not its out of date.

otoh wouldn't it take something like 30 years to review every single line again ? everything would have to be vetted, which means full parliamentary sessions, no ? While outdated, but accepted law, does not need to go through the whole process again.

llimos• 6 years ago

Previously discussed on HN here: https://news.ycombinator.com/item?id=25557746

spzb2• 6 years ago

Thanks. I did do a search before I posted but obviously not very well.

codetrotter• 6 years ago

I believe this looks like a standard copy-and-paste of old standards, and with little understanding of the technical details.

Exactly. I’ve seen people who work like that. Copy-paste a bunch of stuff that they don’t understand and betting that the people that read it don’t understand or don’t care either. And worse yet it turns out that often they are right. No one cares anyway. So the people that do this get away with it. And the people that do care are spending their time writing stuff that in the end most other people that don’t care aren’t even going to give more than a cursory glance anyways.

spzb2• 6 years ago

That describes half the web developers I've worked with too.

atwebb• 6 years ago

Isn't that a little true of every abstraction? yum is shorthand for "I trust you, please give me something"

dylan6042• 6 years ago

For a direct example, take a block of code copied from StackOverflow and then search for it on GitHub.

rglover• 6 years ago

Does anybody know if there's an "official" term for this sort of behavior beyond laziness or apathy?

cube00• 6 years ago

Expedited legislation

contravariant2• 6 years ago

Pretty sure this is the only way to even get a 1246 page long 'agreement', because that amount of text is well beyond what any reasonable person could carefully read and agree to.

Mauricebranagh• 6 years ago

Doesn't mean that the "Sherpas" team, should not have picked that up earlier on.

Sherpas in this sense is the actual career diplomats who do the hard work - but I suspect they did not have subject matter experts to pick this up.

drocer88• 6 years ago

Lawmakers need to do their job. They need to read and vet this stuff, not go on junkets and play golf with lobbyists.

Veen2• 6 years ago

It's written and read by lots of people working in parallel.

wongarsu3• 6 years ago

The negotiation teams had years to come up with it, vet it, understand it and discuss it with the other side. The problems only come when the various parliaments have to understand the fruits of all that labor in a much shorter timeframe.

kmeisthax• 6 years ago

npm install comprehensive_multilateral_free_trade_agreement && npm run brexit

makomk2• 6 years ago

There's not any particular reason why they shouldn't copy and paste this, from a technical perspective. Everyone involved has clearly accepted that they're quite happy with SHA-1 and 1024-bit RSA being mandated as the standard for exchanging this information within the EU, and there isn't any reason why this would suddenly be more insecure now the UK isn't a member.

Of course, politically speaking there are obvious reasons why journalists at organisations like the BBC would kick up more of a fuss about this as part of the Brexit deal than as an EU rule, and indeed conspiciously neglect to mention the EU is presumably already using this insecure cryptograpy internally. Writing the article in this misleading way plays nicely into existing anti-Brexit narratives about it being an incompetent attempt to return the UK to the past and about Brexiters screwing things up by not listening to experts. That doesn't make requiring every EU state to upgrade their systems at the last minute any more practical though.

johannes12343213• 6 years ago

Well, they goal quite certainly was "keep existing process and legal framework" maybe they have noted that they have to rework the corresponding EU agreement, but the Brexit agreement isn't the place to renegotiate EU-internal things.

papaf• 6 years ago

I am surprised to see a trade deal include the transfer of "DNA data". My guess its for people since it also mentions fingerprints.

Hopefully this is only applies to criminals or hippies.

jjgreen• 6 years ago

You hope in vain; DNA is taken from everyone arrested in the UK and retained for 3-5 years if not convicted (indefinitely if convicted).

lawtalkinghuman• 6 years ago

It only applies to criminals and others whose biometrics has been collected by the police. The point of the section of the agreement to which this excerpt is attached is to:

"establish reciprocal cooperation between the competent law enforcement authorities of the United Kingdom [...] and the Member States [...] on the automated transfer of DNA profiles, dactyloscopic data and certain domestic vehicle registration data"

This already happens under existing arrangements between EU Member States, and all this does is continue those mutual arrangements with the UK.

dboreham• 6 years ago

One of those days when your mother emails you the article that's #1 on HN...

vixen99• 6 years ago

Sounds like a huge assumption about 'mothers'.

Kognito• 6 years ago

As per the article, looks as if it has been taken from earlier legislation. Noted here in 2008 [1] but wouldn’t surprise me if it dates back much further.

Given the size of the legal document (~2000 pages) I’m hardly surprised that this sort of boilerplate gets copy/pasted.

The real question is whether this sort of oversight is indicative of the quality of the rest of the text - though I suspect time and effort will have gone into the substantial “non-boilerplate” parts (with any luck).

Either way, the European Parliament won’t be debating this until February so it’s only provisional until then meaning there’s plenty of time to comb through it and make adjustments.

[1] https://www.legislation.gov.uk/eudn/2008/616/annex/chapter/1...

rasguanabana2• 6 years ago

Hard to blame non-technical people when even programmers happen to use md5.

Anyway, why such documents don’t refer to auxiliary standards with big ass year of creation somewhere on top? That might ring a bell if you’re about to use something from 3 decades ago and you have a hint it’s security related.

danaris• 6 years ago

There's a big difference between still using a very-common hashing algorithm that happens to no longer be secure, and discussing the use of programs that haven't actually existed in decades.

rasguanabana2• 6 years ago

Oh I was referring to the other part of article about document recommending usage of algorithms such as 1024 bit RSA and SHA-1.

jgraettinger12• 6 years ago

A more charitable interpretation is that the copy/paste isn't because the authors are hopelessly out of touch: instead, they're seeking to enable the direct re-use of all of the executive policy and judicial precedent which has developed around those legal particulars since they were first codified.

soneil• 6 years ago

That's how I understand it. If you take for granted that the existing corpus already has multiparty agreement, and that any changes you make need the agreement of 28(?) countries - then you change as little as possible.

Especially since this isn't some hand-wavy-future agreement, it comes into force (provisionally) in 3 days.

rusk2• 6 years ago

It’s basically when you have depend on a 3p library that you discover 3 days before release has a crucial bug and the only way to deal with it is to copy and paste huge swathes of library code into your app, tweaking the bits you need to while leaving the rest there, that you don’t understand, possible bugs and all ... but don’t worry there will be 1.1 in a couple of months ...

2T1Qka0rEiPr• 6 years ago

This seems like a good explanation to me, thanks! One question though - why have the EU texts themselves not been updated since 2008?

volta87• 6 years ago

Probably because legislators have better things to do.

foepys• 6 years ago

No need. The intend is clear and there are more important things to do.

kqvamxurcagg2• 6 years ago

In reality more modern communication techniques will be in use now. The legislation is in effect setting a minimum standard for implementation.

thayne2• 6 years ago

Better question, why was it not written so it could be updated by security experts without requiring new legislation.

thesuitonym• 6 years ago

Law moves slowly, this is a feature, not a bug.

nimbius• 6 years ago

Charitable indeed. Friar Occham awaits you in the parlour to delight you with a most fascinating piece of cutlery....

On the one hand, a legislative body so recklessly plunged the nation into chaos through its own incompetence that the parliament changed hands thrice, each assembling with a new headmaster more incompetent than the last. That it, in its eminence and wise foresight, divined it prudent to carefully and diligently craft both in word and in meaning a strong and thorough treatise that on its face may seem silly yet upon only the most assiduous review is the machination of a truly divine primium mobile into which this nation will resume its normal course...

or..

the same bumbling octogenarian landed gentry that put everything from food security to the protestant catholic truce in jeopardy has somehow forgotten the year again.

basicneo2• 6 years ago

Let's keep political cheerleading off HN.

jgraettinger12• 6 years ago

Or, you know, they're trying to quickly forge an agreement that's as similar as possible to the previously-agreed legal, economic, and governmental frameworks under which they've been operating for decades ? An agreement that avoids rehashing settled issues of law that neither side cares to change?

Applying that razor, it seems a mite more likely to me than some octogenarians forgetfully bumbling their way into a thousand page agreement.

edoceo• 6 years ago

Wow. It's such an eloquent way to describe dumpster-fire. If you're not in the word-smithing business already you may want to give it a second look.

jacquesm2• 6 years ago

Friar Occham knows how to use wc and votes for option two.

brmgb• 6 years ago

Most likely a case of "if you don't change the text you don't need to change the system". You have to remember that this is not actually a new agreement. EU countries and the UK are already exchanging this data and have been doing so for decades.

Moodles3• 6 years ago

In Britain we have a phrase to describe silly outrage news like this: "Storm in a teacup".

This, combined with "Signal hacked by cellebrite" last week (bullshit: https://signal.org/blog/cellebrite-and-clickbait/) means the BBC is on a roll lately.

jen202• 6 years ago

Are you sure that this is the not the editorial staff of the BBC News trying to present some illusion of balance in its (hopeless) Keunnsberg-led coverage of Brexit, instead?

jariel• 6 years ago

It's not even charitable, more likely it's true.

Commercial agreements are complicated, if you can re-use text, you do.

I suggest the lawyers may not view the 'examples of tech' as we do, after all 'Mozilla' is still a 'browser'.

Brexit was never so much about commercial terms, it was about political ones. There would be no 'Brexit' from the EEC.

So if the mandate is 'keep the trade stuff the same as possible so 28 different countries can just say yes quickly' - then this snafu would seem more than rational.

Faaak• 6 years ago

Among other interesting things: "for the exchange of DNA profile information [...]: Data are exchanged by Simple Mail Transfer Protocol (SMTP) and other state-of-the-art technologies, using a central relay mail server provided by the network provider. The XML file is transported as mail body"

Well, this is not good

wongarsu3• 6 years ago

Why? XML in S/MIME over SMTP might not be cutting edge, but it's still state-of-the-art. I would be hard pressed to come up with something better that's equally based on open, established standards. XML is the only thing I would like to replace, but that's probably not worth it given the number of existing legacy systems

jmnicolas• 6 years ago

for the exchange of DNA profile information

So you're fine that your DNA information is transmitted in clear in an email?

kortilla• 6 years ago

That’s all open source standardized. That’s a million times better than a dependency on GitHub, AWS, or some Google Drive link.

moby_click2• 6 years ago

A really puzzling part: "SMTP is a ‘push’ protocol that does not allow one to ‘pull’ messages from a remote server on demand. To do this a mail client shall use POP3 or IMAP. Within the framework of implementing DNA data exchange it is decided to use the protocol POP3."

albertgoeswoof• 6 years ago

What’s puzzling about that? It’s true, and seems a reasonable choice

megablast• 6 years ago

You prefer Snapchat or tik tok??

globular-toast• 6 years ago

It sounds like nobody cares what the rules are, only that there are rules. Humans are strange.

kqvamxurcagg2• 6 years ago

This is a repost and the key takeaway is that changing this legislation from the prior version from 2008 would be counter-productive to moving forward and require further EU law changes. When the EU updates their own 2008 legislation then I imagine this trade treaty can also be updated.

wbl• 6 years ago

2008 is after SHA-1 was significantly weakened.

viraptor• 6 years ago

Your comment and OP's can be completely true at the same time.

Veen2• 6 years ago

Presumably, the goal of this part of the agreement is to harmonize various regulations, processes, and bits of legislation. It's included because that's what the pre-Agreement EU/UK verbiage says, not because someone thinks SHA-1 is adequate in 2020.

It makes sense in a way, because there wasn't really time to re-legislate every outdated multi-national standard and regulation that needed addressing in the agreement.

https://www.legislation.gov.uk/eudn/2008/616/annex/chapter/1...

einpoklum• 6 years ago

Mozilla Mail is a modern service...

It is is distributed as Thunderbird these days. And while I have a lot of gripes with the way it's managed (ugh, don't ask!) - it's still one of the best alternatives. Still sort of extensible if you sneak in the back way (i.e. not WebExtensions).

lr• 6 years ago

Being someone who has been in the tech field for well over 20 years, I always look upon any legislation that deals with tech, with suspect. Sadly, I venture that people in other fields feel the same way when legislation is geared toward their areas of expertise. Elected officials are truly like aristocrats, who are too far removed from the world in which the govern. And because of this, they rely too often on lobbyists and their overwhelmed staff to tell them what to do/what to believe.

hkt• 6 years ago

Fitting that a deal setting us back decades would mandate 90s tech.

Though of course, the actual reason is sensible and relates to the legals around those things, I imagine.

bilekas• 6 years ago

Nobody tell them about napster yet!

peterkelly• 6 years ago

If those problems, which are readily understandable to readers here, exist, imagine how many other things are wrong in such a large and wide-ranging document that most of us would be unable to spot.

memetherapy3• 6 years ago

What seems to be missing from this discussion is that this agreement was negotiated mind bogglingly quickly (9 months as opposed to the multi year / decade long process) and hasn't undergone the usual process of scrubbing which is where such technical and legal issues would normally be fixed. This process would itself normally take longer than the entire period in which this has been negotiated. Of course it's a mess and is full of copy-pasta errors. Luckily however law isn't code, especially not at the international agreement level, and it is implemented by humans, not computers (or software developers). The big problem with the Brexit deal is that it has essentially come straight from the hands of the politicians and civil servants who have negotiated it and is then being approved without proper scrutiny, at least from the UK parliament and the council of Europe. Let us hope that the only problems with it are a few embarrassing technical errors that in reality will be dealt with by secondary legislation and side agreements between the parties. If there are serious issues then they will likely be picked up before it is approved by the European Parliament (and it's not a shoe in that it will actually be approved by MEPs) and these will need to be dealt with, probably through a bunch of secondary legislation and agreements.

kergonath• 6 years ago

I can’t wait for them to sit together again and start working on errata.

kgin• 6 years ago

It does make me wonder if this type of legal document is just too large and complex for the people agreeing to it to even really know what they're agreeing to. The international politics version of a EULA.

JamisonM• 6 years ago

I would suggest that the BBC rewarding Prof Bill Buchanan with a quote in a story for this silly bit of grandstanding is a bad idea.

He says, "one day we will build a digital world fit for the 21st Century ..." and I roll my eyes. At least he could follow this up with some tweets that educate his audience about how these sorts of agreement /should/ be drafted. But I suspect that he is just a drive-by critic and doesn't have any insights into how they should be drafted.

And now I feel so snarky.. the man's twitter profile says "Old World Breaker/New World Creator" .. I could only dream of growing up to be this pretentious!

ampdepolymerase• 6 years ago

Welcome to academia, may I offer you tenureship?

phaemon• 6 years ago

Be as snarky as you like. What have you contributed to the field of CS that's so much more impressive than the Professor?

admg• 6 years ago

Fairly standard for the type of quote the bbc likes from academics unfortunately.

kalimoxto• 6 years ago

Can you imagine how much we would laugh if modern web browsers identified themselves to servers by all saying they were Mozilla browsers and referencing old technologies like Gecko?

mgkimsal• 6 years ago

or if apple and ms and google browsers all identified themselves as each other?

cxr4• 6 years ago

old technologies like Gecko

Gecko is a modern browser engine.

extropy• 6 years ago

Gecko is old and, while still in use, is being actively replaced by Servo for last 3 years.

speedgoose• 6 years ago

AES is mentioned too, with big 256 bits keys, but it appears that you can use whatever block cipher mode you want such as the terrible ECB one.

forgotmypw17• 6 years ago

Netscape 3 is a great browser, and I still test and support my websites with it. Fast layout engine, basic JS support, no support for annoying bs like notifications.

nashashmi• 6 years ago

Copy and paste is so abhorrently common in proposal submission. It is also apparently common in policy making. After all, brexit has been going on for about two years with several versions of proposals.

Seriously how often are people going to create fresh documents for nearly the same things? Copy and paste it is. And if they like it, then they will correct it as needed.

mytailorisrich• 6 years ago

This is a point of negotiation and legal matter.

This is a 1,500 page document about a unique issue. It's likely that for some topics they just went "can we agree to stick to the terms of x previous agreement?" and then just copy-pasted the whole thing.

That's the real world. In practice it's not a problem.

deenadayalan• 6 years ago

They should have included DOS, BASIC and MARIO.

rgblambda2• 6 years ago

The treaty of Saint-Germaine-en-Laye which concluded peace with the Allies and what was left of Austria-Hungary, was a copy/paste of the Treaty of Versailles. One clause prohibited landlocked Austria from having submarines.

So I guess this sort of thing does happen a lot.

jedberg• 6 years ago

How does that even happen back then? I guess the human who was retyping/rewriting things didn't think about what they were writing?

rgblambda2• 6 years ago

I want to say the Allies imagined a future where Austria reclaimed it's coastal territories, but I'd imagine it's an oversight when they instructed the typist to copy the part that said the Allies got to repossess the enemy submarines.

Ericson23142• 6 years ago

I would fire anyone that so wantonly cuts and pastes code. I which the law, which is far more important than most other programs, was treated with the same reverence.

johnday2• 6 years ago

Laws are interpreted (eventually) by judges, who are given the solemn duty to exercise common sense in their interpretations.

Computers, by contrast, do exactly what they are told and no more.

This is why it takes an engineer to craft a computer program, but a politician can craft a law.

Ericson23142• 6 years ago

I don't really take comfort in that. At least in the US, the idea that the legal system fixes up bad law is utterly preposterous. Issues with narrow typos, sure, but broader issues with the overall architecture? Hell no.

Ekaros3• 6 years ago

If they were to fix this part, what other parts is there to be also fixed? How long did it originally take time to write just this part? Now expand to whole document. It's quite unrealistic to expect them in hurry to tear down and rewrite certain parts that don't even need negotiation.

Wonder how many years would it be to search for all parts needing updating, then collect necessary personnel to rewrite those and then pass them through all parties involved. Likely very much longer than entire process has now taken time.

w_t_payne• 6 years ago

Don't ask me how ... but this might weirdly be partially my fault .... >///<

gitowiec• 6 years ago

This is common behaviour of administrative workers. 7 years ago I was employed in a company where contracts with such clauses happend in monthly basis. "Web page should work on MSIE 5.5", and etc.

Brexit deal mentions Netscape browser and Mozilla Mail

Related Stories