Rsync.net Warrant Canary

http://www.rsync.net/resources/notices/canary.txt

by jcsalterego • 17 years ago

99 46 17 years ago

rsync.net

melito• 17 years ago

When I saw this on the front page I assumed a warrant had been served.

jcsalterego• 17 years ago

Guess they should have called it a warrant-free canary, huh.

bcl2• 17 years ago

Looks good.

gpg: Signature made Mon Jul 13 08:44:56 2009 PDT using DSA key ID 7D6F806C gpg: Good signature from "rsync.net <info@rsync.net>"

mjgoins• 17 years ago

You realize that unless you have a trust path via keys that you've signed (preferably by meeting the people holding them) that that verification isn't verifying much, right?

It's pretty easy to create a key that has that key id (since it's only the last few hex digits of the full 40 digit fingerprint) and the user id is freeform.

If you don't believe it's easy to pick your own key id, check the keyservers for the number of keys with DEADBEEF as their key id ;)

bcl2• 17 years ago

yes. And if I were a customer of theirs I'd work to obtain a more trusted copy of their key. But, FYI, I've had this copy of their key in my keyring for several years, I didn't just pull it off their website today.

callahad• 17 years ago

Rsync.net is a fantastically awesome service. Check out their FAQ:

Will you support my use of X ?

Yes. If you are using X with an rsync.net filesystem, we will support and troubleshoot your use of it, regardless of how complex or esoteric that usage or application is. All such support will be handled by a real live Unix engineer, and will never be dealt with by a ticket system, autoresponder, or first level / junior "technician".

Really ?!

Yes. We are not just providing offsite filesystems, we are providing complete, end to end, personal customer support.

I can't even get that level of support ("real live Unix engineer") at my current workplace when things go pear-shaped.

boundlessdreamz• 17 years ago

How well will this scale? Isn't this setting the expectations too high and if the company grows well this promise might be difficult to adhere to.

icey• 17 years ago

I used to host with johncompanies.com (started by the same group or person), and support was always excellent with them as well. I didn't have to use it often, but whenever I did it was a fantastic experience.

It seems like they've got a pretty good idea about what things cost them and can scale by charging the right price for their business. I think they'll do fine.

lsc2• 17 years ago

they've been around for a while. I had an account with johncompanies before I started prgmr.com. My experience was quite positive.

I've heard this 'it doesn't scale' argument many times, and I think the source is that the sort of skills it takes to maintain support infrastructure of that quality are quite different from and rarely present in the same individual (or management of a company) as the skills required to scale out a product to the mass market.

Also, I don't believe the mass market doesn't really want a unix nerd on the level 1 support line. they want someone who speaks 'normal person.'

lanaer2• 17 years ago

They are quite costly compared to other online backup services — and money tends to help with scalability.

oomkiller• 17 years ago

I use Rsync.net and have been very happy with them. They even give you the option now to do pull backups via cron to prevent hackers deleting your backups a la the avsim.com hack.

dexen• 17 years ago

Looks like a pretty decent law hack to me; they are going to comply with the warrant and just not update a particular file anymore.

Still, I assume a skilled lawyer would be able to convince a judge that the net effect is that users effectively obtain information about rsync.net being served a warrant quite closely around some specific date, and thus the service broke the law anyway (assuming secret warrants are lawful in the first place).

dkarl5• 17 years ago

It seems transparently, wishful-thinkingly illegal. If everyone can find out when a warrant was served by watching what rsync.net says, then how can rsync.net claim they kept the existence of the warrant secret?

hvs• 17 years ago

I'm not sure that the government can legally force you to lie, though. Anyway, I'm sure the authors of the law didn't consider this possibility (they are politicians after all) so it would ultimately be decided by a judge. I would bet 50/50 on the result.

tc2• 17 years ago

The law takes the idea of forcing a person to speak much more seriously than the idea of forcing him to remain silent, particularly if you would be forcing him to make a knowingly false declaration. I can't think of an instance off-hand where a US judge has forced a civilian by injunction to make a known-false public statement.

bluefish• 17 years ago

It would be an interesting legal case to say the least, especially because they do not indicate that they will provide further information about the warrant, or how to act other than individuals should "take special notice".

Still I believe you are correct, by having a publicly stated policy about their planned inaction when served a secret warranty is effectively the same as making a public announcement. Ballsy, but kudos to them for making a statement about their privacy beliefs.

pavel_lishin• 17 years ago

It does seem like something that only works once. As soon as a warrant is served and they stop updating the file, when can they start updating it again? When the warrant is made public?

whughes• 17 years ago

How long would it take the lawyer to make his case? All rsync.net needs is to skip one day and it's too late. If rsync.net can stall a bit or find a way to fight it, then it's over.

Periodic• 17 years ago

Knowing the way bureaucracies work, they wouldn't manage to get the order to force them to update the canary until a few days later, at which point it would be too late.

All they need to do is buy themselves one day, and have a track record of not being late with the updates.

slackerIII• 17 years ago

I'm not even sure you would need a skilled lawyer. Judges tend to be fairly smart. The law isn't a computer program, mindlessly followed by automatons on the bench. Intent matters, and I wouldn't be surprised if a judge considered this exactly the same as issuing a press release.

sachinag• 17 years ago

This is no different than libraries having a sign up that says "The FBI has not been here" and taking it down after they have (second sign): http://www.librarian.net/technicality.html

My understanding is that most observers believe that the sign is legal.

edfgtyhuj• 17 years ago

It was used almost a century ago in England to warn drivers about speed traps.

"It originated at the start of the last century as drivers started to run foul of police speed traps in which officers used a stopwatch to calculate whether or not a car was going too fast. Even then it was illegal to warn motorists about speed traps, but the AA advised its members to stop if a patrolman failed to salute, and the driver would then be given information about "road conditions" ahead."

ErrantX• 17 years ago

the analogy is not quite the same. Rsync are subtely different in that they are putting up a new dated sign each week and stop doing so if served a warrant.

(the point being they are not actively making a change [taking the sign down] to indicate a "visit". Could make a difference)

pronoiac• 17 years ago

Heh. This is likely based on similar technically legal signs: http://www.librarian.net/technicality.html

This has been around around a year: http://www.reddit.com/r/programming/comments/2ygi6/warrant_c...

Edit: HTML. Another edit: reddit.

defen2• 17 years ago

> In opening remarks, a Democratic senator emphasized Judge Sonia Sotomayor's upbringing, while a Republican senator expressed concerns about activism on the bench.

I don't know, that probably could have been written a week ago. Should we be worried?

:-P

jsteele2• 17 years ago

> I don't know, that probably could have been written a > week ago.

No, it couldn't have, unless you have a time machine and a friend on the NYT's national desk, because it was in the Times today, not last week: http://lmgtfy.com/?q=In+opening+remarks%2C+a+Democratic+sena....

defen2• 17 years ago

It was a joke - my point was that anyone who pays attention to politics would have known that the Democrats would emphasize her upbringing, and Republicans would express concerns about judicial activism.

alain94040• 17 years ago

Funny...

But it probably wouldn't work anyway. If a judge agrees that there is a need for a secret warrant, it's serious enough (aka national security) that the judge will tell you to continue doing business as usual, including posting your weekly canary.

There is no harm to you of posting an incorrect warrant canary and if that's the only objection you have, the judge will be happy to give you immunity on that point.

If you refuse to do so, expect to be held in contempt or similar coercion technique.

Bottom line: it doesn't work. Too bad.

iigs• 17 years ago

While I admire the spirit of this, unfortunately I believe it's of limited use: Once word gets out that these guys are LEA "unfriendly", it will start to attract the kinds of people that get LEA attention, and then they'll have to respond to a court order / subpoena / warrant / lawful intercept, and it's all over.

Large ISPs routinely get subpoena requests all the time (i.e. they have teams that do only that). I think rsync.net is setting themselves up for a lot of undesired press when they finally have to do it.

lsc2• 17 years ago

/Large ISPs routinely get subpoena requests all the time/

sure, but I don't think they are secret very often.

luckyland• 17 years ago

Here's where the warrant will first be served:

http://maps.google.com/maps?f=q&source=s_q&hl=en&...

reconbot• 17 years ago

Couldn't the fbi just use their upstream provider?

pert• 17 years ago

http://www.rsync.net/resources/faq.html#2

forsaken• 17 years ago

Nobody has pointed out how easily the "news story" of today could be faked and updated. It's a simple script that would be able to read google news, pick out a random story, and throw it in the PGP signed message. How can that not be automated?

enneff• 17 years ago

If the signing can be done without a human providing the key/passphrase, then the whole thing is worth nothing anyway.

lanaer2• 17 years ago

Kind of amusing, but dubious legality.

This is better: http://rsync.net/products/encrypted.html

Rsync.net Warrant Canary

Related Stories