Ross Ulbricht’s private journal shows Silk Road’s birth

http://arstechnica.com/tech-policy/2015/01/silk-road-trial-fbi-reveals-whats-on-ross-ulbrichts-computer-in-open-court/

by gk1 • 12 years ago

221 146 12 years ago

tall• 12 years ago

These are very intimate details of his life. The entries do not read like the entries of a psychopath, rather they paint a vivid picture of his life and the perfect basis for a movie.

dublinben• 12 years ago

I've never gotten the impression that Ulbricht was a psychopath or anything similar. He always came across as a naive idealist, caught way over their head in a conspiracy they never expected to succeed. He openly admits in his diary that he practiced terrible OpSec, and didn't care much.

Touche2• 12 years ago

This article doesn't make him look like an idealist at all. It makes him look like an entrepreneur that cares about success about all else. The idealism seemed to come later, as a justification.

spiralpolitik• 12 years ago

Hindsight is 20/20. Sometimes you don't realize you need OpSec above a certain level until after the fact and by them it's too late.

knodi1233• 12 years ago

Yeah, the hollywood version is fait accompli.

davidgerard2• 12 years ago

Yeah, the one where he tried to recruit hitmen made him seem a lot less idealistic. Maybe it's just me.

FeeTinesAMady4• 12 years ago

Why would you have ever assumed that he was a psychopath?

srdev2• 12 years ago

He has been accused of putting out hits on people. That is at least somewhat psychopathic.

pcthrowaway3• 12 years ago

Honestly my impression reading them was that there's a possibility he really was set up by Karpales, or that the prosecution is forging evidence. I just can't believe anyone would really keep journals like this outside of movies. I have a felony for distributing mushrooms years ago, and in that period I knew never to write stuff down like this, as did all of my colleagues, even those who were noticeably less classically intelligent.

patio112• 12 years ago

I just can't believe anyone would really keep journals like this outside of movies.

The CEO of Google once sent someone an email which said, virtually verbatim [+], that he would appreciate them not talking about the illegal act he had just ordered over email because it would open them up to a lawsuit.

We know this. Guess why.

[+] The quote, in case anyone thinks I'm being too harsh in my summary: "I would prefer that Omid do it verbally since I don't want to create a paper trail over which we can be sued later? Not sure about this.. thanks Eric" (The antecedent was to "it" was "share with eBay and Paypal executives Google's internal anti-poaching rules as they pertained to eBay/Paypal for the purpose of eliciting their continued cooperation in the conspiracy.")

dchuk• 12 years ago

I'm ignorant of the law here: This article starts off saying basically that the FBI agents distracted him long enough to steal his computer and image the hard drive...is that legal? I thought you needed a warrant or something for situations like this?

Or is it illegal-but-it's-ok-it's-the-FBI-shhhh?

gk1• 12 years ago

From my understanding, they grabbed the computer just seconds before the arrest.

mgraczyk• 12 years ago

According to the author, the FBI had a warrant for the laptop at the time.

mattmanser• 12 years ago

They just mean they grabbed the laptop off the table before formally arresting him, i.e. they distracted him with a diversion of an argument, another agent grabbed the laptop from the table, and another agent physically detained him and arrested him.

So he couldn't close the laptop and enact the encryption.

reverend_gonzo• 12 years ago

They already had a warrant for his arrest, as well as for the computer. They just didn't want him to be able to turn off the computer, encrypt itself, and have it become inaccessible to them.

heywire• 12 years ago

Imagine if you were the agent who grabbed the laptop, and you accidentally bumped the power button. Or if you were the forensic tech, and you accidentally triggered a reboot of some sort. No pressure!

GCA10• 12 years ago

A legally savvy poster in the original Ars Technica thread says it's allowed if the authorities can claim "exigent circumstances" -- basically meaning that lives were in danger or evidence would have been destroyed if they didn't act fast. Here's more on exigent circumstances via Wikipedia: http://en.wikipedia.org/wiki/Exigent_circumstance_in_United_...

From what we've been told so far, this sounds like a textbook case of an allowable grab.

jrochkind1• 12 years ago

I assume they had a warrant?

jordsmi• 12 years ago

This is when they arrested him. They didn't sneak a copy of his laptop before returning it to him.

ianamartin• 12 years ago

Those journal entries don't really read like journal entries to me. The longer entries seem more like prepared and considered stories--stuff written for an audience other than yourself. I wonder if he was keeping those as notes for a book.

creeble• 12 years ago

A book he could never publish. Unless he got caught.

k-mcgrady• 12 years ago

Write it and have it published when you die I suppose is the other solution.

gwern• 12 years ago

People publish books about crimes all the time.

denzquix• 12 years ago

The extracted quote at the top of the Forbes article here seems to indicate he was thinking along those lines: http://www.forbes.com/sites/sarahjeong/2015/01/22/the-dread-...

"I imagine that someday I may have a story written about my life, and it would be good to have a detailed account of it."

jberryman• 12 years ago

I think you'd expect that from someone on the spectrum of pathological narcissism or psychopathy, which is I think not unlikely given what we know about him.

666_howitzer• 12 years ago

I think "Do things that don't scale" applies perfectly here, the part where Ross initially seeds the marketplace by selling magic mushrooms which he himself grew; may be this explain why new Darknet concepts failed to take off, not due to technological limitation or lack of market need.

https://bitcoinmagazine.com/5285/torbroker-anonymous-finance...

http://www.forbes.com/sites/andygreenberg/2013/11/18/meet-th...

tomphoolery• 12 years ago

I just want to grab this kid and shake him while screaming "WHY WOULD YOU EVER WRITE THAT SHIT DOWN?!?"

It's like he wanted to get caught...

300bps• 12 years ago

In a folder labeled "TorChat," Ulbricht's computer holds years' worth of chat logs.

Felt the same way when reading this. Seriously - three years worth of chat logs? I don't think he wanted to get caught, he just felt that a clueless investigator could never decrypt his data, a clueless prosecutor could never understand let alone describe his operation and a clueless jury would never understand it.

So far we know he underestimated the investigator and the prosecutor. We'll know soon if he misjudged his chances with a jury.

higherpurpose• 12 years ago

Seriously, why would you do that? Hasn't he seen Boardwalk Empire? You get rid of the book and keep it all in your head! That, and it's also common sense.

fizgig• 12 years ago

I know, right? Better yet, why the hell would anyone take anything with that much incriminating info out in public like that?

I wince when I read of security goofs like those mentioned in the article or Poulson's book Kingpin. These are bright guys who should assume they'll eventually get raided or otherwise targeted by the law and have safeguards in place.

Makes for good reading, though. I'm ordering popcorn for this one.

neckro23• 12 years ago

I remember reading about DPR before he got busted, and thinking "wow, this guy must be practicing some insanely paranoid opsec".

Turns out, he was doing nothing of the sort!

saalweachter• 12 years ago

Raise your hand if, when you read an article about gross incompetence while committing a crime, you get the urge to become a criminal mastermind yourself, just to do it right...

nhaehnle2• 12 years ago

You write it down because it's a business and you need some amount of documentation to run any business. The journal thing could have been avoided, but the chat logs? There are bound to be disputes when running a black market, and it's useful to have a reliable record of what happened in the past.

The armchair commentators here write "just keep it all in your head", but that's just not possible.

oroup• 12 years ago

The snatching of the computer before you have a chance to lock it issue seems like something that could be solved with software. I'm imagining a "swatd" service that listens for loud noises (gunfire, flashbangs, shouting, etc) or observes the camera for sudden motion and locks the machine. I'm sure there'd be some false positives from movies and the like, but for guys like this, better safe than sorry.

evo• 12 years ago

I was thinking if it would be feasible to implement an OpenCV-style facial recognition script that could require sustained attention from the user to preserve an open session on the computer. If that user stops watching the screen or is physically separated from the view of the camera, then the locking operation would take place automatically.

I'd be curious from a legal perspective if that would constitute obstruction if you always used it, by analogy to having a data destruction policy in place before the discovery phase of a lawsuit.

Pinatubo4• 12 years ago

I was thinking of a Bluetooth connection to his phone, and if the connection is lost the computer shuts down. I'm assuming the FBI would quickly get him away from his computer, which would trigger this defense.

Or just take the battery out of the laptop and work with the plug. Snatching it away shuts it down.

shittyanalogy2• 12 years ago

how about an rfid device that simply locks the computer when you're more than a few feet away?

saboot2• 12 years ago

If you are under surveillance it's likely they would have observed this already. Don't assume they would go beyond removing all of your valuables and clothes right then and there if they thought this setup was in place.

Some of the above methods can still be broken. Requiring a face present? Why not just print a big blowup photo and quickly insert in front of camera?

There are smart people getting around security.

marincounty• 12 years ago

That's not a bad idea. You could use some kind of USB dongle connected to a wearable? Once you walk away from computer it takes a picture of the screen( looks like nothing is changed), but the computer immediately locks down everything except what's currently on the screen. Only a password along with the wearable would unlock it? (It's probally not easily feasible, but it doesn't sound impossible?) "Oh, I scratched my head, and my computer hard drive shut down."

StoneTable• 12 years ago

You could use a laptop with some kind of sudden motion sensor and use that to lock the machine if the machine is moved.

tacoman• 12 years ago

Thinkpads have this sensor that is meant to protect the hard drive from sudden shock. I bet it could be used for something like that.

http://www.thinkwiki.org/wiki/Active_Protection_System

lsllc• 12 years ago

A bit old, but Amit Singh did some interesting work with the sudden motion sensor on the Mac Powerbooks:

http://osxbook.com/book/bonus/chapter10/sms/

saboot2• 12 years ago

I think this could still be circumvented if this service was known. I guess you would intentionally not make this software available to anyone other than yourself.

What about some sort of 5-10 minute prompt? You cant ask repeated questions due to surveillance, or you could be also requiring some hash value. Perhaps based on some permutation of the current time? It's weak but I can't think of something else you could consistently make a unique hash of using just your brain and some changing property of reality.

Another idea, a heart rate or brain wave monitor connected via bluetooth. If it's disconnected, moved, or shifted it prompts a lock. If your heart rate increases or brain patterns are it also locks. The point is that it cant be removed from yourself, but others cannot stop you from locking it as well.

PhantomGremlin2• 12 years ago

Another idea, a heart rate or brain wave monitor connected via bluetooth

I like this idea. It may or may not be practical, but it's out of the box thinking and would certainly warrant some investigation / development.

squidbot• 12 years ago

Senors, software and such seem pretty error prone or otherwise defeatable. What about a "deadman's switch", a wrist strap connected to a short cable connected to a USB dongle. When the dongle is removed (laptop snatched) it would lock the laptop. The only way to defeat this would to somehow completely restrain someone from moving, and I can't see how you'd do that without seeing it coming. Even a tranquilizer takes a few seconds to kick in.

knodi1233• 12 years ago

please don't make their only option be to either secure your cooperation, or sever your brainstem before you can twitch.

"Oh shit, he's moving his arm! It might have an rfid dongle!" bang

FeeTinesAMady4• 12 years ago

It has to be something they can't see, or they'll counteract it, possibly by shooting you as the other commenter said.

kryptiskt2• 12 years ago

If the target manages to lock the computer, the next thing to do is to freeze the RAM sticks and try to get the encryption key from there: http://citpsite.s3-website-us-east-1.amazonaws.com/oldsite-h...

"We also confirmed that decay rates vary dramatically with temperature. We obtained surface temperatures of approximately −50C with a simple cooling technique: discharging inverted cans of “canned air” duster spray directly onto the chips. At these temperatures, we typically found that fewer than 1% of bits decayed even after 10 minutes without power. To test the limits of this effect, we submerged DRAM modules in liquid nitrogen (ca. −196C) and saw decay of only 0.17% after 60 minutes out of the computer."

kryptiskt2• 12 years ago

I just realized that an easier way, when you have a guy under surveillance using his computer in public, is to capture some decent footage of him entering his password before you bust him. Way less fun though.

runeks• 12 years ago

Ulbricht's Samsung 700Z laptop used DDR3 RAM. These guys couldn't reproduce the "cold boot"/"RAM freeze" attack using DDR3 RAM: http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb...

But I don't see why they would need to freeze anything. I would think the feds should be able to make a device that plugs onto the DRAM connectors of chips and reads the content, although I'm not sure.

8_hours_ago• 12 years ago

The Linux distribution Tails will automatically wipe RAM when shut down, which can be triggered by removing the USB drive it is running off of. I guess the thing to do would be to only work in a place where you can delay law enforcement long enough for the wipe to complete. But alas, it seems Ulbricht wasn't paranoid enough.

https://tails.boum.org/doc/advanced_topics/cold_boot_attacks...

Or, of course, thermite always works.

gst• 12 years ago

To prevent cold boot attacks you can store the key in a CPU register instead of memory: https://en.wikipedia.org/wiki/TRESOR

skeoh• 12 years ago

Is there software out there that will lock your session when a new USB device is detected? Maybe it wouldn't have changed much for Ulbricht but I would like to use something like that. If someone tried to copy files to their own drive while I was distracted then they would unwittingly lock themselves out.

gknoy• 12 years ago

I recall seeing a video of a presentation about trashing a device that's plugged in via exploits (I think?) in the USB protocol, but I imagine that the "do things when something is detected" part would be comparatively easy to reproduce.

Unfortunately, I can't recall where it was, nor can I seem to find it. Sorry.

Kenji2• 12 years ago

"On that day, a male and female agent started an argument in San Francisco's Glen Park public library, to get Ulbricht's attention. As soon as Ulbricht was distracted, another agent grabbed the open computer"

And that, ladies and gentlemen, is how you defeat crypto. How could you even defend yourself against such a thing? The only thing that comes to mind is never working in public on a computer.

robrenaud• 12 years ago

This is the easiest/most feasible defense I can think of.

Use a laptop with a camera. Have the camera require that your face is in the picture to avoid activating the screen saver.

My cell phone already does this, so it's got to be easier with a full powered laptop.

Kenji2• 12 years ago

That sounds like a huge hassle to be honest. My android phone had a feature that made the screen stay on as long as I was looking at it - it was a disaster. It just did not work properly. I ended up deactivating all that crap and just set the screen to never go off, unless I explicitly press the button.

chrsstrm• 12 years ago

I would imagine that if you were up to something like this, the laptop in question wouldn't be your daily driver. In which case you would likely want to physically disable inputs and sensors like cameras, mics, location hardware, etc. I seem to also recall once reading that it was good measure to use a laptop with a removable battery, having actually removed the battery and only being powered by your power cord. Or so I've heard.

jnazario• 12 years ago

isn't facial recognition easily defeated with a picture of the person's face?

that said i concur, the proliferation of built-in cameras should spur us to adopt biometrics such as facial recognition, but it's gotta be better than picking out a few points and doing a simple match like most CV facial recognition systems do. some sort of challenge-response maybe, like "wink your left eye" or "blow a kiss", anything that a simple, static picture couldn't defeat.

but i concur on the larger paradigm - the hardware is common enough to force us to consider biometrics as commonplace.

Jonovono2• 12 years ago

I posted this on the OP comment, but what about using an accelerometer?

gearhart• 12 years ago

Given the proliferation of comments about how to avoid linking meatspace and digital personas, having a laptop with a camera constantly filming your face, and a piece of software designed to recognise only your face stored next to your incriminating digital files seems like an escalation of risk to me.

shittyanalogy2• 12 years ago

Someone should invent a usb dongle that detects a nearby rfid chip that you keep on your keychain. As soon as that keychain is out of range, say 5 feet, the computer locks and encrypts itself. Integrate this into the computer and you wouldn't be able to tell who has one and who doesn't. Think you're being arrested with your computer open? Toss your keys.

knodi1233• 12 years ago

that's called "security through obscurity". and sometimes it works great! Well, the first time.

Of course, just like the shoe bomber changed airport security forever, an rfid keyfob like you suggested becoming commonplace, would just lead to the cops immediately tazing and tackling you, and treating every single motion of your arms as an attempt to destroy evidence.

joezydeco• 12 years ago

You could be grabbed by agents and held there in your chair while another agent starts working on your files.

My idea would be more of a proximity sensor that not only does the RFID-walkaway thing, but also locks the machine up if anyone additional to yourself approaches the device.

chongli• 12 years ago

It'd be easier to just have the machine lock itself and power down whenever anyone plugged in an unknown HID device. The FBI (and other agencies) use USB mouse jigglers to keep the screensaver from activating while they transport the machine back to their lab.

saganus2• 12 years ago

Toss your keys.

But then the LEO agent sees this, and not only does he pick up the keys, he will then proceed to charge you with something for resisting arrest, or obstruction of justice or any of the myriad of ways they have to make your life a living hell.

I think this would be similar to smoking pot in a moving car, then getting a police car to tell you to stop and then you throw the drugs out the window. I believe that's enough of a reason to charge you with all sorts of nasty stuff.

byEngineer3• 12 years ago

how is it legal for the feds to steal private property?

nemo2• 12 years ago

They had a warrant. It wan't technically stealing since they were legally authorized by a judge to take the property in as evidence.

jtbigwoo• 12 years ago

I've worked with some pretty sensitive information at places where it's a matter of policy to lock your screen whenever you leave your desk. It's second nature for me to click the screen saver button every time I get up from my computer now. I'm a little surprised that someone as paranoid as Ulbricht didn't have the same sort of habit.

ryanong• 12 years ago

I think it implied that he didn't even get up from his chair. I think it implied that they grabbed it when he looked away.

MichaelGG7• 12 years ago

I tried a few weeks of living opsec to get a feel for how practical this stuff is. Really got into it, to the point of wearing disposable gloves to get sorta untraceable currency and looking into body armour and secured living arrangements. It's probably easy to get too paranoid, and perhaps those people never end up launching a successful Onion site.

But just quickly, he should have compartmentalized. Zero need to have all that data decrypted while doing day-to-day admin. A throwaway machine with Tails or something would suffice for management. Then, add some physical security, such as smartcards with removal events set to destroy and then chain it to your neck. Or there's little dongles that do proximity detection.

Then get some physical security so your RAM is never exposed. The commercial phreaking devices were said to have thermite, but something explosive might look too much like terrorism. I'm not sure it'd be out of the question to wire up a short-circuit to your RAM at single click, although that would look bad, versus something less obvious.

But really, this is apparently only because he messed up his server security so badly. Otherwise, they wouldn't have been there in person in the first place, right? It's probably safe to assume that if you're being physically targeted, you're going to have a bad time living a normal life. If you have a bunker or something where you can definitively see all approaches and have many minutes in case of a raid, eh, maybe. But by that time, there's probably some sort of correlation information or real-world bug going on, right? If Ross had been super careful, eventually they'd just bug his every movement, word, etc. Get video or audio on his keyboard, even, right?

So worrying about this is the barn door question after horses have left, it feels.

tptacek2• 12 years ago

You don't even need something like Tails. You just need encrypted disk images, and to keep them unmounted when you're not actively using them. This is a capability that is for instance built into Mac OS X.

icpmacdo• 12 years ago

What conclusions did you come to on the body armour? Did you end up walking around with it on day to day? Any other interesting tid bits on your opsec journey?

tptacek2• 12 years ago

What you're really seeing here is the limitation of full disk encryption. I talked a little about this here (the article is really about cipher modes, though):

http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/

The problem isn't "crypto". The problem is the extent to which full disk encryption overpromises and way, way underdelivers. It's easy to have a cryptosystem that is at least somewhat resilient to this threat. You just can't get it with a UX that "unlocks" your whole computer to use it, and then "locks" it again when it goes idle.

arca_vorago• 12 years ago

The problem of evil maid attacks is at least trying to be addressed by the QubeOS team, and think it's an interesting concept. Otherwise, yes, FDE is only a part of what should be a holistic approach.

patcon• 12 years ago

https://twitter.com/patconnolly/status/517792555292164096

grugq removed the PoC repo in prep for a product launch, but here's a fork of a project that's a partial solution: https://github.com/RagnarDanneskjold/darkmatter

Basically, restart an full-disk encrypted device when loss of signal or drop in temperature occurs. Have something similar on your desktop. Wear a BLE Android watch, and make sure your devices restart when they get out of reach, or when put into a Faraday bag, or when dropped in liquid nitrogen :)

Yeah, it's still possible to defeat, especially if someone knows your setup, but it's at least pretty damn close to foolproof. If you sense trouble, just run like hell and lose the signal

splatsearch• 12 years ago

or dont have a battery in your computer so it dies when they grab and run

MrMrtn• 12 years ago

This also reminds me a bit of http://xkcd.com/538/.

Cryptography is only as strong as its weakest link. That link more often than not is the human factor.

gatehouse3• 12 years ago

Up to now I had never considered the need for protection against a mid-keystroke attack. Ideally it would have to involve no unusual hardware or software, or you might as well just slap a "I'm a criminal" sticker on your forehead.

Second, I can't see it working properly if you need to do something specific when you're being struck.

Closest thing I can think of:

- headphones must be plugged in to launch a certain program

- if headphones are unplugged before program is closed, lock and begin wipe

- don't, under any circumstances, let go of the headphones

At this level of paranoia you probably also need interrogation training. Ideally you'd also have your sensitive stuff on a machine that is both hidden and protected, and only access it remotely. You want to be able to deny its existence to have any chance of withstanding a torture attack.

Edit: iphone earbuds have a switch that you might be able to use in your hand/mouth as a deadman switch, but I can't see that being workable for more than a few seconds.

Also, if you're in public, they could film your monitor... so that would need to be sanitized somehow as well.

anonbanker2• 12 years ago

Do I need to pay you royalties for implementing such a headphone-based security scheme in my device?

jqm• 12 years ago

That sounds fine... until you turn your head and jerk your headphones out.

bashinator2• 12 years ago

The problem with schemes like this, is that they show premeditated intent to destroy evidence. I hear that courts don't like that. Maybe there wouldn't be evidence that specifically unplugging the headphones is what caused the drive to self destruct. But a good forensic security analyst should be able to show that the system was intentionally destroyed.

If you can come up with a plan for plausible deniability when it comes to, say, permanently deleting the keys for an encrypted drive, then that's worth way more than the deadman's switch is on its own.

Jonovono2• 12 years ago

hmm. Do some computers have accelerometers? Maybe you could do something like if you are at a coffee shop or somewhere in public when your computer is picked up before you have that turned off it does the necessary security precautions. Not sure what/if any computers have one though, but you could probably build something via arduino or something.

DigitalBison• 12 years ago

MacBooks used to have accelerometers that were used to detect sudden motion and park the hard disk head to prevent a head crash. But it looks like they've stopped including the accelerometers in more recent models with SSDs, since there's no equivalent need.

jpgvm• 12 years ago

Proximity sensor (bluetooth or something) + thermite on the disks.

If you get further away from the machine than 5m or so when it's powered up it will melt everything. For extra kicks also wire up another detonator with a case ground wire or something, if the case is opened - it melts.

sanswork• 12 years ago

Pretty sure they'd just charge you with attempted murder of a federal agent then x the numbers of agents in the area.

dredmorbius• 12 years ago

No real need for thermite (and it's a tell).

Flush crypto keys, activate screensaver, kill all active terminal sessions.

If you want to get extra special: scramble the disk keys. Without those, data's good as toast. And that can happen a lot faster than a shred, wipe, or even dd if=/dev/zero of=/dev/sda bs=1g

Something to fry your memory might not hurt.

oh_sigh• 12 years ago

Have a lanyard around your wrist with the end plugged into a USB port. Set up a daemon that watches for that device to disconnect, and once it does, the computer powers off.

Dylan16807• 12 years ago

http://btprox.sourceforge.net/

woah• 12 years ago

Some kind of lanyard?

madaxe_again• 12 years ago

Clearly we need laptops with kill-cords like outboard engines - operator steps away or device is removed from operator's vicinity, it shuts down.

nhaehnle2• 12 years ago

This shouldn't even be that difficult to rig together: Take a small USB key, combine with a wrist strap, and write a script to listen for USB key disconnects. As a bonus, if you want to get fancy, the encryption key itself (or a part of it) could be stored on the USB key.

alasdair_• 12 years ago

The standard way is to check for your face every second using a webcam. If you go out of view, lock the machine.

misiti3780• 12 years ago

I never saw the number, what was DPR net worth when this all came to a crashing halt? I assume 10's of millions of dollars

Also - was that money recovered by the FBI or could they not find his private keys?

mikeyouse• 12 years ago

I think the peak number in the spreadsheet for the value of SR was $104M -- I can't remember the source, but that figure stood out.

edit for source: http://abcnews.go.com/Technology/wireStory/san-francisco-man...

The FBI had no problem finding his keys because he kept them in a folder called, "Keys" -- the kid was not an OpSec genius..

http://motherboard.vice.com/read/journal-and-chat-logs-from-...

dghughes• 12 years ago

It sounds like a scene from that terrible TV show "What Would You Do?" I'd ignore it that's what I would do.

hurin• 12 years ago

It all seems more amateurish with every additional piece of news coverage - why a single decryption key or even your day-to-day laptop as storage for that multitude of evidence! Surely you don't need 4 years of chat logs to run a site on a day to day basis.

samteeeee• 12 years ago

This "diary" sounds like it was written by the FBI and planted on his computer...

PhantomGremlin2• 12 years ago

I agree it does read that way.

But the most reasonable explanation is that an arrogant narcissist (classic Dunning-Kruger) wrote it.

The FBI did not write it.

krapp3• 12 years ago

It's surprising how much effort some on HN will go through to insist the case against Ulbricht must be completely invalid somehow. Several people in this thread have already assumed that because the FBI has his laptop, that must mean they stole it without a warrant. And now, if they found his diary, well, they must have planted it.

You may have to come to terms with the possibility that the FBI actually has a case supported by evidence obtained through legal means.

deciplex2• 12 years ago

DPR definitely broke the law, there's no question about that. A lot of us think it's an unjust law, but whatever. He may have also put out hits on people (though, curiously, he is not being charged for that). If that's the case then he's also a danger to society and really does belong in prison.

But, it is immensely frustrating, even heartbreaking when you consider the cost in human lives, that given the choice between something like Silk Road and Mexican drug cartels, we as a society have apparently chosen Mexican drug cartels, and all the gut-wrenching bloodshed and destabilization they bring.

I'm reserving judgement on Ulbricht the person, but what he did should not be illegal, for reasons ideological, practical, and humanitarian.

derekp7• 12 years ago

This same narrative also played out during the Hans Reiser arrest/trial. Even after his conviction (due in no small part to his own testimony), people were still defending him -- up until he revealed the location of the body in return for a reduced sentence.

ForHackernews• 12 years ago

I feel like this applies here: https://www.youtube.com/watch?v=hGo5bxWy21g#t=1m19s

alelefant• 12 years ago

In his diary regarding selling out of (illegal) mushrooms he writes: "...but at least now I was all digital, no physical risk anymore."

Given the revelations from the last few years, how many of you would agree that carrying out an illegal plan like this is safer online?

fdsary• 12 years ago

Reading this, and other recent events, gives me the realisation that we need the successor of UNIX. Nowadays, everything runs UNIX. My iPhone, Android, my Mac, my Ubuntu laptop, my Debian or BSD server, even my e-reader runs some Linux.

On recent systems like iOS & Android applications run pretty isolated. You can't read and write the whole file system (afaik), and you need to have the user tap "yes" to use many system API's (like microphone, camera, etc).

Using UNIX for a desktop computer, you don't really utilise the user system. Everything I run is either as my own user, or as root (when adding/remove packages or doing system updates). Otherwise, it's a singe user system. So any program I run can read all permanent data stored by other programs in my home directory. In effect, all programs have 100% access (except for changing system settings, but why would they care when there is only one user to own?

When I encrypt my drive, I encrypt it all but also unlock it all when logging in. It's inherent to the system that my whole home dir is open when using (except for things I encrypt manually, like GPG mail or other user land things). Defaults matter. That's why Ross's documents were readable to the American government.

I think we need a new OS to take over after UNIX. One that is built up of sandboxed modules. Where each program gets it's own file system, where they can do whatever they want. That file system is, if I wish, encrypted until I chose to open it. It could be encrypted with a public key system, so I can have many FS's opened with one key, or derive keys from a master key.

These small systems could even be virtual machines, I can't say anything about the eventual overhead that would bring.

In short, UNIX is bad because the file system is bound to my user, and anything my user runs has 100% access to everything else I run. The user system is nice, but not practical. If it was, Ross would be a free man.

anonbanker2• 12 years ago

Posting as breadcrumbs so I can reference this post later.

styles• 12 years ago

In theory LXC could do this. It needs to be tested more and clearly has security issues right now.

Ross Ulbricht’s private journal shows Silk Road’s birth

Related Stories