HN user
Director of Free Law Project.
We’re familiar with vulnerability disclosure philosophies, but what if the problem can’t be fixed because there’s no forward secrecy for the hundreds of millions of documents that are already out there?
It’s tricky stuff and we have limited resources, unfortunately.
It’s a fine line. Most redactions are for the good, to protect someone or something. For example even in the Epstein files, where some redactions are being abused, most redactions are protecting victims.
If there’s a way to undo huge amounts of redactions, that’d certainly be a net negative. Sort of like if encryption were suddenly broken, you wouldn’t publish a paper saying so.
Our goal has always been to educate about the problem so that it can be addressed. We didn’t have resources to push on the font metrics approach, so we stayed mostly quiet about it.
Really depends on the length and predictability of the redaction, but yes. If it's short and contextually it's only likely to be either "yes" or "no", you've got it. If it's longer and could contain an unknown person's name along with some other words, well, that's harder.
No, we worked with researchers that developed that kind of system, but didn't broadcast our work b/c the research was too sensitive. Seems the cat is out the bag now though.
I think the combination of AI and font-metrics is going to be wild though. You ought to be able to make a system that can figure out likely words based on the unredacted ones and the redaction's size. I haven't seen any redaction system yet that protects against this.
Cool to see this here. It’s funny because we do so many huge, complex, multiyear projects at Free Law Project, but this is the most viral any of our work has ever gone!
Anyway, I made X-ray to analyze the millions of documents we have in CourtListener so that we can try to educate people about the issue.
The analysis was fun. We used S3 batch jobs to analyze millions of documents in a matter of minutes, but we haven’t done the hard part of looking at the results and reporting them out. One day.
OK, this is really neat: - S3 is really cheap static storage for files. - DuckDB is a database that uses S3 for its storage. - WASM lets you run binary (non-JS) code in your browser. - DuckDB-Wasm allows you to run a database in your browser.
Put all of that together, and you get a website that queries S3 with no backend at all. Amazing.
Maine's remote work program is an incredibly promising development to prevent recidivism. The amazing thing about it is that it gives real jobs to prisoners that they can seamlessly continue after they get out of prison. Normally when you get out, it's impossible to get a job, and the clock is ticking. This leads to desperation, which leads to bad behavior.
There is a real risk of exploitation, but if it's properly managed, remote work for prisoners is one of the most hopeful things I've heard about the prison system. It gives people purpose while there and an avenue to success once they're out.
OK, here's the first thing popping up in court about this. There's a motion to unseal search warrants filed by a security researcher at Stanford that was just filed:
https://www.courtlistener.com/docket/69834044/in-re-motion-t...
This doesn't mean there are search warrants, necessarily, but this case might be the next place something pops up. If anybody wants to follow the case, you can do so with this link. :
https://www.courtlistener.com/alert/docket/new/?pacer_case_i...
I run CourtListener.com, which aggregates Pacer data.
So far nothing there, but I created an alert for his name, and I’ll post here and to Dan Goodin (the author of the article) if anything pops up.
Just for the record, they are being sued to oblivion:
https://www.courtlistener.com/docket/66607916/debt-cleanse-g...
You'd have to go study the case, but it's a class action case, so it'll hurt if they lose (and even if they don't). The court appears to be consolidating cases into this one, because LastPass has been sued in federal court 15 times so far:
https://www.courtlistener.com/?q=lastpass%20AND%20(caseName%...
Wow, funny to see this here. I'm the director of Free Law Project. Juriscraper is a project we use to scrape and parse millions of court records. I'll be happy to answer any questions folks have about it.
It's on version 2.6.0 now, but it has had several hundred point releases over the years as we adapt to changing court websites. Fun stuff.
The result of using Juriscraper is that we have something like 200B tokens of court data that we make available in various ways: https://www.courtlistener.com/help/api/bulk-data/
SEEKING VOLUNTEERS
Project names:
- Free Law Project
- RECAP Extension
- CourtListener.com
- Bots.law
Repos:
- https://github.com/freelawproject/courtlistener
- https://github.com/freelawproject/recap-chrome
- https://github.com/freelawproject/bigcases2/
Languages: Python, Django, JavaScript, Browser extensions
Free Law Project is a small non-profit that uses technology to make the legal sector better. We operate at a big scale (about 300M items in our DB and a lot of traffic), and need help scaling, operating, expanding, fixing, modernizing, and maintaining our stack.
One high priority project is adding a CDN to our site due to the crush we just got on the latest Epstein docs:
Background: https://www.axios.com/2024/01/04/epstein-document-crash-docu...
Issue: https://github.com/freelawproject/courtlistener/issues/917
If you have experience in rolling out a CDN, that's great.
If not, we also have a volunteer backlog where we are always looking for help with our website, browser extensions, etc: https://github.com/orgs/freelawproject/projects/31/views/1
At this point, if you are a Python/Django/Browser extension dev, we could probably use your help!
Get in touch: info at free dot law
Lots. You can follow here: https://www.courtlistener.com/alert/docket/new/?pacer_case_i...
(I run CourtListener.)
I run CourtListener. Usually the problem is the opposite: It’s too hard to get things OUT of Google.
Hi HN. I'm the director of Free Law Project, the org that's behind this, RECAP, and CourtListener.com.
The idea of this project is to create topic-based bots that follow certain areas of the law so that folks can access the raw data underlying the news and read it for themselves.
We have a handful of "topic bots" over at https://bots.law, and we're working on Slack/MS Teams/Discord integration as well. We'll probably be launching a Crypto bot soon, if we can find a reasonable curator for that.
We'd love your thoughts and if you follow tech cases, hopefully you'll find our bots useful!
The whole case is here:
https://www.courtlistener.com/docket/66631003/securities-and...
And if you want to get free email updates as it develops, you can sign up here:
https://www.courtlistener.com/alert/docket/new/?pacer_case_i...
At CourtListener we send thousands of emails each day. We recently migrated to AWS SES and learned a ton of lessons beyond DMARC/SPF/etc.
Getting all of those parts right is important, but you also have to handle bounces, down recipient servers, full inboxes, changed email addresses, and a lot more.
It's been a ton of work getting this set up, so we thought we'd share our notes.
This uses AWS's Textract service, but if you're doing a LOT of extraction, that gets pretty expensive pretty quickly. We do thousands of pages daily on CourtListener.com and created an open source microservice for this purpose. It can take PDFs, DOCX, DOC, TXT, HTML, or a handful of other files and extract the text, doing OCR if necessary:
https://free.law/projects/doctor
We're always looking for more people to use and improve it.
This bug means that when somebody uninstalls Signal (or an iPhone disables it for lack of use), people sending messages never learn that the message didn't go through.
As a result:
"I just missed out on placing an offer on a house because of this issue."
"Today I ended up uninstalling Signal after an experience where this problem caused me to almost lose two of my friends."
"I just had the experience of being very worried about a friend's well-being because he stopped responding to my messages."
I'm the director of Free Law Project, the non-profit org that runs CourtListener. If anybody wants to get email or RSS alerts for this case, you can set them up here: https://www.courtlistener.com/alert/docket/new/?pacer_case_i...
My organization built a similar tool that can find bad redactions caused when people just use a black rectangle on top of text in PDFs: https://free.law/projects/x-ray
Very fun project. Lots of problems out there.
Yes, exactly this. All that's needed is to tell senders when a message wasn't received after X hours.
You don't have to figure out if the user uninstalled. This also happens if they get a new phone and don't re-install on it, so relying on uninstalls wouldn't work anyway.
They can just say the message wasn't received. They don't have to say it was uninstalled. Just loudly tell me things aren't working like I expected. That's all this takes.
They just have to tell you if a message isn't received after a day or two. This is already exposed via the check marks, so it's just something they have to amplify with a notification.
Or when you start writing a message to somebody, if they haven't read the last couple messages signal could make that obvious. Etc. Lots of easy fixes.
This is fine, but signal still doesn't tell you when the person you're sending to has uninstalled signal. Instead, your messages go into ether and you think the person is ignoring you. It blows my mind they haven't prioritized this. https://github.com/signalapp/Signal-Android/issues/11164
This is linked from the help page here: https://support.google.com/a/answer/60217#zippy=%2Cwhat-if-i...
we understand some customers may not use their G Suite legacy free edition for business and may be interested in other options. If you have 10 or fewer users in your group and do not use your G Suite legacy free edition for business, please complete the form below by April 1, 2022 if you're interested in learning about different options for your account in the coming months.
Seems promising.
In January 2023, Chrome will stop running any manifest v2 extensions. I suspect that's about 99.9% of all extensions. This is going to be a huge loss.
There's a pretty big legal tech scene these days. I run Free Law Project, where we're looking for experienced python developers and we don't care about having a CS degree if you're good.
There are a lot of other orgs doing similar work. I'd look around at those too, or check out our hiring page. (It says the backend dev position is closed, but we're expanding the position and hiring again.)
My organization, Free Law Project, provided the data for this and several other related stories. It was a multi-year process pulling data out of tables embedded in tiff files. More here: https://free.law/2021/09/28/announcing-federal-financial-dis...
That'd be a win, but to our knowledge, no.