That was probably just commemorating Leonard Cohen's death, and the certificate fingerprints were probably just removed because they switched to Let's Encrypt for those domains. But you never know.

What good is a warrant canary if it's also used for whimsy or commercial speech? If they don't take it seriously enough for people know what it means then their system isn't worth using to start with.

A Twitter feed is not a warrant canary.

Edit: the exact link to the official warrant canary is specified in the top post, please don't answer if you haven't recognized that much:

https://riseup.net/pl/about-us/canary

The "If they're relying on double entendres then it might as well be" as a response to "A Twitter feed is not a warrant canary" really has no sense.

https://en.wikipedia.org/wiki/Warrant_canary

Also worth reading:

https://www.schneier.com/blog/archives/2015/03/australia_out...

Think about it a while longer.

If they're relying on double entendres then it might as well be.

OK, good point.

This could just be drama.

Maybe it's worth checking their feed before writing?

That's the problem with canaries, though. By definition, they exist for situations where the canary-owner can't offer positive evidence for compromised security.

I don't particularly think Riseup is in that position, but unless someone actively says "don't worry about our lack of a canary, we took it down for $REASONS and all is well", negative evidence is all you can react to.

It could have been an attempt at plausible deniability.

Have you happened to see their other messages from the same day?

"Dear friends, please remember that internet is not always the answer..."

"by the way, that wasn't a trump related tweet..."

"listen to the hummingbird, whose wings you cannot see, listen to the hummingbird, don't listen to me. #LeonardCohen"

It all "has nothing to do with" canaries.

or it means "the canary is dead for a reason; don't trust us"

Okay, that's telling, but the canary on its own seems to be valid still - it's from August 16, 2016, and they say it should be 'updated approximately once per quarter'

If "quarter" is defined as "3 months", we're officially just on the outside of a quarter since the last update — 3 months and 5 days, to be precise.

Well, after (I'm sure) many inquiries about the canary, their latest update says nothing specific, just:

> we have no plans on pulling the plug https://riseup.net/en/about-us/policy/government-faq …

https://twitter.com/riseupnet/status/800815181190217729

This reads like a vague suggestion that everything is fine, but in context (ie, no clear denial) it's a huge red flag being waved.

If I were a scary government type and took control of riseup.net, that is exactly the thing I would post to twitter if I couldn't compel them to update the canary.

I certainly have no clue. I'm still getting email :)

And they've had indirect FBI attention before: https://riseup.net/en/about-us/press/fbi-seizes-anonymous-re...

> I'm still getting email :)

The failure mode of their warrant canary is not that you stop getting email, but that other people start getting your email too.

Sure. But you see, the prudent assumption is that adversaries always get all your email :)

Your comment is a distraction, not a contribution. People came here to discuss whether a warrant canary had died, not to hear you trot out security 101 cliches.

> I'm still getting email :)

While obviously this is not about preventing you from "getting email", you might not have received everything. You should consider the service compromised.

A beautiful quote. A nice picture. Also worth seeing the previous two messages there made on the same day while also thinking about the hummingbird.