News for hackers. Stuff that matters.
Re:Author of cURL denied entry to the USA by qume on Tuesday June 27, 2017 @05:52AM (#14643714)
Just to balance the narrative here a bit, I have traveled into and out of the US many times per year for around 15 years with no problems on an ESTA. I only recently switched to a visa.

After a long flight having to deal with the delay and hassle of immigration seems much worse than it is. I really hate it, and the comments here suggest others do too, but if you look at what we have to deal with objectively it's not really that horrible.

It feels weird for me to be defending them, because of the crappy experiences over the years, but when it comes down to it I think CBP are far more reasonable than they are given credit for because of the crappy environment it happens in. If you were calmly asked the same questions by a sweet guy or girl on a chaise longue while being offered champagne and strawberries, people would have almost no problem even though it's really the same thing without the elevated stress level.

Regarding Daniel - like others here I'm sure it's because cURL has been used extensively for bad purposes he was kicked off the ESTA program. Yes it sucks that they didn't let him know in advance, and they didn't have the smarts to figure that he had nothing to do with the bad actors.

For me getting a visa was a pretty easy process. The interviewer in my country was a smart political science graduate and everything went smoothly. An inconvenience for sure, but hey this is another sovereign nation, why should us foreigners expect to be able to march in without playing by their rules, even if we don't agree with them.

Don't get me wrong - this situation sucks for Daniel and US immigration has massive room for improvement.

Re:Author of cURL denied entry to the USA by skynode on Tuesday June 27, 2017 @06:11AM (#14643818)
> Regarding Daniel - like others here I'm sure it's because cURL has been used extensively for bad purposes he was kicked off the ESTA program. Yes it sucks that they didn't let him know in advance, and they didn't have the smarts to figure that he had nothing to do with the bad actors.

Very strange paragraph right there. I could easily generalize this to Windows powershell is increasingly being used in cyber offensives by non-state actors, let us eject Microsoft from the United States

Re:Author of cURL denied entry to the USA by qume on Tuesday June 27, 2017 @06:19AM (#14643866)
Yes you can generalize this to Windows powershell.

And no that does not have anything to do with ejecting Microsoft from the US. Microsoft isn't a private foreign individual using a privileged entry mechanism in the US that given any reason whatsoever can be revoked in favour of a perfectly functional visa process that most countries have to use.

ESTA is only available to a few countries, and not all people in those countries.

I don't think Microsoft will be ejected from the US because of an ESTA invalidation.

Re:Author of cURL denied entry to the USA by skynode on Tuesday June 27, 2017 @06:27AM (#14643920)
Great. So what does this rejection accomplish based on your premise of having written software that has been repurposed by evil actors? Dan's GPS coordinates at any time t does not affect whether he writes code that will be used for good or evil, so what gives? :\
Re:Author of cURL denied entry to the USA by tgragnato on Tuesday June 27, 2017 @06:33AM (#14643958)
No one should be held responsible for a fact that causes damage without direct involvement. The legal system uses `iuris personae` and limited liability precisely for this. Distinguishing a natural person from a legal person in this case is contrary to the purpose of the laws in force.

Each tool can be used for good and for evil: risk management is primarily used to hedge against the risk of a contingent, uncertain loss, and is embedded by the law for companies, and people too.

Re:Author of cURL denied entry to the USA by qume on Tuesday June 27, 2017 @06:52AM (#14644095)
He wasn't denied entry into the US. He was denied access to a fast track system for entry into the US, so he has to use the slow, annoying, more methodical way.

It certainly sucks, but your summary of the US legal system is irrelevant.

Re:Author of cURL denied entry to the USA by pricechild on Tuesday June 27, 2017 @09:04AM (#14644960)
He apparently had his paperwork in order and was rejected when he tried to travel.

Spin it however you like, but the fact is that he was denied entry into the US?

Whether or not he can pay (time, money) to go in the future is irrelevant to being denied today?

Regarding the entire esta vs visas... I'm lucky enough to have passed painlessly through VISA and I don't understand the difference between them? You have to apply for both? You have to provide your identity documents, information about yourself, payment? The only difference I can see is that you don't need to visit an embassy? Why do we draw a distinction, other than marketing?

Re:Author of cURL denied entry to the USA by tgragnato on Tuesday June 27, 2017 @07:47AM (#14644447)
My purpose was not to criticise your comment, but to offer a starting point for reflection. It is not a secret that (in recent years) the number of people subject to more stringent authorisation procedures are constantly increasing, and this without counting the no-fly.

Having been a great admirer of the US, I can say that what I admire are some principles, principles that seem forgotten. They are probably forgotten because when you teach a CBP employee to look for only the worst of people, this will eventually find something suspicious in anyone.

The recent run into exploiting software vulnerabilities could explain why there’s a focus on developers/hackers. But just putting a critique is not constructive, remembering where we come from, what are our principles, why we have them, and their purpose, is much better to motivate why it's wrong to "discriminate" someone.

It's not just slow and annoying, it's wrong because he’s not responsible.

Re:Author of cURL denied entry to the USA by rockdoe on Tuesday June 27, 2017 @10:38AM (#14645768)
The nuance you're trying to invent is meaningless if you miss your flight and the conference.
Re:Author of cURL denied entry to the USA by jorvi on Tuesday June 27, 2017 @06:30AM (#14643940)
> If you were calmly asked the same questions by a sweet guy or girl on a chaise longue while being offered champagne and strawberries, people would have almost no problem even though it's really the same thing without the elevated stress level.

Cute girl offers glass of champagne and complimentary strawberry 'so.. I'm gonna need you to unlock your phone, give me the password to your work-related e-mail, your personal e-mail and all your social media accounts.'

Re:Author of cURL denied entry to the USA by pjc50 on Tuesday June 27, 2017 @09:33AM (#14645202)
A popular tactic of intelligence agencies, Mata Hari passim.
Re:Author of cURL denied entry to the USA by qume on Tuesday June 27, 2017 @06:54AM (#14644109)
I travel into the US constantly, as do many people I know, and I have never in person come across a single person this has happened to.

Not saying it doesn't happen, just that it's easy to blow this stuff out of proportion.

That's what I'm trying to do here - offer the view of someone who does this every few months for nearly two decades.

Re:Author of cURL denied entry to the USA by ubernostrum on Tuesday June 27, 2017 @06:31AM (#14643952)
I don't think it has anything to do with what software he works on.

I'd be willing to bet significant money that it was either a clerical error, or something mundane from his ESTA form that got double-checked and came up "no". I am willing to bet this because I have been in that situation:

https://news.ycombinator.com/item?id=14643861

Re:Author of cURL denied entry to the USA by GreaterFool on Tuesday June 27, 2017 @05:55AM (#14643737)
> cURL has been used extensively for bad purposes

What?! Sources please.

Re:Author of cURL denied entry to the USA by nickserv on Tuesday June 27, 2017 @06:01AM (#14643765)
I once used it to change the user-agent and get an alternative response from an API.
Re:Author of cURL denied entry to the USA by funnyfacts365 on Thursday June 29, 2017 @11:25AM (#14664017)
badass...
Re:Author of cURL denied entry to the USA by joncrocks on Tuesday June 27, 2017 @06:09AM (#14643803)
I presume the author of the comment is refferring to incidents such as https://daniel.haxx.se/blog/2010/12/23/hacking-me/

If you write a general-purpose utility and it gets included in some kind of bad software, the people writing the 'bad' parts aren't likely to include their details, but if your 'good' code has your details....

Re:Author of cURL denied entry to the USA by m-j-fox on Tuesday June 27, 2017 @06:04AM (#14643777)
I mean, I've personally used it to access APIs from shell scripts that would have been far more maintainable in a proper Python script.
Re:Author of cURL denied entry to the USA by contingencies on Tuesday June 27, 2017 @06:09AM (#14643812)
That's three counts of conspiracy to degrade system maintainability, manufacturing tooling with intent to degrade system maintainability, possession of tooling to degrade system maintainability, one count of international travel with intent to degrade system maintainability, two counts of manufacture of false documents[0][1] in support of a conspiracy. Bail denied. And... that's life.

[0] Exhibit A: man curl

[1] CURL website

Re:Author of cURL denied entry to the USA by nthcolumn on Tuesday June 27, 2017 @06:06AM (#14643794)
You monster!
Re:Author of cURL denied entry to the USA by qume on Tuesday June 27, 2017 @06:12AM (#14643827)
If an attackers rouge process lands itself on a target, using something trusted like cURL is better than opening a socket directly, no? Less likely to attract attention?

Same goes for wget, links, etc.

Sorry no sources, it won't take you long to verify this yourself using google. I'm sure there are competent infosec guys and gals here who can provide a better explanation.

Re:Author of cURL denied entry to the USA by funnyfacts365 on Thursday June 29, 2017 @11:27AM (#14664030)
rogue, not rouge.
Re:Author of cURL denied entry to the USA by rev on Tuesday June 27, 2017 @06:09AM (#14643805)
"I once saw him kill three men in a bar with a pencil, with... a... f#@king... pencil." © John Wick
Re:Author of cURL denied entry to the USA by buremba on Tuesday June 27, 2017 @04:20PM (#14649004)
Re:Author of cURL denied entry to the USA by baby on Tuesday June 27, 2017 @08:08AM (#14644583)
> For me getting a visa was a pretty easy process

Just because it went well for you doesn't mean you have to turn a blind eye for other people. As soon as you don't come from a list of "nice" countries crossing borders is a living hell.

Re:Author of cURL denied entry to the USA by Veratyr on Tuesday June 27, 2017 @01:17PM (#14647277)
> but when it comes down to it I think CBP are far more reasonable than they are given credit for because of the crappy environment it happens in

I don't think this is true. The circumstances/environment are the same but compare entering America to entering any other country.

No country but America has ever fingerprinted me, searched my luggage, detained me in a small room with no explanation for 3 hours, forced the departing airport to search me again after security (on 3 separate but consecutive flights to the US, months apart) or made me spend more than ~10 minutes in a line waiting to get through security or immigration. America has done all of these things.