Re:Reset the Net
by dan_bk on Friday March 14, 2014 @12:41PM
(#7400032)
We're totally anti-surveillance, and that's why we let a bunch of companies track you around the Web, here's the list of requests (potentially tracking you) made behind your back:
Re:Reset the Net
by ChrisAntaki on Friday March 14, 2014 @01:14PM
(#7400275)
Yes, that's a great & valid point. We use those to gain intelligence on how to build more effective communications. At the same time, we totally encourage you to use plugins like Ghostery & NoScript, That way, you'll be protected from those services across the entire net. VPNs are also a great tool.
Re:Reset the Net
by ChrisAntaki on Friday March 14, 2014 @02:44PM
(#7400912)
Sorry you didn't like the site. We aren't perfect, but we make an effort to constantly improve. I'll bring up your concerns relating to tracking in the next meeting.
Re:Reset the Net
by IgorPartola on Friday March 14, 2014 @02:23PM
(#7400781)
While I was a fan of the previous campaign (the day we fight back), this one seems DOA. First, there is no actual action to be taken. There is a date, but to get to what the campaign is trying to do you have to watch a two minute video at the end of which it boils down to two calls to action:
1. Developers should add "NSA-resistant features" to their products. No mention of what this actually means.
2. Users should try apps that support their privacy and spread the word about them. No mention of what the apps actually are.
The site itself, as others said, tracks users through Google Analytics. That's right, the same Google that is sending every bit of user data it gets directly to the NSA. You are encouraging us to disable logging in our applications... I don't know what to say to this.
Now, for some more constructive suggestions:
1. Instead of "trying apps", why not focus a bit more on some specific things. For example "try Tor". Most users don't know what that is, but it's a tangible actionable thing someone can spend 30 minutes on and learn something actually valuable.
2. Or, try GPG. This is harder, but I believe can still be something that power users can grasp.
3. For developers, why not hack on Firefox or Chromium to add a Tor-enable private mode. Encourage and fund this project, so that most people can press a button and get a Tor-enabled browser immediately.
4. Or, get developers to set up more Tor nodes and bridges.
5. Or, get developers to finally bring IPv6 to Tor.
6. Or, get developers to create alternatives to specific popular services that are currently monitored by the NSA. The reason GMail is so popular is because it's got a fantastic UI. No open source webmail client comes close. Get developers to volunteer time to develop an alternative that users can host themselves.
Re:Reset the Net
by ChrisAntaki on Friday March 14, 2014 @02:38PM
(#7400877)
We purposefully kept the video vague, so that developers could choose what they felt were the most appropriate improvements, to the vast array of applications out there.
Thanks for your ideas. OTR is another good thing to add, for chat applications. Also, good point regarding user interface. As was discussed at SXSW, friendly UI's have a huge affect on the popularity of an application.
Re:Reset the Net
by IgorPartola on Friday March 14, 2014 @03:56PM
(#7401382)
Glad you are reading this. One more thing: if you could add a text transcript of the main points of the video that'd be awesome. If I was on my phone I definitely wouldn't have watched the video.
This is a great campaign. I hope it gets the attention it deserves. I hope they intend to list some of those apps that we can "pledge to use", and maybe even have donation buttons next to them. Donating to them might get people to actually continue to use them afterwards, and not just try them once and forget about them.
Re:Reset the Net
by simias on Friday March 14, 2014 @12:28PM
(#7399926)
I agree, I think that's the right approach. You can't expect all the governments in the world to stop doing what they're doing and "leave the net alone", we have to develop the technology to put the internet out of reach.
And we already have most of the tools, most people just didn't bother to use them until now. PGP is more than 20 years old and we're still trying to figure out how to protect our emails.
Re:Reset the Net
by ChrisAntaki on Friday March 14, 2014 @02:06PM
(#7400673)
Great point. As discussed at SXSW recently, the more user friendly an application, the more likely it will attain users. Writing software takes energy, and writing secure software is... a challenge. Hopefully though, as time goes on, more frontend developers & designers can join the open source movement, and contribute to making secure applications feel intuitive and friendly.
Re:Reset the Net
by Karunamon on Friday March 14, 2014 @12:26PM
(#7399911)
Can we please stop pretending that email addresses are in any possible sense private information? They're the internet equivalent of a phone number (you know, those things that get printed on dead trees en masse).
Someone getting your email address when you didn't want them to have it is a minor annoyance at worst.
I consider my email address to be private. I consider my phone number to be private too. Whilst I'm aware that it doesn't take a PHD in rocket surgery to discover either, I'm also aware that handing them out to anyone that asks, leads to unwanted spam from both.
Re:Reset the Net
by KhalPanda on Friday March 14, 2014 @12:48PM
(#7400071)
Yes. Obviously. But it's just the complete, wrong delivery method to issue the content for the they're addressing here, as 90% of the other comments here have said, which was my point.
Re:Reset the Net
by ChrisAntaki on Friday March 14, 2014 @01:07PM
(#7400216)
We wanted to keep the video open ended. Our goal is to get a bunch of talented developers on board, who would like to add security features to their applications. We're hoping to encourage developers, and as a group make a noticeable movement towards a more secure web.
Re:Reset the Net
by judah on Friday March 14, 2014 @12:30PM
(#7399936)
I missed the video. OK, so they want devs to add "one NSA-resistant feature" to their web apps. Perhaps they could give examples? I mean, are we talking simple things like SSL, or something more complex?
Re:Reset the Net
by ChrisAntaki on Friday March 14, 2014 @01:16PM
(#7400285)
Definitely. We'll add examples soon. The obvious ones are using SSL, OTR, removing or avoiding logs when possible, and of course, the ultimate being end to end encryption as Snowden recently discussed at SXSW.
Also, the email form is there so we can feature applications on the homepage, in the coming months. While we'd love to list your application(s), there's no pressure.
Step 1: Give us your email address
Step 2: We'll send you an email
Step 3: After an enormous amount of spam and malware from us, you'll change your email address and restore your computer, rendering all previous tracking meaningless.
Re:Reset the Net
by CK101 on Friday March 14, 2014 @03:12PM
(#7401078)
Dont you think the NSA already has a contigency to something like this? If anything thinking big should be what we are doing, because those people are planning something huge and i dont think they'll let anything get in their way.
Re:Reset the Net
by mindslight on Friday March 14, 2014 @01:42PM
(#7400485)
The problem is that SSL (transport security) is the only "NSA-resistant" feature that can ever be added to a website, or incrementally added to an app. And it only works until you (or your hosting provider) gets big enough that NSA demands (or takes) direct access to you, the man-in-the-middle.
Unless your application is open source, administered by a user-controlled package manager, based on end-to-end encryption with user-managed keys, and takes steps to obscure communication-graph metadata, touting the addition of "NSA-resistant" security features is selling snake oil.
Re:Reset the Net
by npizzolato on Friday March 14, 2014 @01:26PM
(#7400362)
I believe his point was that the website makes no mention of SSL or any other examples of NSA-resistant features. "Add one NSA-resistant feature to your app" without any further explanation is not exactly informative or helpful.
Re:Reset the Net
by todd3834 on Friday March 14, 2014 @12:31PM
(#7399946)
Watching the video made me want to yell out "Hack the planet!" . At the end I was hoping for some NSA blocking techniques to share with those less technical but I was left with nothing. I feel like the biggest call to action was to show their banner on my webpages. Feels like this is more of a viral campaign than a tactical offense. I don't think it is, I just feel like there is a missed opportunity by not sharing the NSA blocking information.
optimizely.com googleapis.com amazonaws.com heroku.com googleusercontent.com google-analytics.com newrelic.com chartbeat.com chartbeat.net youtube-nocookie.com googlevideo.com google.com
If you use Firefox, here's another plugin I made, which you might dig - https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...
You can't decry government spying while simultaneously ignoring spying by large companies. They're both equally wrong.
The only message I got from this website was, "We don't get it."
1. Developers should add "NSA-resistant features" to their products. No mention of what this actually means.
2. Users should try apps that support their privacy and spread the word about them. No mention of what the apps actually are.
The site itself, as others said, tracks users through Google Analytics. That's right, the same Google that is sending every bit of user data it gets directly to the NSA. You are encouraging us to disable logging in our applications... I don't know what to say to this.
Now, for some more constructive suggestions:
1. Instead of "trying apps", why not focus a bit more on some specific things. For example "try Tor". Most users don't know what that is, but it's a tangible actionable thing someone can spend 30 minutes on and learn something actually valuable.
2. Or, try GPG. This is harder, but I believe can still be something that power users can grasp.
3. For developers, why not hack on Firefox or Chromium to add a Tor-enable private mode. Encourage and fund this project, so that most people can press a button and get a Tor-enabled browser immediately.
4. Or, get developers to set up more Tor nodes and bridges.
5. Or, get developers to finally bring IPv6 to Tor.
6. Or, get developers to create alternatives to specific popular services that are currently monitored by the NSA. The reason GMail is so popular is because it's got a fantastic UI. No open source webmail client comes close. Get developers to volunteer time to develop an alternative that users can host themselves.
Thanks for your ideas. OTR is another good thing to add, for chat applications. Also, good point regarding user interface. As was discussed at SXSW, friendly UI's have a huge affect on the popularity of an application.
And we already have most of the tools, most people just didn't bother to use them until now. PGP is more than 20 years old and we're still trying to figure out how to protect our emails.
Campaigns like this are just an embarrassment at this point.
Someone getting your email address when you didn't want them to have it is a minor annoyance at worst.
Fight for the Future and Center for Rights will contact you about future campaigns.
Please don't let it stop you from helping to make the web more secure, if you're into it. :)
Also, the email form is there so we can feature applications on the homepage, in the coming months. While we'd love to list your application(s), there's no pressure.
Step 1: Give us your email address Step 2: We'll send you an email Step 3: After an enormous amount of spam and malware from us, you'll change your email address and restore your computer, rendering all previous tracking meaningless.
Welcome to a Reset Internet.
Just an opinion!
Unless your application is open source, administered by a user-controlled package manager, based on end-to-end encryption with user-managed keys, and takes steps to obscure communication-graph metadata, touting the addition of "NSA-resistant" security features is selling snake oil.
Instead of complaining, someone should write a detailing blog post.
(not me though. Dont have the knowledge yet)