PyPI Was Subpoenaed(blog.pypi.org)

1,153 pointsby quercusa3 anni fa597 comments

blog.pypi.org

https://blog.pypi.org/posts/2023-05-24-pypi-was-subpoenaed/

608 comments

> We have waited for the string of subpoenas to subside, though we were committed from the beginning to write and publish this post as a matter of transparency, and as allowed by the lack of a non-disclosure order associated with the subpoenas received in March and April 2023.

That's suspiciously specific. Sounds to me like they also received some other subpoenas they aren't allowed to talk about.

samanator3 anni fa

Yep, I was thinking the same thing. What a beautiful way of communicating that.

Loquebantur3 anni fa

What a weird way to think about such events.

Such subpoenas are clandestine surveillance of citizens by their state. The problem with such types of surveillance in particular is the lack of accountability.

How does the ethical use of this prolematic tool get ascertained? Where and how is the democratic oversight implemented? How is misuse treated and prevented?

blibble3 anni fa

as a foreigner (in terms of the US), I've never understood how these gag orders are compatible with the First Amendment

often there's posts on HN about how the UK and all other Western European countries are totalitarian because they don't have unrestricted free speech

but then apparently the police (FBI) can restrict the free speech of Americans without any court involvement at all?

I really don't understand

wolverine8763 anni fa

Civil rights, including those in the First Amendment, are not absolute. Regarding speech, you also can't harass people, threaten them, defraud them, incite violence, distribute copyrighted information that isn't yours, interfere with others' activities (sing loudly in a movie theater), etc. Private entities such as your employer can restrict your speech in many ways.

> often there's posts on HN about how the UK and all other Western European countries are totalitarian because they don't have unrestricted free speech

I haven't seen these posts. Do you have an example handy?

blibble3 anni fa

> I haven't seen these posts. Do you have an example handy?

here's one from earlier in the week: https://news.ycombinator.com/item?id=36000459

they're pretty common, here's another one: https://news.ycombinator.com/item?id=35617773

wolverine8763 anni fa

In the GGP you wrote,

> often there's posts on HN about how the UK and all other Western European countries are totalitarian because they don't have unrestricted free speech

I don't see that in the comments you cite - nothing related to totaliterianism, unrestricted free speech, or comparison to the US. The comments just look like critiques of some laws related to speech, similar to critiques of US laws. Maybe I misunderstand.

Freedom23 anni fa

I don't have a source handy, I can find one later if you desire. During Melbourne's lockdowns there was consistent criticism from US based commenters about the lack of freedoms in Australia.

edit:

https://news.ycombinator.com/item?id=28651811

https://news.ycombinator.com/item?id=28523358 (this entire comment section, probably: https://news.ycombinator.com/item?id=28522599)

https://news.ycombinator.com/item?id=35105640

heywhatupboys3 anni fa

funnily enough, the USA has much less protective laws against self incrimination than e.g. Denmark. In Denmark, you, as charged, may lie on the stand however much you please.

vintermann3 anni fa

Only in your own defense or in defense of your closest loved ones, I believe. If it's like in Norway.

heywhatupboys3 anni fa

yea, against self incrimination, as mentioned

brewdad3 anni fa

In the US you just have to shut up. It also saves you from getting caught in a lie.

goodpoint3 anni fa

The astonishing amount of people incarcerated without a process tells a different story.

robertlagrant3 anni fa

How many are incarcerated without a process?

wolverine8763 anni fa

I'm not the GP, but here are some ways:

Something like 95% of criminal cases are resolved with plea deals and not trials, and legal representation from public defenders has very limited resources.

Cash bail results in many people imprisoned without trial: After arrest, the court requires bail. Poor people can't afford it, so they are jailed until trial, which can be over a year. The impacts go beyond the (very serious) loss of freedom: They lose jobs, their family loses income, dependents (children, elderly) lose caregivers.

Meph5043 anni fa

Firstly, though I see the concept behind cash bail I don't agree with it. But people has a misconception of the likely result of removing it.

Judges now, don't need or required to use cash bails, they choose to, they can release people without cash bail now. either into the person's own recognizance, or even into the care of others.

If a judge doesn't feel the person is likely to return to their following court date, and they can't leverage financial burden as a means to insure it, they are likely just to forego the process and hold them.

yupyup541333 anni fa

In California "at least 1,317 people have been waiting in county jails for more than 3 years. For 332 of them, it’s been longer than 5 years."

Source: https://calmatters.org/justice/2021/03/waiting-for-justice/

prottog3 anni fa

Both the California and US constitutions guarantee a right to a speedy trial, and California criminal code has specific provisions on how quickly trials must begin. Who is holding the California government responsible for this? What an outrage.

robertlagrant3 anni fa

Wowzer, right. That is...pretty compelling. And incredibly illegal. Does California not know it doesn't have a right to just incarcerate people for no official reason?

KSteffensen3 anni fa

Shutting up and refusing to answer a question makes it very clear that you have something to hide, much more than a lie.

I'm not sure whether that's good or bad. I guess it depends on what you are accused of.

JohnFen3 anni fa

> Shutting up and refusing to answer a question makes it very clear that you have something to hide

It really doesn't, at least in a court of law. Although if the police are interrogating you, they will almost certainly try to convince you that it does.

saghm3 anni fa

(obligatory IANAL disclaimer)

I don't think you're ever required to any answer any questions from the police, whether avoiding self-incrimination or otherwise. You're only required to answer a question in court, and even then only if the answer wouldn't be self-incriminating (or a few other narrow exceptions I think; the concept of the court not being allowed to compel someone to testify against their spouse is a common trope in media, although I'm honestly not certain how accurate it's portrayed). You also aren't required to take the stand when accused of a crime; while you can choose to do so, you're also free to just have your lawyer make your case via the questioning of witnesses instead of having to answer questions directly yourself.

That said, my understanding is that you're _not_ allowed to plead the 5th if the answer wouldn't actually be self-incriminating, so it's a weird thing where you're only allowed to not answer a question by essentially stipulating that you _did_ do something illegal that would be disclosed if you answered truthfully. If they can prove you weren't actually avoiding answering due to self-incrimination but plead the 5th anyways, I'm pretty sure you can be charged with contempt of court. Having never been on a criminal jury, I can't say I know exactly how it would play out in deliberations, but it's hard for me to imagine that it doesn't affect things at all; even if a jury isn't technically allowed to consider it an admission of guilt, from a legal perspective pleading the 5th seems pretty explicitly either a non-legally-admissible admission of guilt or a crime of contempt of court in itself, so I don't see how the law isn't basically forcing the jury to conclude that you've committed a crime one way or another. The question would then boil down to which of the two crimes the jury thought you had committed (the one you were accused of or contempt of court), and while they're not supposed to be deciding the question of the latter, it seems likely that the jury's view will be tainted by this.

Of course, all of this only applies if you did actually commit a crime; if you genuinely didn't commit any crimes, you wouldn't be lying under oath when stating that instead of pleading the 5th. The jury still might think you did commit the crime though and are just doubling down on lying under oath to try to hide that, though.

catiopatio3 anni fa

That’s not the case.

If you choose to plead the fifth, the prosecution is absolutely forbidden from bringing that up the courtroom, much less using it to insinuate your guilt.

Any lawyer in the US will tell you not to speak to the police or prosecutor. At all.

heywhatupboys3 anni fa

Not true. In the Kyle Rittenhouse case, despite being nationally televised to millions, the prosecutor questioned why he didn't answer questions post arrest

catiopatio3 anni fa

And the judge immediately halted the trial, reamed out the lawyer as being unimaginably unprofessional, and threatened that he might toss the whole case if the prosecutor ever insinuated something like that again.

folmar3 anni fa

Is it actually? I've often heard the advice from the US lawyers to answer no questions.

paledot3 anni fa

Or say "I don't recall". That's a popular one with politicians.

weinzierl3 anni fa

Then following up on blibble's question: What is the difference to the UK and other western countries that mostly also have free speech with what looks to me very similar restrictions?

Honest question, like blibble, I don't really understand it either?

all23 anni fa

The US's first amendment is rather unique amongst Western nations. Basically it says "the government cannot infringe on this inalienable right", that is the government cannot govern speech. Here's the actual language

    Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.

The key phrase "or abridging the freedom of speech, or of the press".

As far as I know, this kind of language is absent from other Western nations. For example, Canada jails people for criticizing those of Islamic persuasion. [0] Note, the article doesn't record what the accused actually said. Here's a wikipedia overview of hate speech laws by country [1], though it is wikipedia, so take it with a grain of salt. Here's a somewhat relevant piece from Reason that takes an anti-hate-speech stance [2] where the author details the unconstitutionality of hate speech laws.

"Free speech" as we understand it in the US is unique in the world.

As far as the restrictions at state and federal level, these are considered unconstitutional, and you'll see a large number of them struck down in various courts across the country. Those in power definitely seek to expand their powers and fortunately we have a law that allows the citizenry to push back against that.

[0] https://www.cbc.ca/news/canada/hamilton/muslim-hate-1.614516...

[1] https://en.wikipedia.org/wiki/Hate_speech_laws_by_country

[2] https://reason.com/2021/05/20/teen-arrested-under-connecticu...

amatecha3 anni fa

Rather than posting a poorly-worded, short-on-facts news story about the guy in Hamilton saying some hate speech, you could cite the actual Canadian Criminal Code which is far more specific and worthy of discussion: https://www.criminal-code.ca/criminal-code-of-canada-section...

This is what the guy was charged with violating (as per https://hamiltonpolice.on.ca/news/hamilton-police-charge-mal... )

Framing it as "Canada jails people for criticizing those of Islamic persuasion" is disingenuous, as if Canada specifically has laws about some specific religion or faith.

account423 anni fa

Without knowing what was actually said that the courts deemed to be promoting hatred, "Canada jails people for criticizing those of Islamic persuasion" is a valid interpretation. Citing vague laws doesn't make this any more reasonable.

amatecha3 anni fa

IMO the worthwhile fact to share on an HN thread is "in Canada there are specific laws against inciting hatred through speech etc." and linking that criminal code entry, rather than mentioning and linking a specific news case that we have no real details on. At least the criminal code is a clearly-defined thing we can learn from and internalize, rather than a specific case where the public was not given enough information to make an informed judgement about (as per most news stories, IMO).

account423 anni fa

Both are important really - the law and how it is interpreted by the courts. That we don't know the details of the case doesn't make it less concerning - on the contrary, media not reporting the relevant facts (in this case, what exactly was said/done) only makes this more concerning. Especially if the lack of reporting is due to fear of running foul of the same censorship laws.

contrarian12343 anni fa

It seems kinda arbitrary

Earlier it was listed "..you also can't harass people, threaten them, defraud them, incite violence, distribute copyrighted information.."

So where are these exceptions innumerated? Just purely from a technical point of view, why can defrauding be made illegal, but hate speech can not?

It actually seems the number of exceptions is quite limited - so I never understood why they were not spelled out explicitly (like in an subsequent constitutional amendment for instance). It seems to undermine the authority of the bill of rights. The original text makes no provision for exceptions...

sclarisse3 anni fa

It’s not strictly about the words in those exceptions.

In the case of fraud, it’s not the speech itself, it’s the part where someone gives you money (or other consideration) under some agreement or understanding, and doesn’t actually get what was promised. There’s nothing intrinsically wrong with what you promised, it’s your failure to deliver.

Threatening people? The illegal part is not that you used words at them specifically, it’s that you caused them to credibly fear for their life and safety. You could just as well do that without words, just standing outside their place with a baseball bat making menacing gestures. Harassment similarly may use words, but the objectionable part is often subjecting them to your words or actions or presence directly, to cause distress, instead of leaving them alone in peace.

“Hate speech” as a problem generally is about the content of the speech itself. You might wish to convince people that others in a group are bad and worthy of being considered bad. Your audience is typically people like yourself, or third parties who you wish to sway, and if you are in a public place you are mostly not following around an individual to be hated, or telling them you are about to do them violence. (If you do, it may in fact be harassment or intimidation.)

danaris3 anni fa

Given that some things that don't use words—for instance, art, money—have been ruled as being considered equivalent to speech for the purposes of First Amendment protections, I don't think the rationale you give there is likely to be the one used to justify the listed exceptions to the First Amendment.

In all the cases listed, the speech in question is being used to directly and (at least usually) intentionally harm or interfere with another person. I believe this is a case where looking to the Framers' intent rather than the strict wording of the amendment is worthwhile in determining how best to apply it. It seems obvious that they did not intend to make all forms of fraud and threats legal with no recourse (and I imagine there is some jurisprudence that cites specifics to this effect).

all23 anni fa

The specifics have been determined in case law. I'm not a lawyer, so I can't give a more detailed example. I can, however, give some examples (Mass Media Law at Utah State comes bubbling back into my mind, what a fun class).

Yelling "fire" in a crowded theater, for example [0]. Another comment in this thread talks about the "clear and present danger" doctrine that came from the case. That case was followed by the Brandenburg v. Ohio [2] case in 1969, which instituted the current methodology used for determining what is "allowed" speech. That rule/methodology is called the "imminent lawless action" rule.

[0] https://supreme.justia.com/cases/federal/us/249/47/

[1] https://en.wikipedia.org/wiki/Shouting_fire_in_a_crowded_the...

[2] https://supreme.justia.com/cases/federal/us/395/444/

contrarian12343 anni fa

Yeah, I'm not a lawyer but the system seems honestly nonsensical. They found the law inconvenient, so the court just effectively added a "clear and present danger" clause to the law. If there were problems with people abusing their freedom of speech, then you'd think the natural response would be to amended the bill of rights - and not just a bunch of unelected judges dreaming up something that seems "reasonable"

all23 anni fa

I honestly can't speak to "reasonable", but this format of jurisprudence has been common for the better part of 4000 years (see Jewish law and case law that pops up in the Bible's old testament, especially the tanach).

afthonos3 anni fa

Mostly right, but [0] is out-of-date, was overturned, and is a zombie free speech trope that is resistant to any headshot ever tried: https://www.theatlantic.com/ideas/archive/2019/08/free-speec...

nearbuy3 anni fa

I find the debunkers of this myth to be overzealous, or at least confusing.

You can be charged with a crime if you knowingly, falsely yell "fire!" in a crowded theater and someone gets hurt as a result.

The case you linked is not actually a ruling on whether you can do this.

microtherion3 anni fa

The biggest problem with the trope is that it plants in people's heads the idea that there was EVER a Supreme Court case where the defendant was accused of yelling "fire!" in a crowded theater.

In reality, the phrase was an analogy used to justify the conviction of a man who committed the heinous crime of… making and distributing leaflets opposing the draft in World War I. So for all the high minded rhetoric in the First Amendment, it may not provide all that much protection if your speech inconveniences the government sufficiently.

One might also be tempted to draw inferences from the fact that Schenk, the man whose speech was considered not worth protecting, was a socialist pacifist, while Brandenburg, whose free speech was considered more worthy of protection, was a KKK leader promoting violence against Blacks and Jews. In the US, protecting the civil rights of Nazis has become a litmus test of civic virtue across the political spectrum. Unfortunately, that protection is extended far less vigorously and consistently to other political views.

https://en.wikipedia.org/wiki/Schenck_v._United_States

https://en.wikipedia.org/wiki/Brandenburg_v._Ohio

https://en.wikipedia.org/wiki/National_Socialist_Party_of_Am...

andrepd3 anni fa

Hmm it sure sounds like "government abridging the freedom of speech of individuals" to me

fijiaarone3 anni fa

Case law doesn’t exist in the United States of America. You might be thinking about medieval England, or ancient Persia, where a king or judge’s word becomes law. In the USA, people are judged individually and are equal before the law. One exception, that is traditional, but not enumerated in law, is that the Supreme Court can strike down a law that it deems unconstitutional, but may not amend or make new laws itself. Lower courts havee Ed no such power.

afthonos3 anni fa

That's completely wrong.

First, every court of appeal can strike down a law as unconstitutional. The Supreme Court is only special in that there is no further appeal.

Second, case law absolutely determines the interpretation of each text, and each court is mildly bound by its own precendent (via stare decisis), and completely bound by the precedent of superior courts.

Third, there is no tension between these facts and people being judged individually and being equal before the law. The law must (in principle) be applied equally to everyone.

dragonwriter3 anni fa

> First, every court of appeal can strike down a law as unconstitutional.

Any federal court, not just the courts of appeal.

andrepd3 anni fa

Wow, American exceptionalism claims have now gone so farad to claim that freedom of speech is unique to America!

Not even the historical claim holds, as constitutional protections for free speech in France and Sweden predate the American constitution.

> For example, Canada jails people for criticizing those of Islamic persuasion

He was arrested, presented to court, and acquited. Therefore he was not "jailed". Also: the charge was inciting/organising a hate crime, in the wake of a killing of a Muslim father and his 15-year old daughter, not "criticising those of Islamic persuasion".

Don't be a liar, it doesn't help your argument.

all23 anni fa

> Also: the charge was inciting/organising a hate crime

True, but we don't know what the man actually said. So whether the charge was true or not remains solely decided by those policing speech.

> He was arrested, presented to court, and acquited.

Thank you for pointing this out. I should have been more careful in my reading of the source material.

sebosp3 anni fa

Could it be possible to illustrate with an example just for clarity? How does this compare to, say, the Netherlands? For example what are things that are possible in the United States that are not possible in the Netherlands? I would assume there are things that are not legal but not penalised in the latter but under certain conditions would be addressed and penalised and there's no way around it, but would like to know of an example just to make it super clear for me. Thanks!

Scarblac3 anni fa

A politician in the Netherlands got a crowd chanting "Do you want more or fewer Moroccans?" "Fewer! Fewer! Fewer!" [0].

A court found him guilty for "groepsbelediging", insulting a part of society, which is a crime. He did not get a punishment.

That's the only example that comes to my mind of something that the courts found not allowed in the Netherlands.

[0]: https://www.youtube.com/watch?v=BaB75uznT8o

alwayslikethis3 anni fa

In the US it is legal to advocate hate, such as denying Holocaust or promoting National Socialism or white supremacy. The courts have repeatedly struck down bans on hate speech. Not sure about the Netherlands, but this is illegal in many European countries.

germandiago3 anni fa

Idk the US specifics but hate speech in Spain is something govt has used to prosecute others in the name of so many things and in so many situations that to me, it means nothing. Just having a negative opinion is "hate speech" if the right person gets annoyed and goes for you.

It is a very powerful tool to shut up adversaries and it is extremely harmful for real opinions and real free speech.

all23 anni fa

If you're itching to speak freely, we'd love to have you in the US. :D

krustymeathead3 anni fa

Radiolab has a great episode about how this more broad application of the first amendment sort of came about due to Oliver Wendell Holmes changing his mind about what actually constitutes a "clear and present danger" between two Supreme Court cases in 1919.

https://radiolab.org/podcast/what-holmes

fijiaarone3 anni fa

Why is denying or promoting something considered hate? Where is the list of things we are allowed to deny or approve of?

warkdarrior3 anni fa

Because denying a group of people (say, based on ethnicity or skin color) the right to exist is equivalent to hating them.

concordDance3 anni fa

Take a person who believes that "there needs to be a country for white people and white people are innately better able to form productive societies". This person would clearly be a white nationalist and a white supremacist, right?

But they may also have no hate towards other ethnicities or desire their deaths. If pressed, they might even say that their vision of a "pure" society isn't worth the deaths of minorities that would come about if they tried to implement it.

I think too often we confuse the stereotypical example with the definition. The stereotypical white supremacist hates minorities, but the definition itself doesn't require it (I know of no surveys that would tell us what proportion of white supremacists match the stereotype).

nunobrito3 anni fa

That is simple.

Any left-wing should be allowed, any right-wing stuff should be denied.

Few exceptions exist on the western side, Spain is probably the most remarkable case. Reason why you wouldn't often hear much about what happens there, unless it is something negative to bash the right-wing people there.

concordDance3 anni fa

Note that including denying the Holocaust under "advocating hate" is basically making up a new concept and using an existing word (hate) for that concept.

It comes across as very dishonest.

There are people who genuinely think the Holocaust was exaggerated or didn't happen at any substantial scale who bear no ill will to Jews, seeing it simply as a question of historical fact of limited relevance to the modern day.

drekk3 anni fa

Denying that a targeted genocide happened or saying it's exaggerated is absolutely hateful. I'm not sure how it's of limited relevance when it's within living memory. When (some) Americans start to chant "The Jews will not replace us!" I think it's very relevant to our modern era.

I would really recommend doing a cursory, bare-minimum reading of the associated Wikipedia page [0] and citations. Plenty of historians revise the events surrounding the Holocaust to provide less biased and more nuanced information. Very different from taking an assumption as fact (the holocaust did not happen) and working backwards from that.

[0] https://en.wikipedia.org/wiki/Holocaust_denial

robertlagrant3 anni fa

I think, as ever with these things, the name is misleading. It's not "hate". We've no idea what people are feeling. Why do we a) think someone feeling "hate" is enough to suspend speech, and b) think if we want to justify censorship, we can't just say it out loud?

Why not just say "we ban speech that says the Holocaust didn't happen"? Why get it classified as hate and then because somehow hate is censorable get it autocensored? It seems somehow disingenuous.

concordDance3 anni fa

You're missing my point.

What does the word "hateful" mean? The old meaning is "full of the emotion of hate". Someone who thinks the Holocaust wasn't real could in theory have no strong feelings about it and think it has no relevance to their lives.

It is not required by definition that Holocaust denial is hateful (using traditional definition of the word "hate"). Nor is it required by human psychology (for example, you could have someone who read an unfortunate sampling of books as a child and took "disbelieve anything the victors of a war say about their enemies" as gospel and never got educated on the details).

psd13 anni fa

My goodness. That raises questions. I hope you are merely naive.

"I don't hate them! I just think they got a bit worked up over a few arrests. They're too sensitive. I don't blame them for it, but when you deal with them you've got to remember they can be prone to distorting the truth."

Come _on_

concordDance3 anni fa

Uh, I have no idea what you're saying here. Particularly can't see any relationship between what you quote and my post.

[deleted]3 anni fa

skissane3 anni fa

> The US's first amendment is rather unique amongst Western nations.

> As far as I know, this kind of language is absent from other Western nations. For example, Canada jails people for criticizing those of Islamic persuasion.

The US is not unique in having constitutional protections of free speech. For example part of the Canadian constitution is the "Canadian Charter of Rights and Freedoms", which forms part of the Constitution Act 1982. Section 2 of which says "Everyone has the following fundamental freedoms: (a) freedom of conscience and religion; (b) freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication;" – that's essentially saying the same thing as the US First Amendment.

In Europe, article 9 of the European Convention on Human Rights (ECHR) protects "Freedom of thought, conscience and religion". The Convention is quasi-constitutional in nature – while it is an international treaty whose members are in theory free to leave at any time, in practice quitting it is impossible for many European countries–membership in the ECHR is a requirement for EU membership, so no EU country is going to get away with denouncing it. And many national constitutions have equivalent provisions, such as articles 4 and 5 of the Basic Law of Germany.

One difference – the text of the US constitution doesn't contain any exceptions to the 1st Amendment, whereas the Canadian constitution, the ECHR, Germany's Basic Law, etc, explicitly state that freedom of speech/etc can be subject to limitations. However, in practice, even though the US constitution never explicitly says that the 1st Amendment has exceptions, the Supreme Court has always held that it does, although the scope of these exceptions has varied due to the evolving opinions of the Supreme Court – for the first century of the US's existence, SCOTUS allowed sweeping exceptions to the 1st Amendment; in the 20th century, it narrowed the allowed exceptions significantly, and developed some highly complex case law on which exceptions are allowed.

The real difference is actually nothing to do with the text itself, it is all about case law – since the 20th century, SCOTUS has been very strict in only allowing quite limited exceptions to the 1st Amendment. Courts in Canada, Europe, etc, have always been much more liberal in allowing exceptions to the right of free speech. Now, possibly the difference between a text which provides no explicit exceptions versus a text which does may have influenced that, but I don't think it was decisive. It was not historically inevitable that SCOTUS would start interpreting the 1st Amendment much more strictly in the 20th century, if different justices had been appointed, it easily could have decided to stick with its 19th century case law which allowed greater exceptions to it. Conversely, even though Canadian/European/etc texts explicitly mention exceptions, their courts could have chosen to interpret those explicit exceptions far more narrowly, producing a result much closer to that of the US, if they had wished to do so.

habinero3 anni fa

Canada does a lot of things better than the US, but not free speech.

Canadian law on is nowhere near as protective as the US. Defamation has a much lower standard there.

Defamation with public figures in the US is next to impossible to win. That's not true in Canada.

skissane3 anni fa

Similarly, in Australia it is generally much easier to win a defamation case than in the US.

However, there is one interesting difference – under Australia's uniform national defamation law (adopted in 2005), corporations cannot sue for defamation. (There is an exception for small businesses, with less than 10 employees.) So, the recent Dominion vs Fox News lawsuit would have been impossible in Australia.

0x706B3 anni fa

Hm, not quite sure I can follow the _unique_ part.

E.g. german constitution is quite similar:

``` Article 5 [Freedom of expression, arts and sciences]

(1) Every person shall have the right freely to express and disseminate his opinions in speech, writing and pictures and to inform himself without hindrance from generally accessible sources. Freedom of the press and freedom of reporting by means of broadcasts and films shall be guaranteed. There shall be no censorship.

(2) These rights shall find their limits in the provisions of general laws, in provisions for the protection of young persons and in the right to personal honour.

(3) Arts and sciences, research and teaching shall be free. The freedom of teaching shall not release any person from allegiance to the constitution. ```

(2) notes that there _are_ limits, but if I understood the concept of gag orders and also wolverine876's answer correct, thats the same for the US:

``` Civil rights, including those in the First Amendment, are not absolute. Regarding speech, you also can't harass people, threaten them, defraud them, incite violence, ```

Brybry3 anni fa

I was under the impression that Germany bans Nazi symbols (with some exceptions for education/art). [1]

In comparison, Nazi symbols are protected hate speech in the US. [2]

The US has tried to ban political parties in the past but eventually courts find that sort of thing unconstitutional. [3]

[1] https://en.wikipedia.org/wiki/Strafgesetzbuch_section_86a

[2] https://en.wikipedia.org/wiki/Bans_on_Nazi_symbols#United_St...

[3] https://en.wikipedia.org/wiki/Communist_Control_Act_of_1954

weinzierl3 anni fa

In Germany Nazi symbols are strictly banned but you are allowed to name soldiers killers. My hunch is that calling a veteran or active member of the armed forces of the US a killer would not go so well and might very well end in a slander suit.

When you free speech is restricted still seems pretty arbitrary to me [shrug].

monocasa3 anni fa

You can call US service members killers all you want. In fact "baby killer" is a relatively common refrain during protests aimed at the military. Maybe in the UK with their asinine slander laws you'd have to be more quiet but that's pretty clearly first amendment protected territory in the US.

janalsncm3 anni fa

SLAPP suits are a thing in the US. You might not go to prison for your speech but that doesn’t mean you can do it.

microtherion3 anni fa

You could get sued, but you would almost certainly win, as evidenced by the Westboro Baptist Church who won a Supreme Court case after being sued for witnessing their Christian faith with messages like "Thank God for Dead Soldiers" and "You Are Going to Hell" at a soldier's funeral:

https://en.wikipedia.org/wiki/Snyder_v._Phelps

x1ph0z3 anni fa

This is what the article says for [0]

“Police say the man targeted people on social media and promoted hatred against them after an attack in London, Ont., in June, where four members of a family were killed.”

Does that sound like criticism to you? It reads like harassment to me.

all23 anni fa

I don't know what the man said, only what the authorities reported. This is part of the danger of "hate speech" laws; if speech is deemed dangerous, discourse can be hidden behind public safety concerns and then wholly dismissed. It is then left to those who police speech to determine what is acceptable public discourse and what is not.

damiankennedy3 anni fa

In New Zealand where we don't have a specific constitution or amendments we have a set a laws ^1 that end up in the same place. An example is libel, which both countries have laws against. In NZ such laws are debated in parliament and voted on just as in the US. However in the US there was an additional objection based on it violating the first amendment but then the law was made anyway so it seems politicians in the US can make laws that override amendments in specific situations. The US also has their Supreme Court which seems to play a far more active role than NZ's and also more powerful in that it can creates precedents in the interpretation of laws for example allowing students to wear items of symbolic protest in school.

^1 In 1990 we got a law called the Bill of Rights Act which included freedom of expression.

Edit: added ^1

ztrww3 anni fa

The UK is especially bad because of its very restrictive libel laws, since it puts the burden of proof on the defendant.

blitzar3 anni fa

There isnt one.

tomrod3 anni fa

A ready example: though it is clearly not appropriate to do so, in the US you can express Nazi-isms that are verboten or illegal in parts of Europe.

rfrey3 anni fa

Five comments below this one, user all2 claims that Canada jails people for merely criticising anyone who is Islamic.

aroberge3 anni fa

This is simply not true.

nostoc3 anni fa

Just to clarify : What's not true is that Canada jails people for criticizing islam, not that it was claimed :

https://news.ycombinator.com/item?id=36061407#36064645

hnbad3 anni fa

I think while this is a popular way to think about these things, it doesn't offer enough explanatory power for when things seemingly "go wrong":

Rights afforded by a state are restrictions on a state's power over its subjects. But as the state holds ultimate authority, the only way these rights are upheld in practice is through a system of self-imposed indirection and bureaucracy that mostly exists to limit the power of any one individual operating the state, rather than the state as a whole.

The First Amendment means whatever the state wants it to mean. The Supreme Court can make a case-specific ruling one way or another but it intentionally holds no direct power. A police officer can literally get away with killing you if they can construct a scenario that gives them sufficient justification to do so. The problem with intelligence agency is that by necessity they have less red tape holding them down and they're thus in practice far less limited in how much power they can wield.

States are authoritarian and oppressive by default. They're only held back by self-imposed limitations. But those limitations only exist at the behest of the states themselves. Try and openly plan to dismantle a state (using violence or not) and most states will abandon any pretense of freedom of speech in a second.

cryptonector3 anni fa

> Civil rights, including those in the First Amendment, are not absolute. Regarding speech, you also can't harass people, threaten them, defraud them, incite violence, distribute copyrighted information that isn't yours, interfere with others' activities (sing loudly in a movie theater), etc. Private entities such as your employer can restrict your speech in many ways.

That's all true and should be true, but it's also possible to take these limitations too fare, and we have.

thebigwinning3 anni fa

It appears absolute to me if you sharpen the definition.

Free speech means you can express and advocate for any view point, not that you can make any sounds with your mouth in any context.

wolverine8763 anni fa

You cannot express or advocate viewpoints that "harass people (beyond a some limits), threaten them, defraud them, incite violence, distribute copyrighted information that isn't yours, interfere with others' activities (sing loudly in a movie theater), etc."

For example, someone could not express the viewpoint that 'thebigwinning sexually assaulted coworkers and stole money at their last job'. It would slander you (an exception to free speech that I omitted in the GP) and you would be entitled to damages.

Nor could someone express to an angry crowd the viewpoint that 'the bigwinning should be assaulted', nor could someone selling cryptocurrency express the viewpoint that 'cryptocurrency is a safe, stable investment for unsophisticated investors', etc.

thebigwinning3 anni fa

That's exactly what I'm not saying. These contrived examples only strengthen my view.

> sing loadly in a movie theatre.

Perfect example. Inappropriately making sounds with your mouth, not holding an illegal belief.

> express to an angry crowd the viewpoint

The issue is the context of the angry crowd, not the content of beliefs. Do you believe the US will penalize me for believing crypto currency is safe and stating that publically?

> thebigwinning sexually assaulted coworkers and stole money at their last job'

They are indeed allowed to believe that. They can't be taken to jail for holding that view of me. Now if they tried to get me fired with false evidence that would be a problem. If they caused damage to my business reputation without evidence that could result in civil damages.

wolverine8763 anni fa

The examples are not contrived, they are commonplace legal issues (though any such issue is rare in any one person's life).

We are talking about speech, not thought - expression, not belief. You said "you can express and advocate for any view point", not that 'you can believe any viewpoint'.

Yes, all speech depends on context. The significance of speech is its impact on other people; it is communication. You can say whatever you want in the shower.

thebigwinning3 anni fa

You are not engaging with my point and continuing to converse with the one in your head. Goodbye.

echelon3 anni fa

> interfere with others' activities (sing loudly in a movie theater)

This is more about private property rights, is it not? You can sing loudly in a park until local ordinances (noise, curfew) kick in.

The "movie theater" example I'm familiar with is that you can't scream "fire" in a crowded place.

gremlinsinc3 anni fa

you absolutely can sing loudly in a theater, but you don't have a right to demand you can keep on doing it. It's a private location, so they have every right to throw you out and ban you. similarly to how you don't have a right to say whatever you want without being moderated on Twitter or Reddit.

the fire one is basically anything that incites panic can get you into legal hot water, and if there are injuries or death as a result some form of manslaughter charges probably because ultimately you were responsible.

wolverine8763 anni fa

> you absolutely can sing loudly in a theater, but you don't have a right to demand you can keep on doing it.

good point

[deleted]3 anni fa

lannisterstark3 anni fa

>incite violence

>threaten them

You absolutely can. It just has to be nonspecific. "Kill all lannisters" is fine. "Kill x lannisters in y mall at z time" is not. See : Brandenburg v Ohio, Schenk v US, Hess v Indiana.

>interfere with others' activities (sing loudly in a movie theater),

lmao what? You can absolutely do that. the theater will kick you out but you can absolutely not be arrested for it. what an absurd claim.

>you also can't harass people

You can absolutely do that, to a degree.

>distribute copyrighted information that isn't yours

Not really related to 1A

>Private entities such as your employer can restrict your speech in many ways.

That's not 1A. 1A specifically applies to the government.

georgeplusplus3 anni fa

You beat to exactly what I wanted to say.

krageon3 anni fa

Summarised as "rights [...] are not absolute", this is a really weird statement. I confess I don't understand what makes a "civil right" different from an actual "right", to you.

j_french3 anni fa

Here's a recent example. I've seen other examples too, it's not at all uncommon. https://news.ycombinator.com/item?id=35867043

coldtea3 anni fa

>Civil rights, including those in the First Amendment, are not absolute. Regarding speech, you also can't harass people, threaten them, defraud them, incite violence, distribute copyrighted information that isn't yours, interfere with others' activities (sing loudly in a movie theater), etc. Private entities such as your employer can restrict your speech in many ways.

So the First Amendment is basically just the demo. And other western countries, oft criticized, just didn't have as nice a demo as that, but offer more or less the same features and gameplay.

oreilles3 anni fa

Not so much, there is plenty of other type of speech that is protected by the first amendment and is illegal in countries that don't have such thing in their constitution. For exemple, in France, saying "Macron is trash" can get you to jail (https://rmc.bfmtv.com/actualites/police-justice/insultes-con..., https://www.lepoint.fr/societe/une-quinquagenaire-jugee-pour...)

sofixa3 anni fa

Technically not jail, there's only a fine allowed for the crime of "outrage à personne dépositaire de l'autorité publique" (insulting a public authority figure) and "injure au président de la République" (insulting the president of the republic).

Not great, but not terrible (jail).

scott_w3 anni fa

That's only true if you have a very surface level understand of law and how it attempts to solve real-world problems.

It's nice to say "all speech should be free!" in theory but then, when faced with a situation where a mob boss says "please go kill that person" or ringleader whips up a mob into a riot. Should a judge just say "well, he was just exercising his First Amendment rights!" and ensure no consequences befall that person?

A person enters my home and says things I find offensive. Should the First Amendment prevent me from removing that person from my home for that reason?

I decide to leak trade secrets of my employer for profit. Should the First Amendment protect me from being fired and sued for this?

coldtea3 anni fa

>when faced with a situation where a mob boss says "please go kill that person" or ringleader whips up a mob into a riot. Should a judge just say "well, he was just exercising his First Amendment rights!" and ensure no consequences befall that person?

Isn't that covered by actual murder (or conspiracy to commit murder if it isn't seen through) charges, unrelated to free speech?

>A person enters my home and says things I find offensive. Should the First Amendment prevent me from removing that person from my home for that reason?

Isn't that covered by the right to invite (or throw out) whatever guest you want at your home? You have the same right even if they don't say things you find offensive, heck, even if they just tell you pleasant things...

>I decide to leak trade secrets of my employer for profit. Should the First Amendment protect me from being fired and sued for this?

Isn't that covered by copyright law (or similar)?

The point wasn't "practical limits to free speech" regarding a "mob hit" request or some non-existant and never argued obligation to let people in your house if they speak lest you prevent them from expression (?), but how more abstract (or open to interpretation) restrictions can be used to effectively limit actual free speech.

Not to mention "private entities such as your employer can restrict your speech in many ways", like a not so uncommon case of you saying something they don't like on your (unrelated to work) personal social media, in which they can just fire you. Or the social medium itself can censor you.

Making the FA protections kind of moot, in a time when it isn't the government that has to do the censoring anymore, while the public just gathers on 3-4 tech behemoths platforms.

scott_w3 anni fa

> Isn't that covered by actual murder (or conspiracy to commit murder if it isn't seen through) charges, unrelated to free speech?

> Isn't that covered by the right to invite (or throw out) whatever guest you want at your home?

> Making the FA protections kind of moot, in a time when it isn't the government that has to do the censoring anymore, while the public just gathers on 3-4 tech behemoths platforms.

I don't understand your points. You're both mixing concerns and splitting them, seemingly at random.

coldtea3 anni fa

>I don't understand your points.

Here's the Cliff Notes version:

The examples you brought up as arguments to why free speech can't be absolute (which I didn't argue for in the first place) are contrived and unrelated to free speech.

They are also already covered by existing laws, such as laws against conspiracy to commit murder, about the right of exclusion, etc. If anything I'm separating concerns, mixed up for no good reason.

As for my statement about FA, it's pointing how its protections are rendered moot, since they don't apply to private businesses and thus don't protect speech (the kind that matters, not mob hits) in places where the public discourse really happens nowadays. So, it's not "sufficient free speech protection" anymore.

I added it to further the discussion, what with FA being the very topic of this subthread, and not some randomly "mixed concern"...

scott_w3 anni fa

> They are also already covered by existing laws

The First Amendment supersedes law by determining whether it can be law at all, so whether it's covered by "law" is actually only half the story.

> The examples you brought up as arguments to why free speech can't be absolute

I started with deliberately stupid examples to make my point: Free Speech was always clearly limited, by necessity.

> it's pointing how its protections are rendered moot

That in itself is debatable. What evidence do you bring that this is somehow worse than it used to be? It used to be the case that, to get _any_ significant speech, you had to get your work published. Now you can just shoot it off on Twitter, Reddit, HN, take your pick.

coldtea3 anni fa

>I started with deliberately stupid examples to make my point: Free Speech was always clearly limited, by necessity.

Which is neither here, nor there. Conspiracy to commit murder, as per the "mob boss gives an order example" would always be illegal regarless of our "free speech" stance, and the First Amendment didn't come into play determining whether that "[could] be law at all".

It was rather the other way around: the First Amendment was drafted with the certainty that such a thing isn't about free speech and will always be illegal.

ndsipa_pomu3 anni fa

I thought that the First Amendment was about not allowing government to restrict speech and doesn't cover private issues such as between individuals or between an employer and an employee?

With the mob boss example, wouldn't the charge be something like conspiracy to commit murder rather than prosecuting the instruction itself? i.e. saying the words is not in itself illegal, but the intention to conspire to get the person to commit crime on your behalf is the illegal part and the instruction is evidence.

scott_w3 anni fa

> I thought that the First Amendment was about not allowing government to restrict speech and doesn't cover private issues such as between individuals or between an employer and an employee?

Absolutely, it is. However, I interpreted the comment I replied to as suggesting the First Amendment is not sufficient free speech protection.

mschuster913 anni fa

> Private entities such as your employer can restrict your speech in many ways.

Fun fact: Europe actually has better protections for free speech for employees. Even if you're a hardcore Nazi taking part in actual Nazi rallies, unless you're wearing company clothing or are a high-ranking corporate official, you can't get fired for that. And when you, say, contribute to an open source project in your non-work time on your own computer, your employer doesn't get any rights to that code.

smsm423 anni fa

Yes, they can. They also can perform illegal searches on Americans, and routinely do. To the tune of hundreds thousands times a year: https://www.reuters.com/world/us/fbi-misused-intelligence-da...

There is absolutely no consequences to anybody for this. If you're going to ask how US citizens tolerate such blatant abuse, and why they don't do something about it - that's a very good question. Please get back to me if you find any answer to it.

vintermann3 anni fa

Yes, the thing people gloss over is that laws are only as good as the people ruling on them, and not only is the process of selecting supreme court judges in the US a farce, one of them is openly defending his own corruption now.

In such cases, a well written, clear law on freedom of speech only increases the distance between what people think they have, and what they actually have.

komon3 anni fa

Well, due process is a right co-equal to free speech, so which rights override which others in which circumstances will come down to legal precedent.

My understanding is that the FBI or other non-judicial body cannot unilaterally issue a gag order. Subpoenas and gag orders related to them are granted by judges.

(Which isn't to say that the relationship between the judicial branch and law enforcement bodies is always pure and equal)

jakeinspace3 anni fa

Gag orders do require a court, just not a jury or an open hearing. I agree that they should be unconstitutional.

modriano3 anni fa

Well, the founding fathers intended for the First Amendment to apply only to acts of Congress, and maybe not even then (for example, just six years after ratifying the Bill of Rights, founding father and second President John Adams signed the Sedition act [0], which criminalized false and malicious statements against the government).

It took over 125 years before Supreme Courts started reinterpreting the First Amendment to apply to some government actions that weren't acts of Congress, but there are still tons of situations where regular people can restrict free speech. For example, in Frederick v. Morse, while the Olympic torch was running through some town in Alaska, a public high school student unfurled a banner that read "bong hits 4 Jesus". Despite this not being on school grounds and the student not going to school that day, the school suspended him explicitly because of the speech on his banner, but the SC said that's fine.

(Sidenote: I wouldn't look to the SC for coherent reasoning; the SC has been an absolute dumpster fire for all but the Warren court and parts of FDR's court. Hell, three current Justices (Roberts, Kavanaugh, and Coney-Barrett) worked on George W Bush's legal team in the democracy-negating Bush v. Gore case)

[0] https://en.m.wikipedia.org/wiki/Alien_and_Sedition_Acts

nceqs33 anni fa

You seem to be misunderstanding the First Amendment. CSMA, classified information, defamation, copyright, etc. are all not permitted under the first amendment. Not to mention that gag orders are approved by a court and can be appealed.

blibble3 anni fa

> Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.

seems pretty clear to me, at least for gag orders

less so for the other stuff you mentioned (could you argue pirated Disney movies are speech? probably not)

dragontamer3 anni fa

And the writers of the 1st Amendment went on to pass the Sedition act of 1798.

> That if any person shall write, print, utter. Or publish, or shall cause or procure to be written, printed, uttered or published, or shall knowingly and willingly assist or aid in writing, printing, uttering or publishing any false, scandalous and malicious writing or writings against the government of the United States, or either house of the Congress of the United States, or the President of the United States, with intent to defame the said government, or either house of the said Congress, or the said President, or to bring them. or either of them, into contempt or disrepute; or to excite against them, or either or any of them, the hatred of the good people of the United States, or to excite any unlawful combinations therein, for opposing or resisting any law of the United States, or any act of the President of the United States, done in pursuance of any such law, or of the powers in him vested by the constitution of the United States, or to resist, oppose, or defeat any such law or act, or to aid, encourage or abet any hostile designs of any foreign nation against the United States, their people or government, then such person, being thereof convicted before any court of the United States having jurisdiction thereof, shall be punished by a fine not exceeding two thousand dollars, and by imprisonment not exceeding two years.

Welcome to America. Our laws contradict each other and its all about politics. The Supreme Court figures out where the line is drawn and what is, or isn't, legal according to the Constitution.

With regards to 1st Amendment, the limit is drawn today at Libel, Slander, "Fire in a Crowded Theater", pornography, and many other restrictions upon "free speech". Gag orders included.

dragonwriter3 anni fa

> With regards to 1st Amendment, the limit is drawn today at [...] "Fire in a Crowded Theater"

No, and it never was. That was an obiter dictum that didn’t accurately reflect the state of the law in the decision in which it appeared, and the actual holding in that case itself (now regarded as an intense intrusion on core political speech) is no longer operative.

It's a catchy turn of phrase that gets stuck in the mind, but it was also an rhetorical device neither in a decision that has since been substantively overruled, not an actual example of an existing limit on free speech.

dragontamer3 anni fa

Well, if that particular phrase is poisoned, I guess I could just say "Hobbit" instead, which is owned as a trademark IIRC by the Tolkien estate and they're very litigious about it.

You can't say "Hobbit" in your own stories. But you can say "Halfling", and that's how people tend to get around that problem. Blonde Thor is Disney/Marvel (Historical Thor was a redhead IIRC, so Blonde Thor is Disney/Marvel Trademark), etc. etc. Plenty of restrictions on Free Speech in practice.

dragonwriter3 anni fa

> You can't say "Hobbit" in your own stories

You can, though.

You can't use it to market your stories or other products, and there's some manners of use innthr body of a book that might run some risk of liability for dilution or tarnishment, but...

habinero3 anni fa

Of course you can. You can write about hobbits, make youtube videos discussing them, whatever. There's a lot of fanfic on hobbits out there. You can make fun of hobbits.

If you want to use copyrighted characters and it's not fair use, then no.

RobotToaster3 anni fa

>"Fire in a Crowded Theater"

That one's apparently a myth.

https://reason.com/2022/10/27/yes-you-can-yell-fire-in-a-cro...

dragontamer3 anni fa

Libertarian website argues Libertarian viewpoints. News at 11.

I'm more inclined to believe Supreme Court Justice Alito over a Libertarian website. Especially because a sitting Supreme Court Justice literally will preside over the case and make a decision based on their own ethics/process/whatever.

An entire article that starts off with "BTW: Supreme Court Justice is wrong on subject" is... well... that's not how this works. The Supreme Court justice literally defines (or at least, is 1/9th of the definition) of our country's legal interpretation.

If the Supreme Court says "Obamacare is a tax", then its a tax. No if, and, or buts about it. It can be as ridiculous or contrived an argument they want, its the purview of the Supreme Court. They are the final say on any of these legal matters.

And unless "reason.com" (or any other libertarian source) somehow manages to get the ear of the other Supreme Court Justices to believe their argument, I think I can safely ignore their article there.

But they know that. I'm guessing they're just trying to clickbait readers and make somewhat sketchy arguments for more clicks + plant more articles that are aligned to libertarian values (as is the point of reason.com).

SllX3 anni fa

1. It was falsely shouting fire in a crowded theater, and it was not formative of the opinion itself (Schenck vs United States) but rather an aside.

2. Schenck vs United States was largely overturned by Brandenburg vs Ohio, but this aside was still non-jurisprudential.

3. I am unfamiliar with Justice Alito’s opinion on the matter and you didn’t cite it, so with no context I will only temporarily defer to you for the purpose of saying this: SCOTUS makes jurisprudence through the rulings and opinions they hand down when they take a majority vote in conference, draft opinions and sign on to them. One Justice does not make jurisprudence over a statement which itself was never jurisprudential.

Reason wears their ideological stripes on their sleeves, but this is still essentially a myth that doesn’t die and a fuller explanation of it isn’t a matter of ideology.

You still shouldn’t falsely shout fire in a crowded theater, as people will die. You also shouldn’t pretend a fire isn’t there or part of the show either as people will also die. Basically, if there’s a fire in a theater you’re in, just be glad for modern building and fire codes.

dragontamer3 anni fa

> 2. Schenck vs United States was largely overturned by Brandenburg vs Ohio, but this aside was still non-jurisprudential.

This here is the evolving nature of the court that I want to highlight most of all however.

In 1919, the Supreme Court believed one thing. Later, in 1969, half-a-century later, it believed another thing and overturned the earlier ruling.

As an organization, the Supreme Court tends to try to be consistent. But its not always true, and certainly in these days where we've had a dramatic change in the makeup of the court + filled it with young justices, we're going to see a big change in how the court writes opinions in the years, and decades, to come.

-----------

Laws are written. Constitutional Amendments are written. A few years ago, the 4th Amendment protected a woman's right to privacy and therefore Abortion. That's no longer true today. Etc. etc. Just a modern quickie example about how changing opinions can change our understanding of long-standing laws (or Constitutional Amendments) from the 1700s.

Generally speaking, the Supreme Court is trying to do what's right for our court system. To have laws interpreted consistently over time, and across the country.

SllX3 anni fa

The goal is to be consistent over time but it must also still maintain a reactionary posture to the cases brought before it. When there is a difference in opinion between earlier and later jurisprudence, later jurisprudence takes precedent and to be blunt, sometimes earlier courts get it wrong and later courts recognize this.

> A few years ago, the 4th Amendment protected a woman's right to privacy and therefore Abortion.

Due process clause of the 14th amendment actually was the citation under the portions of Roe v Wade not overturned by Planned Parenthood v Casey prior to them both being overturned in Dobbs. The due process clause is often used to read into law from the bench things which are not written into law by Congress or the States under the doctrine of substantive due process, and the issue with that doctrine comes down to: if Congress didn’t say it, and the States didn’t agree to it (Constitution), then is it really actually Federal law? So far the answer seems to be: temporarily yes, and on shaky ground until either Congress addresses it or a future court does. That a court can overturn its own precedents is why if we wish for them to stick, you write them into statute.

Going back to the First Amendment, most of the seeming contradictions in our free speech law really are addressed in the first 5 words of the First Amendment: “Congress shall make no law”. Courts are not Congress, and our Judiciaries have habits and traditions that predate the Constitution and are rooted specifically in the English common law, especially among the States which is why you can be found civilly liable for defamation in most States, and then the standard is high and the extent to which it is applicable is curtailed more with the First Amendment than it would be without it.

Natsu3 anni fa

> Libertarian website argues Libertarian viewpoints. News at 11.

It's not just Reason or Libertarians saying that the old "fire in a crowded theater" trope is nonsense:

https://www.popehat.com/2012/09/19/three-generations-of-a-ha...

> An entire article that starts off with "BTW: Supreme Court Justice is wrong on subject" is... well... that's not how this works. The Supreme Court justice literally defines (or at least, is 1/9th of the definition) of our country's legal interpretation.

No, a majority of the current Supreme Court is what defines jurisprudence on a subject.

There are crazy (and non-crazy) minority opinions all the time that don't amount to anything. A later Supreme Court can even repudiate an earlier one.

So it's true that this could change someday, and maybe Alito would even be in the majority then, but until and unless that happens, the "fire in a crowded theater" example is still dicta from an old case that's not good law.

[deleted]3 anni fa

blibble3 anni fa

surely that Act is by definition unlawful?

I still don't really understand

in the UK: Parliament has unlimited power and people talk quite a bit about formal constitutions being a good model to be followed

it seems a bit sad the attempt to protect the population against government using a formal constitution doesn't seem to work in reality (even when the wording is as clear as day)

dragontamer3 anni fa

> surely that Act is by definition unlawful?

Whose definition?

Answer: The Supreme Court decides the definition of things. Its only unconstitutional if the Supreme Court says so.

That's how the USA can get away with... I dunno... the Office of Censorship in 1941. (https://en.wikipedia.org/wiki/Office_of_Censorship). Definitions change, not only due to different members on the Supreme Court, but also due to different circumstances (WW2 meant that the Supreme Court was willing to ignore the obvious incursion into the 1st Amendment, at least temporarily)

EDIT: I always forget that it was actually the Office of War Information that did the Hollywood Censorship thing (https://en.wikipedia.org/wiki/United_States_Office_of_War_In...), rather than the Office of Censorship.

blibble3 anni fa

> Whose definition?

I guess that's the underlying problem

I'm not sure how you fix it really, though not having direct political appointees as top judges might be a good start

(maybe put an LLM in charge of a supreme court? I kid, I kid)

damiankennedy3 anni fa

You do have a King though. What would happen if the PM went to see him to form a government and they disagreed? The King is the one with armed guards, military rank and a fortress.

samus3 anni fa

As part of his coronation, the King has sworn an oath to uphold the Law and to respect the primacy of Parliament. Not appointing the PM and his government has serious consequences as the PM is the leader of Parliament, which is the institution that has actually restored monarchy after the Glorious Revolution and which actually bankrolls the armed forces, and which was ultimately elected according to the Law by the citizens.

Randomizer423 anni fa

The king is the de facto ruler, to say otherwise is being pedantic.

afthonos3 anni fa

No, this is pedantic::

De facto means in fact. Given that the king does no governing no, he is not, in fact, the ruler. You may be looking for de jure, though I question even that.

habinero3 anni fa

No, he's the ceremonial head of state. There's a polite fiction that all power comes from him, but he can't actually make anyone do anything.

If he tried, people would say no. If he insisted, he'd get tossed out on his ear.

samus3 anni fa

The king of the UK still has to respect the Law. Being king does not mean that one can do as one pleased, or that there are no checks and balances. The last English king who tried to become an absolute ruler caused the English Civil War and was put on the chopping block by Parliament, as a matter of fact.

skissane3 anni fa

In the constitutions of many other countries, you will find an explicit clause saying (to effect) "rights and freedoms granted by this constitution are not absolute and exceptions can be made to them for sufficiently grave reasons".

Unlike those other countries, the US Constitution never contained such an explicit clause, but the Supreme Court has always read it as if it did. The Supreme Court feels quite justified in doing that, because if you go back and look at the debates in Congress and the state legislatures over the proposal and ratification of the Bill of Rights, it is clear that its proponents always intended it to be interpreted as if such an "exception clause" existed, even though (for whatever reason) they chose to leave it as implicit rather than explicitly putting it in the text.

account423 anni fa

fijiaarone3 anni fa

The first amendment must be a lot longer than I thought.

xupybd3 anni fa

I don't like these gag orders but I can see times when they are needed. Each person has a right to a fair trial. So the courts sometimes have to suppress information from the public to avoid potential jurors seeing information about the case. They must only judge guilt based on what they hear in court not in the media.

xyzzy1233 anni fa

Gag orders are rarely used for this purpose.

The information that so-and-so parties provided some information (without disclosure of that information) in response to a lawful request will usually not predudice a trial.

What gag orders are for is a) avoiding tipping off the subject of an active investigation b) avoiding general knowledge or disclosure of key sources of information and investigative methods used by law enforcement and c) concealing the general scale, nature and purpose of surveillance activities from the general public.

xupybd3 anni fa

> Gag orders are rarely used for this purpose.

I agree, but the only time I think it's justified is when it's to protect the right to a fair trial.

brigandish3 anni fa

So the whole of society must be kept in the dark? No, jurors should simply judge on the evidence presented in court, and those looking for unwarranted (sadly, not literally) secrecy should look for other ways to continue their insidious conspiracies against people.

xupybd3 anni fa

>jurors should simply judge on the evidence presented in court

I don't know if humans are able to ignore evidence they have heard outside of court. We are not good at only including one set of information when making judgements.

brigandish3 anni fa

Right, but you're advocating keeping the whole of society in the dark versus relying on twelve people to be fair, which is what they're told to do. I would say that the latter is better than the former because of the immense harm keeping the whole of society in the dark. It's a numbers game.

xupybd3 anni fa

All of society benefits from the right to a fair trial. But, most of the time gag orders are abused and no one benefits.

brigandish3 anni fa

The way I propose does not preclude a fair trial. The way you propose (i.e. the status quo) precludes an informed electorate and introduces perverse incentives for those in power.

xupybd3 anni fa

I disagree but that's okay :)

brigandish3 anni fa

Rather than disagree you might point out why with reference to the points I’ve made. Comity is only an end in itself in, ironically, cultures that do not value free speech and hence, put truth beneath social harmony. The idea that I could be put on a jury and be unwilling or unable to ignore what a journalist, of all people, had relayed about a case, is risible, and I can bet I’m not alone.

patrick4513 anni fa

They aren't compatible with the first amendment. But at this point, those rights are a joke and and all three branches of our government regard the constitution as toilet paper.

absurddoctor3 anni fa

Having been on the receiving end a bit, the gag orders don't come from the FBI directly. The FBI can ask you not to say anything, but you can ignore that without any legal repercussions. Any gag order that matters is issued by a judge.

yrnameer3 anni fa

There are plenty of laws that aren't compatible with our constitution. Judges will laugh a lawyer out of the courtroom who uses constitutional arguments, and your case will go nowhere.

radarsat13 anni fa

> but then apparently the police (FBI) can restrict the free speech of Americans without any court involvement at all?

are you sure about this? As far as I understand "gag orders" can only come from a judge. Of course the FBI could request strongly that you not talk about something but I'm not sure it would hold legal weight.

patmorgan233 anni fa

They do need a court. Subpoenas are issued and overseen by the judicial system, any gay order has to be signed by a judge. The FBI can't unilaterally censor you.

callalex3 anni fa

Our rights are written in a document. The government is made up of people. There can be a large disconnect between the two.

fijiaarone3 anni fa

It’s voluntary. The only way they can shut you up if you don’t agree to is to kill you.

kfrzcode3 anni fa

Free speech does not equate to unlimited absolution from consequence

make33 anni fa

the fbi is overseen by elected officials, and by laws that were voted for it. it's not perfect but that still makes a huge difference.

bboygravity3 anni fa

That explains the whole Trump Russia ties investigation by the FBI I guess?

Doesn't seem to healthy for any nation that is supposedly democratic?

[deleted]3 anni fa

sibramalisi3 anni fa

Are you still like first amendement don't you number

@_sib_ra10

[deleted]3 anni fa

Loquebantur3 anni fa

Look at this thread.

People engage in childish fantasies featuring themselves in imaginary subversive behavior.

It's unresolvable cognitive dissonance leading to repressing and reinterpreting the cause.

mike_d3 anni fa

> How does the ethical use of this prolematic tool get ascertained? Where and how is the democratic oversight implemented? How is misuse treated and prevented?

I can't speak specifically to this case, but in general when asking a judge for the warrant they also provide compelling evidence that harm would come from disclosure. The judges weigh the rights of the targeted and other parties that would be subject to a gag order against the greater good.

To answer your last two questions, all gag orders eventually expire. It isn't a prohibition against the impacted party speaking out, just a delay. They can go directly to the judge or appeal to a higher court.

yunohn3 anni fa

> It isn't a prohibition against the impacted party speaking out, just a delay.

It’s exactly this “it’s totally fair, surely it’s not ridiculous” attitude that shows how the powers control the people.

Gag orders and secrecy agreements can definitely be indefinite and regularly are.

https://web.archive.org/web/20220809113138/https://cdt.org/i...

rootusrootus3 anni fa

Assuming it's always ridiculous doesn't seem like a position any more enlightened.

JasonFruit3 anni fa

Possibly safer for people's rights, though.

dools3 anni fa

> How does the ethical use of this prolematic tool get ascertained?

Via the judicial system

> Where and how is the democratic oversight implemented?

In congress

> How is misuse treated and prevented?

Through the judicial system and congress

cto_of_antifa3 anni fa

riazrizvi3 anni fa

The USA is a country of laws. It's possible that people submitting packages are submitting illegal malware; spyware, ransomware, software to steal crypto money, or run illegal ticket-buying bots. Ethical oversight is baked into the institutions through governance structures. Institutions aren't perfect. Also there tend to be more complaints in the media about a country's institutions than in regions where there is not a free press. So the voices complaining online don't necessarily correlate with where the problems most lie.

Loquebantur3 anni fa

Describing the US as a country of laws is a little funny. The mere existence of laws does not imply much.

Your examples are even weirder. How would such malfeasance justify clandestine observations? That is clearly disproportional, thus unethical.

Claiming governance structures were "baked into" institutions is pure hopium. Democratic oversight means, there must be transparency enabling you as a citizen to detect and react to misconduct, at least by proxy.

The "free press" isn't free to report and investigate such subpoenas, obviously.

anigbrowl3 anni fa

In a lot of ways, being 'a nation of laws' means the officeholders can evade any kind of personal responsibility by asserting that they're just one cog in the legal gear wheel. Which one? Well that can take years of litigation to establish.

Of course, the idea is that people are corruptible whereas laws are clear and neutral, but reality falls far short of this ideal. Any system can be gamed and ultimately captured; the more widely accountability is distributed, the less the probability of its timely application.

williamcotton3 anni fa

If law enforcement was never allowed to engage in clandestine operations then it would hamper their ability to build a case against and/or apprehend criminals. Case in point, organized crime syndicates.

This is why the majority of your fellow citizens disagree with you and are fine with the current state of affairs.

pksebben3 anni fa

That seems like kind of a fabricated boogeyman, though. I have an extremely hard time thinking of anyone I know whose been affected by an organized crime syndicate, but I can immediately bring to mind a whole host of injustices suffered at the hands of government agencies, from bogus tickets to civil forfeiture to imprisionment for victimless 'crimes' (and that's not even accounting for blanket stuff like xkeyscore or spending my tax dollars on nonsense like the iraq war - all arguably way worse than any criminal organization without government backing could ever hope to inflict)

williamcotton3 anni fa

This is my high school buddy’s dad:

https://www.democratandchronicle.com/story/watchdog/2013/12/...

Three of my teenage friends were in his basement when the FBI kicked down the door and stormed in armed to the teeth.

Perhaps you’re fine letting thieves and murderers get the upper hand but the rest of us are not.

Consider yourself lucky that criminals haven’t had much of an impact on your life.

pksebben3 anni fa

I think where you and I might be diverging here is in our definitions of 'thief' and 'murderer'.

I don't see a difference between, say, a capo that orders a hit, and a member of congress who votes for a foreign 'police action' - save for that the congressmember has much, much higher numbers.

Same goes for a bank robber vs. a bank exec who gets a multimillion $ payout from bailout funds - we're impressed if the bank robber cracks a million - but it's like "that makes sense" when the exec walks away with eight figures of tax dollars.

I don't know anyone whose been killed by a mob hit, but I know soldiers who have lost their lives to bullshit foreign wars, and literally everyone who pays taxes lost money to the villains in 2008.

I believe criminals have had a huge impact on my life - they just all got there through 'legitimate' channels, which IMO makes no difference to whether I'm poorer or people are dead.

Obscurity43403 anni fa

Sorry, what point are you trying to make?

williamcotton3 anni fa

A very basic one: organized crime does in fact exist (contra to claims of bogeymen) and law enforcement benefits from clandestine investigations.

It is a trade-off. The downsides have been enumerated ad nauseam on hacker forums for decades and compared to the reality of organized crime comprise just a small percentage of the ill effects experienced in a relatively low corruption society like the United States.

danaris3 anni fa

No one is trying to claim organized crime does not exist. They are claiming that the harms from organized crime may not be as bad on the whole as the harms from some of these laws intended (at least in part) to combat it.

This does not, of course, mean that the harms to certain individuals from organized crime aren't worse. But governing based on a small number of emotional anecdotes, and ignoring the broader harms being perpetrated to placate that vocal minority, is deeply irresponsible.

williamcotton3 anni fa

What is deeply irresponsible is ignoring the benefits of clandestine operations by law enforcement in a vain attempt to adhere to some kind of free and open source information ideology.

sjy3 anni fa

What about a ransomware, phishing or data breach victim? Cybercrimes are often committed by organised criminals and investigating them seems like the most obvious reason for the DOJ to issue a subpoena to PyPI.

ztrww3 anni fa

> whose been affected by an organized crime syndicate

I can’t think of anyone I know who has been affected by holes in the ozone layer. Must be a fabricated government boogeyman designed to force me to buy an inferior fridge.

Law enforcement agencies have been quite effective in controlling them over the last few decades (that and they’ve been replaced by foreign drug cartels..). It was probably quite different back in the 60s or 70s

pksebben3 anni fa

> I can’t think of anyone I know who has been affected by holes in the ozone layer. Must be a fabricated government boogeyman designed to force me to buy an inferior fridge.

There are many [1] counties in California that come immediately to mind - but I digress.

I'll readily admit that things have changed - organized crime was indeed a much bigger problem in the past - but I might argue that even then the fault lay not with a lack of enforcement, but the existence of really, really dumb laws (prohibition). I might further argue that what organized crime is still problematic, is also a legislative rather than an enforcement issue (current prohibition, which we euphamize as the 'war on drugs').

Even if it's enforcement that's doing the work of eliminating the effects of organized crime on actual citizens - the potential for harm is way bigger from an organization with a monopoly on violence, a state mandate, and practically unlimited coffers.

1 - https://en.wikipedia.org/wiki/List_of_California_wildfires

yrnameer3 anni fa

> Ethical oversight is baked into the institutions through governance structures.

Kind of a shocking assumption to make. Over the past several decades it has become increasingly apparent how our governing structures have no inherent relationship with ethics.

riazrizvi3 anni fa

You’re extrapolating incidents that are being called out in the press to improve the system onto vast legislative infrastructure that is operating day after day for 100’s millions of people in this country.

[deleted]3 anni fa

whitemary3 anni fa

> Where and how is the democratic oversight implemented?

What democratic oversight? This is the United States we're talking about lol.

ajross3 anni fa

> Such subpoenas are clandestine surveillance of citizens by their state. The problem with such types of surveillance in particular is the lack of accountability.

I never know how to interpret statements like this. The fourth amendment guarantees court oversight over search and seizures. A court signs off on every subpoena issued anywhere in the USA. Are you making this argument from the perspective of "I didn't know courts were involved" or "I don't view courts as sufficient oversight".

If it's the latter... what's your alternative? Eliminate gag orders (which is all this is) entirely? You realize that there's a lot of stuff that happens in courts that we all agree should not be public, both for privacy and law enforcement reasons. Why get upset over this one particular thing?

raxxorraxor3 anni fa

A theoretical case were an attacker leveraged some package hosted on PyPI could maybe become aware of investigations and destroy left-over evidence. But I guess a huge packet manager like this is too generic a target for such contraint to really work.

> How does the ethical use of this prolematic tool get ascertained?

It probably doesn't get ascertained, sadly. I think the advantages for investigations that might occur if people communicate more strategically is not worth the risk of political procecussions, which I believe are on the rise for a while now.

benlivengood3 anni fa

FISA judges are the oversight on foreign surveillance, but there is no (public?) oversight of national security letters.

smsm423 anni fa

FISA judges are not oversight of anything, as we learned, they almost never refuse a request, and even if there's a threat of such refusal, FBI could just lie to them, and they would stamp it, and when the lie comes out, nothing happens. FISA court is just a smokescreen to provide an illusion of oversight.

proxiful-wash3 anni fa

Except for other "states" they don't even have the ability to communicate about subjects like this.

lynx233 anni fa

"Ethics" and "democracy", as if they were a real thing... Both are a tool to fights your adversaries, but they are not something you can assume as given.

runsWphotons3 anni fa

It doesn't seem that clandestine.

smohare3 anni fa

lazide3 anni fa

At least they get to subtly communicate they can't talk, instead of being Jack Ma'd.

The constitutional justification is the same one behind not being allowed to yell 'fire' in a crowded theatre if there is none, or not being able to go on TV and threaten the Judge overseeing your case - 'the constitution is not a suicide pact'. [https://en.wikipedia.org/wiki/The_Constitution_is_not_a_suic...]

As to if it is being abused? Guaranteed. Being prevented? Not effectively. Only the occasional leak of the abuse and corresponding consequences (if any) seem to be counteracting it, and even then not well.

Sunlight is the best disinfectant, and most of the national security apparatus is solidly in the dark, and has been for a long time.

tapoxi3 anni fa

Sounds like they got a National Security Letter.

bredren3 anni fa

Does not need to be an NSL to have a non-disclosure attached. Could be a relatively minor (not very spooky) federal investigation.

ajsnigrutin3 anni fa

How does that work with in combination of freedom of speech? Is it one of those cases, where someone has to be brave/foolish enough to disobey and take it to the supreme court?

mike_d3 anni fa

> How does that work with in combination of freedom of speech?

The government is not preventing you from expressing your free thoughts and opinions. They are compelling you to not disclose the details of something you had no knowledge of before they asked you about it.

Nothing is stopping you from writing a blog post about how it is unfair to seek records of a potential criminal, but you cannot write about how it is unfair to seek the records of Bob Jones when you had no other reason to believe Bob was anything but a regular user.

itronitron3 anni fa

But you could post a unique blog post such as that about every one of your users.

[deleted]3 anni fa

mywittyname3 anni fa

A judge signed off on it. Which means that the State made a case for the subpoena to include a non-disclosure.

autoexec3 anni fa

I'm going to go ahead and guess "signed off on" was more like "rubber stamped"

tracker13 anni fa

Most likely... but the party who was served the order can file for appeal if they are willing to go that route. That said, it doesn't mean any such appeal with favor the party served the gag order.

smsm423 anni fa

And the case likely was "we swear it is very important for national security, trust us!" and that was enough. Search request is almost never refused, e.g. FISA court approves over 99% of them. And if the court already deemed the proof strong enough to do the search, surely it's strong enough to put a non-disclosure on it if asked.

amethyst3 anni fa

> I have not received a National Security Letter.

source: https://durbin.ee/ as of Wed, May 24 at 1:45 PM PDT

Breza3 anni fa

Agreed. It's like the librarians who responded to the Patriot Act by putting up "The FBI has not been here" signs.

VWWHFSfQ3 anni fa

I think it just sounds like the three subpoenas they received

wongarsu3 anni fa

I'm not sure I'd call three subpoenas "a string of subpoenas" even if it's technically correct. But I'm more talking about specifically mentioning that the subpoenas from March and April 2023 don't have a gag order. Why mention those months specifically if in the other months they didn't receive any? The natural thing would have been to end the sentence six words earlier.

florbo3 anni fa

It sounds more like they're addressing the inevitable "why didn't you post as soon as it happened" party.

Eisenstein3 anni fa

It is perfectly clear that you are correct because trying to tell anyone about confidential subpoenas could be illegal.

hunter2_3 anni fa

When it requires so much "reading between the lines" that even this community doesn't have a strong consensus on whether this is being (illegally) communicated or not, I think it's plausibly deniable, but IANAL. Contrast with well-known canaries.

kelipso3 anni fa

Canaries that are well known would just become normal communication and thus illegal under a non-disclosure. It's just going to get worse lol.

dragonwriter3 anni fa

> I'm not sure I'd call three subpoenas "a string of subpoenas" even if it's technically correct

I would if the sequence was such that the receipt of eachbof thr subsequebt ones delayed writeup of the overall incident in the interest of completeness or because there was some relationship between them

> the subpoenas from March and April 2023 don't have a gag order. Why mention those months specifically if in the other months they didn't receive any?

Because you are doing an aggregate writeup of a series of events and you want to convey when they occurred and why you are able to do a detailed writeup.

[deleted]3 anni fa

jchook3 anni fa

“The lack of a non-disclosure order”

dkga3 anni fa

Seems like the non-disclosure order did not say anything preventing them from disclosing said non-disclosure order itself

underdeserver3 anni fa

I don't think you can infer that.

A non-disclosure order probably does exist for other subpoenas.

aaroninsf3 anni fa

https://www.aclu.org/other/national-security-letters

dragonwriter3 anni fa

> That's suspiciously specific. Sounds to me like they also received some other subpoenas they aren't allowed to talk about.

It could be, it could also be that they were trying to communicate both the timing of the subpoena string and why they are able to talk about it, and there aren’t any others.

OJFord3 anni fa

It already says at the beginning when they were received (not mentioning potential others).

It's definitely unnatural to say again 'as allowed by the ones received in those months we already mentioned'.

smeagull3 anni fa

I always wondered why you couldn't get all your subpoenas passed through an intermediary who is instructed to post about them before reading them.

firstlink3 anni fa

Because then men with guns come and politely explain why they don't like that. But, seriously, for the same reason as you can't stand up to absolute power in any other way.

dpifke3 anni fa

Being reminded that PyPI is a target for law enforcement makes me even more irked that they've removed end-to-end package signing without providing a replacement[0].

PGP signatures—even though rarely used—would allow someone to verify that a signed package was not modified by PyPI after being uploaded by its original author.

Without any sort of signing mechanism, we have to trust the U.S. Government to never demand that PyPI insert a backdoor, via a National Security Letter, FISA court order, or other kangaroo court process. Good luck with that.

The existing PGP signing mechanism had usability issues and security footguns[1], but was better than nothing. It's a shame they didn't roll out a more usable and secure alternative before removing the existing functionality.

[0]: https://news.ycombinator.com/item?id=36044543

[1]: https://blog.yossarian.net/2023/05/21/PGP-signatures-on-PyPI...

wokwokwok3 anni fa

If you want to start with tinfoil hat theories, think about this:

The PGP signatures were removed, nominally because few people used them. ...but the timing of the removals is coincidental, no?

"You need to have a backdoor that lets us see who's downloading what packages and let us inject custom code to particular targets"

"That's technically impossible because of..."

"Here is a court order. Implementation is your problem. You're not allowed to tell anyone you even received a court order."

"...well, I guess signed packages have to go then..."

(:

I don't actually believe that, since PGP signing was frankly, barely used and really there's hardly any meaningful difference between a PGP you can't verify (which was most of them) and not having it; in fact the illusion of security is probably worse than not having it at all.

...but still. As you say. It sucks there's no meaningful replacement for it.

donaldstufft3 anni fa

I would resign from PyPI before I ever allowed a backdoor to be installed.

I haven't explicitly asked, but I would be very surprised if any of the other PyPI admins felt differently.

wraptile3 anni fa

PyPI is clearly a passion project for the team and Python community in general so I can't imagine that anyone would allow this or die on this hill to save their salary.

I've tried to dig around whether there's any history or potential of government stopping company from ceasing operation/resigning and honestly nothing came up that wasn't ww2 related. So, I think it's pretty safe to rule out PyPI from doing anything like this.

dpifke3 anni fa

My comment was not meant to imply that PyPI admins would be OK with this, but the sad situation in the U.S. (and Australia, and other places) is that they'd probably face jail time if they refused to comply. You can't avoid complying with a court order by saying, "sorry, I quit." (And even if "sorry, I quit" was a valid response, you'd be facing tens of thousands of dollars in legal fees to justify it, with a gag order in place that meant you couldn't raise a legal defense fund.)

If you're looking for examples of what the NSL process is like, Nicholas Merrill's story[0] comes to mind.

Further, the fact that admins have this power—even if they'd never use it—makes them an attractive target for black hats. If backdooring packages was easier to detect, it'd be a less attractive option for those that might want to do so.

I'm still hopeful that they'll re-implement some sort of end-to-end signing mechanism, sooner rather than later. I trust PyPI and the people behind it, but I'd like to be able to verify.

[0]: https://en.wikipedia.org/wiki/Nicholas_Merrill

donaldstufft3 anni fa

Well, AFAIK it's not clear that in the US the courts have the right to compel someone to modify their software in that way. The FBI holds that it does, but so far it's been fought and they've given up when they've tried it. I think if such a thing were to happen, the fundamental ability to secure any software goes out the window. Even package signing, etc go out the window because they can just compel you to produce new software, signed with your existing key.

But let's step back a moment and presume that they do have that ability to compel. The first step here is that none of the PyPI Administrators are the legal owners of PyPI, so such an order would not be sent to any of us, but rather to the PSF itself. The PSF would then be on the hook to either comply or fight said hypothetical order, but individual members of the administration team would not be, and would be free to quit. They may not be able to say why they've quit, but quitting AFAIK would be entirely possible.

The PSF, while not having Apple's war chest, does retain counsel for dealing with things like this, and I can say personally I'd spend myself broke before I'd be willing to do so.

We are going to be implementing signing, and I'm hoping we'll be able to make strong progress on that soon.

[deleted]3 anni fa

woodruffw3 anni fa

I'm the author of that post. There is absolutely no meaningful sense in which PyPI's previous PGP support was (or ever did) provide end-to-end package signing. At the absolute most, when used correctly (which, overwhelmingly, it was not), it provided one half of package signing.

The other half (key retrieval and identity binding) was never provided, because PGP as an ecosystem made doing so intractable. It was not better than nothing, because it was nothing; anything you could have done with it can be done with your own sidecar signatures.

brabel3 anni fa

PGP didn't make it intractable, the problem is itself intractable... you're referring to the public key infrastructure (PKI)[1] problem, which many have tried to solve and failed.

PGP can use the only known solution to the problem, which is letting several key servers be configured by the user to import keys (which can then be verified by checking the key fingerprint on another source which is "trusted", like the publisher's own website).

You can still import keys by physically exchanging trusted keys with others (so called Key Signing Party[2]) but that obviously cannot scale... or using any innovative method you come up with, but no one has found a bullet proof way to do this that's usable.

But saying PGP only solves half the problem is wrong. It solves one problem: that of how to verify a publisher's artifacts were not modified, which is valuable.

The next problem to solve is how to obtain and vet public keys from publishers. The solution could work somewhat like TLS certificates (with certificate authorities playing the role of trusted key servers) or using blockchain (perhaps a rare problem for which blockchain could actually be helpful) but both of these bring their own issues with them. If you know of a better solution, though, do bring it up instead of throwing the bathwater out with the "baby"!

[1] https://en.wikipedia.org/wiki/Public_key_infrastructure

[2] https://en.wikipedia.org/wiki/Key_signing_party

woodruffw3 anni fa

I think it’d behoove you to read the original thread from yesterday: all, and more, of this was covered!

PKI is indeed hard, but it’s not even remotely intractable. The Web PKI is a functioning PKI; yesterday’s thread explains how the codesigning scheme we’re building for PyPI is going to look very similar to the Web PKI.

At the ecosystem level, PGP was not providing resource integrity to PyPI: too many of the keys involved were weak, and only a tiny proportion of packages were even signed. Even if that proportion was 100%, PGP would have been the wrong tool for that job: PyPI already has transport and resource integrity via the right tools: TLS and digests. Using an untrusted signature for resource integrity is using the wrong tool for the job.

The original thread contains multiple references to Sigstore, which is the scheme we’re planning on building on for PyPI.

lll-o-lll3 anni fa

Why sign at all? Isn’t the key requirement that the component was not tampered with after upload? All you need is a hash for that…

Tracing back the code to a legal entity seems unnecessary in the majority of cases.

brabel3 anni fa

Signing is basically hashing + proof of who created the hash. You need either both, or a way to find which hash is correct according to someone, usually the owner of the artifact, and signing gives you just that.

woodruffw3 anni fa

Signing is only proof of identity if you (1) know the underlying identity, and (2) actually trust that identity for intelligible reasons (i.e., you can produce a formal description of the trust relationship).

Without those two conditions, a signature is a digest produced by an untrusted party. For PyPI, that means that PGP signatures are no better than (and in some senses, worse) than PyPI's own digests, since PyPI at least is a currently trusted party.

Groxx3 anni fa

A centralized host can't ever be the only reasonable option for trust. They can be manipulated, technically or socially, and that makes everything vulnerable at once.

Both are useful.

woodruffw3 anni fa

The Web PKI is built around centralized roots of trust, and survives because of concerted efforts to make those roots resilient, trustworthy (in terms of underlying ownership), and publicly auditable (with mechanisms like CT).

To the best of my knowledge, there has never been a successful decentralized PKI. Even the most successful uses of PGP are not decentralized; they're essentially private PKIs maintained by a small set of presumed trustworthy maintainers.

Groxx3 anni fa

PGP absolutely is decentralized - I can trust or distrust key X without communicating at all with any external PKI.

I agree that's not all that useful on a global scale - it essentially degrades to the current PKI setup then, because validating everything is expensive and doesn't need to be done by everyone every time to get nearly all of the benefit. But it is a significant difference for individuals making individual decisions.

brabel3 anni fa

Did you not read the parent comments? You're just repeating what was already said.

lll-o-lll3 anni fa

But a hash provides proof to the actual uploader of subsequent tampering. As you cannot modify the hash without the originator being aware, I think it is enough.

gardnr3 anni fa

One half is better than nothing. Even if it just made users wonder what it was, it was better than nothing.

omginternets3 anni fa

One half of a secure system is just an insecure system. Attackers get to pick which half to attack.

bombolo3 anni fa

That's how security works… it's not an all or nothing process.

woodruffw3 anni fa

Every security design is built out of a matrix of factors, and some (but not all) of those factors can be made zero.

Being unable to verify your trusted identities in a PKI is one such “zero factor.” It makes the PKI strictly equivalent to (crappy) resource integrity at the best, which is when everything is signed. PGP on PyPI didn’t even manage to clear that hurdle; it was worse than nothing by virtue of advertising properties that it was incapable of providing. That too is a zero-able factor in a security design.

omginternets3 anni fa

Actually, it very commonly is an all-or-nothing process. It doesn't matter how robust the lock on your front door is, if there is no lock on the back door, or if your window can be smashed. This especially true when it comes to cryptographic security, which is the subject at hand.

I suspect the source of your confusion comes from the idea of differential security, which is approximately "I don't need the best lock; I just need a better lock than the other guy". Again, note that this does not apply to cryptographic signing of packages. Note also that the question of whether or not your system actually is more secure than the other guy's is very much a binary distinction: it either is or it isn't. You can quantify this quite easily by counting vulnerabilities, or by analyzing the degree of access gained for each vulnerability that is encountered.

So yeah, it's one of the few things that tends to be all-or-nothing (up to some threat model, of course).

dhx3 anni fa

Perhaps look at Gentoo's model of a single monolithic Git repository. It is possibly the largest and most distributed Merkle tree of software distribution signatures in existence. It is updated a few times every hour by a diverse community and each commit has to be GPG signed so you have the opportunity to verify signatures by looking up developer websites, slides from FOSS conferences, etc to confirm whether the keys have been widely published.

There are some caveats:

* Avoid -9999 packages as you won't get any guarantee of authenticity of whatever will be obtained from the upstream repository, other than whatever trust you place in a X.509 certificate that in all likelihood is controlled by either Microsoft (GitHub) or otherwise accessible to Amazon, Google, etc by nature of common open source project hosting arrangements.

* When syncing your local repository, verify all changes since your last sync. This could be as simple as syncing to a point n-days ago, after which numerous developers you know have signed more recent commits on top (you at least know those developers have been impacted too if the whole repository was compromised and the compromise is now on the public record).

* You don't really know how many people are using the packages you care about, and thus how many other people across the world are also exposed to (and possibly reporting problems with) signatures that Gentoo developers have committed.

In addition to relying on existing sources such as the Gentoo Git repository, an additional way to build trust is setting up software "looking glass" tools in different jurisdictions to check that software downloaded from different carriers in different jurisdictions are all the same.

At least with these measures the attacker has to compromise everyone and make this compromise a public record, rather than just silently compromise one target.

Hackbraten3 anni fa

If those agencies can order PyPI to insert a backdoor, wouldn’t they be able to coerce keyservers into updating the public key at the same time?

upofadown3 anni fa

Trust in PGP land is end to end. The keyservers don't matter. They are only a place to pick up keys. Your software verifies that the key is unchanged in that the fingerprint is unchanged. Otherwise it is treated as a separate key. Dead simple.

The confusion here comes from the confusion in the PyPI article about PGP. The article complained that many keys could not be found on keyservers as if that mattered.

The Debian web of trust is a good example of how this stuff actually works. Before you can submit packages to Debian you have to get an existing Debian developer to sign your PGP key. In Debian the trust flows downward from older developers to newer developers.

donaldstufft3 anni fa

> Before you can submit packages to Debian you have to get an existing Debian developer to sign your PGP key. In Debian the trust flows downward from older developers to newer developers.

This is not how signing works in Debian at a technical level. At at technical level uploading to Debian requires them to add your key to a list of keys maintained by the archive administrators. As a matter of policy those administrators ask you to get your key signed by an existing Debian Developer, but at no point does their upload infrastructure check that or use the Web of Trust.

upofadown3 anni fa

That list of keys maintained by the archive administrators are signed by debian developers. That is how the archive admins can be sure that the key is in some sense legit. Otherwise where would be the root of trust?

donaldstufft3 anni fa

The root of trust for uploads is the listed of signatures maintained by the archive administrators, flat out.

The requirement for having individual keys signed by Debian Developers just makes it easier for the archive administrators to decipher which keys they want to add to their root of trust. The upload system does not check those signatures at all, they do not need to exist in the slightest as far as the upload system is concerned.

mistrial93 anni fa

this seems motivated ulterior to the topic, or making a mountain out of a small hill for other reasons. The act of approval is done approximately manually at first, with automation supporting that decision over time. Perfect machines are in short-supply, so to this day there is some manual aspect to this, which is faulted with a tone that is dire ... doesn't add up based on my understanding of this

froh3 anni fa

the original uploaders key? without anybody noticing? I don't think so.

LordShredda3 anni fa

I'm guessing some poor typosquatter managed to hit a gov agency and is about to get alphabet soup all over him.

nonrepeating3 anni fa

“Get alphabet soup all over him”

This is my new favorite alternative to “vanned” (or “v&”)

tenpies3 anni fa

> “vanned” (or “v&”)

Also note that the noun associated with being "vanned" would be a "party van", not just a "van".

To be vanned/V& is to have the glowies inside the party van take the vanned party away.

https://knowyourmeme.com/memes/4chan-party-van

the_jesus_villa3 anni fa

lots of nostalgia for partyvan.org during the chanology days

greggh3 anni fa

Feeling the same.

flyinghamster3 anni fa

I think I'm gonna snarf that one too. It's just too good.

techbro923 anni fa

Think I’m gonna snarf snarf. Actually I just looked it up and apparently that word means to eat or drink greedily. Not sure why you used it here

pjbeam3 anni fa

As in eagerly consume into poster's lexicon I think.

valleyer3 anni fa

http://www.catb.org/jargon/html/S/snarf.html

GrinningFool3 anni fa

Also, https://en.wikipedia.org/wiki/Snarf_(ThunderCats)

codetrotter3 anni fa

https://youtu.be/ikiuMXuueL4

lagniappe3 anni fa

it means copy http://acme.cat-v.org/readme

MisterTea3 anni fa

All of plan 9 uses "snarf" in place of "copy".

labster3 anni fa

Do they follow the Berne Convention on Snarfright?

NoZebra120vClip3 anni fa

Only if there aren't many Trekkies going that year!

techbro923 anni fa

Wow, that’s insane

nonethewiser3 anni fa

Well you certainly snarfed it up

[deleted]3 anni fa

fmajid3 anni fa

More likely it is DRM-cracking packages.

eur0pa3 anni fa

That or fairly unlucky bug bounty hunters

quickthrower23 anni fa

Putting my conspiracy hat back in the closet, I guess there is plausible reason to believe that someone used PyPI for fraud, CP distribution or some other crime.

mistrial93 anni fa

accusations and planting evidence are everyday things in some security circles.. plus idiots abuse open systems.. not proof of malfeasance, maybe just a "setup"

stonepresto3 anni fa

I'd like to put $5 on "ransomeware threat actors"

paulddraper3 anni fa

> poor typosquatter

:/

[deleted]3 anni fa

NelsonMinar3 anni fa

Total speculation on my part but PyPI hosts yt-dlp, the unauthorized video downloader. https://pypi.org/project/yt-dlp/

vore3 anni fa

I would think the government has bigger fish to fry than to spend time subpoenaing yt-dlp.

lazide3 anni fa

The FBI has it's own 'copyright enforcement' division who has as their sole job enforcing copyright, and has it's own dedicated funding

[https://archives.fbi.gov/archives/news/testimony/intellectua...]

RobotToaster3 anni fa

Isn't copyright infringement a tort not a crime? Why is the FBI involved at all?

lazide3 anni fa

[https://www.justice.gov/archives/jm/criminal-resource-manual...]

There is an applicable federal criminal law.

RoyGBivCap3 anni fa

Because the people rich enough to own big copyrights can afford politicians.

dmix3 anni fa

https://en.wikipedia.org/wiki/No_Electronic_Theft_Act

> Introduced in the House as H.R. 2265 by Bob Goodlatte (R–VA) on July 25, 1997

> Committee consideration by United States House Committee on the Judiciary and United States Senate Committee on the Judiciary

> Passed the House on November 4, 1997

> Passed the Senate on November 13, 1997

> Signed into law by President Bill Clinton on December 16, 1997

mindslight3 anni fa

Every time I'm reminded of this law, specifically the year of its passing, I'm newly surprised. With some digital authoritarian laws, I'm acutely aware that they are only recent history (eg FOSTA, DMCA, bank surveillance, "Patriot" act). But with the NETA and the CFAA I have to work at remembering that things weren't always this way, as recently as only a few decades ago. Like imagine the different world we could be living in if they had failed at becoming law and things had developed without them.

lazide3 anni fa

The nominal reason for the passing of the law was widespread use of VCRs, which allowed non-centralized and difficult to control recording/copying, distribution, and at home playing where usage couldn’t be monitored (like at a theatre which can be audited).

Before that, it would involve something like literal film, which didn’t scale well, and was too expensive and difficult for a typical person to do at home. It still happened, but was VERY niche.

With VHS/VCRs, someone could spend a couple thousand dollars and make hundreds of bootleg copies of any blockbuster video out there from their garage, and it was easy to literally go to Blockbuster(tm) and get an copy to duplicate without being tracked. Easy money. Folks would sell them out of the back of (literally) vans, or through friends, or via flea markets, etc.

It’s still super prevalent in Asia, using DVD/Blu-ray’s.

In the US, it then eventually got applied to the internet, because it was even easier and more scalable using computers, and harder to track down the culprits.

It’s all about money in the end of course.

lazide3 anni fa

Ah, back in the days of bipartisanship.

qingcharles3 anni fa

Depends on the level of infringement generally.

sp3323 anni fa

While copyright infringement is usually a civil matter, there are times the DoJ gets involved. They even got a guy sentenced to jail for it in 2018. https://www.justice.gov/usao-ndga/pr/owner-sharebeastcom-sen...

dual_dingo3 anni fa

Not a US cititzen, but "The government" is a wide term and any law enforcement agency would fit this, including the ones that are responsible to deal with things like copyright enforcement - that's exactly the type of fish they exist to fry ...

ChuckMcM3 anni fa

FYI for non US readers ...

In the US, subpoenas come from the Justice Department (either state or federal depending on the crime for which evidence is being sought). The court that issued the subpoena is on it, and the person or entity being served, has the right to see why some government agency felt it could aid in the uncovering of a crime that had already been committed. The person or entity then has the opportunity to challenge that in court prior to complying with it. This is sometimes informally called "quashing the subpoena." From my sister-in-law who is a defense attorney, the most common result of challenging a subpoena is to get what it asks for narrowed down to just what is plausibly responsive.

In the article, this response: As a result we are currently developing new data retention and disclosure policies. These policies will relate to our procedures for future government data requests, how and for what duration we store personally identifiable information such as user access records, and policies that make these explicit for our users and community. Is good practice for limiting what a subpoena can request (you can't give what you don't have).

At Blekko we logged access records in such a way that we could use PII for 48 hours and then it was deleted. The CTO, Greg Lindahl, is a huge privacy advocate and this sort of architecture made it possible to get information to improve our ranking and service without compromising people's privacy. In practice I don't think any agency could go from "we have a suspect" to "issue a subpoena" in 48 hrs so it was a useful way for us to stay out of the crosshairs. The most interesting event was the FBI asking for information on IP addresses that had accessed their honeypot CSAM site. That turned out to be some of the machines in the crawling cluster. Given that the site was outside the crawl "horizon" and didn't rank (very few sites linked to it) it didn't even make it into the cache for rank analysis. But in that case the turn around time was impressive. Of course that is because they were just using their own logs to generate subpoena requests.

sroussey3 anni fa

You can get subpoenas that ask for data longer than your window, in which case you have to have a longer one, even if the reachback is shorter.

Watch out for smaller jurisdictions that might have “you should have expected” laws that says your 48hr window is too short.

ChuckMcM3 anni fa

As I recall (and I'm not a lawyer so don't rely on this advice) the lawyers had advised that as long as the retention period was published, even if a subpoena asked for a longer look back you could meet your obligation by returning "all the data you had" which would only be 48hrs worth.

Had a jurisdiction said, "You should have expected ..." I expect our response would have been, "We have published what we retain, me meet conform to federal and state laws you knew ahead of time we wouldn't have more than 48 hrs worth."

That said, jurisdiction when it comes to the Internet is always kind of "weird". Did you use the web service in your house in Columbus OH, or did you use the web service on a server in a data center in California? Also as I recall our TOS also had a requirement that any legal action be brought in California but I don't think we ever tested that in court.

sroussey3 anni fa

I tested the court jurisdiction a few times, but had mixed results. I tried to quash first anyhow.

The NSA and SS can get quite testy about it and make you wish you were dealing with the FBI.

vore3 anni fa

Given the discussion around how lacking PyPI supply chain security is, how juicy of a target it is for attackers, and how critical infrastructure is probably relying on PyPI, yt-dlp is the last thing on my mind.

throwaway092233 anni fa

Google is a pretty big fish themselves.

What usually happens is the large corporation lays out a case like "yt-dlp is responsible for billions in damages" and they press the DOJ to investigate and prosecute.

account423 anni fa

AFAIK Google hasn't even taken any civil action against y(ou)t(ube)-dl(p) at all, that was all the music industry.

sam0x173 anni fa

One would think that yes.... but this is the U.S. :/

[deleted]3 anni fa

heavyset_go3 anni fa

The FBI does sting operations to arrest homeless people who sell bootleg movies and bags on the street.

astrea3 anni fa

Amazingly hilarious comment given the history of copyright prosecution.

vore3 anni fa

Given PyPI has been a vector for distributing malware into dependency chains, wouldn't you think that would be a more likely target for the DoJ over one of HN's favorite axes to grind?

Sparkyte3 anni fa

I wouldn't be surprised if it was more of AI based impersonation stuff. AI in the government is big because people can use it impersonate people as a form of identity fraud.

WhyNotHugo3 anni fa

Unlikely, due to:

> "Records of all Python Package Index (PyPI) packages uploaded by..." given usernames

> "IP download logs of any Python Package Index (PyPI) packages uploaded by..." given usernames

I don't think they'd want a list of packages uploaded by a given user if they were after yt-dlp devs. They'd be asking for a list of maintainers of a given package.

ed25519FUUU3 anni fa

If yt-dlp was illegal the first thing they’d do is a takedown request, not a subpoena but leave it online.

heavyset_go3 anni fa

That's if they want to go down the DMCA route and aren't using a subpoena in a different case.

NoZebra120vClip3 anni fa

But what if they want records on everyone who downloaded a tool?

[deleted]3 anni fa

not2b3 anni fa

It seems much more likely that some typosquatter managed to compromise the security of government sites by uploading malware, and Uncle Sam wants to catch the culprit.

stonepresto3 anni fa

Or they're chasing threat actors, ransom groups, etc as part of a larger investigation.

slenk3 anni fa

yt-dlp is everywhere - why would they go after pypi and not the source at https://github.com/yt-dlp/yt-dlp

heavyset_go3 anni fa

Not that I necessarily believe this is happening, but this can be a case of making an example out of anyone that wants to distribute the software they wanted censored via chilling effects.

slenk3 anni fa

Ah, fair. Wouldn't be the first time the US Gov't did that

phkahler3 anni fa

Thanks, I was wondering what it might be about. That makes some sense.

schleck83 anni fa

No it doesn't. Noone at the government level gives a shit about a youtube downloader package, typosquatting would be way more likely. Pypi is riddled with malware AFAIK, they don't really moderate it.

ewdurbin3 anni fa

I took a report down within 3 minutes of upload today. We have regularly received comments from our 3rd-party reporters that we are the most responsive.

You are wrong.

zerealshadowban3 anni fa

They log too much data about their users.

So they should promptly update their policies to a) stop logging so much, b) delete all past logs, and c) sharply limit the span of time until deletion of whatever logs they decide they really need to track for internal needs.

They should avoid logging, and rapidly rotate logs, to thwart future subpoenas from the total surveillance state.

chatmasta3 anni fa

PyPi is in a tough spot because they're also getting hit with an onslaught of malicious packages, which got to such a bad point they had to disable signups. How do they mitigate that kind of activity without logging basic metadata like the IP address that published a package? Also, as a user of PyPi, wouldn't you prefer that a malicious package is at least _somewhat_ traceable to an attacker? Of course most would be behind a VPN but it's better than nothing (or maybe it's not, depending on the tradeoff).

Note that the blog post doesn't say they handed the entire database over to the feds. They received three warrants scoped to specific packages and returned only the data they had available that was associated with those packages.

ginto3 anni fa

> How do they mitigate that kind of activity without logging basic metadata like the IP address that published a package

An effective mitigation for abuse/spam is to increase its cost. One example is to require payment.

proto_lambda3 anni fa

That's also a highly effective mitigation against legitimate users, especially those already disadvantaged everywhere else by a lack of disposable income.

ginto3 anni fa

How did you conclude payment equals parting with the money and not getting it back? Collateral works well for many problems in the world.

mort963 anni fa

It would not go over well if PyPI started charging people to host packages.

ginto3 anni fa

Charging goes well for many online services. Hosted email, hosted VPS, and hosted SaaS are some that come to mind. Apple Store and Google Play charge to host mobile games.

chatmasta3 anni fa

And the feds can subpoena all those services and their payment providers for logs including IP address that made the transaction.

mort963 anni fa

Notably, none of your examples include the central distribution service which underpins a whole FOSS ecosystem.

duckmysick3 anni fa

Now they need to subpoena both PyPI and the payment processor. It does slow them down but effectively does nothing to "thwart future subpoenas from the total surveillance state".

takeda3 anni fa

For the kind of service they are providing I think the logging is appropriate.

I mean if DOJ is interested in PyPI logs the only reason I could think of, is if it was used as a supply chain vector into breaking in into other organizations.

alwayslikethis3 anni fa

or locating the people responsible for DRM breakers like youtube-dl? Keeping all the data makes you susceptible to subpoenas like this, which costs money to comply with. There is no reason to keep any data that isn't necessary to the service.

takeda3 anni fa

youtube-dl is an application, there's no benefit for the author to publish it there.

I also checked PyPI repo and looking at it I don't think it is published, there are few that look like might be it, but looking at them, they feel like something that would install something nasty on your computer.

As a somebody who relies on PyPI for development, I want them to store all kinds of data that would discourage PyPI to be used for any shady purpose.

Also perhaps there's a better example than youtube-dl, as they really don't do anything illegal. Yes their github repo was taken by DMCA request but then it was reinstated back. The GitHub spin it that they are standing up for developers, but the DMCA was just frivolous. I guess, still good for them, because they could just take it down and do nothing.

pluto_modadic3 anni fa

This is for package management. I want the supply chain to be secure and would rather know when something unusual happens. Not logging that data would be irresponsible on PyPi's part.

hayleox3 anni fa

Which data are excessive? Everything described in the post seemed totally reasonable to me.

manicennui3 anni fa

(2)

dpifke3 anni fa

PyPI used to be somewhat decentralized, with multiple independent organizations (in multiple legal jurisdictions) running mirrors.

For $REASONS they've decided Fastly should be the only official mirror. This makes it a one-stop shop for malicious governments.

donaldstufft3 anni fa

This post is pretty misleading.

PyPI still fully supports mirrors (though it is becoming increasingly hard to run a full mirror of PyPI, last I looked a full copy of PyPI is about 30TB).

The only thing we ever removed was designating any particular mirror as official and an auto discovery protocol that was quite frankly extremely insecure and slow. That worked by giving every single mirror that wanted to be an "official" mirror for auto discovery a subdomain of `pypi.python.org`, labeled {a-z}.pypi.python.org. A client would determine what mirrors were available by querying last.pypi.python.org, which was a CNAME pointing to the last letter that we had assigned, that would tell it how many mirrors there were, then they could work backwards from that letter. So if the CNAME pointed to c.pypi.python.org, the client would know that a, b, and c existed.

Immediately you should be able to see a few problems with this:

- It is grossly insecure. Subdomains of a domain can set cookies on the parent domain, depending on ~things~ they can also read cookies.

- It does not scale past having 26 mirrors.

- It does not support removing a mirror, there can be no gaps in the letters.

So we needed to remove that auto discovery mechanism, which raised the question of what, if anything, we should replace it with?

Well at the time we had only ever made it up to g.pypi.python.org. So there was only 7 total mirrors that ever asked to become an official mirror. To my knowledge we never reused a letter, if a mirror went away we would just point the mirror back at the main PyPI instance. I don't remember exactly, but my email references there being only 4 mirrors left.

From my memory at the time, most of those 4 mirrors were regularly hours or days behind PyPI, would regularly go offline, etc.

But again, we never stopped anyone from running a mirror, we just removed the auto discovery mechanism and required them get their own domain name. We even linked to a third party site that would index all of the servers and keep track of how "fresh" they were, and other stats (at least until that site went away).

Running a mirror of PyPI is a non trivial undertaking, and most people simply don't want to do that. We never had many mirrors of PyPI running, and as it turns out once we improved PyPI most people decided they simply didn't care to use a mirror and preferred to just use PyPI, but still to this day we support anyone to mirror us.

dpifke3 anni fa

I misrembered the PyPI mirror system (pre-Fastly) being more similiar to Debian[0], I didn't realize it had so many problems.

Debian managed to solve all of the concerns you listed, what makes PyPI unique?

[0]: https://www.debian.org/mirror/list

donaldstufft3 anni fa

So there's a few things here:

Firstly, Debian's mirror network URLs allow a mirror operator to attack the base Debian.org site if they rely on cookies on debian.org (they may not, I'm not sure). Specifically the `ftp.<country>.debian.org` aliases cause this. On PyPI we did use cookies at the base url, so this was a non starter for us to keep.

The second thing here is that Debian and PyPI from a technical level about how mirrors are configured and hosted are generally similar. Meaning other than the above aliases, mirrors are expected to have their own domain and users are expected to configure apt or pip to point to a specific domain. Debian does have a command that will attempt to do that configuration for you to, to make it easier.

The third thing is that Debian's mirrors are as secure as the main repository is against attacks from a compromised mirror operator. This isn't the case in PyPI where you're forced to trust the mirror operator to serve you the correct packages. There is vestigal support for a scheme to support this in the mirroring PEP, but nothing ever really implemented it except the very old version of PyPI (none of the clients, etc). That scheme is also very insecure, so it doesn't really provide the security levels it was intended to.

The fourth thing is that a Debian mirror is easier to operate.

Packages on Debian don't live forever, as new versions are released old versions get removed, and as OS releases move into end of life, entire chunks of packages get rotated out. However on PyPI we don't have the concept of an OS release, or any sort of phasing out of old packages. All packages are valid for as long as the author makes them available. This means that the storage space to run a PyPI mirror (currently ~30TB) is a lot more than the storage space for a Debian mirror (~4TB).

On top of that the way apt and pip function are inherently different. Apt has users occasionally download the entire package set so that apt has a local copy of the metadata while pip asks the server for each package for the metadata (it does some light caching, but not a lot). This means that to discover what packages are available, apt might make one request a day while pip might make 100 requests for every invocation of pip. Packages on apt release a lot slower and less often than on pip. so many times people may not be needing to download more than a handful of packages, but people generally need to download a lot of packages from PyPI at a time.

I believe? the Debian mirroring protocol is rsync based, which is generally pretty reliable, while the PyPI mirroring protocol is a custom one which works, but it sometimes has a tendency to get "stuck" every few months and require operators to notice and fix themselves.

I suspect the differences between the strength of the mirror network is some combination of the two, but I suspect the the third and fourth things are the biggest differences, particularly when PyPI's CDN solved the problem in most users minds that would cause them to want to host or use a mirror.

jehb3 anni fa

Suggestion: Start slipping unique URLs into the "hidden" backend fields of systems where you'd like to know if your data was breached, improperly used, or handed over to a three letter agency.

Suddenly getting hits at mydomain.com/[uuid]? At least you know somebody has looked at the data, or at the very least fed it through some processing tool that is extracting and visiting the URLs.

mmsc3 anni fa

This is called a canary and can be used in so many places: https://blog.thinkst.com/2022/09/sensitive-command-token-so-...

tailspin20193 anni fa

https://canarytokens.org

krick3 anni fa

How do you suggest it should've been used in this case? As a PyPI username (obviously pointless), or what?

jehb3 anni fa

Good question. I'm not familiar with what fields might be be collected on the PyPi backend. But the email address field alone could be enough, if you set up a wildcard DNS and made your account email something@[uuid].mydomain.com, and looked for any http traffic to that subdomain.

datenwolf3 anni fa

Or run your own authorative DNS for example.com (or a subdomain used for this) and track queries on those UUID.

austinjp3 anni fa

I'm pretty sure I've seen a SaaS that does this, but I can't remember the name.

bl4ckneon3 anni fa

"Thinkst canary" I think you're thinking about. https://canary.tools/

austinjp3 anni fa

Yes that's the one, thanks.

jacquesm3 anni fa

> We will not be releasing the usernames involved publicly or to the users themselves.

Why not to the users themselves? Have they been prohibited from doing so? (TFA does not say afaict)

tptacek3 anni fa

The subpoena probably includes a nondisclosure clause; a court order certainly would. The mechanics of nondisclosures on subpoenas is interesting and I don't totally understand it (by definition, a subpoena is a document authorized by someone other than a judge).

jsjohnst3 anni fa

> by definition, a subpoena is a document authorized by someone other than a judge

Uhm, am I misunderstanding what you wrote, because that is definitely not true. Subpoenas require an officer of the court by definition (in the US anyway), which can be a judge, a court clerk, or even lawyers in some jurisdictions.

tptacek3 anni fa

Can a court clerk or a lawyer unilaterally create a nondisclosure requirement? It is not generally that case that a lawyer, absent a judge, can send you a document you're not allowed to disclose (though certainly lots of C&D's try to suggest otherwise).

I'm sure the NDA stuff here is ironclad! I'm just curious what the mechanism is.

jsjohnst3 anni fa

> Can a court clerk or a lawyer unilaterally create a nondisclosure requirement?

If they are acting as an officer of the court, which they’d need to be to sign off on a subpoena, I believe the answer is yes. The mechanism is called a “gag order”.

tptacek3 anni fa

For subpoenas authorized under the Stored Communications Act, there's statutory authorization for DOJ to request time-limited NDAs, which makes me wonder if there needs to be explicit authorization for other kinds of subpoenas. This is the kind of noodling I'm doing here; I'm not trying to message-board my way to a first-principles argument that the NDA was bogus. :)

lazide3 anni fa

It's very common for a subpeona related to an ongoing investigation to include a gag order. For instance, if someone is investigating someone for a crime, and requests that users search history, the last thing they want is for Google et al to alert the user that this happened, as they may not be ready to arrest them yet and the target would flee.

Same with wiretapping orders, or frankly a subpeona for pretty much anything from a third party.

jacquesm3 anni fa

I don't follow you, which NDA?

vdqtp33 anni fa

> Subpoenas require an officer of the court

That's not entirely true.

https://en.wikipedia.org/wiki/Administrative_subpoena

Local organizations have come up with equivalents, although there is less (no?) statutory support for that.

jsjohnst3 anni fa

> Subpoenas require an officer of the court … or an agent working for the government

I left off the second part after the ellipses because it’s not relevant to the current discussion and because there’s constitutional challenges against them even when federally issued, as your link calls out. I didn’t want us to tangent off needlessly. The law is a messy place, lots to find and hate.

chaps3 anni fa

There was no NDA:

  "We have waited for the string of subpoenas to subside, though we were committed from the beginning to write and publish this post as a matter of transparency, and as allowed by the lack of a non-disclosure order associated with the subpoenas received in March and April 2023."

steve19773 anni fa

… for the suppoenas received in March and April 2023

chaps3 anni fa

Yeah, that was notably strange language for sure.

tptacek3 anni fa

Interesting! (I initially read this backwards and thought you were saying they did have an NDA).

[deleted]3 anni fa

jacquesm3 anni fa

So is this message a way to obliquely signal to those users (whoever they are) that they may be under investigation without actual disclosure?

tptacek3 anni fa

I doubt it. Most of these investigations (really: most federal computer-related investigations) are super boring, and are about things ordinary people wouldn't object to seeing investigated.

We're a message board and we're thus optimized for drama over truth-seeking (it's just human nature). The truth of these kinds of events is usually not all that interesting. If it's something more dramatic, we'll hear more about it in the future. In, like, a sort of Bayesian sense, you can predict that any given subpoena or court order is going to be about a case nobody would bother sending warning signals about.

bredren3 anni fa

> Most of these investigations (really: most federal computer-related investigations) are super boring, and are about things ordinary people wouldn't object to seeing investigated.

This is true. The result may be so boring local news wouldn’t even cover it. In some cases you have to find the investigating agency’s unremarkable press release and then dig for related court documents to even find out what happened.

can16358p3 anni fa

That might get PyPI into trouble especially with a gag order which we can assume that they are forced to obey and forced not to talk about.

PyPI would pretty much want to inform the users, but they probably simply can't (without getting into legal trouble).

[deleted]3 anni fa

toast03 anni fa

The users themselves already know their own usernames, presumably. They could let the users know they were subpoenaed without letting them know their username. :P

ruffrey3 anni fa

Often subpoenas are part of an ongoing investigation, and they require not releasing information to those who’s data was subpoenaed.

stonepresto3 anni fa

The why: notifying a suspect in a criminal investigation could allow them to flee or take measures to avoid prosecution, destroy evidence, etc.

shadowgovt3 anni fa

That, or they have reason to believe the investigation is legitimate and they would prefer not to hinder it.

jacquesm3 anni fa

They say very explicitly that they do not know what it was about.

weaksauce3 anni fa

they have five usernames... that can narrow down what projects they were associated with pretty quickly to infer if there was something nefarious about them. though it could be entirely unrelated to their activity on pypi and be a trawl for leads based on username similarity from some other messageboard or activity that was used for illegality. though, thinking about it more, that seems legally dubious a reason to be able to get a subpoena issued for. ianal

CodesInChaos3 anni fa

They only wrote that they weren't told what it was about. However it might be obvious from the packages uploaded by those users (e.g. if they uploaded malware).

shadowgovt3 anni fa

There's a wide gulf between concrete knowledge and belief.

I see an ambulance going lights-and-sirens behind me. I don't know they're on their way to or from a hospital, but I pull over because I have reason to believe they are.

junon3 anni fa

Weird analogy. An ambulance has a very narrow scope of responsibility. Legal processes have a very wide scope. Clearly this is related to a legal matter and not an immediate medical matter. But the nature of the legal matter could be a very wide variety of things, ranging from lower court civil proceedings up to treason, etc.

junon3 anni fa

Good on the PyPi folks. This is an incredibly well done disclosure, an example to be sure.

aa_is_op3 anni fa

By the number of malicious packages that site has hosted over the past few months, this was only a matter of time.

I've lost track of the number of "white hats" that contact us with extortion requests after they used some dependency confusion attack.

Mystery-Machine3 anni fa

Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it? Would you rather them not report it to you or even worse, exploit it?

dahwolf3 anni fa

Pay me or I will harm you is extortion, as simple as that.

There's an entire industry now of people that check known vulnerabilities (so they don't invent anything themselves) in software/packages and cross check this against outdated websites, at a very large scale.

They have no morals or security ethics, they barely even have knowledge, they just want to make money with the least amount of effort possible.

Don't ever pay them a cent. They're just as ruthless as spammers.

autoexec3 anni fa

If several groups of people who "barely even have knowledge" can profit from checking for well known vulnerabilities on websites and reporting them I say more power to them.

If there is an entire industry of people doing low effort work which then discovers vulnerabilities on a company's website that company should pay them, and probably fire some people they've already been paying for not putting in even that much effort to secure their own stuff.

Who is less ethical? The people reporting vulnerabilities and wanting to be paid for it or the companies who don't bother to invest in even basic security practices putting people's data at risk and allowing scammers and hackers to leverage those insecure systems to hurt others?

dahwolf3 anni fa

The word "companies" is doing a lot of work in your rant.

The vast majority of websites on the internet do not have a team behind them. That's exactly the reason why they lack maintenance.

So they're not intimidating well-funded companies, they're intimidating that nice guy that in 2003 build a website for the local bridge club. Volunteering his time and money to do so.

bmacho3 anni fa

> There's an entire industry now of people that check known vulnerabilities (so they don't invent anything themselves) in software/packages and cross check this against outdated websites, at a very large scale.

If it's easy, then more the danger, and more the reason to pay the white hats instead of getting robbed by black hats?

JadeNB3 anni fa

> Why is it an extortion request and "white hats" if they have successfully found a security issue in your project and reported it to you, without actually exploiting it?

Presumably because there is some demand for compensation before disclosure?

cjsawyer3 anni fa

Sounds like they’re the ones who implemented the bad code in the first place, as a honeypot. That just extortion with extra steps.

accrual3 anni fa

Is it still "white hat" if money or a transaction is involved? My understanding is it's either black hat, the exploit is sold for money. Red team, you paid to be exploited for your own benefit. Or white hat, an exploit was found and it's communicated to limit black hat and red team. White hat + money would just be gray hat or blackmail.

rocqua3 anni fa

White hats can still get bug-bounties. Though if a company hasn't published such a bounty and a hat 'extorts' the bounty by demanding payment or else they will publish, that hat has a tint of grey.

Aeolun3 anni fa

That's not a tint of gray, that's just plain black.

passion__desire3 anni fa

Why can't PyPI safeguard popular packages by making sure that new packages are few (4 or 5) edit-distance away to make sure popular ones don't get intermixed with malicious packages. Is that difficult to implement?

rocqua3 anni fa

pip-env, pipe, pipes, sip, siv, lipo, etc Are all within an edit distance of 4 from pip, and would all be blocked.

Besides 'dependecy confusion' is not typo-squatting at all. It is about having a public package that masks the name of a private package repo. The default behavior of pip is to then use the public repo, which can let outsiders who know internal package names totally take over those internal packages.

heavyset_go3 anni fa

That's certainly a way to look a gift horse in the mouth.

misterpigs3 anni fa

I love this level of transparency.

voynich3 anni fa

Yeah, whether necessary or not, it's still nice to have such a level of detail in a transparency report.

SV_BubbleTime3 anni fa

Sure. But I would love if they had considered this from the start:

>As a result we are currently developing new data retention and disclosure policies.

“I guess we don’t actually need that” should have been the idea from the start.

thih93 anni fa

After a quick glance at the information listed in the report I didn't notice excessive data collection on pypi's part.

I'd say they followed "I guess we don't actually need that" approach reasonably well so far and good for them if they want to improve that even more.

donaldstufft3 anni fa

One important thing to remember here is that PyPI was originally started in 2002 as a weekend hack project that grew overtime to become the piece of critical infrastructure it is today. There's a lot of stuff in PyPI that exists as historical baggage and cruft and reviewing them just never bubbled up to be a priority. Likewise a lot of the policies it has have been added and grown overtime as something happened that caused us to need one.

On top of all of that, it's volunteer run and has been understaffed for basically it's entire life, so sitting down and figuring out a proper data retention policy that takes a holistic view of everything we have just never bubbled up.

In general I think we already do a pretty good job of collecting a minimal amount of data, and hopefully with proper policies we can do an even better job.

itake3 anni fa

I can't tell if this is sarcastic.

While they are transparent the events happened, they are not transparent about which packages and what authors are being flagged, which is unfortunate.

thih93 anni fa

Is it possible that they can't publish that? Perhaps even not allowed to say that they can't publish that?

einpoklum3 anni fa

> While they are transparent the events happened

Considering they are admitting they will always obey government commands, including regarding non-disclosure of actions to affected users, it is prudent to assume they are, in fact, not transparent about events; only about those events which the government has let them tell you about. Other events (e.g. National Security Letters) may or may not have occurred.

tomjen33 anni fa

> We will not be releasing the usernames involved publicly or to the users themselves.

Which is the most important part.

tptacek3 anni fa

They're not allowed to release that.

Edit

I read 'chaps as saying there was an NDA on the subpoena, but apparently there wasn't, so this might just be flatly wrong.

AnotherGoodName3 anni fa

The NDA isn't the only reason you don't risk interference in an ongoing investigation though so regardless the basic point still stands.

remram3 anni fa

Even in the absence of NDA, are you allowed to? Counsel has apparently advised them not to. Would it not carry the risk of being complicit to a crime?

kevin_thibedeau3 anni fa

Disclosing facts is not a crime.

remram3 anni fa

There are lots of situations in which disclosing facts is indeed a crime. You are answering my specific question with a nice sounding maxim which is obviously not true in general.

rocqua3 anni fa

Perhaps there is no NDA on the fact that subpoenas were issued, but still an NDA on whom they were issued about? Limiting The scope of such an NDA feels like a plausible result of negotiations after a motion to squash the subpoena.

dev_tty013 anni fa

Releasing the user names would not be respecting the privacy of the users.

throwaway_131403 anni fa

Do you still love it if it enables a terrorist or otherwise very bad person to evade capture?

evandale3 anni fa

Not OP but yeah. I don't buy into the whole "to protect you from bad people I need to erode your rights" argument.

Never made sense to me. Terrorists and other very bad people usually aren't in the business of following laws so I don't know what crimes you'd prevent by weakening the rights of everyone else.

xp843 anni fa

I'm very unaware exactly what the issue is with this particular case, so be gentle, but what is the difference between the government agencies doing their job to stop criminals, and evil rights-destroying which it sounds like you are clearly convinced is what's going on?

Let's say someone stole your identity and in the process they emailed all your financial documents to example.anon12345(at)gmail. If you contacted the police and the FBI subpoenaed Google to force them to give them the details of whatever they know about that accountholder, is that bad and hurting the rights of somebody, or is it protecting your rights?

Does it change based on the despicableness level of the crime suspected? From one count of copyright infringement of a Taco Bell commercial, to organized retail theft rings, to identity theft, to CSAM, to terrorism?

I'm not saying you're wrong, I'm just curious what the "We hate subpoena power" argument is so I can decide where I stand on it. I feel mildly like I'm not as bothered as you are, but I suspect I'm missing something.

Also, should "online" operate under different rules than offline? If the "feds" have probable cause that some guy is a drug kingpin and they break into his office and his safe to seize evidence, is that equally bad as forcing Google to open up his Gmail account for them?

M3L0NM4N3 anni fa

I mean, surveillance reduces crime. Wherever you fall on the spectrum of surveillance/privacy, I can guarantee if the government read everything everyone wrote/texted/read and recorded their every move, there would be less crime.

menus3 anni fa

Great to know that. I'll let the parents of Uvalde know how surveillance reduced crime on the 1 year anniversary of the school shooting.

Surveillance does not reduce crime, tending to people's basics needs so that they don't need to commit crimes reduces crimes.

xp843 anni fa

Is a subpoena of 5 specific users' data, presumably with the purpose of getting evidence about things that already happened, the same as 'surveillance'?

> the government read everything everyone wrote/texted/read

is this really a relevant analogy for this? And yes, I've heard of the mass surveillance via telco that we did find out (through Snowden) was happening, and do think it seriously crossed the line. I'm just wondering if this kind of case at issue has anything in common with that malfeasance at all.

Is it your belief that they lacked any probable cause and are actually trying to persecute those 5 people for some reason?

Rather than try to argue against a position I'm not fully understanding, I'd like to hear how you think police should solve crimes with a significant "cyber" component.

M3L0NM4N3 anni fa

To be clear, I'm not advocating for it. But if people couldn't use the internet/communications to plan or communicate criminal activities, crime would reduce (to some degree, meaningful or not).

Aachen3 anni fa

Climate activism is also being considered an act of terrorism by some now (particularly some Christian party in Germany), dunno if those people label themselves as 'very bad persons'. Probably goes for all terrorists, but this might be easier to relate to as it's grounded in reality and we'd likely agree with the change they seek

Child porn and terrorism are the favorite subjects of politicians looking to enact a new law but idk if it's good to follow that thinking and use it as an example as opposed to a serial killer or something

Danjoe43 anni fa

Yes. Truth itself stands at the top of the moral hierarchy. It can stand alone without any justification. "You told the truth" will never be immoral, consequences be damned.

Zetice3 anni fa

Dumb legal question; what's the difference, if any, between "We've been subpoenaed" and "Someone had a warrant for data"?

schoen3 anni fa

The subpoena is a command to the possessor of the data, which tells the possessor of the data to produce it, with a particular deadline. Since this deadline is in the future, the subpoena can be challenged legally (normally by requesting a court to "quash" it; more riskily, sometimes by complying imperfectly or not at all, and then arguing in response to an attempt to punish the noncompliance that this was reasonable). A subpoena can be issued by many entities, for example including some law enforcement entities themselves, or a lawyer actively involved in litigation. (Yes, lawyers can personally write and issue subpoenas.) The subpoena is, however, enforced by a court, in the sense that the court is asked to punish people who fail to obey it.

The warrant is a command to a law enforcement officer, which allows the law enforcement officer to personally go and search and seize things (or people), while overriding some rights that would normally prevent this. Normally it is issued by a court. Generally there is no way to challenge a warrant to prevent its execution, because it is not disclosed to the target before it's executed (i.e., a law enforcement officer shows up with the warrant and begins executing it immediately, by force if necessary).

(Edit: I wrote above that it's risky to comply imperfectly with a subpoena and then argue in court that this was reasonable, but usually if a lawyer gives a professional opinion that the subpoena is invalid or overbroad for some reason, then the recipient of the subpoena won't be punished for following that advice. The lawyer may also attempt to negotiate directly with the issuer of the subpoena, for example by sending a letter explaining why the the subpoena appears to be invalid. The legal standards for issuance of subpoenas are also pretty broad. For civil litigation, which is not what DoJ is doing here, they are set out in https://www.law.cornell.edu/rules/frcp/rule_26; notably, they can be issued to third parties.)

therein3 anni fa

Really nice response, I'm not the one who asked the question but I learned something from your response.

Zuiii3 anni fa

> https://www.law.cornell.edu/rules/frcp/rule_26;

This url does not exist. Was this response generated by an LLM?

dragonwriter3 anni fa

> This url does not exist. Was this response generated by an LLM?

No, its just that HN’s automatic linkification continues until it breaks on whitespace, so if you type punctuation (here, the “;”) after a link with no intervening space, it gets included in the URL.

Strip the semicolon and its fine:

https://www.law.cornell.edu/rules/frcp/rule_26

schoen3 anni fa

Thanks! I probably should also have mentioned https://www.law.cornell.edu/rules/frcp/rule_45 (with no punctuation at the end).

But also I possibly shouldn't use civil litigation as the only example of subpoenas, again because this one arose in a different context.

woodruffw3 anni fa

Not a dumb question: a subpoena is an order to provide information or access, while a warrant is a court-issued document authorizing the government (or an agent of the government) to perform an act (e.g., an arrest, or seizure of an item).

Subpoenas can be issued by attorneys (including prosecuting attorneys) as part of the investigative and discovery processes.

indymike3 anni fa

Subpoena = "Ask firmly, but nicely"

Warrant = "Back up the van and haul it away"

paxys3 anni fa

Warrant = we (police or other authority) have the right to come and search your property for evidence.

Subpoena = the court compels you to hand over the evidence we need.

woodruffw3 anni fa

Subpoenas are orders, but they're not necessarily court-issued. Warrants, on the other hand, are court-issued -- the police can't issue warrants on their own in the US.

rocqua3 anni fa

A warrant for a things isn't an order to the owner of that thing. It's an order to (and peemission for) officers to go and seize the thing.

You get shown the warrant to prove that they have permission, not to order you to comply.

woodruffw3 anni fa

Yes, I'm aware -- my other comment says that.

I realize this comment is a little ambiguous: the order in the warrant case is an order by the court to the court's officers to perform an arrest, seizure, etc. It's not an order for you (the subject of the warrant) to comply.

[deleted]3 anni fa

jupp0r3 anni fa

"9. IP download logs of any Python Package Index (PyPI) packages uploaded by the given usernames"

This was the point where I was wondering if this is really about some malicious packages or something more along the lines of copyright infringement software.

femto1133 anni fa

This definitely seems like a significant element of the ask, but for any popular package a list of all the downloaders would be pretty overwhelming in size (and I think of very limited utility). I'm guessing that some versions of some more obscure package(s) were identified as being used in an attack and they're either trying to identify potential attackers or other victims (or both) of that attack.

From a 2021 article[1] about packages used to deliver malware "we have alerted PyPI about the existence of the malicious packages which promptly removed them. Based on data from pepy.tech, we estimate the malicious packages were downloaded about 30,000 times."

For comparison yt-dlp has tens of millions of total downloads and gets downloaded over 70,000 times every day [2]

[1] https://jfrog.com/blog/malicious-pypi-packages-stealing-cred...

[2] https://pepy.tech/project/yt-dlp

tgbugs3 anni fa

One theory that I don't see mentioned yet is that someone used an upload to pypi to exfiltrate data or simply as a way to upload arbitrary data somewhere. In a sense pypi is just a file hosting service, so it could have nothing to do with any actual python projects at all.

rocqua3 anni fa

Interesting approach to data exfil. Though it seems predictable that exactly this kind of subpoena would be issued. If you can predict it, you can probably mitigate it.

Which means the subpoena would only be useful if the criminals made an opsec mistake. That is generally how most sophisticated criminals get caught, but here it feels like anyone inventive enough to try will probably also be prudent enough not to leave a trail.

etaioinshrdlu3 anni fa

Amazing how upset users here get over the very reasonable response to very normal police work.

sneak3 anni fa

Normal police work doesn't go fishing for the IP addresses (potentially millions of users) of everyone who downloaded a package.

> "IP download logs of any Python Package Index (PyPI) packages uploaded by..." given usernames

Do you feel the same way if the cops are receiving the IPs of everyone who downloaded yt-dlp? IP addresses and timestamps resolve to physical locations and oftentimes street addresses.

buzzscale3 anni fa

That doesn't make any sense though. What benefit would DOJ get from getting the IP address of everyone who downloaded ytp-dlp? They aren't the enforcement arm of google's terms of service, which is a civil matter.

Even if they were, and the DOJ was going for a dragnet operation to go after tools that could potentially infringe terms of service of big corporations, they would go after every tool and every fork. Not just 1 package. But again, what court would allow such action and why?

If I was in the DOJ and was investigating a malicious package uploaded to PyPI, I would ask for the IP's of the downloaders to see if the uploaders dun goofed and downloaded their package shortly after uploading off VPN. Or to find out if any major corporations were impacted by downloading the malicious package and to inform them.

ranger_danger3 anni fa

In the US at least, it has been ruled that an IP address is not sufficient evidence to link activity to any particular person. You could have been hacked for example.

sneak3 anni fa

In the US they don't need evidence or a warrant to put certain people they deem surveillance-worthy under 24/7 surveillance.

account423 anni fa

Exactly. This is like the police going to a store with a list of suppliers and demanding personal data of everyone who bought any of those suppliers' products. That's well beyond "normal" but somehow for digital data its ok?

etaioinshrdlu3 anni fa

(Deleted comment as it was wrongly assuming bias)

subarctic3 anni fa

I think you're reading it wrong too - it says "IP download logs of any Python Package Index (PyPI) packages uploaded by the given usernames". So that's anyone who downloaded those packages, not just the specific users' download activity.

ewdurbin3 anni fa

no. they wanted the downloads by randoms. we don’t store those with IPs

Vervious3 anni fa

Yeah, I feel like this crowd sometimes forgets that the department of justice exists first and foremost to keep us safe.

With PyPi hosting a ton of malicious packages and malware, certainly I am not morally opposed.

smolder3 anni fa

You could reasonably argue it exists foremost to keep wealthy, well-connected people and organizations safe, and to punish their adversaries.

Vervious3 anni fa

That’s a different argument, though. And it’s a hard argument to make; nowhere in the Constitution does it say “Justice for wealthy people only.” The intent of the Justice system is not nefarious; it merely exists to enforce the law.

I reject the vibe that “law enforcement bad, freedom good, tear it all down.” It is not at all constructive or thoughtful. I fear that people are forgetting that everyone is really on the same side, that we do really want to prevent crimes, and fairly and equitably. It’s ok to want a more fair and equitable Justice system, but in my opinion the solution is not to attack every law enforcement action with emotionally charged language.

winrid3 anni fa

Same with the dozen street cameras at every intersection in China, right? Right? :)

unethical_ban3 anni fa

It's truly disheartening to see examples where someone (presumably a real human) thinks that all law enforcement, across all nations and times, and in all cases, are equal.

asynchronous3 anni fa

Well when the convergence looks like it’s on the horizon, call us paranoid.

winrid3 anni fa

I didn't say equal, did I?

willdr3 anni fa

They are equal insofar as they exist for the same purpose.

throwaway_131403 anni fa

Agreed - how else was the DOJ supposed to do their job? They clearly need the data for an investigation. No need for PyPI to give information about how current users can alter their accounts to thwart future requests.

dvt3 anni fa

Most likely caused by phishing, ransomware, or (unlikely) crypto mining. I'd bet someone from some agency had credentials leaked due to a malicious package. Honestly, PyPI is stuck between a rock and a hard place, but having something like a "verified" badge (where someone's real identity is tied to it) for certain packages would go a long way to ensure some level of security.

The problem gets a bit hairier when dealing with dependency chains, however.

bogwog3 anni fa

It’s nice that they’re committed to user privacy, and this post really gives me confidence that my privacy will be reasonably protected.

…but why is that a goal for PyPi? As a publisher of packages, it’s a nice-to-have, but as an end user it’s kind of scary. I don’t want to use software packages published by anonymous and potentially unaccountable people. That’s probably why they have so many malicious packages.

Maybe you live in an oppressive regime who will imprison/murder you for publishing some code; ok, but that’s an outlier, and there are a lot of ways to get around that situation.

I just don’t see the benefit of privacy in this situation? Is it just to reduce the administrative overhead of collecting/verifying identity info? I’m genuinely curious to learn about a realistic use case that justifies the risks to all users.

I know you can self host your own package index, but very few users have the resources to do that.

kortex3 anni fa

I think largely because the prerogative is on the code author to reveal as little or as much about themselves, and the prerogative of library users is to sufficiently vet a package. If folks want to publish code pseudonymously, and folks want to use that code, as long as it's not abusive, what's to stop them? You can achieve basically the same effect with github, gitlab, or even plain self-hosted HTTP packages (pip just uses a convention for listing packages in a dir, any HTTP file host can be a package server), without PyPI.

I actually think the larger problem is Python's reliance on imperative code that executes at install time. Yeah you can use pip --download and extract it yourself, but folks rarely do that.

whimsicalism3 anni fa

> as allowed by the lack of a non-disclosure order associated with the subpoenas received in March and April 2023.

Yeah no way they haven't had other subpoenas then.

b33j0r3 anni fa

Why don’t nerds get the same rights?

According to US news over the past 3-4 years, you can just ignore subpoenas, then get a contributor job on a cable news network. Bonus points, the more you flout the law as arrogantly as possible ;p

kjkjadksj3 anni fa

I don’t understand how the information requested is relevant at all for any purpose. Most users of pypi merely download through pip; they arent registering anything. Furthermore, I would think a bad actor who would register would spoof their ip and use burner accounts anyhow.

buildbot3 anni fa

Correlating IP address use to something else happening at the same time? Like a malware author being incredibly dumb and using their home IP to upload PyPy packages, while IDK, using that same IP as a C&C server endpoint.

shadowgovt3 anni fa

They may not even need to have slipped up and direct-connected via their home IP. The FBI has sufficiently compromised subsets of Tor in the past to do correlative attacks on specific targets.

caturopath3 anni fa

> Most users of pypi

Presumably the 5 users in question were interesting in some way, not just random.

> I would think a bad actor who would register would spoof their ip and use burner accounts anyhow

Maybe, but they could find that out with the information. If there's a 10% chance each was sloppy or un-paranoid, there's a 40% chance they get at least one piece of real info.

The person might not have thought they were doing anything wrong. Some judge might have greenlit this for a piracy case against the five maintainaers of youtube_dl{c} or something silly.

cubefox3 anni fa

Apparently no plans to set up a canary.

jrockway3 anni fa

Is there any precedent for people not facing legal consequences for failing to update the canary? The subpoena probably says "and also update your warrant canary to say there were no legal requests." Now you're in contempt of court and in jail for 5 years while you wait for your "compelled speech" case to go to the Supreme Court.

In general, I think it usually goes poorly when programmers invent clever legal workarounds. The legal system isn't a computer program. It's guys with guns.

buildbot3 anni fa

Isn’t the idea that the (US) government can’t (technically) compel you to lie?

linsomniac3 anni fa

"Just because you're right doesn't mean you won't go bankrupt in a court of law proving it."

dennis_jeeves13 anni fa

That's real world wisdom...

EatingWithForks3 anni fa

The better question is: are you (or PyPI in this case) interested in a legal tussle with the US Gov?

mrguyorama3 anni fa

You can beat the wrap but not the arrest.

waselighis3 anni fa

I would think there are certain situations where a person might be compelled to lie, such as if you have a security clearance, have signed an NDA, or are acting as an informant. That is, a person may have to lie to prevent divulging classified or secret information through implication.

EDIT: One situation where the government cannot compel you to lie is if it violates your fifth amendment rights (self incrimination).

sigstoat3 anni fa

those are all things you actively agreed to, in advance, in exchange for some sort of consideration (job, not going to jail for illegal things you've already done, etc)

rossdavidh3 anni fa

I have never heard any legally competent source say that the U.S. government cannot (with warrant or whatever) compel you to lie. I'm pretty sure that, in the case of a canary, they can.

short_sells_poo3 anni fa

That may be the case but if the cost of testing it is 5 years in jail while the case works it's way through the courts, few people will be willing to rely on it.

asne113 anni fa

Please, we do it routinely. They're called "informants."

At the end of the day if uncle Sam demandeth, uncle Sam will haveth.

tptacek3 anni fa

The US compels certain kinds of speech all the time.

dwheeler3 anni fa

The US government is not compelling speech, it's compelling PyPI to accurately reveal to the US government the contents of past speech that PyPI has access to. Compelling disclosure of certain kinds of data, when it's known, is a normal part of legal actions in the US and probably elsewhere.

akerl_3 anni fa

You seem to be describing what these subpoenas have requested. This thread is about canaries, and whether the government could compel a company to keep one updated against their will.

User233 anni fa

The process is the punishment.

JohnFen3 anni fa

> The subpoena probably says "and also update your warrant canary to say there were no legal requests."

I think that would be outside what can be done with a subpoena. It would require a court order.

redox993 anni fa

Can you provide any evidence of the US forcing someone to update their canary?

snapcaster3 anni fa

How would one even observe this evidence?

metiscus3 anni fa

The only way I can think of would be that after the case has ended it may be possible for a party who had been directed to update a canary under a court order to notify people that they had done that. It would probably depend on the court etc and I am not a lawyer.

burnished3 anni fa

Can a subpoena stipulate that?

bitxbitxbitcoin3 anni fa

Exactly. Warrant canaries are security theatre.

actionfromafar3 anni fa

Not always, if the entity has a stance to uphold and the money to fight back, it doesn't have to be.

If a mom-and-pop shop or open source org, it's a faint hope at best.

waselighis3 anni fa

Long ago, Apple included a warrant canary in their transparency report. One day, it disappeared. Nothing came of it.

https://www.theverge.com/2014/9/18/6409575/apple-warrant-can...

The problem with a warrant canary is there's too much doubt about why it disappeared. Did they actually receive a warrant, or is it just a decision from corporate to discontinue the practice?

actionfromafar3 anni fa

A decision from corporate to discontinue is also a signal.

cubefox3 anni fa

There can be some doubt, but too much?

DANmode3 anni fa

> why it disappeared

The result is the same.

Zetice3 anni fa

If you can just say, "We got subpoenaed" in a blog post, isn't that even more effective than a canary would be?

caturopath3 anni fa

Canaries would be for times when they couldn't legally say that.

cubefox3 anni fa

There was a delay.

skullone3 anni fa

Why would they? It's a public repository, nothing confidential or private

JohnFen3 anni fa

Account details are confidential and private.

woodruffw3 anni fa

I don't understand (genuinely, I'd like to!) what a warrant canary would have done here: this was a subpoena, not a warrant, and PyPI is a public package index.

cubefox3 anni fa

I'm obviously talking about a subpoena canary.

tptacek3 anni fa

Canaries probably don't work, which makes them worse than theater.

CarbonCycles3 anni fa

What an odd article and release statement. It’s almost as if they’re signaling w-out literally signaling the parties of interest.

Surprised the doj didn’t issue any gag orders.

rossdavidh3 anni fa

One gets the impression that this was an artfully crafted way around the specifics of the gag order, to disclose whatever wasn't specifically prohibited by it. IANAL.

throwaway_131403 anni fa

Exactly. I guess the transparency is nice but at what point are you potentially helping someone cover their tracks who may or may not actually deserve that help?

Aeolun3 anni fa

Kind makes me feel like a lot of these services should just _not_ be hosted in the US? If we'd have this hosted in Germany or Sweden, would the government be so casually requesting data from these registries?

sneak3 anni fa

> "IP download logs of any Python Package Index (PyPI) packages uploaded by..." given usernames

This is way overbroad. The fact that a judge granted this is very bad.

duskwuff3 anni fa

It's hard to say that it's "overbroad" without knowing the details of the situation.

It's not hard at all, on the other hand, to imagine situations where this would be a reasonable request. Probably the most obvious would be if the packages contained material which was illegal to possess or distribute (like CSAM). Another would be if the packages were being used as part of a malware C&C operation -- knowing what IP addresses downloaded the packages would aid in determining the scope of the campaign.

kjs33 anni fa

We get "please provide the logged IP addresses of user X" subpoenas on a weekly if not daily basis. Which law school did you go to so I can tell our corp counsel they've been doing it wrong and stop asking?

tw-09812309813 anni fa

You should re-read the quote. This was not a request for the IP addresses of the users in question, but for the everyone that downloaded any packages uploaded by those users.

kjs33 anni fa

You're right. Sorry that I implied that was the only thing they asked for. But the point still stands that it's very common to be compelled to provide the equivalent of "tell me everything you know about this IP address", and our legal has said we (usually) legally have to provide it.

robryk3 anni fa

Note that GP complains not about the request for IP addresses of user X, but the request for IP addresses of anyone who downloaded content uploaded by user X.

rolph3 anni fa

[In March and April 2023, the Python Software Foundation (PSF) received three (3) subpoenas for PyPI user data. All three subpoenas were issued by the United States Department of Justice. The PSF was not provided with context on the legal circumstances surrounding these subpoenas. In total, user data related to five (5) PyPI usernames were requested.]

either a small group of users, or one user with multi aliases wrote a nastyapp ?

BrandoElFollito3 anni fa

I wonder why such organizations that hold critical data for the community at large do not use an international canary system.

Should one of the countries issue an order, the ones outside of its jurisdiction can openly disclose the information. Say if the US forces the US entity to not do something, the French one sees it and can warn all users.

detaro3 anni fa

"I've been ordered not to tell the details, but I know you will publish them, so I'm going to tell you the details" is not going to be taken as "obeyed the order" by law enforcement or courts.

BrandoElFollito3 anni fa

Sorry but I think I do not understand (English is not my first language). Who would be in trouble?

In case anything happens with the content of the service, the detail of the changes would be made clear by someone outside the jurisdiction.

A typical example is TrueCrypt that, one day, changed their page to say to use something else instead of their product.

If the code was shared between several countries, the others could simply publish that this and that was changes out of band, and that it means that the code is now positively unsafe.

detaro3 anni fa

We're not talking code changes here, but purely a data request. For code changes the trail is more obvious and it being noticed is easier to explain - but you are still in a situation that anything that can be read as you publishing it in an indirect way (e.g. by giving details to a connected organization which you know won't keep it private) will be taken as such and get you in trouble. I think it'd be quite hard construct that in a truly "safe" way.

BrandoElFollito3 anni fa

> We're not talking code changes here, but purely a data request

You are right. My comment was a bit offroad, I could have made that clearer (about how to deal with "data" (code, ...) in international context)

> I think it'd be quite hard construct that in a truly "safe" way.

For open source code it is easy - everyone sees teh chnages and why they've been promoted.

For closed source, having your source at a third party (or synchronized), build from only the identical code (between the two repositories), and enforce a two-eyes kind of code promotion (merge) will make it so that any change in the code that is not vetted by both parties (or multiple parties) will not get built.

I gave the example of Truecrypt that was unfortunately US-only and they had to revert to allusions in order to inform that it was tempered with.

snapcaster3 anni fa

Really weird, anyone have some inside gossip on what this is about?

Retr0id3 anni fa

The most optimistic reason would be that they were investigating a supply-chain attack, or something of that nature.

commandlinefan3 anni fa

This makes me wonder... it's entirely possible that the PyPI people would be enthusiastic about helping to track down offenders, and their users might agree, _if they knew what the offense was_. Instead, they're presented with a typically antagonistic demand for details, so they understandably get defensive on behalf of their users. I wonder if there's not a better, less heavy-handed way to get cooperation with law enforcement when the request is reasonable.

Retr0id3 anni fa

Personally I would rather not set a precedent of handing data over to government agencies just because they ask nicely, even if it seems like it's for a mutually agreeable good cause. That is, I would rather they go through these "formal" channels, even if it seems a bit heavy-handed.

Further, whatever they're investigating here is probably "important", for some definition of important, so they likely value the ability to lean on non-disclosure clauses etc.

bhouston3 anni fa

I wish it was that but those people would be smart enough to not use their real name when signing up - those doing supply chain attacks are often at least somewhat professional and take precautions.

I suspect it was more about going after software that was enabling piracy, those are often created by naive students who are not expecting the power of government to be unleashed on them.

nibbleshifter3 anni fa

> those doing supply chain attacks are often at least somewhat professional and take precautions.

Not really.

The vast majority of supply chain attacks in practice are idiots exploiting namespacing, bitflips, or typos on pypi/npm to drop miners or infostealers.

Yes, even the shit tier supply chain attacks count :)

guhcampos3 anni fa

Could be anything I guess, even legitimate reasons. T Think of the supply-chain attacks going on in the past few years. I'd say investigating these would be a legitimate reason for a subpoena.

jamesmurdza3 anni fa

It could be related to the large number of malicious or booby-trapped packages that have been uploaded recently to the index.

foota3 anni fa

My guess? A hacking case against someone for typosquatting or malicious packages or something.

[deleted]3 anni fa

paulpauper3 anni fa

maybe to do with web scrapping, auto-posting spam, etc.

https://www.developer-tech.com/news/2023/may/22/pypi-suspend...

yuvadam3 anni fa

Subpoenas are from March and April, predating the spamming of the past few weeks.

richbell3 anni fa

PyPI has had a pretty consistent spam problem for a while now.

paulpauper3 anni fa

it likely shows that it was an ongoing problem

dark-star3 anni fa

Strange that they didn't mention in 3b for how long they record IP addresses and logins. One has to assume that they keep this data indefinitely, even though they don't need it except for such subpoenas

phendrenad23 anni fa

An important aspect here is the fact that subpoenaes only share information one way. You are asked to provide information, and you get zero information about why. There is a simpler way to get information: Contact the person you want information from and make the case that they should give you the information. Using a subpoenae seems like something a government would do when they're doing something shady and don't want you to know about it.

mschuster913 anni fa

> PyPI retains records of all changes to projects on the index, and has since 2002-11-01 17:11:36 UTC.

Wow, I had zero idea how old Python is.

dragonwriter3 anni fa

Python was released in 1991 with 1.0 in 1994, PyPI is newer (the date listed there appears to be when it went online.)

jwilk3 anni fa

https://www.pypa.io/en/latest/history.html#before-2013 says PyPI was launched in 2003.

dragonwriter3 anni fa

Wikipedia agrees with the activity history PyPI themselves posted in TFA and indicates the index at its original home under python.org went live in November 2002, and PEP 301 was posted with present-tense descriptions of the URL where the index was available on 11/8/2002. But,

jwilk3 anni fa

AFAICS PEP 301 linked only to a demo site until April 2003:

https://github.com/python/peps/commit/c773b1b2ce0a2817

paradox2423 anni fa

When your platform is the source of malware used in supply chain attacks you gotta expect the Feds are going to come knocking eventually.

einpoklum3 anni fa

Here is what I consider the key section:

> The privacy of PyPI users is of utmost concern to PSF and the PyPI Administrators, and we are committed to protecting user data from disclosure whenever possible. In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data. I, as Director of Infrastructure of the Python Software Foundation, fulfilled the requests in consultation with PSF's counsel.

The first part of this section contradicts all of the rest. If user data privacy is of "utmost concern", then it is a concern above fulfilling legal obligations under US law. Plus, such supposed obligations must be staunchly fought before even considering whether or not to observe them. So, in fact, user data privacy is a minor concern for the Python Software Foundation, while swift prostration towards the US federal state is what's of utmost concern.

Of course, they almost admit it themselves. If we carefully read the second clause, they don't say "we're committed to protecting user data from disclosure", but - the "we're committed... when possible". So, they're saying that if they believe it isn't possible to protect, they have _no_ commitment to try their utmost to protect. i.e. when they see fit, user data protection is _not_ a concern at all. ... ok, ok, it is a public relations concern.

__MatrixMan__3 anni fa

Kudos to PyPI for handling this professionally.

That said, I think we should be working towards a world where they're unnecessary. As a middle party to what ought to be a developer/developer trust relationship, they're attack surface that threatens depender sometimes and dependee other times.

Going peer-to-peer will be less convenient, but worth the investment in the long run.

miga3 anni fa

Excellent example of how difficult it is to design privacy-friendly service.

Any information that can be subpoenae-ed can also be hacked away.

berkes3 anni fa

> Any information that can be subpoenae-ed

What if you operate from e.g. Iceland, Switzerland or even many EU states? Can a US Gov. agency still subpoena you?

ChrisMarshallNY3 anni fa

That's an excellent transparency report.

rendx3 anni fa

Way too much unnecessary data collected and stored as usual. But one of the best transparency reports ever. Thanks PyPI!

krick3 anni fa

I'd say nothing but nickname and the list of packages uploaded (which should be public in the first place) should've been stored anyway.

It immediately reminded me, that PyPI content is really trash as it is because of all the squatting and pointless unfinished toy-projects, and whatever they are logging clearly doesn't help, but I think that big problem for PyPI is one seemingly minor detail: lack of namespaces (as in packagist.org of pkg.go.dev). It is not a solution for all sorts of malicious behaviour, of course, but it really makes things much easier. It doesn't solve typosquatting and such, but, honestly, neither does the current system, obviously. And at least it allows to keep the actual package names semantic. And which one of countless "*/time" libraries you wanna get you just kinda have to decide separately, using the number of starts on the github as a reference and carefully copy-pastying the id to your requirements.txt

The same issue I have with Cargo. I mean, really, isn't it obvious that making users compete for better project names just makes everything shit?

WiSaGaN3 anni fa

How difficult is it for the US government to supply chain attack other countries that are using popular Python packages such as PyTorch given their power over these kind of global software infrastructure under US internal law? Are we able to assess it given there are gag orders as well?

ralmidani3 anni fa

Does a "subpoena" mean a judge was involved? The post says the subpoena was issued by the DOJ.

tptacek3 anni fa

It means a court is involved, but not a judge.

Edit

Even that is technically wrong; some DOJ subpoenas are apparently preauthorized by statute.

idlewords3 anni fa

There's a pretty extensive list of administrative subpoena authority here:

https://www.justice.gov/archive/olp/rpt_to_congress.htm

tl;dr: Everyone from the Appalachian Regional Commission on down can subpoena you without a court being involved. And of course Congress has inherent subpoena powers.

tptacek3 anni fa

Oh, this is so cool. Thank you!

This is a step towards answering my noodly question earlier in the thread: authorization for NDAs and "gag orders" in subpoenas appears to be controlled by (varying) statutes.

stjohnswarts3 anni fa

I don't have a problem with this as it was 5 particular users and not "give us all the data for for all your users". They didn't really have much of a choice. I don't think they would have had a choice in any of the 5 eyes countries or their allies

ur-whale3 anni fa

> We will not be releasing the usernames involved publicly or to the users themselves.

Emphasis on the last part: or to the users themselves.

In other words: unless they actually let the users involved in spite of claiming the opposite, the whole article is complete posturing.

burnished3 anni fa

What a weird take

asne113 anni fa

I keep seeing people trying to assure other readers that the recipients of these subpoenas have some recourse to appeal.

This is not the case if the subpoena is issued by the FISA court, otherwise known as "the court of no rejection."

dragonwriter3 anni fa

> I keep seeing people trying to assure other readers that the recipients of these subpoenas have some recourse to appeal.

Because they do, in regular federal courts.

> This is not the case if the subpoena is issued by the FISA court

The Foreign Intelligence Surveillance Court doesn’t (and courts in general don’t) issue subpoenas.

asne113 anni fa

> The Foreign Intelligence Surveillance Court doesn’t (and courts in general don’t) issue subpoenas.

This sounds like a matter of technicality, no? Whatever you call it, what they issue has the effect of a subpoena that you can neither appeal nor speak about.

My point is not that this is what's going on here, but that the right to appeal is not generally a given.

dragonwriter3 anni fa

> This sounds like a matter of technicality, no?

No.

> Whatever you call it, what they issue has the effect of a subpoena that you can neither appeal nor speak about.

No, it doesn’t. FISC doesn’t generally issue orders that are subpoena-like that would be presented to people outside of government. It provides surveillance orders to the FBI under which they conduct surveillance and, should someone later question if maybe that surveillance was a criminal violation of the Foreign Intelligence Surveillance Act—which would also be the FBI—the FBI can show the FBI the paper from the FISC that says its okay and then the FBI will not arrest the FBI for criminal violations of FISA.

Or if someone somehow finds out they were surveilled and files civil charges, the paper serves a similar function.

Where they do (and this only, IIRC, occured under law that has now expired) issue orders that apply to external parties, those can be challenged directly in the FISC, appealed from the FISC to The Foreign Intelligence Surveillance Court of Review, and, from there, to the US Supreme Court. There is at least one such appeal to FISC-R by Yahoo! that has been published in redacted form.

In no case does FISC issue orders that would go to an outside party who would then have no means or forum to challenge them.

morkalork3 anni fa

Is there a way to be only contactable in public? Like say a blind man standing in a town square, where any subpoena would have to be read out loud to them in earshot of anyone walking by? Is such a thing possible, digitally?

account423 anni fa

> PyPI retains records of all changes to projects on the index, and has since 2002-11-01 17:11:36 UTC.

> submitted_from | IP Address

> PyPI retains records of critical user events including account creation, emails sent, email address changes, logins, and login failures. See this list for the comprehensive set of events recorded.

> ip_address_string | IP Address

Retaining IP addresses for over a decade doesn't sound GDPR-compliant.

HeavyStorm3 anni fa

There were lots of specifics asks from the court. What if Pypi didn't had those data, like IP addresses? I don't remember ever recording those in a longstanding storage.

rektide3 anni fa

It'd be lovely to see better patterns emerge to aggregate and/or anonymize data.

Great respect for the response. Reevaluating data retention is a great move.

svaha17283 anni fa

If it takes subpoenas to get package management fixed in Python so be it. Can the Rust Crates.io team take over Python management as well?

tomjen33 anni fa

>We will not be releasing the usernames involved publicly or to the users themselves.

They point out that they are not subject to a gag order.

buildbot3 anni fa

Yeah this is interesting, because they could in absence of the gag order but choose not too. Unless it’s not a gag order but a specific don’t tell these users anything?

stjohnswarts3 anni fa

I doubt any investigators worth their salt would let the people they're investigating know that they are investigating them before they're ready to charge them.

stuaxo3 anni fa

The list of things they asked for seems to be basically "everything" - seems like a dragnet approach.

[deleted]3 anni fa

seventytwo3 anni fa

Any bets on this being part of a broader investigation into software supply-chain attacks?

gjmacd3 anni fa

I would point to Jim Jordan and all the other Republicans after January 6th who didn't honor a subpoena and toss them in the trash. Nobody in our government honors them, why should we in the private sector? What's going to happen, they going to raid offices and get a bunch of PC's and books?

kgbcia3 anni fa

Probably someone made a YouTube or Tor package so the state is after them.

scrum-treats3 anni fa

It would be great to see this for VS Code extensions as well.

tru3_power3 anni fa

Is this related to that Microsoft disclosure?

fijiaarone3 anni fa

It’s ok, this government is perfect.

Liberonostrud3 anni fa

How can you pronounce this word?

hajimuz3 anni fa

Dude I thought it’s Chinese Gov. Hey, America!!!

diligence_3 anni fa

firstlink3 anni fa

> associated with the subpoenas received in March and April 2023.

Oddly specific wording there. It would seem they have received additional subpoenas outside that timeframe which do have gag orders, and someone slipped up and failed to put the gag orders in these particular subpoenas.

Seems like the DOJ may be doing some long-term fishing for, what, software developers? First the DOJ came for the conservatives, and I said, "go get 'em!" because I wasn't a conservative; next the DOJ came for ____?

bratbag3 anni fa

It's interesting how you manage to leap from what is probably a supply chain attack investigation straight into a pErSeCuTeD CoNsErVaTeS conspiracy.

burnished3 anni fa

Step one: have position and power as part of a dominant group

Step two: style yourself as an oppressed minority

Step three: defend any action, decision, or position as a persecuted martyr

metiscus3 anni fa

Across the ages, government has applied a disproportionate level of scrutiny to groups and people perceived as dissidents, minorities, and anyone else who could potentially be conceived as a threat to institutional power regardless of the magnitude of the threat or if that threat is true or false. Historically this is a bipartisan issue, for decades the FBI vigorously attacked anti-war groups, black civil rights groups, and various left wing groups via COINTELPRO. I guess to summarize, the way I think of it is that the government is coming for anyone they see as a potential threat and it doesn't matter what the politics of that group are.

avgcorrection3 anni fa

> The privacy of PyPI users is of utmost concern to PSF and the PyPI Administrators, and we are committed to protecting user data from disclosure whenever possible.

Don’t lead with this.

> In this case, however, PSF determined with the advice of counsel that our only course of action was to provide the requested data.

If you’re going to say this.

I’m not judging their decision. Maybe not going to prison is a greater concern to them. It’s fine to just say that you thought it was best to comply because [lawyer reasons that you don’t have to disclose to anyone]/counsel.

EDIT: Or say “there are bad people out there and we trust the DOJ”. Whatever.

paulgb3 anni fa

It's a completely reasonable reading of their message to assume that the “possible” in “whenever possible” roughly means “legal”. I don't think any reasonable reading of it means to imply that they are willing to violate federal law.

avgcorrection3 anni fa

Fair point.

Mystery-Machine3 anni fa

Oke way to protect user data is to NOT ask/collect data in the first place. What's the need of person's full name and address for? Maybe I'm missing the point, but I see zero reasons to have this data in the first place.

masto3 anni fa

If you read the whole thing, it's pretty clear they don't have the person's full name and address, and thus did not provide it. They do mention that it will be needed for organizations that sign up for billing when that feature becomes available.

Other than possibly IP addresses, it seems like the only information they had available to disclose was close to the bare minimum needed to operate the service.

dubbel3 anni fa

You are probably reading what data the DoJ requested. Further down in the blogpost (in the "Details" section) they state that they don't have a lot of the data requested and exactly what kind of data they could and did provide. Addresses are not requested by PyPI.

junon3 anni fa

And they state very clearly they don't have this information. In fact, PyPi seems to retain a very reasonable set of information, strictly related to the service itself. I found this disclosure to be entirely refreshing.

[deleted]3 anni fa

avgcorrection3 anni fa

That’s the best principle to follow. Agreed.

HelloNurse3 anni fa

sudo give us user data

tptacek3 anni fa

Lighten up. Nobody's going to federal court to stop the DOJ from investigating botnets, carding rings, and ransomware scams, which is what these things are usually about. Nobody's mental model of PyPI was that they had Signal's priorities.

avgcorrection3 anni fa

Then all the less reason to roll out the “of utmost importance” boilerplate. So what’s your point?

Also I don’t see how being light-hearted has anything to do with this submission, Thomas.

davidguetta3 anni fa

Its just they have no choice. And when they do the choose their "utmost priority". Its not that complicated

[deleted]3 anni fa

mrguyorama3 anni fa

Then they shouldn't say protecting their users are their top priority, because they have shown it is not. That's called lying. A correct statement would have been "we will comply with lawful LEO requests"

junon3 anni fa

How have they shown it's not, exactly? Really curious what you think they could have done better aside from blatantly going against laws in their jurisdiction.

adamckay3 anni fa

There's a difference between abiding by lawful court orders that have gone through judicial process and a friend in a police department calling in a favour.

x0x03 anni fa

Helping convict scammers, typo-squatters injecting malicious code, etc is protecting their users. Just not the (likely) bad actors that are the subject of the subpoenas.

hgsgm3 anni fa

The fact remains, that unless you are willing to break the law, obeying the law is your top priority.

ewdurbin3 anni fa

This assumes that all of this is binary, when in reality it’s a complex system that takes time and effort to modify in a meaningful and responsible way.

junon3 anni fa

If you're so inclined, you're welcome to make an anarcho-oriented package management system yourself. PyPi has never claimed to be one, though.

duxup3 anni fa

I don’t see anything conflicting in what they said.

They can feel that way, and comply.

avgcorrection3 anni fa

Yeah. I was probably being a little too boilerplate (what looked like) -intolerant. ;)

casey23 anni fa

How come when PyPI hosts unwanted malware they get subpoenaed but when Apple or Microsoft or anyone else with a big team of lawyers distributes auto-installing "updates" designed to harm/scam users the DOJ is silent?

throw_a_grenade3 anni fa

So just yesterday PyPI announced they're retiring cryptographic signatures: https://news.ycombinator.com/item?id=36044543.

It's hard to keep those things separated. I would very much like the code submitted to PyPI be protected end-to-end by cryptographic signatures, when PyPI has either no resources, or no spine to stand up to a government. Any signatures, even PGP, which should be in place until someone provides better mechanism.