Julian Assange and WikiLeaks

May 31, 2010 5:28 PM

No Secrets: Julian Assange’s mission for total transparency. A New Yorker profile of WikiLeaks founder Julian Assange and his "media insurgency."
posted by homunculus (43 comments total)

Excellent, Instapapered for later reading. There was a piece on him in the SMH just recently too.
posted by unliteral at 6:12 PM on May 31, 2010 [1 favorite]

Cyberpunk.
posted by delmoi at 6:38 PM on May 31, 2010 [1 favorite]

His appearance on Colbert was pretty good.
posted by JHarris at 6:48 PM on May 31, 2010

Julian Assange on the Colbert Report.
posted by homunculus at 6:56 PM on May 31, 2010 [2 favorites]

Aaah, I can tell reading this, now, that the description of the Reuters attack video is going to be a blood pressure raiser for me.
posted by JHarris at 7:04 PM on May 31, 2010

Cyberpunk.

Seriously. Brilliant misfit computer hacker of ethnically ambiguous background, leads a clandestine international network shrouded in secrecy, devoted to uncovering sensitive information. All that's missing are the cybernetic implants, but give it a few years.
posted by StrikeTheViol at 7:42 PM on May 31, 2010 [13 favorites]

Does anyone else think the Reuters attack video is going to be for WikiLeaks what the bin Laden/Michael Moore faceplant was for Snopes? I think they've imperiled their straight-shooter bonafides with their presentation of that material.
posted by NortonDC at 8:38 PM on May 31, 2010 [2 favorites]

I love the end:

The Web site's strengths--its near-total imperviousness to lawsuits and government harassment--make it an instrument for good in societies where the laws are unjust. But, unlike authoritarian regimes, democratic governments hold secrets largely because citizens agree that they should, in order to protect legitimate policy. In liberal societies, the site's strengths are its weaknesses. Lawsuits, if they are fair, are a form of deterrence against abuse. Soon enough, Assange must confront the paradox of his creation: the thing that he seems to detest most--power without accountability--is encoded in the site's DNA, and will only become more pronounced as WikiLeaks evolves into a real institution.

How stupid can you be?

First, there is zero relation between WL's presence in a liberal or illiberal society and its being, in virtue of being extremely secure, hard for affected entities to combat. If, indeed, there is a paradox in WikiLeaks, it does not manifest itself only in liberal societies (nor is this a weakness). Second, it is not clear that what lawsuits deter is abuse per se, even if we grant that they are fair, which would be rather a lot to grant. Finally and most astoundingly, the idea that democratic governments, in the first place, actually do keep secrets (tout court) because citizens agree that they should is risible, as is the conclusion we are presumably meant to draw from the claim that such governments should be able to persist in keeping such secrets. As to the first, plainly it is not the case that citizens agree regarding each secret that it should be kept secret, since for the most part the secrets are secret from the citizens themselves. It may be that citizens for the most part do agree that, in general, the government should be able to keep secrets in the pursuit of legitimate policy, but even there we might hope that for the most part if your policy's so legitimate you don't need to keep many secrets in order to pursue it (entanglements with other governments is an obvious case where this is not true). But what has that got to do with keeping secrets generally? We are (or, prior to now, so I would have thought) aware of illegitimate policies and illegitimate means to carry out policies not in themselves legitimate even this history of these United States.

Basically the contrast is: you have "societies where laws are unjust", and then "unlike in authoritarian regimes", as if authoritarian regimes just are (a subset of) those where laws are unjust, and in democratic regimes laws just are just. What?
posted by kenko at 8:47 PM on May 31, 2010 [9 favorites]

Check out the book Secrets: A Memoir of Vietnam and the Pentagon Papers by Daniel Ellsberg... really good read.
posted by HLD at 10:06 PM on May 31, 2010

"With the release of “Collateral Murder,” WikiLeaks received more than two hundred thousand dollars in donations, and on April 7th Assange wrote on Twitter, “New funding model for journalism: try doing it for a change."

Very good, very good.
posted by coolxcool=rad at 10:59 PM on May 31, 2010 [5 favorites]

Does anyone else think the Reuters attack video is going to be for WikiLeaks what the bin Laden/Michael Moore faceplant was for Snopes? I think they've imperiled their straight-shooter bonafides with their presentation of that material.

Well, I'm not aware of what this was for Snopes, since I guess I missed that little mishap and have still been relying on Snopes for my debunking fix. But I think this article makes it clear (as other interviews with Assange have recently) that Wikileaks is about more than just getting the information out there and letting people decide for themselves. Wikileaks did release the full video along with the edited "Collateral Murder" one. The point is made that even journalists are often uninterested in the information they provide unless Wikileaks promotes it and does the journalists' work for them.
posted by Jimbob at 12:00 AM on June 1, 2010 [2 favorites]

My biggest problem with Assange: holding the site (and information) hostage earlier this year/late last year until he received $600k for the "yearly operating budget."
posted by autoclavicle at 1:27 AM on June 1, 2010

New funding model for journalism: try doing it for a change.

Or, how about… Google News TV
posted by Civil_Disobedient at 2:45 AM on June 1, 2010

That pissed me off too, autoclavicle, and my worst fear was that Wikileaks was going to stay that way - just releasing the occasional Big Story rather than really being a wiki. Thankfully they came back, and when you look at how they run the operation, the budget seems necessary. They don't just have to pay for web hosting.
posted by Jimbob at 3:33 AM on June 1, 2010

Wikileaks did release the full video along with the edited "Collateral Murder" one.

Wikileaks is not doing themselves a favor by muddling the hosting brand with the editorializing brand. The former should be relatively apolitical, meaning that they host any info worth exposing (I know there is editorializing by omission here, but they should try for an appearance of impartiality), and the later should take credit for "Collateral Murder."

I'm also loving that cyber punk angle.

Also, props to the people who take the responsibility to keep his body and soul together--he has the personality of an ascetic monk.
posted by wires at 7:47 AM on June 1, 2010

wires - I agree but I think this is a ploy to get Wiki Links (the technology and platform) to get plumed by the media that has to this point been too timid in using what they have published unbiasedly.

I don't think he really WANTS to be political, he just wants media outlets to use this trough of leak material that no-one is searching through.

If you can't lead a horse to water, then... I cannot finish the analogy but you get the point.
posted by DetonatedManiac at 3:34 PM on June 1, 2010

AHH, I got the analogy... It's like a fuel siphon, you don't want to drink gasoline, but you do need to suck enough material through the hose to get the material in Wiki Links to become a natural part of the news life cycle.
posted by DetonatedManiac at 3:36 PM on June 1, 2010

Yeah, I get the impression that Assange doesn't give a shit about the whole left/right thing. If you look at the diversity of material they publish, it really seems more about the little guy versus the big guy. I can respect that, as long as it doesn't devolve into pure conspiracy theory.
posted by Jimbob at 5:26 PM on June 1, 2010

Pilfering outgoing traffic as a Tor exit node is a pretty crappy thing to do.
posted by cloax at 5:55 PM on June 1, 2010

Pilfering outgoing traffic as a Tor exit node is a pretty crappy thing to do.
Having a supposed anonymising network that means this can happen is the pretty crappy bit. It's as if https was encrypted only as far as your ISP.
posted by bonaldi at 6:20 PM on June 1, 2010

Wow! It's insane that the book Underground (mentioned in the SMH article) goes for $145.03 for a used paperback. Luckily, Suelette Dreyfus has made the text freely available on Project Gutenberg.

"Why would an author give away an unlimited number of copies of her book for free? That's a good question. When 'Underground''s researcher, Julian Assange, first suggested releasing an electronic version of the book on the Net for free, I had to stop and think about just that question.

I'd spent nearly three years researching, writing and editing the nearly 500 pages of 'Underground'. Julian had worked thousands of hours doing painstaking research; discovering and cultivating sources, digging with great resourcefulness into obscure databases and legal papers, not to mention providing valuable editorial advice.

So why would I give away this carefully ripened fruit for free?

Because part of the joy of creating a piece of art is in knowing that many people can - and are - enjoying it. Particularly people who can't otherwise afford to pay $11 USD for a book. People such as cash strapped hackers. This book is about them, their lives and obsessions. It rubs clear a small circle in the frosted glass so the reader can peer into that hazy world. 'Underground' belongs on the Net, in their ephemeral landscape."

Thank you, Suelette and Julian.
posted by unliteral at 6:28 PM on June 1, 2010 [2 favorites]

Pilfering outgoing traffic as a Tor exit node is a pretty crappy thing to do.\

Well, that's how Tor works, and to be honest, when I use Tor I assume that's exactly what the exit nodes are doing, because beyond pure altruism I can't think of any other reason someone would want to run an exit node.
posted by Jimbob at 7:03 PM on June 1, 2010

A few remarks on this.

First of all: even acknowledging the few issues I have with it (the most troublesome of which were addressed above by kenko) the New Yorker piece is excellent and well worth reading carefully and in its entirety. I would highly recommend doing so before you continue reading and forming opinions on and around this, if you haven't already. Here's the easier-reading single page version.

Second: the issue about sniffing traffic on the Tor exit node is essentially a misunderstanding caused by a lack of clarity in the original article, as should become clear to anyone taking the time to investigate the issue. A mighty tempest in a teapot is gathering over this as we speak, due mainly to Wired Threat Level's sensationalist squawking and Slashdot's sloppy, out of context blurb. It would be great if people could maybe slow down and examine this rationally before rushing to echo that kind of hype.

Before you get upset about how "crappy" this supposedly is, make sure you understand how Tor works and what it does and does not promise to do for you, which the project's maintainers fall over themselves to try and get across to everyone precisely in order to avoid such misunderstandings. More specifically to this particular incident, please also check out the Tor Project's own statement and Ethan Zuckerman's elucidation of the issue from a technical point of view. Previous research has focused on exactly this type of scenario to highlight the dangers of using Tor improperly. Additional relevant discussion is currently happening online, and it should be easy to locate if you are so inclined.

There are plenty of important and complex issues to discuss around WikiLeaks and the impact it's having on journalism and the transparency of governments. Let's make sure we have those conversations with clear understanding of the facts and technical realities at play. Thanks!
posted by mindwarp at 10:29 PM on June 1, 2010 [3 favorites]

Good information, thanks mindwarp.
posted by unliteral at 4:02 AM on June 2, 2010

Let's make sure we have those conversations with clear understanding of the facts and technical realities at play. Thanks!

None of your links contradict the "facts" as such, not even the Tor one. The Tor defence is that they never promised end-to-end encryption, and that of course the exit node can read what's passing through unless it's encrypted.

But that's not what the fuss is about; the fuss is about the risks of using Tor which, despite their protestations, aren't nearly visible enough on their pages. "Research" isn't publicity, either.

If you're the non-technical journalist/parent of young children they're targeting their copy at, you could be forgiven for misunderstanding the danger of an "unencrypted exit node" when they're promising to make you "secure and anonymous on the internet". You could especially be forgiven for not fully understanding the "warnings" page.

Also: We'll have the conversations we'd like to, on the topics we'd like to. Don't presume we don't understand the technicalities because we don't share your opinion of them. Thanks!
posted by bonaldi at 5:22 AM on June 2, 2010

bonaldi: "We'll have the conversations we'd like to, on the topics we'd like to. Don't presume we don't understand the technicalities because we don't share your opinion of them. Thanks!"

This really comes across as more snappish than seems warranted. I'm sorry you've interpreted me as trying to dictate which conversations and topics are allowed; this was not at all my intention. The intended meaning was instead: have the conversations you want on any of the many relevant topics but, whatever those conversations may be, make sure a clear understanding of the technologies involved is part of them. This seems only reasonable, not to mention fair. Nowhere did I "presume" anything, but merely tried to contribute useful information and call attention to it.

Now to the issue at hand:

"Having a supposed anonymising network that means this can happen is the pretty crappy bit."
[...]
"The Tor defence is that they never promised end-to-end encryption, and that of course the exit node can read what's passing through unless it's encrypted. But that's not what the fuss is about; the fuss is about the risks of using Tor which, despite their protestations, aren't nearly visible enough on their pages."

So, wait... the fuss is not about Tor not magically encrypting the Internet, but simultaneously the crappy bit is having an anonymizing network where this can happen? It sounds like you're saying: it's not that Tor promised this wouldn't happen, but the very existence of Tor somehow implies it should never happen, and the fact that they put big red boxes on their homepage trying to warn people that it easily can happen doesn't matter at all.

What is the fuss about, exactly? The Tor website not having even bigger and clearer warnings? Perhaps you should recommend some design improvements to them, if that's the problem. Suppose you took some medicine after seeing a dire warning on the label about how it might be dangerous when taken improperly, but failed to understand the warning. Is the medicine "crappy" because of this, even if it's excellent when used as intended? You call Tor a "supposed" anonymizing network. Is the effectiveness of Tor as a whole, all the time, downgraded to "supposed" status because somebody didn't know how to use it on specific occasions?

How does a need for greater education on staying safe online translate into crappiness on the part of Tor when Tor, regardless of how successful you think they are at it, engages in efforts to help fill that need? What exactly is the improvement you're asking for?
posted by mindwarp at 10:22 AM on June 2, 2010

whatever those conversations may be, make sure a clear understanding of the technologies involved is part of them

Perhaps you could show where there were misunderstandings of the technologies involved, then? Because otherwise this is just patronising and fully deserving of snappiness.

How does a need for greater education on staying safe online translate into crappiness on the part of Tor when Tor, regardless of how successful you think they are at it, engages in efforts to help fill that need? What exactly is the improvement you're asking for?

Tor promises a "secure and anonymous" internet, in very clear terms. It warns that it actually isn't secure or anonymous in very technical terms.

People, unsurprisingly, take the first part to mean that the nefarious won't be eavesdropping on them, as shown by the number of documents being sent across it in plaintext that shouldn't have been.

Now, this Wikileaks story is exposing exactly how large the issue is. Cloax, rightly, says that sniffing as a Tor exit node is a crappy thing to do. Which it is, but if it can be done it will. So it's also pretty crappy that the service doesn't provide the security it promises in big type. If a massive amount of your users have a dangerous misapprehension like this, you've failed.

Saying "but we said it wasn't secure in baffling small type! What's the problem?" is no defence.

Ultimately, the problem is that the need for actual security is obvious and known: it's so obvious that the front page says in a sneering way that they won't "magically" encrypt your connection, as if expecting something that promises security to keep you secure is childishly foolish.

Then there's a warning further down, which links to a screed of computerese, point four of which says that there's virtually no security of the kind people care about -- the don't-let-other-people-read-this kind. Saying "downloader beware" and stopping there isn't enough.

Tor is anonymizing if you don't use it to send any personally identifying information. That's great. But that's only a very narrow kind of security, and not something that should be marketed to parents trying to protect their children online etc.
posted by bonaldi at 11:35 AM on June 2, 2010

Wikileaks denies Tor hacker eavesdropping gave site its start
posted by homunculus at 11:40 AM on June 2, 2010

bonaldi: "Perhaps you could show where there were misunderstandings of the technologies involved, then? Because otherwise this is just patronising and fully deserving of snappiness."

I didn't say that there were any specific misunderstandings or on whose part, did I? What I did say was: Look, if you are tempted to get upset and think that this is Tor's failing, make sure you take into account what Tor is, what it isn't, and what claims it makes and doesn't make. That way, if somebody (like you) wants to call Tor crappy because people are using it wrong, they'll need to at least acknowledge that first of all Tor isn't meant to provide that kind of security, therefore this is a case of user misconception, and secondarily that Tor makes at least some effort to prevent that very misconception.

Your original one-liner beating up on Tor did not bother to mention either of those facts, thereby contributing to the hype and misunderstandings I was talking about. That was my only concern and the reason I posted the links, so that people reading this and unfamiliar with the finer points of Tor may benefit from the context they provide. The last thing on my mind was to imply that you misunderstood the technicalities, since I don't know you or your level of understanding, and certainly I cannot form an idea of it from what basically amounted to "blah blah supposed to be anonymous blah blah Tor crappy".

"Tor promises a "secure and anonymous" internet, in very clear terms. It warns that it actually isn't secure or anonymous in very technical terms."

Let's take a look at the Tor homepage. I don't see any big type "promise" of an easily secure and anonymous internet anywhere on it. What is there is a short paragraph introducing the tool and a clear warning that one should understand how Tor works before expecting any security from it. The paragraph is titled "anonymity online", which says nothing whatsoever about encryption. It also says nothing about preventing eavesdropping. That's because anonymity is not encryption, which is what you need to avoid being snooped on. Beyond having never claimed to protect against snooping and making reasonable efforts to educate, Tor can hardly be held responsible for failing to preempt conflation of these completely separate concepts in the mind of every potential user.

While more education and more clarity are always good things, and I'm sure Tor will continue to improve its efforts in that regard, you're attempting to make it sound like Tor has a big colorful splash page saying "No worries! This is all you need to be secure!" while in fact they immediately attempt to disabuse the downloader of just such a notion. This is not a fine print issue, which implies deceptive advertising. This is an issue of the warning being written in normal type and people failing to heed it. You can claim that the warning should be bigger or stronger, and like I said it's always good to be as explicit as possible. But that's more like the reason why it's a good thing to make the warnings on tobacco packaging more direct and harder to ignore, and much less like the "Tor is misleading me" situation you seem to want to represent.

"People, unsurprisingly, take the first part to mean that the nefarious won't be eavesdropping on them, as shown by the number of documents being sent across it in plaintext that shouldn't have been."

This is actually not nearly as clearly shown as you seem to be claiming. The original story mentions something about "Chinese hackers" using Tor to gain access to and distribute sensitive documents. Perhaps the Chinese hackers did not actually care about somebody being aware that the documents were in transit and what they were, but merely cared about making it difficult for eavesdroppers to determine the identity of the leakers and distributors of those documents. Again, an issue of anonymity being distinct and separate from encryption.

Tons of people use Tor without encrypting their traffic because it is not always necessary to do so, even if you're leaking sensitive documents. In no way does that one paragraph from the New Yorker article imply that there is a "large issue" with "a massive amount of [Tor's] users" having "a dangerous misapprehension", as you rush to conclude. I suspect that, since this Chinese hackers bit has attracted so much attention, upcoming investigation and clarification will do a great deal to shed light on exactly what happened and what large issues, if any, it does imply.

"Ultimately, the problem is that the need for actual security is obvious and known: it's so obvious that the front page says in a sneering way that they won't "magically" encrypt your connection, as if expecting something that promises security to keep you secure is childishly foolish."

I think you're seeing sneering where there is none. Seems to me that if you're trying to prevent somebody from getting a mistaken idea like "Wow, this Tor thing automatically resolves all my security problems at one fell swoop! Awesome, let's go do something that requires strong anonymity and encryption without bothering to read any further!" it makes a lot sense to point out that there is no magic involved, and that one does need to read and understand further.

"Tor is anonymizing if you don't use it to send any personally identifying information. That's great. But that's only a very narrow kind of security, and not something that should be marketed to parents trying to protect their children online etc."

You keep repeating this parents and children thing as if that was one of Tor's main intended demographics. I doubt there are many parents using Tor to protect their kids so far, even just due to the network being so slow, and public statements by the Tor Project almost always focus on the needs of people in environments that restrict free speech. Implying that Tor is something that's actively "marketed to parents" is misleading.

The more important point though, and part of why it's so important to bring the technical realities into this type of discussion, is that nothing, except end-to-end encryption anonymizes you if you use it to to send identifying information. That is why the Tor page, in the only place where it does encourage parents wanting to protect their children to use the software, clearly says "You've told your kids they shouldn't share personally identifying information online, but they may be sharing their location simply by not concealing their IP address" [emphasis mine]. This implies directly that Tor protects against the latter problem and not the former. Again, this has nothing to do with the way Tor operates, as your original comment likening Tor to a kind of broken https suggested, but with how it is used.

[As a final aside, I just want to note that Tor isn't sold (as the choice of the word "marketed" might make some people think) but rather distributed for free.]
posted by mindwarp at 1:32 PM on June 2, 2010

Look, if you are tempted to get upset and think that this is Tor's failing, make sure you take into account what Tor is, what it isn't, and what claims it makes and doesn't make.

This is essentially what all of the above boils down to: "If you're tempted to get upset and think this is Tor's failing, well don't, because it isn't and you're wrong. Tor doesn't break anonymity, users break anonymity"

I know how those types of discussions go, and this one's going this way too. So I'll leave it well alone.
posted by bonaldi at 3:03 PM on June 2, 2010

bonaldi: "This is essentially what all of the above boils down to: "If you're tempted to get upset and think this is Tor's failing, well don't, because it isn't and you're wrong. Tor doesn't break anonymity, users break anonymity""

Actually, so far this discussion is going the way of you being unable to show any substantial responsibility on Tor's part, then vaguely hinting that there's two sides of it and it's all a matter of opinion so you'll leave it alone instead of addressing any of the other points made. Which are various, in spite of what you claim above.

If you post lazy one-liners about how something sucks because it was used wrong, don't be surprised when somebody points out the obvious issues with that statement and complains that you're contributing to completely unhelpful hype and misinformation.
posted by mindwarp at 3:23 PM on June 2, 2010

then vaguely hinting that there's two sides of it and it's all a matter of opinion
What? Not at all. I'm strongly implying that you're like a pro-gun nut. I don't believe this is all a matter of opinion, merely that our opinions will never meet. They certainly won't if you keep straw-manning mine.

Tor isn't crappy because it was "used wrong", it's crappy because it's not nearly good enough to do the job people need, not to mention the job people assume it's for to such a degree that its own pages have to be plastered in "this isn't as good as you think, it doesn't do what you think, it really just does this.|

Don't understand the difference? Serves you right for expecting magic.
posted by bonaldi at 4:50 PM on June 2, 2010

bonaldi: "Tor isn't crappy because it was "used wrong", it's crappy because it's not nearly good enough to do the job people need, not to mention the job people assume it's for to such a degree that its own pages have to be plastered in "this isn't as good as you think, it doesn't do what you think, it really just does this."

Don't understand the difference? Serves you right for expecting magic."

That doesn't qualify as not being "nearly good enough to do the job people need". Tor is plenty good enough to do the job people need, when used properly. That's hardly grounds to say it's crappy by any reasonable standard of logic.

If anything, what you're talking about might be grounds to say that Tor needs to be even clearer in its warnings because there is a tendency towards misunderstanding Tor in some users, and I could even agree with that. Compare this with your implication that the argument is somehow a "serves you right" type of thing, which couldn't be farther from my feelings on the matter.

You're not acknowledging that your criticism should be rightly directed to Tor's documentation, not to the tool, because what you really want to do is say that Tor sucks while using something that was never meant to be part of Tor as your main evidence for that claim. That's one of the ways in which this is not all a matter of opinion, as you correctly concede. I'm only asking that you avoid muddying the relevant facts, not demanding that our opinions meet, and don't resemble anything remotely like your idealized "pro-gun nut" for doing that. Talk about straw men.
posted by mindwarp at 5:17 PM on June 2, 2010

Tor isn't crappy because it was "used wrong", it's crappy because it's not nearly good enough to do the job people need, not to mention the job people assume it's for to such a degree that its own pages have to be plastered in "this isn't as good as you think, it doesn't do what you think, it really just does this.

It's as good as it possibly can be though. There's no way to encrypt the traffic from a web server that doesn't support encryption. That's what SSL is for. Tor makes it clear that all it does is (a) prevent people on your end seeing what data you're accessing and (b) prevent the end server from accurately determining who is accessing it. Going beyond this is impossible. You can't impose encryption when only one half of the transaction is capable of initiating it. The Tor site, as well as the various off-shoots that offer "portable" Tor/Browser combination packages do as much as they can to make this clear. If people expect magic, then they deserve what they get. If you go as far as Tor has gone to give people all these warnings, and explain using nice diagrams what it's doing, then you can't help what people continue to assume. What made people assume this in the first place? Not the Tor people. It's like blaming Google for allowing people to guess your Gmail password when Google tells you to choose a strong password.

Do you have any better ideas for an anonymity network?
posted by Jimbob at 5:30 PM on June 2, 2010

Tor is plenty good enough to do the job people need, when used properly.
Not so, since the job people need is secure and anonymous internet, plainly what the people whose data was (not) intercepted by WikiLeaks were hoping to use it for. Tor might be plenty good enough to do the job Tor can do, but that's tautological and trite.

I'm only asking that you avoid muddying the relevant facts
Again, what facts are being muddied here? You've been so quick and desperate to leap to Tor's defence on this point, but I simply don't see where it's being traduced by hype. I certainly didn't say Tor failed at the job, I said that the entire setup was crappy.

This is almost exactly equivalent to me saying "Linux is crappy because you can't run Photoshop natively, the font smoothing's hideous and WiFi support is a nightmare".

To which you reply: "Don't muddy the facts! Linux never claimed to be able to run Photoshop; the font smoothing setup is well documented, and do you expect any wifi card to magically work?".

Tor isn't crappy because it fails within its parameters, it's crappy because of those parameters.
posted by bonaldi at 5:34 PM on June 2, 2010

Tor isn't crappy because it fails within its parameters, it's crappy because of those parameters.

So you're saying Tor is crappy because every web server out there doesn't use HTTPS for every transaction and TCP/IP doesn't include any kind of native anonymous routing?
posted by Jimbob at 5:40 PM on June 2, 2010

Okay, I guess it's fair to interpret your comment as "Tor is crappy, but it's not their fault" but the way you've carried on the argument up to this point does make it sound you're blaming Tor for the limitations.
posted by Jimbob at 5:42 PM on June 2, 2010

So what's the solution? You think Tor should just shut down and go away, since true anonymity is impossible and there's no point offering any mechanism that only goes part way?
posted by Jimbob at 5:43 PM on June 2, 2010

If you go as far as Tor has gone to give people all these warnings, and explain using nice diagrams what it's doing

This is the documentation thing, and I think it's a separate issue. I don't think the site's nearly as clear as you and mindwarp seem to think: the parts that are in plain English say things like

"Tor provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy."

while the warnings are along the lines of

Tor does not provide protection against end-to-end timing attacks: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit.

Do you have any better ideas for an anonymity network?
Well, like you say, Tor goes just about as far as it can, which is nowhere near to solving the actual problem.

I think of it as a step or two above LifeLock, where the question isn't "do you have any better ideas for a system to guarantee your good name?" it's "this will never work beyond a narrow range of methods, what is a better solution to the actual problem?". Same question with Tor.

The answer to that, of course, I don't have. But it certainly might involve something Tor-like or distributed at some stage, combined with non-optional encryption of messages. Will it work for any random browsing? Not really. Would it get your message privately, tracelessly and securely to their recipient? Yup.
posted by bonaldi at 5:46 PM on June 2, 2010

Tor does not provide protection against end-to-end timing attacks: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit.

Well that warning is pretty lame, since that attack is purely theoretical. But, above the fold, in the main text on the Tor front page:

Tor doesn't magically encrypt all of your Internet activities, though. You should understand what Tor does and does not do for you.

And if you click on the link associated with that quote, you're taken to the following warning:

Tor anonymizes the origin of your traffic, and it encrypts everything between you and the Tor network and everything inside the Tor network, but it can't encrypt your traffic between the Tor network and its final destination. If you are communicating sensitive information, you should use as much care as you would on the normal scary Internet — use HTTPS or other end-to-end encryption and authentication.

And from the Wikipedia page:

Tor cannot and does not attempt to protect against monitoring of traffic at the boundaries of the Tor network, i.e., the traffic entering and exiting the network.[7] The United States government, for example, has the capability to monitor any broadband Internet traffic using devices mandated by the Communications Assistance for Law Enforcement Act (CALEA) and can therefore legally monitor either end of a Tor connection if it originates or terminates in the US.

They're not attempting to hide this information.
posted by Jimbob at 6:07 PM on June 2, 2010

bonaldi: "Not so, since the job people need is secure and anonymous internet, plainly what the people whose data was (not) intercepted by WikiLeaks were hoping to use it for. Tor might be plenty good enough to do the job Tor can do, but that's tautological and trite."

First of all, as I've already pointed out above in the comment you so conveniently ignored, it is not at all "plain" that that's what happened with those people. The New Yorker paragraph in itself certainly doesn't support that. Other various and sundry bits of misreporting concerning that paragraph are also currently being discussed online, and no doubt they will hit the news at some later time.

Second, nobody is making a tautological argument. I mean exactly what I say: Tor is good enough to do the job people hope to use it for. Nothing prevents anyone from using end-to-end encryption over Tor, which yields a connection that is both encrypted and anonymous. That's your definition of "the job people need" from Tor. Ergo, and I repeat, what you're talking about in no way qualifies as Tor not being good enough to do the job people need.

"Again, what facts are being muddied here? You've been so quick and desperate to leap to Tor's defence on this point, but I simply don't see where it's being traduced by hype. I certainly didn't say Tor failed at the job, I said that the entire setup was crappy."

Maybe the problem is that you don't see the facts yet? If you claim that Tor is unable to deliver on the promise it makes to its users, that's simply technically wrong, as shown above. The muddying comes in when you take a theoretical Tor user's misuse of Tor, add to it some highly dubious perceived failing in Tor's explanation of itself, and proceed to claim that it all adds up to Tor being crappy and failing to do what users need it for.

"Tor isn't crappy because it fails within its parameters, it's crappy because of those parameters."

No. The parameters are as good as they can possibly be, as Jimbob pointed out, and Tor meets the standard set by them. That's not "crappy", period.

Linux, on the other hand, could be dismissed as "crappy" depending on your needs for an operating system, because two of the three issues you cited are not at all part of its parameters. There's nothing forcing Linux to have terrible font smoothing or preventing it from having a better wireless connection wizard; it could do better at that. Running anything natively is impossible if that code isn't ported to a platform, though Linux does come as close as possible via a compatibility layer.

But you can still take Linux, compare it to Windows or OS X, point to some set of parameters that you think operating systems in general should be able to fulfill, and then claim that Linux falls short. You cannot do the same with Tor the way you're attempting, which must be why you try to conflate people's mistaken assumptions about what Tor is with some failing in Tor's stated functionality which doesn't exist.
posted by mindwarp at 6:13 PM on June 2, 2010

They're not attempting to hide this information.
I don't think they are, it's just telling that the "sales" pitch is in nice clear English, and the drawbacks are in technicalese. I'd argue that to the common user there's a difference between "you're at risk for one small leg of the journey as shown in this diagram" and the unsaid "anyone who chooses to run a certain type of server can sit and read everything that passes out of it".

It is not at all "plain" that that's what happened with those people
It's mostly irrelevant, since it was totally plausible that WikiLeaks could have done this. Nobody came out saying "wait, wait, this is impossible!". The response was "Yes, this is how Tor works. So?"

Maybe the problem is that you don't see the facts yet?
You still haven't provided any! Point to a misstatement of fact, here. You may dislike the hype surrounding the interpretation of the facts, or the judgements based upon the facts, but that's a different matter from the "I'm just clarifying the facts, m'am" steez you're trying to pull.

Additionally, I'd argue the hype you dislike so much is very necessary, as it will spread the word to people who have misconceptions about Tor that it's not the panacea they imagine. It'll spread it far better than a brisk "I'll believe if you consult paragraph 12, section 4 of our warning you will see that this was always a possibility".

No. The parameters are as good as they can possibly be, as Jimbob pointed out, and Tor meets the standard set by them. That's not "crappy", period.
Ah, wait, is this one of these facts? Compare with LifeLock again: it perfectly meets the standard set by the parameters of an achievable identity protection service, but it's still a crappy service because what you actually want -- proper identity protection -- is impossible to achieve, and the best outcome you'll get is something that is, ultimately, pretty crappy.
posted by bonaldi at 6:49 PM on June 2, 2010

U.S. Intelligence Analyst Arrested in Wikileaks Video Probe
posted by homunculus at 10:00 PM on June 6, 2010