Chelsea Manning ordered to be released [pdf] - <AUTHOR> https://www.courtlistener.com/recap/gov.uscourts.vaed.412520/gov.uscourts.vaed.412520.41.0.pdf <comment><USER2> What's the legal reasoning (if there's any) to keep her locked up and ruin her financially while not being able to swing the same punishment at all those people who refused to testify in the recent impeachment?

<comment><USER3> The reasoning is that the DOJ under Barr (and the administration in general) has no interest in cooperating with Congress or fulfilling their constitutional/legal obligations.

If the Congress really wants it can enforce its own subpoenas by putting anyone who refuses to testify in their own jail, without asking the DOJ for help. This is a power that hasn't been used since 1934, and the current Congress has opted to work through the courts / make appeals to the electorate instead of applying it.

<comment><USER4> Actually the way to settle differences between the branches is to use the third branch, the Judicial branch. Congress takes them to supreme/federal court, which decides if the subpoenas are valid and would then enforce the subpoenas and the executive branch then has to comply. Basic checks and balances.

[https://www.theatlantic.com/ideas/archive/2019/12/house- demo...](https://www.theatlantic.com/ideas/archive/2019/12/house-democrats- need-better-subpoena-strategy/602782/) [https://www.theatlantic.com/ideas/archive/2020/01/democrats-...](https://www.theatlantic.com/ideas/archive/2020/01/democrats- should-appeal-directly-roberts/605413/)

<comment><USER5> Congress already had the judicial branch confirm they have the power to hold people in contempt, but they didn't use that power in this case.

[https://en.m.wikipedia.org/wiki/Jurney_v._MacCracken](https://en.m.wikipedia.org/wiki/Jurney_v._MacCracken)

<comment><USER4> So do it again.

Honestly though, I think the impeachment just pointed out the Ukraine stuff about as much as it pointed out Trump's phone call shenanigans, it wasn't good for them politically to keep at it, his approval rating was going up and he was raising tons of money during it. It was backfiring politically for them, the majority of the public wasn't interested (especially after the Russia thing coming up empty, you can only cry wolf so many times) and it brought their own misdealing to light so they didn't push it as they would if they really cared.

<comment><USER6> The Ukraine "stuff" was a conspiracy theory. The Russian "thing" was an actual collaboration between our enemies and our presidents flunkys that nobody seriously denied happened.

<comment><USER7> I don't think so. The American meddling in Ukraine before Trump even was in office is highly suspicious. You could argue that it was a justified reaction to the Crimean invasion, but saying there wasn't any stuff is completely dishonest. Biden pressured Ukraine to fire a public defender. He was even praised for doing so. This hypocrisy seriously damages any credibility of those accusing Trump of meddling in Ukraine.

Of course you should ask yourself what Russia and America are even doing in Ukraine in the first place, but that is probably a lot more comprehensive.

Some news papers argue Biden didn't pressure the public defender out of office, but that would be clearly fake news. As I said, there are people on record praising him for doing so.

<comment><USER8> In your post you said several things about "Biden". Could you clarify just who that is? I believe there is an intentional rhetorical trick being used to conflate to people with that surname. I can't say whether your use of it was intentional, but it would help if you clarified who you were talking about.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Ms. Manning. Thank you. Living a life under public scrutiny isn't for everyone. I appreciate your sacrafice and sticking to what you felt was right.

</comment><comment><USER10> From my understanding this whole ordeal appears to be vengeful and a complete miscarriage of justice. It's almost as if it's being done to make an example and have a chilling effect on future whistleblowers.

Based on reading the news over the years it seems like the US DOJ has had quite a poor track record in general.

The Aaron Swartz case, the attitude towards Assange/Manning and a record number of prosecution of whistleblowers, doctoring of emails to obtain FISA warrants, running guns to Mexico. An attorney general was held in contempt at the time, and it looks like the current one might be too, someday, if not worse.

Incidentally I also read the recent OIG memo about rampant supervisor- subordinate romantic relationships in the DOJ, violating all sorts of workplace protocol.

I am sure there is plenty of great work coming from the department that you never hear about but all this stuff makes it seem like in some ways the department has been run very unprofessionally for at least 10+ years now.

Also disappointing has been the apparent timidity of the American news media who, until William Barr, seemed to be very soft on the DOJ.

</comment><comment><USER11> I sure hope she leaves the country after this. This will keep happening for the rest of her life. You really don't want to run afoul of the security apparatus.

<comment><USER12> I hope she stays. The country needs more people like Manning.

<comment><USER13> Which is precisely why she should go. The thing they did to Snowden is not exactly something that will scare Whistleblowers away.

If you want heros and whistleblowers who risk their life for the truth to stay, maybe start taking that freedom of speech thing you are so proud of a little bit more seriously..

</comment></comment></comment><comment><USER14> If anyone knows of a (legit) way to donate or make a payment towards her $256,000 in fines, please do share the details.

<comment><USER15> Why would you want to throw away money paying an illegitimate debt? Donate to a trust that will take care of her instead.

<comment><USER16> I imagine it's going to be hard for her to find employment, and if she doesn't pay those fines she'll eventually end up in custody with even more fines.

<comment><USER17> It's generally hard for trans people to find employment, period -- and I doubt she has meaningful job skills given her extended imprisonment. That said, trans people rally around our own so she shouldn't have trouble surviving; but whether or not that life is existentially fulfilling is another question...

Also, I don't think it's legal to jail someone over unpaid debt (though many states will certainly try). They can do all sorts of things like garnish your wages, but federal courts don't throw people in jail for being poor.

<comment><USER18> > It's generally hard for trans people to find employment, period -- and I > doubt she has meaningful job skills given her extended imprisonment.

She's a celebrity speaker with a large upper-middle-class fan base, so as long as their interest doesn't go somewhere else she'll probably do okay.

Of course, if her opponents don't do their part to keep her in the news, the attention will wane.

> Also, I don't think it's legal to jail someone over unpaid debt

It's not. Though it's quite possible she could now be charged with criminal contempt and imprisoned for that.

She could also be jailed for refusing to pay her existing debt (but not for inability to pay.) But note that isn't always an easy line to draw, and a lot of time the latter is dressed up as the former, though with sufficient litigation (which someone has to fund) to challenge it, higher courts may reverse it.

<comment><USER19> I mean, I'd pay to see her speak.

<comment><USER20> I'd pay just for what she did. It would be nice if she pointed us to a place where we can donate directly to her.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> The judge assumes without comment that it was justified to hold Manning in the first place, and finds that she must now pay $256,000 for refusing to collaborate with the government anti-freedom-of-the-press campaign against Julian Assange.

Shameful.

<comment><USER22> Shameful? Yes.

Freedom of the press for trying to persecute a Russian agent? Well...

Sources:

[https://www.washingtonexaminer.com/opinion/mueller-report- de...](https://www.washingtonexaminer.com/opinion/mueller-report-details- suggest-julian-assange-is-a-russian-agent)

[https://washingtonmonthly.com/2019/07/15/ecuador- concluded-t...](https://washingtonmonthly.com/2019/07/15/ecuador-concluded- that-assange-has-ties-to-russian-intelligence/)

[https://www.vox.com/world/2017/1/6/14179240/wikileaks- russia...](https://www.vox.com/world/2017/1/6/14179240/wikileaks-russia-ties)

And so on.

<comment><USER23> Even if Assange was a Russian agent he still did nothing wrong regarding his actions of helping whistle-blowers publish their data.

<comment><USER24> He's charged with conspiracy for conspiring to commit a crime. That's illegal.

<comment><USER23> This is irrelevant to what I am saying. I am not talking about whether what he did was illegal, I am just saying that he did nothing wrong. After all there is nothing wrong with a lot of things that are or were illegal.

</comment></comment></comment></comment></comment><comment><USER25> Her prolonged imprisonment in inhumane conditions is an ugly stain on Obama's presidency. I remember when he campaigned praising whistleblowers and government openness.

<comment><USER26> > Her prolonged imprisonment in inhumane conditions is an ugly stain on > Obama's presidency. I remember when he campaigned praising whistle-blowers > and government openness.

And Trump praised Wikileaks, and by extension Julian Assange, during his campaign and now [1] look at where things are?

The sooner people realize the type of person drawn to politics is inherently the same (supposed party factions and names are irrelevant when looked at objectively and by outcome) and have ALL lied and manipulated to get to the position to do so, the better we will be as a Species and will hopefully lead to building viable alternatives.

These people are the epitome of the narcissistic, sociopaths everyone rants running large corporations, except these are they type who will do and say anything to be elected: this is why I think seeing your Trumps or Berlusconi be elected would be useful if people were open to seeing it for it what truly is. Instead you get division and discord when we all intuitively realize that this is a myopic system that always leads to this inevitable outcome.

Every politician is the same as Trump and Berlusconi, they just hide it better.

If there was a time for this kind of Governance, and I grant you it may have been useful during initial colonization/Industrialization; it has since become clear with how this, environmental ecocide, financial/banking malfeasance, climate change, and now Corona Virus pandemics are handled that it HAS LONG exceed its last glimmer of utility.

1: [https://www.msn.com/en-xl/news/other/us-assange-and- wikileak...](https://www.msn.com/en-xl/news/other/us-assange-and-wikileaks/ar- BB10Z2Wl)

<comment><USER27> > Every politician is the same as Trump and Berlusconi, they just hide it > better.

Citation effing needed. I would argue those are outliers of sociopaths that reached positions of power, they don't represent every head of state, let alone all elected public officials.

<comment><USER26> Sure: The Clinton's are my favorite example, not least of which because I lived with a crazy kool-aid drinker who swore Hillary was the Messiah come back to save the Earth when she was a total crony:

[http://www.clintoncashbook.com/](http://www.clintoncashbook.com/) [https://www.youtube.com/watch?v=EKqWHkg5xmc](https://www.youtube.com/watch?v=EKqWHkg5xmc)

Obama has already showed himself to be an enabler for the Military Industry Complex as he expanded the wars in Afghanistan, Iraq (went in Yemen, Syria, Ukraine etc...) and went deeper on extra-judicial wars and rendition camps, then went deeper with the use of Drone Warfare, such that he was called the Drone King. Which makes sense because how did a formerly unknown Senator form IL become a 2-term president who seemingly eroded Citizen Rights? His war on whistle-blowers is already outlined. And was a Constitutional Scholar/Lawyer no less!

Worth noting, Trump from a supposed contrasting party, expanded drone warfare even further [1]. Further solidifying my point(s). And Trump doubled down on not just drone war-fare and its secrecy, but also went further than Obama on prosecuting whistle-blowers [2].

I'd say something about the Bush dynasty but I think its very easy to see their alliances to the Saudi family and previously Nazi-sympathizers to build their wealth and eventually political clout.

FYI: I'm an anarchist, and I don't have a political affiliation so I can scrutinize both 'parties' objectively and what is consistent (In the US) is that politicians always side with War and interventionism, and are often benefactors of some cronyism--they may decry it, but it happens.

Dick Cheney is the like the poster-child of what these people embody. Those that fail to 'play the game' are often berated and marginalized and subject to unfair (often illegal) practices when they run for office as they will not participate in the order of things: eg Ron Paul and Bernie Sanders come to mind.

I highly recommend Jermey Scahill's work.

1: [https://chicago.suntimes.com/news/2019/5/8/18619206/under- do...](https://chicago.suntimes.com/news/2019/5/8/18619206/under-donald-trump- drone-strikes-far-exceed-obama-s-numbers)

2: [https://theintercept.com/2019/05/21/why-you-should-care- abou...](https://theintercept.com/2019/05/21/why-you-should-care-about-donald- trumps-war-on-whistleblowers/)

<comment><USER27> > I highly recommend Jeremy Scahill's work.

Seconded, I wasn't referring to Hillary "Jill Stein/Tulsi are Russian assets" Clinton.

I'm not even American, so my interest on American politics is academic at best (eventually the trends trickle down to other countries). The US is ahead of the rest of the Global North in complete institutional breakdown.

I just don't believe we should paint "politicians" with a broad brush. Most of them (like in all professions) are too ignorant to be evil, they just go with the flow. The the zeitgeist changes, they will change with it.

I'm no anarchist, so I believe the zeitgeist can be changed, but that goes against entropy, you need to apply energy to keep it changed. It's not a one- shot revolution that does it. Life is too depressing otherwise...

</comment></comment></comment></comment></comment><comment><USER28> The last page states she will owe $256,000 in fines and the motion to dismiss them was denied. Really?

<comment><USER29> With a law degree going to cost you near on $150,000 in student debt, you start to think of limited options and [https://en.wikipedia.org/wiki/Debt_bondage](https://en.wikipedia.org/wiki/Debt_bondage) has many forms.

<comment><USER30> Depends entirely on where you go. Your $150,000 figure will get you a law degree from an elite top 20 law school, which will earn you a starting median income as a lawyer of $175,000+ in the private sector.

The median lawyer in the US will earn $4 or $5 million over their law career, at a present $120,000 per year.

The median lawyer from an elite school will earn more than twice that over a career.

$150,000 is a reasonble entry fee considering the immense income potential, which is what you're buying access to.

If you just want a law degree and are not worried about the income potential, you can alternatively go to a cheaper school (public + in-state) and slash the student debt dramatically.

<comment><USER31> Plenty of lower income lawyers out there, but yeah. Like anything, the best candidates get the best jobs. You're not going to a top firm if you graduate at the bottom of your class and went to an average school, unless you have some other magical quality or connection.

</comment></comment></comment></comment><comment><USER32> Did something in particular change so they no longer needed her testimony, or did they finally accept her argument that she already told them what she knew and had nothing more to say?

Edit: Oh I didn't see that the Assange grand jury was dismissed today!

<comment><USER33> She attempted suicide and a judge decided that she need not be incarcerated to compel her to be a witness.

<comment><USER34> That's not _at all_ what the court order says.

<comment><USER33> It also makes the reasonable point that the Assange grand jury had been dismissed, but IIRC (and it's only been two or three hours) the court's statement was clear that incarceration to compel was not necessary. (Probably motivated more by the grand jury's conclusion than the suicide), but if you'd like to tell all of us what you think they said, that would be super!

</comment></comment></comment></comment><comment><USER35> On the one hand, I understand the hacker ethos and the feeling that the Espionage Act in particular is a disgrace, especially as applied to Assange. (I thought the resurrection of the Espionage Act during Pres. Obama's administration was one of the most disgraceful actions of his presidency.)

On the other hand, Manning has no leg to stand on. She was granted immunity per the first sentence of this order, thus her Fifth Amendment privilege doesn't apply. She has no privilege against testifying against friends or people she wishes to lend moral support, and especially not when being called to testify in a (secret) grand jury proceeding.

She could have chosen either to comply with the court order or face contempt proceedings as a form of civil disobedience. Instead, she's arguing that she's special and that contempt proceedings need not apply.

I respect people who commit civil disobedience, especially in reaction to injustice like the Espionage Act. It's a credible signal that someone finds some particular law wrong. But this is not that scenario. By trying to avoid punishment for her contempt of court, Manning has done nothing to sway the minds of the people who need to be convinced (i.e. Congress or maybe the Justice Department).

<comment><USER36> The judge's distinction between _punitive_ and _coercive_ is important. Contempt of court is closer to police use of force than to criminal punishment. Faced with a hostile suspect, cops can do some nasty stuff. Electric shocks, beating with sticks, painful chemicals. But suppose they're ordering you to stand up, and you're deaf or paralyzed. The baton keeps landing and you keep not doing what they ask. Resisting arrest is a punishable crime! But they can't just beat you to death on the side of the road for it. They'd have to actually get a conviction, and even then, beating isn't a sentencing option.

Contempt of court is the nightstick. Obstruction of justice is the resisting arrest charge. That may be on the table for her. But you can't just keep holding someone in contempt until they do the thing they'll never do, or once you no longer need it. She's not asking for special treatment, that is just how contempt works.

(Not a lawyer).

<comment><USER35> I'm not sure I follow this analogy. I'm also not sure it's a very reasonable analogy in the first place. Seems a bit non sequitur.

<comment><USER36> Contempt is not society's punishment for anything. It's a tool the judge can use to extract your cooperation with a specific demand. Not as revenge.

<comment><USER35> Though there is common law contempt, in the US it has been codified in statutory law[1]. The text of the law states that it is indeed a punishment for disobedience with the court.

In general, "revenge" is not the aim of any administration of justice; however, punishment is a tool, for better or worse, that is used in an attempt to achieve justice. Punishment is also the type of remedy that the state can do well. The maxim about "have hammer; see problem nails" applies to the state as well.

Keep in mind that the statute, enacted by Congress, explicitly allows the exact punishment Manning herself received. While holding her beyond the grand jury proceedings was considered moot, the fines themselves survived, as fines are wont to do.

[1][https://www.law.cornell.edu/uscode/text/18/401](https://www.law.cornell.edu/uscode/text/18/401)

<comment><USER36> You're right, there is such a thing as criminal contempt, which can be used punitively. But it is a crime for which you have to be charged and convicted. Chelsea Manning's contempt is the civil variety, which must have a coercive purpose.

</comment></comment></comment></comment></comment></comment><comment><USER37> Looks like they are still fining Manning $256,000.00.

<comment><USER38> Where's the GoFundMe? I have a spare $1 to jump start the effort.

<comment><USER32> [https://actionnetwork.org/fundraising/chelsea-manning- needs-...](https://actionnetwork.org/fundraising/chelsea-manning-needs-legal- funds-to-resist-a-grand-jury-subpoena)

<comment><USER38> Contributed $10.

</comment></comment></comment></comment><comment><USER39> TLDR; the Assange grand jury was dismissed today so Manning is ordered released but she still owes the coeercive fines which amount to $256,000.

<comment><USER40> That is obscene. I can just about understand contempt of court incarceration for not testifying (though I have extreme reservations on the practice) but such punitive and life-debilitating fines strike me as purely malicious.

<comment><USER41> I'm sure her representation, who likely are working pro bono, will challenge the fines.

<comment><USER42> They did, as part of that order those challenges were denied. No idea if they can appeal that bit. IANAL.

</comment></comment></comment></comment><comment><USER43> Can Manning avoid the fines by declaring bankruptcy?

<comment><USER44> That's not how it works Michael.

You don't "avoid" fines by declaring bankruptcy. You can go through a bankruptcy process and as the debtor you may be forgiven from certain things that the other side will clearly never receive money from, but this isn't a clean slate trick you just do and walk away from.

You basically convert your obligation into distrust. And can "refinance" some debts including judgments against you.

So, could Manning go through bankruptcy and have the court never receive their money, yes. But I wouldn't say this is "avoiding the fine", just changing it.

<comment><USER45> I have no idea what the implications of bankruptcy are in the US, but it sounds like you are alluding to something serious - aside from no credit, what would Manning face in this scenario?

<comment><USER44> No, you are entirely misreading that. You don't just get everything reset to zero. So bad credit, yes, but also maybe a condition is that you are still on the hook for legal fees but they have been worked down to 50,000 and the payments have been rescheduled to 20 years.

It's a legal process, not an eraser.

</comment></comment></comment></comment><comment><USER16> It's a shame lamo didn't make it to see this. I know it really fucked him up to out her. That would be such a nightmare situation to be in.

<comment><USER46> >I know it really fucked him up to out her

Did it really? Lamo was a person who'd go out of his way to seek out kids to snitch on just to amuse himself.

<comment><USER16> According to his own words, yes. I knew lamo for just shy of 20 years.

I will not defend his character; his regular drug abuse and mental health issues could make him unpredictable, mean, vicious, etc. I've never called him a friend, but he was a peer, had a keen mind, and was fascinatingly unique.

I'm not defending him, but as someone that spent years conversing with him and sharing information, both online and in person, including discussions about this exact topic: Yeah, it really messed him up. Anyone that he was comfortable conversing with would say the same.

</comment></comment></comment><comment><USER47> I've said it before but the idea of secret courts trying to coerce people into doing things seems extremely backwards and regressive. Maybe I don't understand this system but it doesn't seem to be about getting justice. If there is testimony already given as well it seems doubly wrong, inconsistent and hateful.

<comment><USER48> > "Maybe I don't understand this system..."

sounds like you understand the system pretty well. the US is grounded in a limited federal government and the right to vigorously oppose it (short of, say, revolt) without persecution (see: bill of rights).

holding manning in jail for so long was persecutory and unjust.

<comment><USER11> It's common practice to hold even low level offenders for a year or more to extract a confession. NYC has been particularly infamous for this.

<comment><USER13> Doesn't make it right tho.

</comment></comment></comment></comment><comment><USER49> At last some good news today.

</comment><comment><USER50> It seems to me that the 1st Amendment should, in principle, give you the right to remain silent in any circumstances (including when you're subpoenaed). After all, shouldn't freedom of speech include the freedom to not speak - isn't remaining silent in of itself a form of expression?

I understand that this is not at all how the courts have interpreted the constitution, but it remains my gut interpretation - that individuals should have the right to freedom of speech and silence. I also believe, for the similar reasons, that lying to an FBI officer, when not under oath, should be constitutionally protected.

<comment><USER35> While it might sound nice to want to sweep away compelled testimony, in this case the cure is much worse than the disease.

A major part of the Constitution's objective as specified in the preamble is to "establish justice." Certainly criminal elements - actual criminals, not people who are quasi-political prisoners like Assange - would love to be able to refuse to testify under any circumstances. Such an interpretation would be untenable and would lead to essentially a failed state. Thus we understand that the First Amendment does not mean that people cannot be called to testify in court.

Furthermore, keep in mind that your interpretation is directly contradicted by, well, the Constitution.

Sixth Amendment:

> In all criminal prosecutions, the accused shall enjoy the right [...] to > have compulsory process for obtaining witnesses in his favor [...]

Considering that the First and Sixth Amendments were proposed together and ratified at the same time, I think the idea that the First Amendment allows people not to speak under compulsion of court is untenable.

Finally, the text of the First Amendment begins "Congress shall make no law [...]" That framing is important: the right is against Congress enacting a law, not the courts granting an order compelling speech (like a subpoena) or forbidding it (like a gag order or keeping grand jury proceedings secret).

<comment><USER50> Thank you for a very insightful reply that has made me reflect on my position.

I am still concerned by the ethical ramifications of forcing people to testify against their friends and loved ones. I don't think it would necessarily result in a failed state if the prosecution were forced to rely on only willing witnesses and physical evidence.

I am curious if you have any insight regarding the crime of making false statements to federal agents [1]. This actually is a law passed by congress that seems to interfere with free speech.

[1] [https://en.wikipedia.org/wiki/Making_false_statements](https://en.wikipedia.org/wiki/Making_false_statements)

<comment><USER35> Cheers for thoughtful dialogue on the Internet!

I should be clear: I don't personally support what the DOJ is doing to Assange. I even think the Espionage Act likely has Constitutional defects as applied to his case; it's just never been tested. And I think the Espionage Act should be repealed at the earliest possible moment. That being said, I think we're stuck with it, and our Constitution likely doesn't prevent it from being a law, albeit a bad one.

On the other hand, I have serious misgivings about the false statement laws, at least as they cover unintentional false statements (i.e. those without _mens rea_). I don't think our Constitution was meant to punish people criminal for actions that they aren't even aware of. Unfortunately, there is long precedent establishing that "strict liability" is permissible even in criminal law. It seems like a gross violation of due process to me, but unless and until something changes, we're stuck with it.

I think you've also hit on a much bigger problem I have with the justice system: this fairly absurd idea that law enforcement can do nearly whatever it wants, whenever it wants in order to seek its own ends. If I were to propose criminal justice reforms, I would focus first almost exclusively on police procedure. Forget about bail reform or sentencing guidelines: don't allow cops to lie to people while performing an investigation; strictly prohibit cops from making any innuendo that someone waiving his or her rights is somehow "looking guilty" or some such nonsense; and get rid of the plea bargaining system.

Essentially the only thing anyone should ever say to law enforcement in the US is, "I refuse to any questioning without my attorney present." Anything else you say to them can and will be used against you, and _cannot_ be used for your defense, since it is hearsay. It's not too hard to see that the distribution of people who know how to respond to pressure from the cops to talk is heavily skewed toward the less privileged segment of the population. When you add in things like plea bargaining, which has resulted in even many innocent people pleading guilty to crimes they didn't commit, I don't think anyone can call it justice.

It's late so I'm rambling, but I think there are serious problems with the justice system. I just don't think Chelsea Manning is a particularly great poster child for them.

</comment></comment></comment></comment><comment><USER51> And here all along I thought that she was already out.

Bad for me for being out of touch.

Awful for the Justice system for this clusterfuck!

</comment><comment><USER52> so she is ordered released but still has to pay $256K in fines. i was so hoping that those fines would be waved.

</comment><comment><USER53> Manning for President!

</comment><comment><USER54> This is fantastic news.

<comment><USER33> Why?

I'm not familiar with the facts of the case.

And, I further realize that facts are almost completely immaterial to motivated reasoning about the case, but...

... assuming that you (or someone) is a straight-shooter, why is this "fantastic news"?

<comment><USER55> [https://en.wikipedia.org/wiki/Chelsea_Manning](https://en.wikipedia.org/wiki/Chelsea_Manning)

tl;dr she was a whistleblower facing the wrath of the people she outed

<comment><USER56> Manning was never a whistleblower hence the espionage charges.

<comment><USER57> She was a whistleblower, hence everyone with a hint of credibility saying she was.

Also, it's customary on HN to point out when you have a conflict of interest. You work for a military contractor & used to work for the government, and probably should disclose that when talking about a subject so closely tied to your work.

<comment><USER44> Can you help me understand the difference between leaker and whistleblower?

<comment><USER58> Whistleblower is commonly understood to uncover illegal, criminal or otherwise punishable activity within the organization, that is being hidden. Thus the metaphor of "blowing the whistle" \- as in, attracting attention to something untoward going on. However, just releasing secret documents which do not contain the proof of any specific criminal, or otherwise untoward, behavior is not "whistleblowing". For example, Manning released 251,287 US Diplomatic cables and 482,832 Army reports - unless you consider the whole US Diplomatic corps and US Army to be a criminal enterprises, this goes way beyond whistleblowing, as described above.

</comment></comment></comment></comment></comment></comment></comment><comment> an-allen Did they just charge her a quarter of a million dollars for refusing to speak. What a crock of thuggy shit justice department.

<comment><USER59> Land of the free, home of the brave.

<comment><USER60> Especially given its current leadership, I often turn away jobs of more than two times my salary - in USD (I live in Canada) - to avoid living in America.

That Trump ever got elected - or was ever seriously considered as a candidate - tells me that enough of the the population is seriously disturbed that I'd like nothing to do with it.

And then there's the war atrocities...

<comment><USER61> Before you write off 50 million people as "seriously disturbed", you should find out their motives. Not the cherry-picked mockery of them you see on social media, but their more common motives. To make such a crude judgement as you did, you have to be ignoring some huge factor. If you conclude that factor is "they're stupid" or "they're evil", then you haven't found it. This applies generally to many controversial ideas. Being unable to see it from any other point of view doesn't make you right.

<comment><USER62> If you know their motives, would you please be kind enough to share them with us? As an outsider it is kind of hard to see through superficial news posts.

<comment><USER63> As a Democrat-voting libertarian with very Republican family, I think Jonathan Pie encapsulated it perfectly just a few days after the election: [https://youtu.be/GLG9g7BcjKs](https://youtu.be/GLG9g7BcjKs)

The truly sad part is that the Democratic party seemingly hasn't learned anything in the last four years, and are well on their way to dooming us to another four years of Trump.

<comment><USER4> Jimmy Dore, Tim Pool, and hundreds of others on the left have explained so well what was happening and is still happening. People who talk to people, not people who sit in high rises offices in major expensive cities and listen to themselves on Twitter all day which is a fraction, of a fraction of the population (majority of people don't even have time to tweet or care if they did, the loudest voices there are not representative of political thought for the majority of Americans). DNC has doubled down and moved further in the direction that lost them the last one. People have missed that Republicans have moved left or more center cause of Trump, gay marriage is something Trump doesn't care about at worst and supports at best, same thing on marijuana legalization. People who voted for Obama voted for Trump, the Christian right vote for Trump or don't vote at all because who else are they going to vote for.

In my state, NAFTA fucked over a lot of people, people working factory jobs are now working two jobs, Clinton's brought that into reality, and she still advocated for that and other trade deals like TPP. Bernie might have had a chance then, because he stood against it, he's since said things like "white people don't know what its like to be poor", turning it into a race issue instead of a class issue, stopped talking about worker rights, he sure doesn't now, even without the DNC's help, people watched how the DNC played Bernie and rigged things against him, changed the rules and sacrificed their morals to let billionaire in and keep saying anyone they don't like, even on their own side, is a Russian asset, they know they're just as dishonest. They see rich white people at the top of the DNC, the people the DNC says we're supposed to hate, and recognize the sheer hypocrisy of it all. In the last 4 years they've sinked to Trump's level, and got down in the mud with him.

</comment></comment></comment></comment></comment></comment></comment><comment><USER64> Thank god. It's a mockery of the idea of America as a land of freedom when we have political prisoners who we abuse in this way.

</comment><comment><USER65> It's so sad that one of the most courageous soldiers in the history of the US military has been treated so horribly by the government.

<comment><USER66> The US Military has no real oversight, and to question it is to have one's patriotism questioned. It's beyond vexing.

</comment></comment><comment><USER29> I'm wondering if jail is a safer or less safer place in light of the current pandemic.

Let's face it, if you got your freedom after so many years only to be handed a facemask on your way out and told - you will need this. Has to suck at some level.

<comment><USER67> Being confined in an unhealthy space is a very bad place to be right now. This would be a great time to release nonviolent offenders.

<comment><USER29> Only if they have somewhere to live, so they can isolate themselves if they need or want too. Adding to the homeless would be placing them at greater risk with less medical and people to look out for than any prison.

Homeless people are overlooked at the best of times, at the worst, they can't isolate, they live day by day. We should be focusing in assisting them as by helping them, we also help everybody else as nobody wants to be spreading this and some won't have that choice.</comment></comment></comment>


Repairs taking place on SpaceX drone ship following SES-11 booster landing - <AUTHOR> https://www.nasaspaceflight.com/2017/10/repairs-asds-ses-11-booster-landing/ <comment><USER2> The drone ship was quoted as having no hard feelings about the incident. When asked to comment its only response was, "of course I still love you."

<comment><USER3> in my opinion they really missed the opportunity to name it:

Mistake Not My Current State Of Joshing Gentle Peevishness For The Awesome And Terrible Majesty Of The Towering Seas Of Ire That Are Themselves The Mere Milquetoast Shallows Fringing My Vast Oceans Of Wrath

or the Rocinante, which would be a nice meta-Expanse reference and itself a pretty decent literary reference.

<comment><USER4> wouldn't Rocinante be better for one of the BFS?

</comment></comment></comment><comment><USER5> This used to happen a lot, when they were regularly crashing rockets into the ship rather than landing them. There was a joke in the fan community that the Falcon 9 was actually a really ineffective anti-ship missile. At least one of them punched a nice hole through the deck: [https://imgur.com/fWNb1zo](https://imgur.com/fWNb1zo)

<comment><USER6> Talk about RUD!

<comment><USER5> I _almost_ miss photos of debris-covered ships coming back into port. Almost.

</comment></comment></comment><comment><USER7> Intrigued by the Octograbber, haven't seen it before but here's some discussion[0].

Looks like it scoots under the landing legs, latches on to the booster and provides additional vertical support via hydraulic jacks until the booster can be welded to the deck by the crew.

GIS has a bunch of pics too.

Maybe they could just leave it attached and drive around the stack on those little tank treads.

[0]: [http://forum.nasaspaceflight.com/index.php?topic=42511.0](http://forum.nasaspaceflight.com/index.php?topic=42511.0)

</comment><comment><USER8> I have to hand it to them, they are doing a damn good job on safety.

I wonder how this bodes for the future of hazardous professions like offshore oil-drilling.

<comment><USER6> They probably won't be landing rockets on oil rigs, so probably not very much related.

<comment><USER9> If they keep upping their launch cadence, I suspect they'll actually _need_ something similar to an oil rig permanently sited instead of running the ships back and forth all the time.

<comment><USER10> There's an advantage to the ships that a fixed location couldn't provide. With the ship, you can anchor the rocket and pull it into port without having to move the rocket itself after landing. On a fixed platform, you'd have to have infrastructure to relocate the rocket to bring it into port. Unless, of course, you're going to refurbish it and launch from the platform ... Now that would be impressive.

<comment><USER11> At that point they would be better off using full RTLS and landing the rocket on land back near the launchpad as much as possible.

Also based on the BFR / spaceX airways teaser video, they might be planning this sort of offshore refurbishment / no refurbishment needed mode anyway.

</comment></comment></comment></comment></comment><comment><USER12> More pics from /r/spacex: [https://imgur.com/a/CwL5w](https://imgur.com/a/CwL5w)

</comment><comment><USER13> Url changed from [http://www.parabolicarc.com/2017/10/24/spacex-drone-ship- dam...](http://www.parabolicarc.com/2017/10/24/spacex-drone-ship-damaged- after-falcon-landing/), which points to this.</comment>


[JavaScript] PLYND, the easiest way to make a multiplayer game online - <AUTHOR>

In a few words:
Plynd empowers HTML5 developers to build great multiplayer games:
* No backend required: We provide the infrastructure! You can save and retrieve all the data you need about your game without setting up any server. Even better, you can register some javascript functions to be run server-side.
* Full multiplayer environment: We provide the coding-expensive experience of setting up a multiplayer game: Authentication flow, invitation, matching, notifications, chat, and more ; all automatically there for your players to enjoy.
== Demo ==
http://armsrace.plynd.com - our own adaptation of the famous Risk game - is a showcase of the technology.
The tutorial http://blog.plynd.com/Creating-a-fully-multiplayer-TicTacToe-on-Plynd covers in details how it works and how to get started.
The code for the tutorial is on https://github.com/Plynd/TicTacToe
I'd love to have your feedback on the techno in general, and more specifically on the concept of server functions - see http://blog.plynd.com/Part-V-Put-the-update-logic-server-side/
Thanks a lot!
Laurent @ Plynd <comment><AUTHOR> Links mentioned above for easier access:

\- [http://armsrace.plynd.com](http://armsrace.plynd.com)

\- [http://blog.plynd.com/Creating-a-fully-multiplayer- TicTacToe...](http://blog.plynd.com/Creating-a-fully-multiplayer-TicTacToe-on- Plynd)

\- [https://github.com/Plynd/TicTacToe](https://github.com/Plynd/TicTacToe)

\- [http://blog.plynd.com/Part-V-Put-the-update-logic-server- sid...](http://blog.plynd.com/Part-V-Put-the-update-logic-server-side/)</comment>


Galaxy S3 Hottest Selling Phone At Amazon Germany - <AUTHOR> http://www.galaxyinsider.com/news/922

<comment><USER2> Not true at the moment that the Samsung Galaxy S3 is the best seller at Amazon Germany.

What is amazing to me is that not a single Windows phone is anywhere in the list! Could someone point out what I've missed?

What's different about German vs. American taste in smartphone operating systems?</comment>


Ask HN: How does your engineering organization decide what tools to support? - <AUTHOR> We are a medium sized company with around ~2k engineers and have a developer tools group that supports code review products, issue tracker, CI machinery, deployments, etc.
Some tools can be fairly opinionated amongst engineers and have different tradeoffs. For instance, among issue tracking there is JIRA, Asana, Pivotal Tracker, etc.
How does your company select their supported engineering tools? Is this done amongst a select group of engineering leads? Organizational surveys, etc?
It would also help to know the size of your engineering organization to know what model scales. <comment><USER2> > How does your company select their supported engineering tools? Is this done > amongst a select group of engineering leads? Organizational surveys, etc?

IMO. All tools are history from a distant past.

There was problem some time ago. Some people picked a tool and it persists. The reasons for a particular tool could have been anything and may or may not still hold true.

Usually the tooling ends up fragmented by team, office locations, external acquisitions... especially when there are multiple similar products available.

The alternative is to have one ruthless dictator who forces the adoption of ONE SINGLE TOOL and kill everything else. That's the only way to get decent tooling and unify it across a company. (Coincidentally, that's also the only way to migrate from a mess of old tools).</comment>


Bernie Sanders briefed that Russia is trying to help his presidential campaign - <AUTHOR> https://www.washingtonpost.com/national-security/bernie-sanders-briefed-by-us-officials-that-russia-is-trying-to-help-his-presidential-campaign/2020/02/21/5ad396a6-54bd-11ea-929a-64efa7482a77_story.html <comment><USER2> It must feel amazing to be in Russia's shoes right now. Imagining having so much power over the American political process, you can cripple any of your enemies by merely showing interest in or supporting them directly or indirectly through various channels.

<comment><USER3> That's all fine and well but would you care more about political circus in Washington or NATO troops 100km from your second largest city if you were Russian government? NATO extension to the East went on regardless of who was in power in the US. If anything the chaos makes it harder to negotiate. Remember what Obama said to Medvedev?

</comment></comment><comment><USER4> I assume the point (if there is indeed such an operation) is to ensure that the Democrats nominate the least electable candidate possible. (Of course, Trump looked unelectable back in 2016, so why would they have helped his campaign before the general? Because any other Republican would have been at least as hawkish on Russia as Clinton? I dunno...)

<comment><USER5> A lot of the disclosed content from tech companies about Russian disinformation campaigns was that they played both sides. They're just as happy to push 2nd Amendment groups as gun control groups at the same time. And the more they can radicalize and push people to the fringes, the less functional the United States is as a global power.

Sanders being the most radical left makes him an obvious one to support, him getting elected would stir the right's "OMG, not socialism!" pot about ten times more than any other candidate. Support for Sanders may not even be about low electability, but about ensuring the two parties are as split as humanly possible, regardless of who actually ends up winning.</comment></comment>


Why writing a Windows compatible file server is (still) hard - <AUTHOR> http://tuxdeluxe.org/node/298

<comment><USER2> One of my first jobs during University involved automating windows interoperability for a small Linux distribution. I must agree with the author, "Interoperability with Windows is hard. But somebody has to do it.", I'm just glad I don't have to do that anymore :)

</comment><comment><USER3> This is a dupe of <http://news.ycombinator.com/item?id=737271></comment>


Show HN: Deadly simple HipChat API V2 room notification library - <AUTHOR> https://github.com/achiku/hipnotify <comment><AUTHOR> HipChat official third-party library web page introduces two sophisticated Python client libraries supporting almost all V2 APIs currently available.

[https://www.hipchat.com/docs/apiv2/libraries](https://www.hipchat.com/docs/apiv2/libraries)

However, our usecase just needed HipChat V2 room notification API + Python3 compatible HipChat client, which can only send messages to the specified room if a room token is given, without needing an admin token. (Admin token could be pretty dangerous and certainly unnecessary in this case.)

This library is designed to do simple thing simple with minimum sysadmin concern.</comment>


RSS Hits the Big Time - <AUTHOR> http://www.aaronsw.com/weblog/rssstimulus <comment><USER2> Maybe if all possible government departments (and regulated financial institutions, too?) were required to keep such an open flow of vital information we would be less stapped for effective oversight - and have fewer B. Madoffs -- or fewer that got as far as he did.</comment>


How not to run a CA - <AUTHOR> http://blog.koehntopp.info/index.php/3075-how-not-to-run-a-ca/ <comment><USER2> In related news, Trustico's site is down apparently due to users being able to run commands as root on their webserver.

I wonder if this was used to extract some private keys?

[https://twitter.com/svblxyz/status/969220402768736258](https://twitter.com/svblxyz/status/969220402768736258) [https://twitter.com/Manawyrm/status/969230542578348033](https://twitter.com/Manawyrm/status/969230542578348033)

<comment><USER3> I am aware this is not contributing to the thread but... the only way I can summarize my feelings on that is 'holy fuck'. I just spent a minute just muttering 'holy fuck' to myself.

They are running the good old php shell of "<%= system(%_REQUEST['cmd']) %>". As root. As a security company.

This entire company is just blowing my mind at the moment. What's next, are they running their services on a notebook in the office?

<comment><USER4> "As a security company."

Well, their CEO's linked-in profile doesn't really sound like a security company.

> Email Marketing Digital Marketing Google Analytics Google Webmaster Tools > Market Analysis Marketing PPC SEM SEO Sales Security Social Media Marketing > Web Analytics Affiliate Marketing Google Adwords Management E-commerce Lead > Generation Online Marketing Online Advertising SaaS Marketing Strategy > Strategic Partnerships Cloud Computing New Business Development Business > Strategy Start-ups Web Development CRM Social Media Product Marketing > Solution Selling Strategy Channel Partners Channel Sales Business Alliances > Business Development Leadership Social Networking Network Security Hardware > Product Management B2B Professional Services GTM Partner Program Development > Internet Security Google B2B Marketing Sales Operations

<comment><USER3> If you sell certs, you're a company in a security-related context. I don't care who you are, I care if you do your job.

Saying that, that quote sounds way too long to not be BS.

<comment><USER5> The quote sounds like SEO.

<comment><USER6> CEO SEO?

<comment><USER7> SpaceX to launch SEO CEO's REO into LEO.

(I expect this post will get 0E0 upvotes)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> They have a tool that allows you create a private key + CSR

[https://www.trustico.com/ssltools/create/csr-pem/create-a- ne...](https://www.trustico.com/ssltools/create/csr-pem/create-a-new-csr- instantly.php)

Apparently they decided to keep a copy of the private key.

Edit: Looks like they are having problems atm. A copy can be found at

[https://web.archive.org/web/20180217071027/https://www.trust...](https://web.archive.org/web/20180217071027/https://www.trustico.com/ssltools/create/csr- pem/create-a-new-csr-instantly.php)

<comment><USER4> Up until a few years ago there was a <keygen> tag which embedded a x509 CSR generator into a regular HTML form. The private key was generated by the browser(1) and was completely inaccessible to the site or any JS running on it. That's the proper way to generate certificates in browsers, but it's been removed since and was never supported in IE.

StartSSL used it, for example, but also allowed you to hand them a CSR of your own making. Although they of course ignored almost everything in the CSR apart from the public key (which is probably a good idea).

(1) IIRC you could even have a smartcard generate the key, at least in theory.

<comment><USER9> You say "they of course ignored almost everything in the CSR apart from the public key" but it turns out they went a bit further than that, they also ignored the signature on the CSR.

So you could put some other public key in there, add a bogus signature that wouldn't verify and they'd issue certificates for a key you never even controlled.

The bad security implications for that scenario are a bit subtle, and situational, but CAs are supposed to be checking that the CSR is properly signed, that's only a long way down the list because StartCom/ WoSign had so many other serious problems.

<comment><USER4> Actually I've never seen a solid argument for why that's a problem. A similar issue exists in PGP, but again it's unclear what the actual problem is. Some (non-x509) PKIs can't do this anyway.

<comment><USER9> Two people have asked essentially the same thing here, I'll answer this one because it was at the top. I am going to deliberately use a far-fetched scenario rather than invoke specific technologies, because there is no benefit to learning more specific here than "Nope, a competent CA must never allow this to happen".

Alice has public key A, and Bob has public key B, and everybody trusts Charlie the Certificate Agency to issue certificates, Alice has one binding (Alice,A) and Bob has one binding (Bob,B).

Alice controls a missile she will only accept Major Tom's commands. Bob runs firework displays, he accepts the display organizer's commands.

I want to fire Alice's missile. I impersonate Bob, and I trick Charlie into issuing a certificate (Bob,A) because she doesn't verify that I know the Private Key for A. Then I offer (as Bob) to run a really great firework show for Tom, and I give him the (Bob,A) certificate so he can command firework launching.

When Tom sends me a launch message encrypted to A, I simply deliver it to Alice, who launches the missile as I desired.

Alice was never compromised, neither was Tom. Charlie's only mistake was not verifying that I controlled the Private Key for the cert she issued me. Bob was compromised, but he was just running a firework business, he didn't know this was a matter of national security.

<comment><USER4> I'm aware of this[1], and with what you said out front in mind - it doesn't apply to either HTTPS or PGP. (I'm pretty sure you can build systems affected by this with X509, though).

[1] I don't want to take away from your good post, it's a good and well explained scenario to illustrate the issue. Personally I found Dominic Tarr's paper on AKEs-as-capabilities quite illuminating when I read it, and the analysis applies to your scenario as well. (The scenario is also a neat demonstration of a bunch of other issues, too)

<comment><USER9> Hmm. I _think_ I agree with you that it isn't practical in HTTPS. I can see clearly why you can't do anything like this in TLS 1.3 because it has this nice simple ordering - the client and server do DH key agreement - we now both have encryption but no certainty of who we're talking to - then the server sends a certificate and uses the key from that certificate to sign their DH transcript, the client optionally also sends a certificate, they too use the key from that certificate to sign the transcript. Since I don't know Alice's Private Key I cannot sign transcripts while presenting the (Bob,A) certificate, and if I let Alice do the key exchange so that she'll sign, I'm cut out of the loop entirely. That's easy to follow.

But in TLS 1.2 and earlier it's murkier to me because there are cases with and without DH, and what gets signed, by who, and when varies. I _think_ you're right, but I started doodling the possible cases out and I filled two A4 pages before I gave up. Certainly even if you're right as to how the protocol is designed it will not astonish me if somebody implements it wrong and doesn't check a signature somewhere given the many cases.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> This shows that you need a lot more than a fancy web site to convince you that a CA is professional.

It's kind of crazy how little we know about these important institutions. Credit reporting agencies are another example of complete incompetence in a presumed-sensible organization.

Especially once money changes hands, there ought to be a lot more terms in the contract to specify good behavior. You need backup when you discover something is run by 6-year-olds.

<comment><USER11> This was a "reseller", and they don't have to be audited, and the browser CA inclusion policy probably doesn't mandate anything from CAs regarding their resellers. Well, it should.

</comment></comment><comment><USER12> The thing that isn't clear to me is how Trustico even had the private keys to begin with. It's been a while since I've purchased a SSL certificate, but I remember generating the private key locally and providing a certificate signing request, which isn't the private key. What am I misunderstanding here?

<comment><USER13> "Trustico allows customers to generate a Certificate Signing Request and Private Key during the ordering process," the statement read. "These Private Keys are stored in cold storage, for the purpose of revocation."

Maybe they decided preparing CSR is too hard for their clients :/

<comment><USER14> > Maybe they decided preparing CSR is too hard for their clients :/

It seems that a lot of businesses and people feel that making things "easier and more convenient" takes priority over best security practices. For example, we can't support client side TLS cert authentication (in addition to a username and password) because customers won't be able to generate the CSR or know how to import the certificate into their client. Instead, let's use SMS or email based two factor authentication.

<comment><USER15> And they're probably not wrong. In other words, I suspect that if there were two identical competing services, the convenient one would win. If one only supported client certs, and one only supported 2FA, I have a (unsupported) feeling that the client cert company would not survive long.

<comment><USER16> Yep. The problem is that most customers cannot judge the level of security offered by a company. So Company "A" says they are "secure," but has a cumbersome process to follow to get a certificate. Company "B" says they are "secure" and has a convenient process. Guess which one gets the business (all else being equal).

In reality Company "B" may well be much less secure then "A", but the customer has no way of knowing that or making a judgement on which company is more secure.

<comment><USER17> On the other hand, a customer who doesn't realize that their private key should never leave their premises has no business asking for a certificate. It's like not selling guns to children.

<comment><USER14> While that may be true, that doesn't mean the rest of us shouldn't have the option of using certificate based authentication.

<comment><USER17> We have the option of using certificates, but not the option of giving away private keys.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Oh, it's worse than that: [https://twitter.com/svblxyz/status/969220402768736258](https://twitter.com/svblxyz/status/969220402768736258)

You can run arbitrary shell commands as root from their webserver.

<comment><USER19> Cue the intro to Bohemian Rhapsody. This is a huge WTF. SQL injection? Too basic. We do raw shell injection now. To a CA.

Welcome to the future of computers where security comes secondary to extra profits and marketing.

<comment><USER20> FWIW, Trustico isn't a CA. They're a certificate reseller; all certificate validation is handled by a different company. If Trustico hadn't been generating their customers private keys for them (or if their customers had refused to let them do things that way) they wouldn't have been able to screw things up this badly.

<comment><USER19> Got it, that kind of makes sense. The concept of certificate reseller doesn't make a whole lot of sense to me but thank you for making the distinction

<comment><USER9> Mostly they exist because of price discrimination.

Rich Uncle Bob hears he needs an "SSL Certificate" he's heard of "Thawte" brand SSL, he goes to the brand website and clicks "Buy $69.99 per year".

His savvy friend Tight Mike needs one too, he shops around, finds a reseller called "Discount SSL" that offers an Thawte certificate for $18.99

What's the difference? Nothing except that Tight Mike was looking for a cheaper price, and if "Discount SSL" didn't sell it to him for $18.99 he might have eventually kept looking enough to find that somewhere else has a GoDaddy cert for $12.99 or whatever. Bob didn't care, he just paid whatever they asked, so wring the maximum possible out of him.

In theory there's also some more traditional "sales and service" type role, where they educate customers, help manage local experience e.g. maybe the Reseller is in Egypt and your English isn't so good - and that sort of thing. But a LOT of the business is straight price discrimination, trying to ensure as much of the customer's money goes to you as possible without them switching to a competitor with lower prices.

</comment></comment></comment></comment></comment><comment><USER21> Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange.

It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.

<comment><USER22> Security depends on your threat model. HTTP is generally secure for publishing and has the added advantage of being cacheable by proxies. This blog is secure

<comment><USER23> > _HTTP is generally secure_

This statement is wholly incorrect. HTTP is _not_ generally secure.

> _for publishing_

When I publish something I do _not_ intend for third parties to interfere with the delivery of what I publish.

> _and has the added advantage of being cacheable by proxies_

If you trust your proxy, you can still have cached data at your proxy. If you don't trust your proxy, then why are you proxying through it?

<comment><USER24> HTTP plus a trusted hash would provide an integrity measure of the content of a page, and enable hashing.

It would not prevent anyone from _examining_ that content in flight, or altering it. It _would_ allow any such alteration to be _identified_.

It _is_ possible to offer various levels of assurance on unencrypted communications.

Mind: I'm describing a possible world, not the one most of us happen to live in. Unless, say, you're retrieving Debian package repositories over FTP or HTTP transport, and rely on the package signature rather than HTTPS for integrity.

See for example: [https://unix.stackexchange.com/q/90227](https://unix.stackexchange.com/q/90227)

<comment><USER23> You cannot have a "trusted hash" if you cannot trust the delivery mechanism (unencrypted and unauthenticated TCP).

The content of the delivered payload (your blog and your "trusted hash") can be altered by _anyone_ in transit.

When you take unencrypted and unauthenticated TCP and upgrade to encrypted and authenticated TLS, only _then_ can you begin to have trust.

<comment><USER25> You can't have encryption without authentication, because a man in the middle can snoop your connection.

You _can_ have authentication without encryption. This is what PGP signed messages are.

I'll admit it's weird to call a cryptographic signature a "trusted hash", which makes it seem like the author of the post you're responding to doesn't know what they're talking about. But it's totally possible to to have trust without encryption or TLS. TLS isn't even the best protocol for signing out there, as the whole thing depends on CAs being trustworthy (which they aren't).

All that said, if you want trust on the internet, start with HTTPS. Sure, you don't need the encryption for delivering non-secret content, but it's the easiest way to set up trust and the only one non-technical people are likely to verify in any way (because their browser does it for them). It doesn't provide very strong guarantees, but it's better than nothing. If you want more go with PGP.

And the fact that you _can_ use PGP over HTTP doesn't in any way mean that HTTP is secure in general.

<comment><USER23> > You can have authentication without encryption. This is what PGP signed > messages are.

Yes, but you must install the authorization certificate using a secure method.

Honestly I think far too many CAs are "trusted" by default, _especially_ for executing things (such as javascript) on my computer.

<comment><USER24> > you must install the authorization certificate using a secure method.

No.

You must be able _to trust the authorisation certificate._

Again, PGP/GPG and PKI: keyservers are _not_ authenticated, _anyone_ can post a key. Anyone can _sign_ a key. And if keys are transmitted via plaintext methods (such as an ASCII-armoured key exported and posted to an HTML website), then _that_ can be distributed and installed in an insecure method.

 _The security for PKI comes from the trust and integrity of those signing keys._ Whilst _anyone can sign a key_ , the catch, for the attacker, is that _you choose the keys you trust, and extent to which you trust them._

This isn't a magick bullet, and has numerous issues and challenges (trust roots, scale, trust revocation, general comprehensibility to the lay public, etc., etc., etc.)

But, given the following components, _an insecure distribution method is absolutely possible and has in fact been the mainstay of PGP /GPG networks over the past quarter century_:

1\. A robust and cryptographically valid cipher system and implementation for generating, signing, and validating keys and signatures.

2\. Key signers _trusted to you_ who have signed keys.

3\. Reasonable assurance of the validity of a given key _relative to the claimed identity_ by those you trust as signers.

I think that's pretty much it. _How you distribute the information generated within this system doesn 't matter, because the cryptography, implementation, trust, and keysigning practices are where the integrity of the system are manifested._ That is, the system does _not_ rely on transport-layer security _outside_ those domains.

If you look up PGP keysigning protocols, you find that these are generally based on _in-person_ procedures, which is to say, the transport layer _for that element_ is highly assured. There are other alternatives, including TOFU or numerous informal-but-generally-sufficient mechanisms.

What PGP/GPG lack that the SSL/TLS systems have (generally) is the notion of _universally trusted authorities_. If you introduce _that_ particular element, you end up with numerous cans of worms. And in fact what we've started seeing are effectively secondary (or greater) checks on CA reliability, in the form largely of major browser vendors, or operating systems, who maintain their own lists of trusted and untrusted CAs. This is a step, by TLS, in the direction of PGP's distributed WoT. PGP, on the other hand, has moved somewhat toward centralised trust in the form of auto-signing systems (PGP Inc., now part of Symantec, ran one such keyserver). Signatures by such keyservers are _not_ a strong assurance of trust, but do establish a documentary record of key existence and history which may prove useful.

Full and true trust are phenomenally complex and/or difficult. Ultimately, impossible as an absolute, but _useful_ even in imperfect form.

<comment><USER24> One clarification: You choose the _signing_ keys you trust.

You can also partially trust keys, in which case a given key requires _multiple_ signatures (from partially-trusted signers) to itself be considered trusted.

Note the distinction between trusting a _key_ and its _signers_.

Among core problems with PGP/GPG is the lack of a notion of a _negative trust_ signature. That is "I am signing this key to indicate that _I know it is not what it claims to be and /or is otherwise not trustworthy_". That would be generally useful (and, of course, also generally exploitable in various ways, a common story).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> While the article title is accurate (you should not run your CA in this manner), Trustico is not a CA but is instead a reseller of CA services.

</comment><comment><USER27> This is such a clusterfuck I don't even know where to begin. I am very happy that "pay money" for DV SSL certs is going the way of the dinosaur, with Let's Encrypt.

The only SSL cert you should ever pay money for is $90/year for an EV SSL cert for an ecommerce/product purchasing website where people are entering credit card details. The big friendly green bar GUI element, for non-technical users, is worth it.

<comment><USER28> I would pay for an acme endpoint that is not rate limited.

<comment><USER29> You don't have to pay; you just have to ask. :-)

[https://letsencrypt.org/docs/rate- limits/#overrides](https://letsencrypt.org/docs/rate-limits/#overrides)

<comment><USER30> And it just "takes a few weeks"!

</comment></comment></comment></comment><comment><USER31> Original (and much more accurate) source: [https://www.digicert.com/blog/digicert-statement-trustico- ce...](https://www.digicert.com/blog/digicert-statement-trustico-certificate- revocation/)

HN discussion: [https://news.ycombinator.com/item?id=16485801](https://news.ycombinator.com/item?id=16485801)

</comment><comment><USER32> > proving that Trustico has knowledge of all their customers private keys, > keeping copies of them, which proves that they never knew how to run a > Certficate Authority business in the first place

Well, they also weren't actually running a CA business either.

</comment><comment><USER33> also, 23,000 people disclosed their private key to a third party.

a) in a sense maybe they thought they were disclosing their private key to a their CA so in a sense it didn't really matter because their CA could issue certificates for their domain anyway (... ignoring certificate transparency/other external verification)

[... we know this is not true and it's mostly people don't know/don't care/it doesn't matter what they are doing in the scheme of things]

</comment><comment><USER34> This is going to be the funniest thing I read all day. Thanks for writing it up!!

</comment><comment><USER35> Mirror, because the site wasn't loading for me earlier: [https://www.eternum.io/ipfs/QmSjZic3JCaU3MHro8MyvRi1RpQweuYC...](https://www.eternum.io/ipfs/QmSjZic3JCaU3MHro8MyvRi1RpQweuYCen2HGpyFUTauWX/)

</comment><comment><USER36> I'm wondering if anyone could explain what the "right" thing for Trustico to do?

<comment><USER20> They should not have offered a web form for generating private keys, and instead should have educated their customers on how to generate their private keys and CSRs on their own servers.

If they had done that they wouldn't have had access to any private keys in the first place, so all their subsequent mistakes in mishandling those keys would have been impossible to make.

As for the whole "arbitrary Remote Code Execution as root" on their web server, that's got a pretty obvious solution: sanitize your data inputs, and don't run your web application server as root.

</comment></comment><comment><USER37> > So the CEO of Trustico, Zane Lucas, mailed the private keys of 23000 > Trustico customers to Digicert

How is it that these guys have managed to stay in business for this long?

</comment><comment><USER25> Intel is breathing a sigh of relief that finally there's a distraction from Spectre and Meltdown.

</comment><comment><USER38> letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the certificate for. This seems to me to be a very low bar. What am I missing?

<comment><USER39> There's a difference in certificate type. Let's encrypt (which only issues basic certificates) just verifies that you're the rightful owner of a domain, not whether the domain is what it says.

If you'd like to have more verification for your certificate you need a extended validation certificate (which often costs money). These certificates also include your (company) name and the issuer verifies whether it's correct or not.

Basic certificate issuers don't judge over domain names or content, they just verify domain ownership.

<comment><USER40> To clarify, other certificate types do not judge content either. The difference is that they verify your organisational details (to a varying degree, depending on the validation level) and include them in the certificate. The CA is not going to check whether the business is fraudulent or anything like that.

</comment></comment></comment><comment><USER31> > TL;DR: Forget your EV or other certs. Just run "Let's Encrypt".

The author has a fundamental misunderstanding of the situation [1]. Trustico's awful decisions regarding

a) storing customers private keys and

b) improperly handling key material

Have no bearing whatsoever on EV certs, which verify the legal entities that run websites. This is like saying Trustico is bad, therefore HTTPS is bad.

[1] Assuming this is what the author said - the site is in plain HTTP so integrity isn't guaranteed.

<comment><USER41> There is at least some merit to the argument that "Trustico Bad" => "CAs bad" => "HTTPS Bad".

More than one CA has been shown to be extremely lacking in trustworthiness and that trust is important. I'm OK with the centralised model but there needs to be a bit more visibility of the CA process.

<comment><USER42> I'd settle for an end to the credentialism that ensures only the rich and powerful can enter the CA business. The actual technical chops and physical/operational requirements to become a CA are modest by the standards of the average HN reader, but the financial cost for the audit required to wind up in the browser trust stores is prohibitively high.

...That, and given the massive failures we've seen coming out of the CA world recently, I question whether those audits are actually worth anything.

<comment><USER43> Aren't the audits what allow us to find out about the failures, and revoke their ability to be a CA?

<comment><USER42> How many of the most recent failures have come to light as a result of a failed audit, and how many were due to a post-audit, outrage-generating violation of basic best practice and common sense?

<comment><USER44> The whole point of auditing is to detect problems _before_ they become big, embarrassing, messy failures that put users at risk.

If you hang out on mozilla.dev.security.policy for a while, you'll see plenty of examples of audits exposing weaknesses or sloppiness on the part of CAs, and receiving the resulting pushback from browser vendors. Here's the most recent example I've found: [https://groups.google.com/forum/?fromgroups=#!topic/mozilla....](https://groups.google.com/forum/?fromgroups=#!topic/mozilla.dev.security.policy/Mezqdljjerc)

</comment></comment></comment></comment></comment></comment><comment><USER45> "Bad Actors" in the tech field tend to flock together. Comodo has been at the center of several really ugly stories, this one being the latest. The CEO of Comodo attempted to sue Lets Encrypt before they launched, in order to kill the project because of the threat it represented to their business model. after 24 hours of backlash from the internet public he backed down and said it was all a misunderstanding. Of course.

Cloudflare uses Comodo for their SSL. They could use some other cert authority, but they chose to use Comodo. This is on topic, in a general sense of CAs and trust. It bears repeating: Bad actors tend to flock together.

<comment><USER46> Your argument for guilt by association is not compelling. Cloudflare is their customer. I am Cloudflare's customer. Does that make me a bad actor too?

<comment><USER47> Continued usage of Cloudflare baffles me. They spewed tons of private data, across customer boundaries, on random web responses, which made its way into search engine cache around the world. They conducted an act of Internet censorship:

[https://fightthefuture.org/article/the-new-era-of- corporate-...](https://fightthefuture.org/article/the-new-era-of-corporate- censorship/)

..and the CTO who made that decision later backed down and said he wouldn't make that same decision again. O_o

I really feel like the biggest reason they're still in business is that very few alternatives offer anything really competitive.

<comment><USER46> Keeping nazis off of servers one owns/rents themselves is not censorship.

<comment><USER48> How is that not censorship? Their opinions are wrong and disgusting but kicking them as a customer for their beliefs is very obviously censorship.

<comment><USER9> Censorship is something sovereign entities do. When anybody else chooses what they will or won't say we call that Free Speech. Nazis don't have a right to make other people say what they want.

The fact that American TV networks weren't allowed to say "shithole" in reporting what the US President said is an example of censorship. The FCC, a government agency, requires that they not use certain words. When Fox decided to get rid of O'Reilly that's not censorship that's just basic ability to read how the wind is blowing.

<comment><USER45> You're speaking of a strict definition of censorship which is when an authoritative body is the one censoring. And you are not wrong.

Private censorship is still censorship, however. It is also a form of speech itself.

</comment></comment></comment></comment></comment></comment></comment><comment> cup-of-tea SSL is fundamentally broken. Web-of-trust is the only real way to do security.

<comment><USER49> I think the real sentiment here is: good PKI is an unsolved (and perhaps unsolvable) problem.

<comment><USER50> I agree. The CA model is broken (why should I trust a Russian to certify cia.gov?). The Web of Trust model is less broken in some ways, more in others.

I think a real solution would be something like a multi-root, score-based system (e.g. if the U.S. government, Underwriters Laboratories & ICANN all state that I'm talking to www.google.com/220.127.116.11, then I honestly probably am) — but I'm worried that it'd be way too complex for normal people.

<comment> yjftsjthsd-h I would settle for restricting scope of CAs. As you say, cia.gov should only be signable by (at least) US CAs, but whatever.gov.ru should probably NOT be signable by any American CAs.

CAA records help with this, where available, but still leave some things to be desired.

</comment></comment></comment></comment><comment><USER51> > TL;DR: Forget your EV or other certs. Just run "Let's Encrypt". It gets you > a cert, it's fresh, and it does not make any difference whatsoever. At least > not any you or anyone else can check for, or cares for.

Let's Encrypt shut down their new test interface because of a security flaw they found. If this was in a production service, this would have been about as bad of a security flaw as is possible in a PKI system.

Let's not get all high and mighty assuming Let's Encrypt won't get compromised; they probably will. We should be planning for how to deal with that.

<comment><USER52> That doesn't make sense. You cannot criticize someone for finding an issue in the testing environment _before_ it hits production. That's _literally_ what the testing environment is for.

<comment><USER51> I was not criticizing them (can you quote the part of my comment that was critical?). I was illustrating that they are not perfect, and just using them without considering that they too could be compromised is a bad idea.

</comment></comment></comment><comment><USER53> I think we should use ssh instead of SSL and also ssh instead of username/password pairs.

If somebody is doing a distributed chat/social system, I would use ssh if I were them.

By ssh I don't mean execution commands but rather encryption/authentication framework.

<comment><USER54> ssh is, by default, Trust on First Use which is a significantly different model than a Trusted Thirdparty (CAs).

There are some well known trade-offs, namely that having everyone manually verify fingerprints on initial connect and again on any server change is a large burden.

I don't particularly want to have to go into my bank's local office and verify in person the fingerprint is correct each time they need to rotate a secret.

If this isn't what you meant, that we should use TOFU vs Trusted third party, please do expand.

<comment><USER53> I think it works much better for contacts. You have to verify contact once and then you are assured that it's still the same person.

<comment><USER44> > You have to verify contact once

Only if users never replace their keys, which puts them at significant risk in the event of a key compromise.

<comment><USER55> Replace your key by signing a message announcing your new key?

<comment><USER56> If your key is compromised, anyone can send that message and sign it with your key... :)

</comment></comment></comment></comment></comment></comment><comment><USER57> Browsers need to remove all CAs except Let's Encrypt.

CAs have proven again and again to be ridiculously insecure, and the problem is that there is no penalty for their mistakes.

So just remove them all, after a warning period: Let's Encrypt is enough.

Or if they want to stay in business and be trusted by browsers, then require them to put up at least $100k in cash in escrow for each certificate they sign, which is forfeit if there's evidence that any compromise of that specific certificate, due to their fault, has or may have happened, with at least half of the money being distributed to whoever provides the evidence first.

<comment><USER58> > Browsers need to remove all CAs except Let's Encrypt.

No. I love Let's Encrypt, but we can't put all our eggs in a single basket like that.

Now, if we could somehow foster multiple non-profit organizations like Let's Encrypt, but run under the aegis of different boards and sponsors, I'd be 100% for this idea.

It's very odd that companies for whom CAs business is quite literally a money printing operation can't be bothered to do the relatively minimal maintenance and care required for a trustworthy CA. A bizarre and unexpected failure of the market.

<comment><USER57> Security requires that ALL CAs be secure, since any compromised CA can compromise all websites (barring fragile schemes like pinning or certificate transparency checks), so the less CAs there are, the more secure the system is.

It's like a building that needs secure doors: it's better to invest in a single, massive, bulletproof, guarded door rather than inviting anyone who meets some standards to add a door to the building, since what matters is the weakest door.

<comment><USER59> The proper solution is to actually make sure the CAs are secure, it doesn't matter if there are 1 or many. Also more CAs mean that any problems are only localized to their certificates instead of the entire internet.</comment></comment></comment></comment>


Next steps for Wayland support - <AUTHOR> https://community.ubuntu.com/t/next-steps-for-wayland-support/1122 <comment><USER2> Weren't they going to abandon Mir in favor of Wayland?

<comment><USER3> The new Ubuntu GNOME desktop doesn't use Mir, but Mir is still being developed for other uses, like embedded devices. It's also one potential way Ubuntu MATE may get Wayland support.

<comment><USER4> So it should really say "Next steps for Wayland support in MIR". As it is, it seems a lot like this is for Ubuntu proper and not just those who want to maintain MIR. If MIR isn't the main path forward for Ubuntu, then this is not relevant for a lot of Ubuntu users.

<comment><USER3> In the post author's defense, in the context of the Mir category of that site, it makes sense.

</comment></comment></comment></comment><comment><USER5> > _There's currently not a good Wayland test suite - something you can run > against your compositor implementation to verify that your implementation of > the protocol behaves as expected._

Bad test suite was one of the reasons why Canonical started Mir in first place. It is good to see this ported to Wayland.

</comment><comment><USER6> A next step for Wayland, in general: [https://github.com/SimulaVR/Simula](https://github.com/SimulaVR/Simula)

This is a Wayland-based 3D compositor for usage in VR (HTC Vive, etc). Imagine a future Ubuntu that let you navigate your work in highly immersive 3D environments. :-)

<comment><USER7> Given the graphical glitchiness and inconsistency of even 2d desktop environments in Linux the idea of experiencing that in 3d seems... irritating at best, nauseating at worst.</comment></comment>


Don't Bother Recruiting at This LA Hackathon - <AUTHOR> http://pydanny.com/los-angeles-open-source-sprint-on-nov-4th.html

<comment><USER2> Hmmm... is this a good thing, or a bad thing?</comment>