[liberationtech] Jacob Appelbaum's Ultrasurf Report

Fri Apr 20 12:40:09 PDT 2012

Hi Catherine,

On 04/19/2012 03:16 PM, Catherine Fitzpatrick wrote:
> Jacob Appelbaum's agenda doesn't seem to be entirely altruistic here
> with this Ultrasurf report.
> 

Where did I claim altruism? I am auditing tools that claim to be
perfectly anonymous because it benefits everyone to have honesty and
truth in advertisement for our community of tools.

I did however invest, as Ultrasurf acknowledged, a great deal of time in
disclosure to Ultrasurf. I also invested a great deal of time in making
positive suggestions, which were largely accepted by UltraReach. I hope
you'll note that the language on their website is drastically different
today if you compare it to the text on their website from a year ago.

Honesty in advertisement is important information that helps users to
make an informed decision and to ensure that Government funded projects
at least attempting to be honest in how they sell themselves to their users.

> There's a lot going on -- first, there's the desire of him (and his
> supporters) to attack the US government and "DC Lobbyists" merely for
> what they are, which is a hated government with a disliked Internet
> Freedom program, which has put him under investigation for his
> involvement in WikiLeaks (his buddies at the State Department
> notwithstanding). 

This is nonsense. Not only do you have it all wrong, you're actually
just out of your depth. It shows.

I am not attacking the US government. To be quite honest, I gave this
report to those around DC that asked - this includes people at State,
BBG and of course, Ultrasurf - well before the report was released to
the public. I did this to ensure that we could broker a discussion with
Ultrasurf to ensure that Ultrasurf felt we were coordinating and being
responsible.

I did not give this to the Chinese or Iranian or Syrian governments nor
any of their agents or anyone that I felt would do Ultrasurf harm or
attempt to attack their users.

I actually rather like the Internet Freedom program, it's not perfect
but it's pretty good! So again - you think you know what I think but
you're mistaken.

> Second, there's the desire to attack any competitor
> of Tor, especially a competitor that adheres to the idea of
> proprietary versus open source software. These are religious
> matters.

Surely you don't suggest that for proprietary or open tools it is
reasonable to never have a third party security audit?

There is no competitor to the Tor Project in the field of online
anonymity. There are charlitants who claim to be perfectly anonymous and
untraceable - as we see with Ultrasurf - they do not live up to their
advertised claims.  You conflate Free and Open source software with peer
review, which is understandable but a very serious mistake to make.

If you suggest that peer review is a religous matter, I think you're
making an even bigger mistake. Do you realize that there has been *no*
peer review - even by funders of the tool? None. Zero. This is changing
now and that is because of my peer review of their claims. I have even
offered to help them and have given them a large amount of time in the
last six months because I want them to improve.

The fact that they are closed source presents them with a serious
problem and I'd love to hear your suggestions for a solution with it. It
appears that some governments, such as Syria and likely China release
backdoored versions of software. I have some samples of a common tool
which appear to have such a backdoor. AV software sometimes
automatically classifies Ultrasurf as malware. This is usually a
mistake. However - what happens when it actually includes malware *and*
it actually has something wrong with it? Say because it has been
tampered with in transit or an attacker, such as the Chinese, compromise
the download servers?

One solution is to offer source code and for trusted users in a
community to review them, and to ensure that any changes make sense or
fit with the established norms of the system. It's also possible to look
at copies of the program in every linux distribution, every released
copy on software mirrors and other places to compare with the expected
result.

Another solution is to offer digital signatures - this is something that
is now happening because of my report. The downside is that China and
the Stuxnet authors both clearly have the ability to falsify the
selected digital signature method selected by Ultrasurf.

So - again, we see no peer review and no safe method of verification.
I'd love to see you solve those problems and while Open and Free
software doesn't solve it all, I think it gets us a lot closer.

So do please offer suggestions and try not to punt.

> 
> In other words, when a person who runs a competing open-source
> software solution, who has his reputation largely wrapped in it, goes
> and publicly attacks a proprietary software solution as inferior and
> even harmful, and attacks a software used by a government that has
> him under investigation, it's ok to question where he is going with
> this.
> 

The facts stand for themselves. You're unable to evaluate those facts
and as a result, you simply, as usual, attack me. I mean, you're
welcome, I think the solution to "bad" speech is more speech.

> There is the added dimension of the pornography issue -- Appelbaum's
> slam on Ultrasurf for blocking porn distracts from the fact that Tor
> is notoriously used for viewing pornography, including illegal child
> pornography.

Do you have proof that Ultrasurf blocks Child Porn Catherine? I suspect
the answer is no - which well, I think that's because the answer is no.

The fact of the matter is that they block access to legal US
enterprises. I think that government funded services have a duty of care
not to restrict access to legal US businesses - this is why I am against
Amtrak censoring the internet - don't censor with public money.

In any case - just to settle this issue - members of police forces
around the world use Tor, as does the Internet Watch Foundation, to hunt
for Child Porn - they need anonymity, so that they can find the bad guys.

Do you have another suggestion for an anonymity solution that is good
enough for the Internet Watch Foundation to catch sexual predators? I
bet they'd love to hear it and most of all, I'm certain this list would
be interested in such a solution.

Frankly, I think that the good outweighs the bad in this case and I'd
encourage you to admit that you don't actually know the whole story.

> And there's the fact that Appelbaum has published his
> critique just as yet another criminal case involving the use of Tor
> for illegal drug sales is being publicized:
> 
> http://www.justice.gov/usao/cac/Pressroom/2012/045.html

I had no knowledge of this press release from the Justice department nor
would anyone else, I imagine. It's pretty ridiculous to suggest that I
timed the release of my report in response to that DoJ press release.

When I met them in December, we agreed upon a ninety day time frame for
release of the report. The report was originally scheduled for release a
month ago but Ultrasurf asked for more time. I planned the release for
Monday the 16th of April as a firm deadline and they were well aware of
it before publication.

> 
> There is no reason to take his concerns public, as the notion that
> "users need to be warned" isn't sufficient, as most users couldn't
> read a blog in English anyway, and most users don't care about
> anonymity, which they lost to their ISP anyway. They care about
> trying to access blocked sites, and perfection in this effort isn't
> required.

I disagree with you very strongly and many others in the computer
security field, as well as other fields, believe that sunlight is a good
way to solve problems.

This report, as I understand it, has or will been translated into other
languages for the benefit of non-English speaking users.

I think you may be right about "most users don't care about anonymity"
but I'd like you to tell us all - if you claim as a human rights worker
that you won't disclose a report but you actually do disclose it against
their wishes - have you done something wrong? Is honesty in
advertisement important? I think it is very important and as long as
they claim to be anonymous and an anonymity service, I'd ask you to
consider what you're claiming to be irrelevant. The issue is that they
_claim_ to be an anonymity service - it has nothing to do with your
projections of a user, which are speculative at best.

> 
> So this report seems a hostile, politically-motivated attack on his
> part.
> 

Only if you disregard the fact that I have worked closely with them
until I felt they were stalling me and not fixing issues that needed to
be fixed. They sure are working hard to fix those issues now - after
nearly four months of dragging their feet - I think that's a good thing.

> What's important in the fight for Internet freedom are the following
> principles of non-coercion:
> 
> o no one should be forced or brow-beaten into using open-source
> software; proprietary software is ok to use. If your opensource
> software is demonstrably better, it will sell itself without you
> having to artificially level the playing field with constant
> ideological attacks

We disagree about Free Software in this field and that is OK. In the
area of anonymity and security, I think that we must have tools that
regardless of their license, are open for review and verification. That
is why Free and Open source software is on the table. It makes it easier
and frankly, possible, to review claims.

I'm not forcing or brow-beating anyone. I presented a paper with some
serious concerns, I worked with Ultrasurf to correct a number of the
most serious, and I have encouraged further third party review to
improve their system.

If that's brow-beating - what is your email where you directly attack
me? It seems a bit duplicitous at the very least and it reeks of
political attacks against me for my associations that you despise.

> 
> o no one who produces proprietary software solutions should be
> bullied into having to discuss their flaws openly or be forcibly
> outed as to their flaws;

You keep saying that I'm a bully but you fail to acknowledge that I
worked with Ultrasurf, flying to another state to meet with them,
disclosing the report to them privately and so on.

There was no bullying.

> it merely helps give ideas to authoritarian
> governments and doesn't really help users.
> 

Do you have evidence for your assertion here? I'm guessing "no" but I'd
like to know. Yes? No?

> o if you don't like proprietary software, you don't have to wage a
> jihad against it, you can make your own opensource software that is
> supposedly better
> 

It's not hard to do that and many people have done so.

> o pluralism is the best defense against authoritarianism, not
> everyone being forced to go to "the best" circumvention tool or "the
> ISP that secures your privacy". It's precisely when the market is
> open with a variety of options that authoritarian is undermined
> 

It's nice that we actually, for once, agree. Pluralism in design choices
is absolutely required. It is an example of how a free market may work
in a practical sense and I support that concept entirely.

Security researchers who test claims are serving as a correction to
overvalued ideas or solutions in the market.

> o software does not have to be perfect to largely achieve its goal --
> 1/99 binary thinking is a killer of freedom

There is no perfect software but there are those who claim perfection
without acknowledging their imperfections. That is a real problem.

> 
> o people have the right to be wrong about software -- an open society
> requires that right to be wrong and to float contrary hypotheses even
> if they are incorrect, politically or otherwise
> 

I agree. I also have the right to show the world that there is something
wrong with that very software.

> o you don't have to be technically capable to criticize software that
> profoundly influences all of us as we increasingly move our lives on
> line.
> 

You're right - you don't have to be literate in a field of specific
interest to criticize it. However, it sure would help if you
acknowledged that Ultrasurf's designated enemy is however quite literate
on the subject matter.

Today someone pointed me at this report authored by an academic in China:

https://www.scribd.com/doc/90338145/UltraSurf-analysis-by-Zhang-Lei-in-Chinese

> My thoughts:
> 
> 
> http://3dblogger.typepad.com/wired_state/2012/04/jacob-appelbaums-obfuscation-about-circumvention.html
>

Thanks for your thoughts - I hope you'll address each of my points and
try to be constructive.

It's been a pleasure,
Jacob
_______________________________________________
liberationtech mailing list
liberationtech at lists.stanford.edu

Should you need to change your subscription options, please go to:

https://mailman.stanford.edu/mailman/listinfo/liberationtech

If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?"

You will need the user name and password you receive from the list moderator in monthly reminders. You may ask for a reminder here: https://mailman.stanford.edu/mailman/listinfo/liberationtech

Should you need immediate assistance, please contact the list moderator.

Please don't forget to follow us on http://twitter.com/#!/Liberationtech

----- End forwarded message -----
-- 
Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE