[liberationtech] Introduction --- Haystack

[Danny O'Brien]

On Sat, Sep 11, 2010 at 10:49 PM, Danny O'Brien <danny at spesh.com> wrote:
> First, I'd like to thank Dan for joining this debate. There's a great
> deal of useful information in this document, and much to mull on from
> a technical and design point of view.
>
> I would like, however, to drill down to one non-technical detail. You
> say that you spent some time distanced from CRC and Haystack. Could
> you give the dates of your absence from the project?

I was asked offlist if this question was truly germane to a discussion
of the merits of Haystack.

Let me explain why I believe so. In my conversation with Austin, at no
point did he suggest that Daniel was the only coder on the project,
nor that Daniel had spent any time without a direct and active
involvement in the project. In fact, quite the opposite: when
specifically asked, Austin told me that "around seven" developers,
including himself, worked on the Haystack code. And when I asked him
why development had slowed for so long, he told me that this was
because of the export sanctions licensing process.

I think that much of the merit (and risks) attached to Haystack are
not just technical; they are in part connected to the well-running and
transparency of the institution that runs it.

Clarifying exactly what the CRC has been doing in the last year helps
us all understand better what the risks and benefits of using Haystack
are, and how well they are understood by the organization, and how
well that information is being provided to end-users.

The fact that CRC has been without the direct involvement of their
only Haystack developer for a long period of time certainly explains
the state of the software I saw.

In the interests of establishing a real understanding, I'd like to
repeat my question: when, exactly, was CRC without the direct
involvement of the person who wrote "every line of Haystack"?

d.

> d.
>
> On Sat, Sep 11, 2010 at 6:42 PM, Daniel Colascione
> <daniel at censorshipresearch.org> wrote:
>> I have recently, and _tentatively_, agreed to resume a more active
>> role in the Censorship Research Center, the organization I co-founded
>> June 2009 with Austin Heap, and to continue development of Haystack.
>> Several months ago, I distanced myself from the organization due to
>> fundamental disagreements over transparency, press relations, and
>> other issues. I've agreed to return provided certain changes are made,
>> including a greater commitment to openness, frankness, and involvement
>> with the community.
>>
>> In the interest of transparency, let me make a few unambiguous
>> statements and hopefully resolve any confusion:
>>
>> - Haystack is not complete. A large amount of work remains.
>>  Development was in hiatus until I returned.
>>
>> - We have fewer than two dozen testers as far as I am aware.
>>
>> - The "test" version of Haystack is an early functional testbed that
>>  does not provide the security guarantees we have advertised for the
>>  final product. It was never intended for distribution to anyone
>>  except a small cadre of testers. We are aware of its
>>  vulnerabilities.
>>
>> - Our testers are aware that the test version is not the finished
>>  product, and they are aware that it does not provide the security
>>  properties we guarantee for the finished product.
>>
>> - Our public statements about Haystack's capabilities apply to our
>>  design for the finished product, not to the test version.
>>
>> - The Haystack client will be released as an open-core system under
>>  the GPLv3 or later.
>>
>> - We will submit this open-core version to peer review and incorporate
>>  community suggestions.
>>
>> - We will publish our threat model and rationale and open it to peer
>>  review.
>>
>> - We will publish our cryptographic protocols and open them to peer
>>  review.
>>
>> - We will release the system to the general public only after a third
>>  party has verified that the program operates as designed, and that
>>  our design provides the security properties we describe.
>>
>> - We will never censor our users on the basis of content.
>