Hacker News new | past | comments | ask | show | jobs | submit login

That's not the promise they made, rather it was that they had not developed and would not develop any means to circumvent the protection/encryption for paying users' accounts.

The 'not complying' is only a side effect, and is more so tantamount to a refusal to do work for the government in opposition to lavabit's own business promises. I'm not sure the government in any instance has a right to compel work to meet their specified ends.




Here my biases as a secure software engineer may be coloring my comments, because to my mind, building an architecture which solicits sensitive data from clients but fails to preclude the disclosure of those secrets without enormous engineering effort is the same thing as conceding that such disclosure is possible.

Imagine a mail service that operated solely as a Tor hidden service and required all users to use PGP --- for instance, by checking the contents of mail messages to ensure they were encoding them, and rejecting them if they weren't. That's a service that might reasonably make a promise not to cooperate with a court order.

Lavabit didn't have that system and instead had to make a difference promise: that they would shutter the enterprise before cooperating with a court. And so they did.


That's retarded though. The absence of getpeername calls in their frontend does not constitute an inability to comply with a pen register order.

There are costs of doing business and one of the costs is the ability to comply with lawful court orders. You are completely wrong about the government lacking the means to compel compliance.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: