Does Calibre have a NSA backdoor?

[unboggling]

But seriously, on the general issue raised in the first post above, I don't worry about it.

Anyone with serious resources -- such as a government agency -- can know or learn pretty much everything about me. The tracking and profiling doesn't bother me, because I filter out as much advertising as possible anyway. I'm not political. I'm not a threat. So why would anyone waste time messing with little old me?

On one hand I find it mildly annoying that some of what I read might be tracked. For example, a few weeks ago I was reading a novel in which a character murdered someone with an esoteric poison I'd never heard of. I looked it up on Wikipedia, aware that it might become known in the future that I'd looked up that poison on Wikipedia that day. So I'd better not kill anybody using that poison, or perspicacious investigators might unearth that suspicious research. It was a passing thought and mildly annoying. But since I don't intend to ever poison anybody, that remains minor annoyance.

On the other hand, I understand why the security agencies want as much raw data as they can get. It's a cold, cruel world and there are lots of crazy or malevolent people in it. I feel a little safer knowing people are watching for internal or external security threats.

So, the mild annoyance balances the mild sense of safety and I don't worry about it. Because I'm not a criminal, terrorist, or spy.

Meanwhile, I use calibre to manage the books I read.

Reiterating what MelBr mentioned above: They don't need backdoors into calibre or even operating systems. The NSA (for example) is reputed to have supercomputers, decryption experts, network experts, and raw internet packets.

[MelBr]

unboggling,

If you just want to stay sane and don't have to worry about things you've described, de-Google yourself as much as possible. They're the "Big Brother" everyone has warned us about and they can track you across 90%+ of websites even if you never visit google directly. Most of the top 10,000 websites include some form of Google web bug that can track you: Google Analytics, Adsense, Doubleclick, Google+ share buttons, Google Fonts, Youtube videos, Google JS CDN etc etc.

The issue is that even if you're not a threat, you can still be categorized and put into some undesirable category. It's the "false positive" issue. https://en.wikipedia.org/wiki/Precision_and_recall

These Type I and II errors then cause this type of situation: http://news.yahoo.com/google-pressur...140900667.html

Use Firefox (don't use Chrome "botnet") and install DisconnectMe or Ghostery, Adblock Edge (not AdblockPlus), HTTPSEverwhere and use Startpage.com as your primary search engine... and get rid of Gmail. Doing just that will eliminate most of your online worries.

[ApK]

Man, from all this Paranoia and Ranting (which I presume is what the letters stand for in that P&R section I've heard about here) you'd think the Internet was actually designed to share and disseminate information. It's like you think the Internet was invented as part of some sort of government project to get more access to information. Geesh. What kooks.

[BetterRed]

Originally Posted by MelBr

Use Firefox (don't use Chrome "botnet") and install DisconnectMe or Ghostery, Adblock Edge (not AdblockPlus), HTTPSEverwhere and use Startpage.com as your primary search engine... and get rid of Gmail. Doing just that will eliminate most of your online worries.

And even when you do all that, and you take the precaution of using a small commercial ad free no frills iMap mail server you can still end up as collateral damage. It happens when the big boys in the Valley call in favours and ask the TPTB to shut down this cheeky upstart service that expects people to pay for what they offer for 'free'.

The TPTB say what, we can't have that - free enterprise, people making their own decisions, people refusing to conform to the norm - that might bring about a civilisation that will see through our deception. This is the USA don't they know that. Eric get the Bolshevik Bullshit Commissariat and their mates to cook up some cock-'n-bull story about Snowden; like they did about ripping babies from humidicribs back in '91, and how the gooks sank our ships in Tonkin, and call Rupe and get him to make a movie about it.

Oh, and send the cyber-drones down to Texas and get them to take out those no frills mail servers, we can't have 410,000 citizens upsetting Mark, Brin and co - we're gunna need their support come next years mid-terms.

EDIT : For those who missed the humour in ApK's post, the Internet started out as DARPAnet, who's DARPA then ? The US Defense Advanced Research Projects Agency - I'd call that a government body, AFAIK Gore never worked for DARPA nor on any project it funded, not sure about TBL.

BR

[chaley]

Originally Posted by BetterRed

AFAIK Gore never worked for DARPA nor on any project it funded

Gore never claimed to have "invented" the internet. A good discussion and analysis of what he really said is at http://www.snopes.com/quotes/internet.asp.

[Sabardeyn]

GORE?!?
That's it, you've jumped the shark for sure now!

[BetterRed]

Originally Posted by chaley

Gore never claimed to have "invented" the internet. A good discussion and analysis of what he really said is at http://www.snopes.com/quotes/internet.asp.

Aaah, but did he ever deny that he didn't invent it But if it wasn't Al Gore who invented it, then it must have been Gore Vidal who did it.

Apart from crazy wing-nuts and loopy moon-bats no one believed that he did or said that he did. Oh dear the wing-nuts and moon-bats just shut down the entire USA guv-in-mint.

Gor' blimey, who writes this rubbish

BR

[unboggling]

Originally Posted by MelBr

… The issue is that even if you're not a threat, you can still be categorized and put into some undesirable category. It's the "false positive" issue. https://en.wikipedia.org/wiki/Precision_and_recall

These Type I and II errors then cause this type of situation: http://news.yahoo.com/google-pressur...140900667.html ...

True. But such situations occur regardless of the specific technology used. For example, while receiving a speeding ticket you ask the police officer for directions to the club where you're meeting someone. An hour later a team of cops raid the club and arrest you for murder. Because it turns out the precinct's computer was temporarily down, and the officer who wrote the speeding ticket belatedly recognized the name of a wanted person, which matches your name. So you spend a couple hours in jail saying "but you've got the wrong guy" until the precinct's computer comes back up and they realize your fingerprints, address, and social security number are different, so free you with apologies.

It is a similar issue to this: Guns don't kill people. People use guns to kill people. The technology is a set of tools. The tools can be used responsibly, or they can be abused. Or simply accidentally misused.

[unboggling]

Originally Posted by MelBr

Use Firefox (don't use Chrome "botnet") and install DisconnectMe or Ghostery, Adblock Edge (not AdblockPlus), HTTPSEverwhere and use Startpage.com as your primary search engine... and get rid of Gmail. Doing just that will eliminate most of your online worries.

Originally Posted by BetterRed

And even when you do all that, and you take the precaution of using a small commercial ad free no frills iMap mail server you can still end up as collateral damage….

Furthermore: Let's say you use particular tools to minimize your internet footprint, disguise your activities, and obfuscate your identity as much as possible. Wouldn't security agencies want to track you in particular even more closely than people who don't bother with such tools? Isn't the mere use of such tools like waving a red flag at a bull?

[MelBr]

Originally Posted by unboggling

So you spend a couple hours in jail saying "but you've got the wrong guy" until the precinct's computer comes back up and they realize your fingerprints, address, and social security number are different, so free you with apologies.

Yeah, but you're left with mental anguish and you could be spending months trying to expunge your arrest record (which is a huge detriment if you're looking for a job) and trying to expunge your fingerprints from the system (I think it's impossible to remove fingerprints from the FВI database).

Originally Posted by unboggling

Furthermore: Let's say you use particular tools to minimize your internet footprint, disguise your activities, and obfuscate your identity as much as possible. Wouldn't security agencies want to track you in particular even more closely than people who don't bother with such tools? Isn't the mere use of such tools like waving a red flag at a bull?

What you've described is an argument from ignorance fallacy. There's really no harm in reducing your web footprint. "Absence of evidence is not evidence of absence."

[unboggling]

Originally Posted by MelBr

What you've described is an argument from ignorance fallacy. There's really no harm in reducing your web footprint. "Absence of evidence is not evidence of absence."

Unless the actions to reduce your footprint and keep it reduced are indicators that increase the likelihood of your footprint being flagged as suspicious. Hypothetically. Which in turn could increase the probability of subsequent potentially false or unfalse positives in your case. Hypothetically.

I'm not a lawyer, but: Perhaps the false positive's supposed "mental anguish" at being in jail for a couple hours is outweighed by the coolness factor and brag rights at parties. And who cares if an employer learns that you were arrested and released due to mistaken identity. If the employer wants to use that as an excuse, sue them and win. Plus, you wouldn't want to work there anyway. And I'd also hope the false positive didn't sue the cops just for doing their job.

[BetterRed]

@unboggling - My 8+ years of Lavabit use had nothing to do with hiding myself or my messages. My ISP does not offer IMap, Google was going through its "you did have mail, but we lost it" phase, hotmail required me to install WebDav connectors which only worked with their mail clients, and yahoo is... well its yahoo

I chose Lavabit (from several commercial mail service providers) because it was simple (its UI didn't change at all in the 8-9 years I used it - I love that), it had no record of ever losing any mail, it worked with the several mail clients I tested. And it was a small business - I'm a capitalist, so I encourage entrepreneurs and start ups - sometimes by investing in them, more often by paying for their services.

All that stuff in the media about it using very secure encryption is bullshit as far as I'm concerned - maybe there was some super duper premium service that did that - but it must have been a secret because I never saw it.

I had almost nine years of my 'important' mail on the Lavabit servers that I could access from wherever I happened to be - even in China. I had mail to/from Tax authorities and banks in UK, SNG, NZ & AUS, US immigration, my solicitors, my partner, my mum and aunties, friends in lots of countries, mates serving in US & Aus armed forces in Afghanistan & Iraq, doctors and hospitals etc etc. Now all I have is a mish mash of Outlook pst and eml files on a couple of hard disks.

The NSA would have known of Snowden's use of Lavabit, and they would have been monitoring his account (mine too no doubt). Just after HRW Moscow agent Tanya Lokshina's posted Snowden's email addy on her Facebook account a couple of Congressman jumped up and down and asked what the Administration was doing about it - slam, bam and damn the consequences, it was closed down. You might wonder how the US congressmen knew of Tanya's post - a link to it appeared in an article on the UK Telegraph site - that's where I found it, maybe a Congressman's intern did too.

I imagine the NSA would have preferred otherwise, but for purely political reasons it was closed down - and 410,000 people lost all their mail, primarily US citizens, no doubt some conducting small legitimate businesses employing other US citizens - and no doubt all paying their health insurance and taxes.

Am I pissed off, yes, very much so - but I'll shut up now - did the OP ever make a 2nd post?

br

[unboggling]

@BR, I imagine the OP was trolling. But it is an interesting subject. Re Lavabit, I wasn't talking about that service in particular. Nor alluding to political interference in intelligence activities. AFAIK political heavy-handedness is not particularly technology-dependent. Though I'm not a historian either.

[MelBr]

Originally Posted by unboggling

Unless the actions to reduce your footprint and keep it reduced are indicators that increase the likelihood of your footprint being flagged as suspicious. Hypothetically. Which in turn could increase the probability of subsequent potentially false or unfalse positives in your case. Hypothetically.

I'm not a lawyer, but: Perhaps the false positive's supposed "mental anguish" at being in jail for a couple hours is outweighed by the coolness factor and brag rights at parties. And who cares if an employer learns that you were arrested and released due to mistaken identity. If the employer wants to use that as an excuse, sue them and win. Plus, you wouldn't want to work there anyway. And I'd also hope the false positive didn't sue the cops just for doing their job.

That's not how employment law works. Plus your current employer would probably not fire you because of an arrest. Suing over employment/dismissal is extremely hard and a giant waste of your time and life. And in the end, you'd probably end up with a huge bill regardless of the outcome.

As for the miscategorization issue, again, you cannot classify something based on the lack of evidence. That's not how most ML algos work. If you want to get classified and put into various databases, do some Google searches on various subjects of dangerous materials, their procurement, processing and use. That's going to raise some flags for sure. Oh, and browse Islamic fundamentalist forums.

Originally Posted by BetterRed

@unboggling - My 8+ years of Lavabit use had nothing to do with hiding myself or my messages. My ISP does not offer IMap, Google was going through its "you did have mail, but we lost it" phase, hotmail required me to install WebDav connectors which only worked with their mail clients, and yahoo is... well its yahoo

I never used Lavabit (never heard of it before that incident) but apparently the day after Snоwdеn went public in HK, the owner of the site got the NSL. So apparently they knew his email & provider right away! They must have extensive dossiers on their employees/contractors.

[unboggling]

Originally Posted by MelBr

That's not how employment law works. Plus your current employer would probably not fire you because of an arrest. Suing over employment/dismissal is extremely hard and a giant waste of your time and life. And in the end, you'd probably end up with a huge bill regardless of the outcome.

OK, I stand corrected. My apologies. Don't sue that employer because it's not worth the aggravation.

Originally Posted by MelBr

As for the miscategorization issue, again, you cannot classify something based on the lack of evidence. That's not how most ML algos work. If you want to get classified and put into various databases, do some Google searches on various subjects of dangerous materials, their procurement, processing and use. That's going to raise some flags for sure. Oh, and browse Islamic fundamentalist forums. …

OK, re ML, I assume security agencies also use other additional means of gathering intelligence. Elementary logic: the lack of current proof does not mean you did not do it or intend to do it soon. It is a myth to say you are innocent until proven guilty. Again I make an assumption about attitude: in security/intelligence circles everyone is guilty until "probably-proven" innocent, and even then you'd better keep a close eye on them. By analogy, the competent bodyguard to a VIP automatically assumes everyone in the vicinity is armed and lethal and constantly evaluates potential risks. The lack of apparent gun doesn't mean there is not a lethally dosed nearly invisible needle attached to someone's finger. No gun does not equal no intent to harm. No evidence does not indicate no intent to harm. So it makes sense to constantly evaluate all possible indicators, including subtle or unconscious ones, or even technically astute network-savvy ones.