She framed it as a personal opinion from the very start, where she sought to impress upon us that she may never be hired again by Signal after this post. I thought in this case the in depth legal analysis didn’t add anything to the arguments she was trying to make, though maybe helpful background for some. I don’t think anybody seriously thought Moxie was trying to or had any chance of getting any criminal convictions thrown out, especially not anything concluded before the hack was public! So most of it was pretty moot. HN is well within its lane talking about the substantive points she was going for. And on those, I found her a bit heavy on appeals to “duh” like the following:
> Basically, “I’ll show you mine if you show me yours.” That is not generally how vulnerability disclosure works, and AFAIK, Cellebrite has not taken them up on the offer so far.
This was not an attempt at responsible disclosure, nor was it a specific exploitable disclosure at all. It was a wake up call to everyone, her included, that law enforcement tech is just as shitty as every other kind of tech. Her ideas about how things generally work are not really relevant, but that was literally all she had to say about that. Then back to the perfectly good lawsplainer which formed the vast majority of this opinion piece.
Also, what judges are going around being offended on someone else’s behalf, on the not-court-appropriate cutesy language used outside court in the course of vigorous public debate, by someone who is not even a party to the hypothetical proceedings she discussed? Yes, judges don’t like it when you get cute with them. We get it, you know judges, but this was not the same thing at all, the blog post was not a court filing. It just demonstrated the proposition that Cellebrite evidence was unreliable until proven otherwise. It said: “all ye who are affected by this, start your engines”. It certainly made her run around in circles trying to analyse the implications. That was the point.
> Basically, “I’ll show you mine if you show me yours.” That is not generally how vulnerability disclosure works, and AFAIK, Cellebrite has not taken them up on the offer so far.
This was not an attempt at responsible disclosure, nor was it a specific exploitable disclosure at all. It was a wake up call to everyone, her included, that law enforcement tech is just as shitty as every other kind of tech. Her ideas about how things generally work are not really relevant, but that was literally all she had to say about that. Then back to the perfectly good lawsplainer which formed the vast majority of this opinion piece.
Also, what judges are going around being offended on someone else’s behalf, on the not-court-appropriate cutesy language used outside court in the course of vigorous public debate, by someone who is not even a party to the hypothetical proceedings she discussed? Yes, judges don’t like it when you get cute with them. We get it, you know judges, but this was not the same thing at all, the blog post was not a court filing. It just demonstrated the proposition that Cellebrite evidence was unreliable until proven otherwise. It said: “all ye who are affected by this, start your engines”. It certainly made her run around in circles trying to analyse the implications. That was the point.