I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company you're fine.
Might as well start sending 249 requests to every company they can think of.
> I'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company you're fine.
I think you just answered your own question. The difference between 0 and 1 is pretty important.
Think of it this way: until relatively recently, Github would return either a 500 or a login page (I forget which) if a logged-out user tried to access a private repo, whereas they would return a 404 if a logged-out user tried to access a nonexistent repo.
If someone thought that you were working on a secret project and they had an idea what the project name might be, they would be able to confirm this with a simple HTTP request. They don't even need to see the contents of the repository in order to obtain what could be potentially damaging information (the mere existence of the project).
This way, one can never be sure whether a company has received any letters, which is itself a rather valuable piece of information, until they have already received a large number (and presumably for a large number of targets).
The cynic in me thinks the publicity associated with reporting anything is going to make it impossible to tell who got any at all once it's a marketing tool.
The usage of a 0-249 block also keeps that sense of fear for the user base of the service(s). A sort of government scare tactic, you could say.
If a service was allowed to say that they had 0 requests, perhaps more users would flock to that service as a less surveilled alternative to a competitor that is in the 1-249 bracket(or higher).
As a Cloudflare customer, I'm really happy to see this. Cloudflare provides a great service, but to do so, they have to assume a position of enough power that makes them an easy (legal) target for a determined government.
As a US resident (and citizen), though, I find this very disconcerting. The difference between 0 and 249 requests is a lot.
There isn't much else a company the size of Cloudflare can be expected to do (lobbying the government requires levels of cash that I doubt Cloudflare has right now), but it makes me sad that this is even newsworthy.
They say they've received 0-249 NSLs, but they also said "CloudFlare will therefore challenge in court any NSLs we receive." While it's possible this statement doesn't apply retroactively, they seem to be implying they haven't received any NSLs.
14 comments
[ 3.1 ms ] story [ 40.5 ms ] threadI'm puzzled why it's not 1-249 with 0 being a different group. So this law basically means that as long as you send less than 250 requests to a single company you're fine.
Might as well start sending 249 requests to every company they can think of.
I think you just answered your own question. The difference between 0 and 1 is pretty important.
Think of it this way: until relatively recently, Github would return either a 500 or a login page (I forget which) if a logged-out user tried to access a private repo, whereas they would return a 404 if a logged-out user tried to access a nonexistent repo.
If someone thought that you were working on a secret project and they had an idea what the project name might be, they would be able to confirm this with a simple HTTP request. They don't even need to see the contents of the repository in order to obtain what could be potentially damaging information (the mere existence of the project).
This way, one can never be sure whether a company has received any letters, which is itself a rather valuable piece of information, until they have already received a large number (and presumably for a large number of targets).
If a service was allowed to say that they had 0 requests, perhaps more users would flock to that service as a less surveilled alternative to a competitor that is in the 1-249 bracket(or higher).
As a US resident (and citizen), though, I find this very disconcerting. The difference between 0 and 249 requests is a lot.
There isn't much else a company the size of Cloudflare can be expected to do (lobbying the government requires levels of cash that I doubt Cloudflare has right now), but it makes me sad that this is even newsworthy.
If you've never received one, my understanding is that there's no law preventing you from saying "0", so why wouldn't you if it were true?