logoalt Hacker News

Avamanderyesterday at 4:01 PM6 repliesview on HN

> They "handle the business" while someone else does 99% of the actual work, then ask to split 50/50.

As a response, Micay decided to destroy the update signing keys for all the CopperheadOS devices out in the wild. Resulting in financial damages to Donaldson.

Hardly a level-headed response, even if you disagree about the financial share of something.


Replies

HybridStatAnim8yesterday at 6:40 PM

That is a perfectly level-headed response. Signing keys must be protected. In the event of a hostile takeover, where a malicious party seeks to compromise the privacy and security of your userbase, destroying the keys is a sensible decision. Failure to do so, and successful compromise of the keys, will let the malicious party push whatever update they want, and it will be accepted due to being signed correctly.

It was not a disagreement about shares, it was a hostile takeover. Someone who never owned the project sought to steal it.

show 1 reply
freehorseyesterday at 5:06 PM

> Hardly a level-headed response, even if you disagree about the financial share of something

According to the linked responses, the keys were not deleted because of disagreement over financial share, but over how the keys were to be used (in particular, in potentially dangerous security-wise ways), for which he did not want personal responsibility over (the keys belonged and used by him even before that project)

show 1 reply
spring-onionyesterday at 8:25 PM

Hey! On a quick introductory note, I'm the community manager and the person who was interviewed. Please, read questions 17, 25 and 26 and our respective answers to them in the linked forum thread. In particular the following parts that I'm pasting here for convenience:

Question 17: Did your and Donaldson values begin to diverge? Was Donaldson more concerned with making money than you were?

Answer: [...] In 2018, matters between Micay and Donaldson came to a head over Donaldson’s desire to pursue business deals with criminal organizations, and his attempts to compromise the security of CopperheadOS, including by proposing license enforcement and remote updating systems that would allow third-parties to have access to users’ phones. As part of this process, Donaldson began to demand that Micay provide Donaldson with the “signing keys” - i.e. the credentials required to verify the authenticity of releases of CopperheadOS. Donaldson advised that, in order to secure certain new business, potential customers required access to the Keys.

The keys had been in continuous use by Micay, in his personal capacity, since before the incorporation of Copperhead. However, more importantly, any party with the keys could mark malicious software as “authentic”, and thereby infiltrate devices using CopperheadOS.

Micay was unwilling to participate in that kind of security breach. Since Donaldson had control over certain infrastructure for the open source project, he would be able to incorporate (or hire others to incorporate) the privacy-damaging features described above for all future releases of CopperheadOS. Micay therefore deleted the keys permanently and severed ties with Copperhead and Donaldson.

Question 25: Did things between you and Donaldson devolve when he approached you about a compliance audit? Did he tell you that he needed to know how the signing keys were stored?

From Wired:

We understand that Daniel's recollection was not that James wanted to know more information about how the signing keys were stored, but that he wanted direct access to them.

Question 26: Did you suspect his request was tied to a deal he was brokering with a large defense contractor? Did you believe this would put the entirety of CopperheadOS’ user base at risk?

Answer: Yes and yes.

The large defense contractor in question was Raytheon. The decision to destroy the signing keys was not based on a financial disagreement, but an existential one. Every single CopperheadOS user back then would have been compromised otherwise. It's of course a big deal given the implications, but it acted as a last resort for Daniel to stop a hostile takeover attempt fueled by greed, which he ultimately took because there was no other way out.

show 2 replies
ForHackernewsyesterday at 4:21 PM

Sometimes deleting it all is the only principled action https://www.theguardian.com/technology/2013/aug/08/lavabit-e...

show 1 reply
DANmodeyesterday at 4:25 PM

The keys got wiped for way spookier reasons than Micay wanting money.

Intelligence wanted in, and Donaldson seemingly would have been happy to oblige.

show 2 replies
margalabargalayesterday at 4:15 PM

"Financial damages".

So what? Causing someone financial damages isn't illegal. Your boss causes you financial damages when they fire you. Your competitor causes you financial damages when they offer a discount.

If Micay was a 50% owner, sounds like he didn't do anything illegal. Immature maybe, which simply puts him at parity with the other party involved.

show 5 replies