[leeoniya]

the only type of architecture that is resistant to this would have to be distributed. for anything centralized and under control of a US company, the US laws can compel them to install intercept devices. sadly, not everything can be distributed, there will be centralization somewhere.

[maxerickson]

So people should start using it and hope that when the US compels them to do something, it is done in a way where Mozilla can resist it politically?

[leeoniya]

it's hard to answer this with a blanket statement because it's one company that does many things and builds many products. i'm not sure what the law says about requiring a company to continue to operate a service just for the sake of intercepting traffic, when the morals/mission of the company would otherwise terminate the service. i'd be interested to see if something like this has been tested in court.

the general rule of thumb is, don't base critical parts of your business or personal life on third-party cloud products that may go away for whatever reason, without your control and without notice. this includes Google's random termination of APIs, encrypted email services, etc. have a plan B if for some reason the Tor relays need to be suddenly taken offline, forever.

[hadoukenio]

Company morals, mission statements, constitutions etc are marketing material and not law. If the law requires a company to comply but their mission statement goes against this, the law will win every time.

[bzbarsky]

This is why the right place to put this sort of thing if you're really serious about it is in the corporate charter. Then it does become law as far as the company is concerned, since it's only chartered to operate under the terms of the charter.

Unfortunately, some jurisdictions don't allow sufficient customization of corporate charters to do this yet. It's been getting a bit better recently.

[leeoniya]

i dont think i claimed their morals would allow them to not comply with the law. but a company's past conduct is pretty important to evaluate in the context of how such situations will be handled. i'm unaware of a law that requires companies to continue providing compromised services to their users, for example.

[maxerickson]

I still don't see why someone worried about the US government would even start using a service where the best outcome of a warrant is that the service gets shut down.