34 ms·

> It almost makes me wish we could abolish standards committees. I have for some time let myself believe that standards committees are a politically correct wa

by bostik 11y ago

> It almost makes me wish we could abolish standards committees. I have for some time let myself believe that standards committees are a politically correct way to ensure incompatibility. My boss/supervisor from an earlier life was a regular in IETF IPSec working group. (This would have been in 2004-2005.) He commented, on several occasions, that the reason IPSec was such a travesty of a spec was because the working group was infested(!) by employees from all the big players. Each of whom made absolutely sure that their bastardised version of IPSec was allowed (and therefore declared compatible) by the spec, no matter now insane, inane or outright nonsensical it was. I still remember with horror the kinds of contortions we had to make our code do to support L2TP IPSec with native clients on multiple OS's. (Think: kernel patches that would cause maintainers to claw their eyes out.) He also quipped that IKEv2 was supposed to fix most of the problems encountered with IKEv1, but thanks to the special interests involved, he didn't expect it to come out any time soon, and even then he had no idea how badly it would be watered down when it did. The RFC for IKEv2 eventually came out in 2010.[0] I haven't had much of a look, to be honest. Apart from Cisco and Juniper, is anyone even really using IPSec for real these days? 0: https://tools.ietf.org/html/rfc5996 https://tools.ietf.org/html/rfc5996

pjc50 11y ago
We know from the elliptic curve debacle that standards committees provide an opportunity for active sabotage. IPSec is a useless nightmare as you say.
tptacek 11y ago
The IPSEC working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes they were plowing ahead with. A decade later, Eric Hughes (I think? One of the early cypherpunks) made news by suggesting that NSA had deliberately sabotaged IPSEC, implanting crypto vulnerabilities derived (IIRC) from IV handling mistakes. If you go back and look at the threads, it's pretty clear that wasn't NSA: the personalities involved aren't hard to track down. It was just garden variety bikeshedding. The problem definitely isn't that standards groups attract noisy morons. William Simpson is very well regarded as a systems person. The problem is that it puts specialists in one field, specialists from others, and generalists in a room together, and puts them all on the same tier, and says "let the most persuasive person win".
- bostik 11y ago
  > working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes I did not know that, thank you for pointing it out. On the other hand, I think I even read through the other material: > A decade later, Eric Hughes (I think? One of the early cypherpunks) made news [...] I got the link from somewhere, possibly on SILC, and remember the ensuing discussion. There was a lot of bickering, and one of the comments has remained with me. Can't remember the exact words, but the context was "if this was NSA, they sure knew how to appear juvenile."
beagle3 11y ago
(unrelated to crypto, but) that's how we got XMPP. Back in '99, there was an IETF working group tasked with creating a chat protocol, with members from all the players at the time (AOL, Microsoft, IBM, Netscape, and a few more). I wasn't part of the wg, but I did follow it closely, and it was clear that some big players only cared about making their own product (as close as possible to) the standard (e.g. Microsoft), and the biggest player (AOL) was just actively sabotaging the process in order to prolong their advantage. Eventually, the group disbanded, and the mostly-working protocol at the time (Jabber -> XMPP) was adopted. It was a horrible ultra verbose under specified mess (and in some cases still is). But it was there, it was working, and it was open.

by bostik 11y ago

pjc50 11y ago

We know from the elliptic curve debacle that standards committees provide an opportunity for active sabotage. IPSec is a useless nightmare as you say.

tptacek 11y ago

The IPSEC working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes they were plowing ahead with. A decade later, Eric Hughes (I think? One of the early cypherpunks) made news by suggesting that NSA had deliberately sabotaged IPSEC, implanting crypto vulnerabilities derived (IIRC) from IV handling mistakes. If you go back and look at the threads, it's pretty clear that wasn't NSA: the personalities involved aren't hard to track down. It was just garden variety bikeshedding. The problem definitely isn't that standards groups attract noisy morons. William Simpson is very well regarded as a systems person. The problem is that it puts specialists in one field, specialists from others, and generalists in a room together, and puts them all on the same tier, and says "let the most persuasive person win".

bostik 11y ago
> working group also boasts the hilarious threads where William Simpson and Perry Metzger ran Phil Rogaway --- Phil Rogaway! --- off the list for trying, early and without success, to fix some of the more basic crypto mistakes I did not know that, thank you for pointing it out. On the other hand, I think I even read through the other material: > A decade later, Eric Hughes (I think? One of the early cypherpunks) made news [...] I got the link from somewhere, possibly on SILC, and remember the ensuing discussion. There was a lot of bickering, and one of the comments has remained with me. Can't remember the exact words, but the context was "if this was NSA, they sure knew how to appear juvenile."

beagle3 11y ago

(unrelated to crypto, but) that's how we got XMPP. Back in '99, there was an IETF working group tasked with creating a chat protocol, with members from all the players at the time (AOL, Microsoft, IBM, Netscape, and a few more). I wasn't part of the wg, but I did follow it closely, and it was clear that some big players only cared about making their own product (as close as possible to) the standard (e.g. Microsoft), and the biggest player (AOL) was just actively sabotaging the process in order to prolong their advantage. Eventually, the group disbanded, and the mostly-working protocol at the time (Jabber -> XMPP) was adopted. It was a horrible ultra verbose under specified mess (and in some cases still is). But it was there, it was working, and it was open.