6 ms·

patio11 wrote on Twitter (https://www.twitter.com/patio11/status/664551822120476672 https://www.twitter.com/patio11/status/664551822120476672): > Tor is having

patio11 wrote on Twitter (https://www.twitter.com/patio11/status/664551822120476672 https://www.twitter.com/patio11/status/664551822120476672): > Tor is having a fit of institutional pique that researchers are compromising the network's privacy guarantees by, well, looking at it. > If you write security software, and you're not praying that loyal opposition hits you with everything they've got, you're not doing security > Tor is intended to be, and is marketed as, robust against nation state adversaries. It cannot possibly be so if it worries about academics.

bri3d 11y ago
If, as the Tor blog post insinuates, the product of the CMU research was "targeted data dump to the Feds to investigate criminal activity," I could see the hand-wringing being warranted. That's paying a university to do law enforcement work. If the product was (as it seems based on public information) "paper about how to attack Tor along with a couple of case studies," I really don't see the problem. The kerfuffle around the talk and paper's release is certainly interesting in its own right, though.
- gwright 11y ago
  > That's paying a university to do law enforcement work. Not really. The organization involved is SEI, a Federally Funded Research and Development Center sponsored by the Department of Defense. Not at all the same thing as CMU. Mentioning this for clarity, not as a statement about the actually activities.
  - zurn 11y ago
    So it's FBI paying the military to do law enforcement work. Not really better.
ikeboy 11y ago
There's a difference between white hat and black hat. Working for the other side is not white hat, and arguably security software writers should only welcome white hat research.
- tedunangst 11y ago
  Everything would be so much simpler if the people writing "secure" software could pick who got to attack it.
  - ikeboy 11y ago
    But after-the-fact reputational effects seem fine, if the action was unethical.
  - pyre 11y ago
    Your position seems to imply that "bank robbery" should not be a crime because banks are supposed to be secure, and it's their own fault that there was a flaw in the system. I think that reasonable people can conclude that a system should be secure, there are things that "shouldn't" be done, regardless of the security of the system. It's not to say that "outlaws" won't break the law, but that we view their actions as negative (even if in a perfect world their actions would be futile).
    - tedunangst 11y ago
      I would not keep my valuables in a bank whose security consisted of a "keep out" sign.
      - pyre 11y ago
        I didn't imply that you should. My statement still stands. While "they shouldn't have done X" is not security, that doesn't mean that the statement is devoid of meaning, or that we should ignore the question of whether or not "they should have done X." Edit: Your statements seem to imply that because "100% security" would mean that anyone "doing X" would have no result, then everyone should be allowed to "do X" without question.
        tedunangst 11y ago
        I am saying that regardless of what we'd like to expect, we should prepare for the unexpected. Picking your attacker is doomed to fail; don't try. I don't think this is controversial.
striking 11y ago
Yeah, but CMU allegedly got paid a pretty big chunk of money for it. If they were just doing research, whatever. But $1m? That's a whole lot of taxpayer money.
- jeromegv 11y ago
  Well TOR is also funded by taxpayer money...
  - striking 11y ago
    My point was "this is more money than CMU should have gotten for looking into the Tor network, especially from the FBI" rather than "taxpayers paid for this"
    - structural 11y ago
      In the government contracting world, $1m is an absolutely tiny program - keep in mind that this covers not only the research, but also all the overhead / facilities / computers / keeping the lights on stuff. $1m will cover something like 3-4 staff for about a year. Less, if they're senior people.
  - federico3 11y ago
    *Tor
- tedunangst 11y ago
  $1M is not a lot of money. That's not nation state money; that's Tim Tebow money.
  - brazzledazzle 11y ago
    That's irrelevant to his point.
    - twblalock 11y ago
borkabrak 11y ago
Your points are well-taken, but I would expect academics to be the only demographic more likely than governments to compromise a well-designed security system. Although I suppose the academics I mean aren't undergrads..
deleted 11y ago
[deleted]
comex 11y ago
A group that performs an actual attack, hands the result to a nation state adversary, and doesn't publish the results either before or after (except in the abstract of a withdrawn talk) is hardly the "loyal opposition". edit: Academics are not Obama's proverbial JV team. One should expect them to be as smart as those working for internal agencies, if somewhat less focused on attacking real-world systems. It seems that in this case, the only difference is that they're somewhat worse at keeping secrets, but given that the talk was withdrawn, it's not that they didn't try. So I don't see the grounds for the implicit suggestion in the quoted tweets that they aren't 'real' adversaries.
- cuckcuckspruce 11y ago
  > One should expect them to be as smart as those working for internal agencies, if somewhat less focused on attacking real-world systems. It's this reason, along with DARPA and similar funding, that I call it the military-industrial-(higher-)education complex.
kevinchen 11y ago
This misses the point entirely. Nobody is saying that security researchers shouldn't find vulnerabilities. The problem is that rather than publishing or filing a bug, the researchers helped the government exploit it for $1M. Effectively the same as selling the exploit on the black market.
- XorNot 11y ago
  Yeaaaahhhh no. In exactly the same way that the military is not mercenaries.
  - hobs 11y ago
    And civilians are not the military.
Hello71 11y ago
I believe the complaint here is not that they were analyzing the software, but that they were launching active attacks and using the results in an unethical manner, i.e. to conduct possibly-illegal criminal investigations. This is Not OK in the same way that it's Not OK to go around breaking into people's houses with lockpicks and searching them on the grounds that you are conducting lock research. Note that I understand that physical lock security is a relatively well-settled field. That is not relevant to the point at hand; even if it were an important thing to study, it would be Not OK for the government to be paying people to go around picking locks. Edit: Furthermore, by the same logic, it is acceptable for the government to do nearly anything illegal in order to conduct "research". Microsoft, Google, and co claim to be secure, so therefore it should be OK for the government to be attacking them.
abdullahkhalids 11y ago
A lot of people in this thread are misreading the blogpost. The primary complaint is against Feds and not CMU[1], specifically that the Feds used a loophole in the legal system to exploit Tor. They are then asking the university and researchers to be more careful about the funding/nature of their research and blaming them for bringing academic security research into dispute. I agree that some of the middle paragraphs could have been worded more carefully. [1] "Civil liberties are under attack if law enforcement believes it can circumvent the rules of evidence by outsourcing police work to universities." from post

bri3d 11y ago

If, as the Tor blog post insinuates, the product of the CMU research was "targeted data dump to the Feds to investigate criminal activity," I could see the hand-wringing being warranted. That's paying a university to do law enforcement work. If the product was (as it seems based on public information) "paper about how to attack Tor along with a couple of case studies," I really don't see the problem. The kerfuffle around the talk and paper's release is certainly interesting in its own right, though.

gwright 11y ago
> That's paying a university to do law enforcement work. Not really. The organization involved is SEI, a Federally Funded Research and Development Center sponsored by the Department of Defense. Not at all the same thing as CMU. Mentioning this for clarity, not as a statement about the actually activities.
- zurn 11y ago
  So it's FBI paying the military to do law enforcement work. Not really better.

ikeboy 11y ago

There's a difference between white hat and black hat. Working for the other side is not white hat, and arguably security software writers should only welcome white hat research.

tedunangst 11y ago
Everything would be so much simpler if the people writing "secure" software could pick who got to attack it.
- ikeboy 11y ago
  But after-the-fact reputational effects seem fine, if the action was unethical.
- pyre 11y ago
  Your position seems to imply that "bank robbery" should not be a crime because banks are supposed to be secure, and it's their own fault that there was a flaw in the system. I think that reasonable people can conclude that a system should be secure, there are things that "shouldn't" be done, regardless of the security of the system. It's not to say that "outlaws" won't break the law, but that we view their actions as negative (even if in a perfect world their actions would be futile).
  - tedunangst 11y ago
    I would not keep my valuables in a bank whose security consisted of a "keep out" sign.
    - pyre 11y ago
      I didn't imply that you should. My statement still stands. While "they shouldn't have done X" is not security, that doesn't mean that the statement is devoid of meaning, or that we should ignore the question of whether or not "they should have done X." Edit: Your statements seem to imply that because "100% security" would mean that anyone "doing X" would have no result, then everyone should be allowed to "do X" without question.
      - tedunangst 11y ago
        I am saying that regardless of what we'd like to expect, we should prepare for the unexpected. Picking your attacker is doomed to fail; don't try. I don't think this is controversial.

striking 11y ago

Yeah, but CMU allegedly got paid a pretty big chunk of money for it. If they were just doing research, whatever. But $1m? That's a whole lot of taxpayer money.

jeromegv 11y ago
Well TOR is also funded by taxpayer money...
- striking 11y ago
  My point was "this is more money than CMU should have gotten for looking into the Tor network, especially from the FBI" rather than "taxpayers paid for this"
  - structural 11y ago
    In the government contracting world, $1m is an absolutely tiny program - keep in mind that this covers not only the research, but also all the overhead / facilities / computers / keeping the lights on stuff. $1m will cover something like 3-4 staff for about a year. Less, if they're senior people.
- federico3 11y ago
  *Tor
tedunangst 11y ago
$1M is not a lot of money. That's not nation state money; that's Tim Tebow money.
- brazzledazzle 11y ago
  That's irrelevant to his point.
  - twblalock 11y ago

borkabrak 11y ago

Your points are well-taken, but I would expect academics to be the only demographic more likely than governments to compromise a well-designed security system. Although I suppose the academics I mean aren't undergrads..

deleted 11y ago

[deleted]

comex 11y ago

A group that performs an actual attack, hands the result to a nation state adversary, and doesn't publish the results either before or after (except in the abstract of a withdrawn talk) is hardly the "loyal opposition". edit: Academics are not Obama's proverbial JV team. One should expect them to be as smart as those working for internal agencies, if somewhat less focused on attacking real-world systems. It seems that in this case, the only difference is that they're somewhat worse at keeping secrets, but given that the talk was withdrawn, it's not that they didn't try. So I don't see the grounds for the implicit suggestion in the quoted tweets that they aren't 'real' adversaries.

cuckcuckspruce 11y ago
> One should expect them to be as smart as those working for internal agencies, if somewhat less focused on attacking real-world systems. It's this reason, along with DARPA and similar funding, that I call it the military-industrial-(higher-)education complex.

kevinchen 11y ago

This misses the point entirely. Nobody is saying that security researchers shouldn't find vulnerabilities. The problem is that rather than publishing or filing a bug, the researchers helped the government exploit it for $1M. Effectively the same as selling the exploit on the black market.

XorNot 11y ago
Yeaaaahhhh no. In exactly the same way that the military is not mercenaries.
- hobs 11y ago
  And civilians are not the military.

Hello71 11y ago

I believe the complaint here is not that they were analyzing the software, but that they were launching active attacks and using the results in an unethical manner, i.e. to conduct possibly-illegal criminal investigations. This is Not OK in the same way that it's Not OK to go around breaking into people's houses with lockpicks and searching them on the grounds that you are conducting lock research. Note that I understand that physical lock security is a relatively well-settled field. That is not relevant to the point at hand; even if it were an important thing to study, it would be Not OK for the government to be paying people to go around picking locks. Edit: Furthermore, by the same logic, it is acceptable for the government to do nearly anything illegal in order to conduct "research". Microsoft, Google, and co claim to be secure, so therefore it should be OK for the government to be attacking them.

abdullahkhalids 11y ago

A lot of people in this thread are misreading the blogpost. The primary complaint is against Feds and not CMU[1], specifically that the Feds used a loophole in the legal system to exploit Tor. They are then asking the university and researchers to be more careful about the funding/nature of their research and blaming them for bringing academic security research into dispute. I agree that some of the middle paragraphs could have been worded more carefully. [1] "Civil liberties are under attack if law enforcement believes it can circumvent the rules of evidence by outsourcing police work to universities." from post