4 ms·
You're absolutely right if my goal was to get people to post these papers, which reading back can easily be how it is interpreted. My point was more that, as a
by janpieterz 11y ago
You're absolutely right if my goal was to get people to post these papers, which reading back can easily be how it is interpreted.
My point was more that, as a 'consumer' of this product without any background knowledge, their contests seem extremely convincing to the point of being slightly ridiculous. A 300,000 dollar bounty, while participants get quite some more access than they would normally get while attacking this system, gives me that feeling of it being actually quite secure, besides some possible attacks. If they're possible, if there are complaints, why can't they be made real and substantiated?
My first post is indeed not delivering the message I intended, hope this one shows it better.
- tptacek 11y agoThis is one of the rare instances where me and Bruce Schneier agree unequivocally, so maybe you can just take Schneier's word for it --- remembering, when you do, that this happens so often in security that Schneier was moved to write a little article about it! https://www.schneier.com/crypto-gram/archives/1998/1215.html#contests https://www.schneier.com/crypto-gram/archives/1998/1215.html...
- janpieterz 11y agoThanks a lot, that was very insightful and exactly the kind of insight I was looking for. I think for me as an outsider it's really easy to fall for that trap, where certainly point 3 in his article was a realization that I would look at it the same way, perhaps spend a bit of time in my evenings on it but never spend, say, 3 months of research on the off chance that they might pay and that I might be the first winner/best winner, compared to a good (hourly) pay.