4 ms·
The parent post is presenting conflicted information about trust. I find that both interesting and disgusting. I'm disgusted (fear + boredom) with it because I
by kordless 10y ago
The parent post is presenting conflicted information about trust. I find that both interesting and disgusting. I'm disgusted (fear + boredom) with it because I fear for the human race moving forward with existing centralized infrastructure. The boredom is a side effect of it involving trust and me not trusting it. I remain interested in talking about trust, however, so I'm conflicted myself. :)
This is the basic argument they are making:
> I don't trust it as much as I trust openssh...And in a piece of vital security infrastructure, trust is everything.
This is an implicit statement that all infrastructure tends toward full trustworthiness by the increasing use of legacy software. It also implies that trusted infrastructure affects everyone (which is true). Together, this is a logical fallacy - infrastructure will never be 100% trustworthy and when it breaks it will not affect everyone the same. You yourself made that observation regarding holes in OpenSSH. It is anti-trust, or "inverse trust" (if one is a stickler for terms) when one attempts to publically imply their individual/internal trust of a thing is based on their societal/external trust of another thing which is being used in a mutually exclusive way. That itself is an anti-competitive practice, whether intentional or not.
I think calling this flawed logic out is important when the subject is trust and security. There's a reason for the limit of causality in our universe. The lesson we can take from that limit would be to not apply inverse internal trust to something to prevent it's external use when using it is required to trust it.
- qwertyuiop924 10y agoAllow me to clarify my opinion: I fail to see what's wrong with saying that a new piece of software hasn't yet earned the trust that an older piece of software has. However, I never said that it could not earn that trust. That's an assumption on your part. And I don't distrust Teleport because OpenSSH exists, I distrust Teleport because it hasn't proven its reputation yet. If OpenSSH didn't exist, I'd be saying the same things. The difference is, because OpenSSH does exist, I can make a comparison to piece of infrastructure I do trust. And I do agree that we cannot move forward with existing infrastructure, I just don't trust this particular piece of new infrastructure yet.