5 ms·

I'd recommend watching this [1] talk once the videos go online. It paints a pretty nasty picture of all the things you can screw up and still end up FIPS valida

by dsl 9y ago

I'd recommend watching this [1] talk once the videos go online. It paints a pretty nasty picture of all the things you can screw up and still end up FIPS validated. 1. https://www.blackhat.com/us-17/briefings/schedule/index.html#attacking-encrypted-usb-keys-the-hardware-way-7443 https://www.blackhat.com/us-17/briefings/schedule/index.html...

jlgaddis 9y ago
Oh, I'm well aware that FIPS -- or any other certification program, actually -- isn't a panacea. There were issues found with the RNG in some country's national ID cards (smart cards) as well; the RNG had also achieved FIPS 140-2 validation. All things being equal, though, I would still be inclined to have a little more trust in something that has been through the process than I would in, say, the homebrew RNG [0?] used by Honest Achmed's Used Cars and Certificates. [0]: https://xkcd.com/221/ https://xkcd.com/221/
- deleted 9y ago
  [deleted]
- jlgaddis 9y ago
  > Honest Achmed's FYI, I was making a reference to a "bug" from 6.5 years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959 (another HN'er thought this was a "little racist")
  - Xylakant 9y ago
    FWIW: I'm absolutely certainly guilty of the same mistake, but referencing a racist stereotype that somebody else (jokingly) used doesn't make it not racist (1). It's easy to fall into the trap and me, too, considered Honest Achmed a good joke at the time, but I don't, any more. (the joke is still good, but the names picked are not) (1) unless you use the reference to put it into context, or discuss it, ...
    - jlgaddis 9y ago
      TBQH, I really don't care if anyone thought it was racist or was offended by it or whatever. They're completely missing the point -- and "Honest Achmed" wasn't even a key part of that sentence anyways. It could've been Honest Achmed, Honest José, or, hell, even Honest Abe, but I suddenly remembered that ticket and so I replaced "some fly-by-night crypto startup" (or whatever I had originally written) with that. I'm over all the politically correct bullshit and people actively looking for things to be offended by. It wasn't meant to be racist. It was meant to illustrate a point. I come to HN to get away from all of that shit so, please, go be offended by something else.
      - tptacek 9y ago
        When you respond to private trolling by publicly counter-trolling, you're not so much taking a stand on principle as you are jamming the thread with noise. If it's PC BS, it doesn't deserve discussion.
        ganoushoreilly 9y ago
        He's right though, because the name was Achmed and not Joe or Robert, people automatically assumed he was being racist which is ironic because as he pointed out the but is specifically "add Honest Achmed's root certificate" and it is in fact about "Honest Achmed's Used Cars and Certficiates". Was the original bug filing racist, maybe, maybe not. So in this instance, someone let their emotions jump the gun and were quick to accuse racism. The only way to stop the behavior is to identify it. Considering the whole "PC" movement prevalent these days, his response was tactful and relates to the original story which is more than those than those accusing racism could claim.

by dsl 9y ago

jlgaddis 9y ago

Oh, I'm well aware that FIPS -- or any other certification program, actually -- isn't a panacea. There were issues found with the RNG in some country's national ID cards (smart cards) as well; the RNG had also achieved FIPS 140-2 validation. All things being equal, though, I would still be inclined to have a little more trust in something that has been through the process than I would in, say, the homebrew RNG [0?] used by Honest Achmed's Used Cars and Certificates. [0]: https://xkcd.com/221/ https://xkcd.com/221/

deleted 9y ago
[deleted]
jlgaddis 9y ago
> Honest Achmed's FYI, I was making a reference to a "bug" from 6.5 years ago: https://bugzilla.mozilla.org/show_bug.cgi?id=647959 https://bugzilla.mozilla.org/show_bug.cgi?id=647959 (another HN'er thought this was a "little racist")
- Xylakant 9y ago
  FWIW: I'm absolutely certainly guilty of the same mistake, but referencing a racist stereotype that somebody else (jokingly) used doesn't make it not racist (1). It's easy to fall into the trap and me, too, considered Honest Achmed a good joke at the time, but I don't, any more. (the joke is still good, but the names picked are not) (1) unless you use the reference to put it into context, or discuss it, ...
  - jlgaddis 9y ago
    TBQH, I really don't care if anyone thought it was racist or was offended by it or whatever. They're completely missing the point -- and "Honest Achmed" wasn't even a key part of that sentence anyways. It could've been Honest Achmed, Honest José, or, hell, even Honest Abe, but I suddenly remembered that ticket and so I replaced "some fly-by-night crypto startup" (or whatever I had originally written) with that. I'm over all the politically correct bullshit and people actively looking for things to be offended by. It wasn't meant to be racist. It was meant to illustrate a point. I come to HN to get away from all of that shit so, please, go be offended by something else.
    - tptacek 9y ago
      When you respond to private trolling by publicly counter-trolling, you're not so much taking a stand on principle as you are jamming the thread with noise. If it's PC BS, it doesn't deserve discussion.
      - ganoushoreilly 9y ago
        He's right though, because the name was Achmed and not Joe or Robert, people automatically assumed he was being racist which is ironic because as he pointed out the but is specifically "add Honest Achmed's root certificate" and it is in fact about "Honest Achmed's Used Cars and Certficiates". Was the original bug filing racist, maybe, maybe not. So in this instance, someone let their emotions jump the gun and were quick to accuse racism. The only way to stop the behavior is to identify it. Considering the whole "PC" movement prevalent these days, his response was tactful and relates to the original story which is more than those than those accusing racism could claim.