10 ms·

Cambridge University refuses to censor student's thesis

498 points by r11t 16y ago

instakill 16y ago
Brilliant. If only more institutions had a spine like the one displayed here.
- CrazedGeek 16y ago
  They're legally required to: http://news.ycombinator.com/item?id=2039235 http://news.ycombinator.com/item?id=2039235
  - Qz 16y ago
    They're not legally required to be so badass about it.
liuhenry 16y ago
Previous post/discussion: http://news.ycombinator.com/item?id=2039117 http://news.ycombinator.com/item?id=2039117
w1ntermute 16y ago
Dupe: http://news.ycombinator.com/item?id=2039117 http://news.ycombinator.com/item?id=2039117
rlmw 16y ago
To be fair I didn't read this the first time it was on HN - I'm inclined to think that the title of the post is more descriptive than the original, and its deserving front page material, even if it is a duplicate.
- liuhenry 16y ago
  Agreed, but it is useful/insightful to have the comments/discussion on hand.
jburwell 16y ago
First, he thrusts the knife in, then violently twists it -- "Accordingly I have authorised the thesis to be issued as a Computer Laboratory Technical Report. This will make it easier for people to find and to cite, and will ensure that its presence on our web site is permanent....". Classic.
- p_nathan 16y ago
  The Brits often have such a way with words. Bless them.
  - chunkyslink 16y ago
    The English have a way with ... English! Fancy that.
isomorph 16y ago
He's a good lecturer too. Funny how being a good lecturer and being a badass correlate.
- jlees 16y ago
  "Security! Security! Security!" Although there were some fantastic lecturers at Cambridge who were somehow very terrible at getting the material across, but whose content/personalities were so enjoyable it was worth turning up anyway. I dare say it's the same everywhere.
Tarski 16y ago
Wouldn't it have been far nobler to approach the banks affected by the exploit with these findings rather than publishing schematics for the exploit into the public domain?
- ars 16y ago
  Based on their response it wouldn't be effective - they would just try to cover it up. Plus it's likely it's already being used secretly by those with nefarious purposes, publishing just means the average person knowns about it - it's not likely to change how many actually use it.
- wjy 16y ago
  I believe the article states they notified the banks before publishing the original work.
  - Tarski 16y ago
    No it doesn't? I'm not taking the side of the banks here, just trying to understand why the author took the approach he did. It's a shame that at times the HN community is one of single-mindedness where opposite views are met with immediate down-votes.
    - drm237 16y ago
      > ... because it documented a well-known flaw in the chip-and-PIN system... The author of the article at least believes that it is a well-known flaw so responsible disclosure isn't really applicable.
      - Tarski 16y ago
        Well I think you hit the nail on the head, that the disclosure isn't responsible. I'm all for bringing the flaws in chip-and-pin to the public attention, however I find it distasteful that a leading university publishing the schematics of a device that can be used to commit fraud, receives so much applause for this community. I get the impression that this has captured the public mood of "sticking it to the bankers", when really Cambridge have gone about this one the wrong way.
blhack 16y ago
>Cambridge is the University of Erasmus, of Newton, and of Darwin. This is a very elegant way of giving them the finger.
- elblanco 16y ago
  It's also a surprising appeal to authority logical fallacy. Those people don't work there anymore. (not that I disagree with them that they shouldn't censor the findings)
  - isomorph 16y ago
    it's browbeating, a cornerstone of academia
  - telemachos 16y ago
    On the one hand, I don't want to feed the pedantry. On the other hand, it's only a logical fallacy if it fouls an argument. In this case, it's not being used (so far as I can see) in the course of a direct argument. Here's the whole sentence: > Cambridge is the University of Erasmus, of Newton, and of Darwin; censoring writings that offend the powerful is offensive to our deepest values. It's not part of a syllogism. It's the author's statement of core values (as he sees them) of Cambridge. It's part of an explanation for why he won't do something, not an attempt to prove that he shouldn't.
    - elblanco 16y ago
      > On the other hand, it's only a logical fallacy if it fouls an argument. ... > It's part of an explanation for why he won't do something ergo it's an appeal to authority or at the very least an appeal to tradition/precedent (or I suppose even lesser a non sequitur) http://en.wikipedia.org/wiki/Appeal_to_authority http://en.wikipedia.org/wiki/Appeal_to_authority http://en.wikipedia.org/wiki/Appeal_to_tradition http://en.wikipedia.org/wiki/Appeal_to_tradition either way, it's a fascinatingly shoddy, and unnecessary, argument that severely detracts from the otherwise fine argument. A simple, "this paper represents basic security research. We believe censoring basic research is wrong and harmful. Therefore we will not censor this research." would have done.
nsdsudf 16y ago
Prof. Anderson shows good character. Let's talk about the other side. Businesses have always acted this way when it comes to computer security (for at least the last 15 years, feel free to cite earlier examples). By now they probably understand that what they're doing is wrong, from a security perspective. They may even understand that issuing takedowns increases publicity. Still, business are sociopathic, they don't care about the legitimacy of their actions. They have a staff of lawyers they're already paying for, and a responsibility to defend trade secrets and protect their product base. So they marshal their lawyers, essentially for free, and maybe they get something out of the effort as a result. If they don't, nothing much was lost, and they generally don't care about their perception in the security community. Same old story. This incident is less about someone standing up to a bully and more about someone weathering another wave coming out of the ocean.
- ggchappell 16y ago
  I think I see what you are saying, but I don't agree with the contrast you mention in your last sentence. Consider: being sociopathic, not caring about the legitimacy of their actions, harassing someone when the risk to them is small -- how does this differ from being a bully?
  - sudont 16y ago
    Eventually a bully may learn. A true sociopath will continue no matter how many times punished.
    - ggchappell 16y ago
      Interesting point. But if that's true, then businesses almost never act in a manner we would call sociopathic. And my earlier comment (suitably modified) still stands.
      - deleted 16y ago
        [deleted]
      - 16y ago
sdgherhe 16y ago
http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b
yesbabyyes 16y ago
Link to original letter - oh boy this is a good read: http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf
- gridspy 16y ago
  Nice last paragraph: Nonetheless, I am delighted to note your ﬁrm statement that the attack will no longer work and pleased that the industry has been ﬁnally been able to deal with this security issue, albeit some considerable time after the original disclosure back in 2009.
dfhjtjty 16y ago
Click on our website: === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === "Priority, my friend!! Christmas is coming, quick to our website shopping, our web site shopping there will be something different, unexpected things to you, let you have different sense, our website wholesale various fashion shoes, such as Nike, Jordan, prada, also includes the jeans, shirt, bags, hats and decoration. All these products are our free transport, prices are competitive, we can also accept paypal j, after the payment within short time, can ship. = New era cap $12; Air jordan(1-24)shoes $30; jordan air max oakland raiders $34a€“39; Ed Hardy AF JUICY POLO Bikini $25; Christan Audigier BIKINI JACKET $25; Tshirts (Polo ,ed hardy,lacoste) $15 coogi DG edhardy gucci t-shirts $18; gstar coogi evisu true jeans $35; coach chanel gucci LV handbags $36; Sunglasses(Oakey,coach,gucci,A r m a i n i) $15; === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) ===
drivebyacct2 16y ago
For the third time, we get it.
fleitz 16y ago
I tend to disagree with the banks' assessment that it will undermine public confidence. The research gives the public one more piece of information to judge the risks for placing their money in a financial institution. The banking sector as participants in a free market who frequently advocate for opening of more sectors of the economy to the free market (and rightly so) should be encouraging such research. The research gives consumers of banking services more accurate information to consider when deciding how accessible their money should be. Additional information allows consumers to make more informed choices regarding the trade offs between security and convenience. Banks could offer insurance to their customers to protect them against the risks while still keeping the benefits of increased convenience. It's an opportunity for the banks to differentiate their services and cater to the needs of their customers. Yes, not having a PIN is less secure, but it's also more convenient, with proper positioning of their products banks should be able to offer tailored solutions that better address the needs of their customers.
- duffbeer703 16y ago
  Bankers rarely want a "free market". They do want to be free of restrictions to their potential to make money. Here's an example: In a "free market" the government wouldn't mandate that all banks that offer credit/debit cards provide liability limits for fraudulent activity. Those liability limits (which apply to everyone) in effect subsidize inherently insecure payment methods and impose enormous barriers for competitors to enter the market.
joeycfan 16y ago
Nice to see this sort of thing. I was worried it was extinct.
GrandMasterBirt 16y ago
"we have no choice but to back him. That would hold even if we did not agree with the material!" Reminds me of a Frankin quote: "Sir, I disagree with you, but I will fight to the death for your right to say it."
- instakill 16y ago
  Surely you mean Voltaire? "I disapprove of what you say, but I will defend to the death your right to say it"
emilepetrone 16y ago
BBC video on chip & pin findings: http://www.youtube.com/watch?v=_yyfcHSXZLc http://www.youtube.com/watch?v=_yyfcHSXZLc
raghava 16y ago
>You complain that ... and indeed to censor it. The penultimate para in the original letter, wow! A befitting answer to a bully, and how! :)
koski 16y ago
I wonder when Cambridge starts to be blocked by the banks then ... :)
dghrtjty 16y ago
====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )====
revorad 16y ago
The thesis - http://www.cl.cam.ac.uk/~osc22/docs/mphil_acs_osc22.pdf http://www.cl.cam.ac.uk/~osc22/docs/mphil_acs_osc22.pdf
kwoks 16y ago
Am proud of being in the University of Cambridge.....we don't produce apps.
marcamillion 16y ago
Intentionally or unintentionally, this has got to be one of the best pieces of marketing for research inclined students and faculty that they could have ever produced. So much so, that the skeptic in me thinks this was intentionally leaked. I had always considered possibly applying to the University of Cambridge, and I know they are Ivy League...but this letter, firmly solidifies them as a contender for any higher education I might pursue.

498 points by r11t 16y ago

instakill 16y ago

Brilliant. If only more institutions had a spine like the one displayed here.

CrazedGeek 16y ago
They're legally required to: http://news.ycombinator.com/item?id=2039235 http://news.ycombinator.com/item?id=2039235
- Qz 16y ago
  They're not legally required to be so badass about it.

liuhenry 16y ago

Previous post/discussion: http://news.ycombinator.com/item?id=2039117 http://news.ycombinator.com/item?id=2039117

w1ntermute 16y ago

Dupe: http://news.ycombinator.com/item?id=2039117 http://news.ycombinator.com/item?id=2039117

rlmw 16y ago

To be fair I didn't read this the first time it was on HN - I'm inclined to think that the title of the post is more descriptive than the original, and its deserving front page material, even if it is a duplicate.

liuhenry 16y ago
Agreed, but it is useful/insightful to have the comments/discussion on hand.

jburwell 16y ago

First, he thrusts the knife in, then violently twists it -- "Accordingly I have authorised the thesis to be issued as a Computer Laboratory Technical Report. This will make it easier for people to find and to cite, and will ensure that its presence on our web site is permanent....". Classic.

p_nathan 16y ago
The Brits often have such a way with words. Bless them.
- chunkyslink 16y ago
  The English have a way with ... English! Fancy that.

isomorph 16y ago

He's a good lecturer too. Funny how being a good lecturer and being a badass correlate.

jlees 16y ago
"Security! Security! Security!" Although there were some fantastic lecturers at Cambridge who were somehow very terrible at getting the material across, but whose content/personalities were so enjoyable it was worth turning up anyway. I dare say it's the same everywhere.

Tarski 16y ago

Wouldn't it have been far nobler to approach the banks affected by the exploit with these findings rather than publishing schematics for the exploit into the public domain?

ars 16y ago
Based on their response it wouldn't be effective - they would just try to cover it up. Plus it's likely it's already being used secretly by those with nefarious purposes, publishing just means the average person knowns about it - it's not likely to change how many actually use it.
wjy 16y ago
I believe the article states they notified the banks before publishing the original work.
- Tarski 16y ago
  No it doesn't? I'm not taking the side of the banks here, just trying to understand why the author took the approach he did. It's a shame that at times the HN community is one of single-mindedness where opposite views are met with immediate down-votes.
  - drm237 16y ago
    > ... because it documented a well-known flaw in the chip-and-PIN system... The author of the article at least believes that it is a well-known flaw so responsible disclosure isn't really applicable.
    - Tarski 16y ago
      Well I think you hit the nail on the head, that the disclosure isn't responsible. I'm all for bringing the flaws in chip-and-pin to the public attention, however I find it distasteful that a leading university publishing the schematics of a device that can be used to commit fraud, receives so much applause for this community. I get the impression that this has captured the public mood of "sticking it to the bankers", when really Cambridge have gone about this one the wrong way.

blhack 16y ago

>Cambridge is the University of Erasmus, of Newton, and of Darwin. This is a very elegant way of giving them the finger.

elblanco 16y ago
It's also a surprising appeal to authority logical fallacy. Those people don't work there anymore. (not that I disagree with them that they shouldn't censor the findings)
- isomorph 16y ago
  it's browbeating, a cornerstone of academia
- telemachos 16y ago
  On the one hand, I don't want to feed the pedantry. On the other hand, it's only a logical fallacy if it fouls an argument. In this case, it's not being used (so far as I can see) in the course of a direct argument. Here's the whole sentence: > Cambridge is the University of Erasmus, of Newton, and of Darwin; censoring writings that offend the powerful is offensive to our deepest values. It's not part of a syllogism. It's the author's statement of core values (as he sees them) of Cambridge. It's part of an explanation for why he won't do something, not an attempt to prove that he shouldn't.
  - elblanco 16y ago
    > On the other hand, it's only a logical fallacy if it fouls an argument. ... > It's part of an explanation for why he won't do something ergo it's an appeal to authority or at the very least an appeal to tradition/precedent (or I suppose even lesser a non sequitur) http://en.wikipedia.org/wiki/Appeal_to_authority http://en.wikipedia.org/wiki/Appeal_to_authority http://en.wikipedia.org/wiki/Appeal_to_tradition http://en.wikipedia.org/wiki/Appeal_to_tradition either way, it's a fascinatingly shoddy, and unnecessary, argument that severely detracts from the otherwise fine argument. A simple, "this paper represents basic security research. We believe censoring basic research is wrong and harmful. Therefore we will not censor this research." would have done.

nsdsudf 16y ago

Prof. Anderson shows good character. Let's talk about the other side. Businesses have always acted this way when it comes to computer security (for at least the last 15 years, feel free to cite earlier examples). By now they probably understand that what they're doing is wrong, from a security perspective. They may even understand that issuing takedowns increases publicity. Still, business are sociopathic, they don't care about the legitimacy of their actions. They have a staff of lawyers they're already paying for, and a responsibility to defend trade secrets and protect their product base. So they marshal their lawyers, essentially for free, and maybe they get something out of the effort as a result. If they don't, nothing much was lost, and they generally don't care about their perception in the security community. Same old story. This incident is less about someone standing up to a bully and more about someone weathering another wave coming out of the ocean.

ggchappell 16y ago
I think I see what you are saying, but I don't agree with the contrast you mention in your last sentence. Consider: being sociopathic, not caring about the legitimacy of their actions, harassing someone when the risk to them is small -- how does this differ from being a bully?
- sudont 16y ago
  Eventually a bully may learn. A true sociopath will continue no matter how many times punished.
  - ggchappell 16y ago
    Interesting point. But if that's true, then businesses almost never act in a manner we would call sociopathic. And my earlier comment (suitably modified) still stands.
    - deleted 16y ago
      [deleted]
    - 16y ago

sdgherhe 16y ago

http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b http://goo.gl/l5v0b

yesbabyyes 16y ago

Link to original letter - oh boy this is a good read: http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf http://www.cl.cam.ac.uk/~rja14/Papers/ukca.pdf

gridspy 16y ago
Nice last paragraph: Nonetheless, I am delighted to note your ﬁrm statement that the attack will no longer work and pleased that the industry has been ﬁnally been able to deal with this security issue, albeit some considerable time after the original disclosure back in 2009.

dfhjtjty 16y ago

Click on our website: === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === "Priority, my friend!! Christmas is coming, quick to our website shopping, our web site shopping there will be something different, unexpected things to you, let you have different sense, our website wholesale various fashion shoes, such as Nike, Jordan, prada, also includes the jeans, shirt, bags, hats and decoration. All these products are our free transport, prices are competitive, we can also accept paypal j, after the payment within short time, can ship. = New era cap $12; Air jordan(1-24)shoes $30; jordan air max oakland raiders $34a€“39; Ed Hardy AF JUICY POLO Bikini $25; Christan Audigier BIKINI JACKET $25; Tshirts (Polo ,ed hardy,lacoste) $15 coogi DG edhardy gucci t-shirts $18; gstar coogi evisu true jeans $35; coach chanel gucci LV handbags $36; Sunglasses(Oakey,coach,gucci,A r m a i n i) $15; === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) === === ( http://www.etradinglife.com http://www.etradinglife.com ) ===

drivebyacct2 16y ago

For the third time, we get it.

fleitz 16y ago

I tend to disagree with the banks' assessment that it will undermine public confidence. The research gives the public one more piece of information to judge the risks for placing their money in a financial institution. The banking sector as participants in a free market who frequently advocate for opening of more sectors of the economy to the free market (and rightly so) should be encouraging such research. The research gives consumers of banking services more accurate information to consider when deciding how accessible their money should be. Additional information allows consumers to make more informed choices regarding the trade offs between security and convenience. Banks could offer insurance to their customers to protect them against the risks while still keeping the benefits of increased convenience. It's an opportunity for the banks to differentiate their services and cater to the needs of their customers. Yes, not having a PIN is less secure, but it's also more convenient, with proper positioning of their products banks should be able to offer tailored solutions that better address the needs of their customers.

duffbeer703 16y ago
Bankers rarely want a "free market". They do want to be free of restrictions to their potential to make money. Here's an example: In a "free market" the government wouldn't mandate that all banks that offer credit/debit cards provide liability limits for fraudulent activity. Those liability limits (which apply to everyone) in effect subsidize inherently insecure payment methods and impose enormous barriers for competitors to enter the market.

joeycfan 16y ago

Nice to see this sort of thing. I was worried it was extinct.

GrandMasterBirt 16y ago

"we have no choice but to back him. That would hold even if we did not agree with the material!" Reminds me of a Frankin quote: "Sir, I disagree with you, but I will fight to the death for your right to say it."

instakill 16y ago
Surely you mean Voltaire? "I disapprove of what you say, but I will defend to the death your right to say it"

emilepetrone 16y ago

BBC video on chip & pin findings: http://www.youtube.com/watch?v=_yyfcHSXZLc http://www.youtube.com/watch?v=_yyfcHSXZLc

raghava 16y ago

>You complain that ... and indeed to censor it. The penultimate para in the original letter, wow! A befitting answer to a bully, and how! :)

koski 16y ago

I wonder when Cambridge starts to be blocked by the banks then ... :)

dghrtjty 16y ago

====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )==== ====== ( http://ta.gg/4wt http://ta.gg/4wt )====

revorad 16y ago

The thesis - http://www.cl.cam.ac.uk/~osc22/docs/mphil_acs_osc22.pdf http://www.cl.cam.ac.uk/~osc22/docs/mphil_acs_osc22.pdf

kwoks 16y ago

Am proud of being in the University of Cambridge.....we don't produce apps.

marcamillion 16y ago

Intentionally or unintentionally, this has got to be one of the best pieces of marketing for research inclined students and faculty that they could have ever produced. So much so, that the skeptic in me thinks this was intentionally leaked. I had always considered possibly applying to the University of Cambridge, and I know they are Ivy League...but this letter, firmly solidifies them as a contender for any higher education I might pursue.