3 ms·

Filo is upset that he did not bother to check the code (that originally came from SUPERCOP, a benchmarking tool) he blindly included in go's xcrypto. Here is DJ

Filo is upset that he did not bother to check the code (that originally came from SUPERCOP, a benchmarking tool) he blindly included in go's xcrypto. Here is DJB's tweet: https://twitter.com/hashbreaker/status/1108637226089496577 https://twitter.com/hashbreaker/status/1108637226089496577 (regardless, you should not directly encrypt a large amount of data, even nacl suggest against it https://nacl.cr.yp.to/valid.html https://nacl.cr.yp.to/valid.html) In addition both Filo and Garrett have a bone to pick with DJB due to their personal political beliefs and his involvement in the Appelbaum case and I found both of them to be extremely dislikeable and unable to accept their own faults in personal discussions that I had with them in the past (regarding different issues). Considering that this was a subpost my opinion of them is even lower now.

sneak 6y ago
Your criticism of the messenger of further evidence of djb's longstanding refusal to deal straightforwardly with security reports is not on topic, IMO. Not everything is a simple dichotomy.
- dependenttypes 6y ago
  (regarding qmail) It was a security bug back in 2005. It stopped being a security bug when DJB mentioned on the official page about the memory limits. Regarding the salsa20 implementation: I just mentioned in my previous message why this was not a bug and the only reason that people were upset over it was due to Filo's incompetence. As for evidence of DJB dealing straightforwardly with security reports: https://news.ycombinator.com/item?id=23250748 https://news.ycombinator.com/item?id=23250748 I think that https://old.reddit.com/r/crypto/comments/72w42c/statement_regarding_cryptanalysis_of_22_12_rounds/dnlv59e/ https://old.reddit.com/r/crypto/comments/72w42c/statement_re... would be a better example of DJB not properly handling security reports.
  - dullgiulio 6y ago
    salsa20 was added in 2012, the warning file was added into the repository in 2016 the earliest (it is not clear when--which is vary bad for security and also shows the move was not advertised.) Incompetence is a strong word on the wrong target...
    - dependenttypes 6y ago
      > the warning file was added into the repository in 2016 the earliest There is no official public repository. It gets released in tarballs. This does indeed make him seem slightly less incompetent though. > which is vary bad for security It is a framework for benchmarking cryptographic algorithms.
mjg59 6y ago
My opinions around DJB have very little to do with my political beliefs, but rather more to do with spending time with people who are far better at cryptography than he is without having anything approaching his ego.
morelisp 6y ago
> even nacl suggest against it You're defending djb's decision by pointing to another of his projects, which in turn cites another email from djb. I'm not saying you're wrong¸ but it's not exactly a reviewed position.
- dependenttypes 6y ago
  I meant it in another way. If he had taken DJB's advice this would not be an issue, so DJB can't be blamed for it. Sorry for the misunderstanding. That being said, he seems to agree with this. After all he followed said advice in his tool age.
morelisp 6y ago
> a bone to pick with DJB due to their personal political beliefs "Political beliefs" is a weird way to say DJB has stepped up to defend at least three people accused of sexual abuse by multiple victims.
- dependenttypes 6y ago
  I actually had https://blog.cr.yp.to/20160607-dueprocess.html https://blog.cr.yp.to/20160607-dueprocess.html in mind when mentioning political beliefs, but even then I think that this still falls under the "political belief" label - the belief that anyone accused of rape should not have any form of defence. Anyway, the person who is being sued was part of a harassment campaign against multiple people, including Bernstein himself, so I can't see why it would be a bad thing for him to send his declaration. For anyone interested, his declaration is here: https://www.courtlistener.com/recap/gov.uscourts.cand.340308/gov.uscourts.cand.340308.26.0.pdf https://www.courtlistener.com/recap/gov.uscourts.cand.340308... And here is the most objective and complete story of the Appelbaum events that I have personally seen so far https://github.com/Enegnei/JacobAppelbaumLeavesTor/blob/master/JacobAppelbaumLeavesTor.md https://github.com/Enegnei/JacobAppelbaumLeavesTor/blob/mast... (if anyone has anything better please do let me know) > accused of sexual abuse by multiple victims Including false accusations by others in the name of the so called victims. Such as the "Alice" case. (if I am not mistaken this specific accusation was published by the person being sued themselves)
  - sneak 6y ago
    People can be onboard 100% with his argument for due process (I am) and simultaneously 100% against his association with Jake Appelbaum, whose (perhaps subcriminal) misbehavior was widely reported in private in our industry prior to the bevy of as-yet-unproven rape accusations. Appelbaum is and has been a scumbag regardless of the fact of whether or not he has been adjudicated a rapist in a court of law. People who associate with scumbags (and, indeed, defend them in particular) aren’t great, and can and should be subject to criticism for their choices regarding scumbags. Fortunately, it isn’t a simple dichotomy. I agree with due process for imprisoning people. I also agree in public criticism of entirely legal misbehavior and freedom of association. I don’t respect people who defend scumbags socially (defending subcriminal scumbags from prison is another matter), and djb is certainly that.

sneak 6y ago

Your criticism of the messenger of further evidence of djb's longstanding refusal to deal straightforwardly with security reports is not on topic, IMO. Not everything is a simple dichotomy.

dependenttypes 6y ago
(regarding qmail) It was a security bug back in 2005. It stopped being a security bug when DJB mentioned on the official page about the memory limits. Regarding the salsa20 implementation: I just mentioned in my previous message why this was not a bug and the only reason that people were upset over it was due to Filo's incompetence. As for evidence of DJB dealing straightforwardly with security reports: https://news.ycombinator.com/item?id=23250748 https://news.ycombinator.com/item?id=23250748 I think that https://old.reddit.com/r/crypto/comments/72w42c/statement_regarding_cryptanalysis_of_22_12_rounds/dnlv59e/ https://old.reddit.com/r/crypto/comments/72w42c/statement_re... would be a better example of DJB not properly handling security reports.
- dullgiulio 6y ago
  salsa20 was added in 2012, the warning file was added into the repository in 2016 the earliest (it is not clear when--which is vary bad for security and also shows the move was not advertised.) Incompetence is a strong word on the wrong target...
  - dependenttypes 6y ago
    > the warning file was added into the repository in 2016 the earliest There is no official public repository. It gets released in tarballs. This does indeed make him seem slightly less incompetent though. > which is vary bad for security It is a framework for benchmarking cryptographic algorithms.

mjg59 6y ago

My opinions around DJB have very little to do with my political beliefs, but rather more to do with spending time with people who are far better at cryptography than he is without having anything approaching his ego.

morelisp 6y ago

> even nacl suggest against it You're defending djb's decision by pointing to another of his projects, which in turn cites another email from djb. I'm not saying you're wrong¸ but it's not exactly a reviewed position.

dependenttypes 6y ago
I meant it in another way. If he had taken DJB's advice this would not be an issue, so DJB can't be blamed for it. Sorry for the misunderstanding. That being said, he seems to agree with this. After all he followed said advice in his tool age.

morelisp 6y ago

> a bone to pick with DJB due to their personal political beliefs "Political beliefs" is a weird way to say DJB has stepped up to defend at least three people accused of sexual abuse by multiple victims.

dependenttypes 6y ago
I actually had https://blog.cr.yp.to/20160607-dueprocess.html https://blog.cr.yp.to/20160607-dueprocess.html in mind when mentioning political beliefs, but even then I think that this still falls under the "political belief" label - the belief that anyone accused of rape should not have any form of defence. Anyway, the person who is being sued was part of a harassment campaign against multiple people, including Bernstein himself, so I can't see why it would be a bad thing for him to send his declaration. For anyone interested, his declaration is here: https://www.courtlistener.com/recap/gov.uscourts.cand.340308/gov.uscourts.cand.340308.26.0.pdf https://www.courtlistener.com/recap/gov.uscourts.cand.340308... And here is the most objective and complete story of the Appelbaum events that I have personally seen so far https://github.com/Enegnei/JacobAppelbaumLeavesTor/blob/master/JacobAppelbaumLeavesTor.md https://github.com/Enegnei/JacobAppelbaumLeavesTor/blob/mast... (if anyone has anything better please do let me know) > accused of sexual abuse by multiple victims Including false accusations by others in the name of the so called victims. Such as the "Alice" case. (if I am not mistaken this specific accusation was published by the person being sued themselves)
- sneak 6y ago
  People can be onboard 100% with his argument for due process (I am) and simultaneously 100% against his association with Jake Appelbaum, whose (perhaps subcriminal) misbehavior was widely reported in private in our industry prior to the bevy of as-yet-unproven rape accusations. Appelbaum is and has been a scumbag regardless of the fact of whether or not he has been adjudicated a rapist in a court of law. People who associate with scumbags (and, indeed, defend them in particular) aren’t great, and can and should be subject to criticism for their choices regarding scumbags. Fortunately, it isn’t a simple dichotomy. I agree with due process for imprisoning people. I also agree in public criticism of entirely legal misbehavior and freedom of association. I don’t respect people who defend scumbags socially (defending subcriminal scumbags from prison is another matter), and djb is certainly that.