4 ms·

This is hilarious. The main important point is that it makes a mockery of the security snake-oil salesmen and the government sponsored investigation agencies.

This is hilarious. The main important point is that it makes a mockery of the security snake-oil salesmen and the government sponsored investigation agencies. It also demonstrates that legislation is powerless over the internet (something I think everyone quietly realises but doesn't want to admit). They've let the cat out of the bag and now it won't go back in. The Internet is an uncontrollable, resiliant, self-aware monster with a good self-preservation instinct. It's fighting back against those who wish to control it.

weego 15y ago
I'm not sure it really proves any of those things at all, but it does prove that no matter how good you are at something, chances are you will come across someone better than you at some point in your life. When you thing is security and the other person is feeling malicious I guess it can be an ugly outcome.
- chrisjsmith 15y ago
  It's not about being quantifiably better - it's about perception. Security is wholly percieved. It doesn't actually exist.
  - joe24pack 15y ago
    okay, I'll bite, would you care to explain how security does not exist?
    - wnight 15y ago
      Secure vs who? With what budget? Are you content with achieving 'security' by shredding the server or do you plan to hook it up to a network?
      - joe24pack 15y ago
        So security is relative compared to a threat. That's a assumption that any thoughtful person can make. Yes, the resources available to you will greatly affect your ability to achieve a particular level of security. Just because you connect your server to a network does not mean that the security of your server disappears. Whatever level of security you've managed to achieve is still there. It just may be that the attackers you face are able to overcome your security measures. If by security one means absolute security against all threats present and future, then yes security is not only illusory but also meaningless.
        wnight 15y ago
        So you do a lot of work and achieve what you might call "near-perfect real-world security" and are not hacked, are you secure? When you later find out you were vulnerable. Were you secure? Does knowing that an undetectable root-kit could have been installed during this time, change your perception of the state of your current security? Would it matter if the newly-released insecurity was a one-in-a-billion thing? For instance when's the last time you actually took measures to guard against a trojaned compiler? If you did get hacked because of a one-in-a-billion thing which nobody could have predicted did it happen because you weren't secure or did it happen despite your security? It's a subtle difference in perceptions. Does your perception of your security level change if you realize the crooked CEO conspired with the security consultant to arrange a back door and that the one-in-a-billion thing was a virtual certainty? It goes deeper than simply being all relative, you always make some assumptions - even incredibly large ones. Even a tiny mistake can totally scupper system robustness. In crypto and security a system is often weaker than its weakest link and that includes designer assumptions, operator errors, and customer specifications as well as expected issues such as programming errors. Speaking of security as a thing that can be achieved is mostly wrong and confuses many.
deleted 15y ago
[deleted]
pasbesoin 15y ago
My concern is that the physical layer is more limited and is indeed disrupt-able / controllable. We need some neutrino transceivers. And a few other orthogonal communication technologies. Edit: I guess it is also a comment on the situation that I deleted my comment before reconsidering and deciding to repost it. When opinions can no longer be expressed without fear of (arbitrary and/or extra-judicial) retribution, things have really started to go too far. The physical media are too constrained. Even if you're not into "black arts" (and I'm not), you may have increasingly limited trust in the powers controlling the infrastructure (not so much the engineers, but the people who pay them and/or put them in jail).
- chrisjsmith 15y ago
  We have amateur radio (pirate or registered), AX25, APRS mail, USB-stick sneaker-net, UUCP, modems, dialups, OTP encrypted SMS still. It's low bandwidth but important information is actually really small. IPv4/6 may die but there are still ways of shifting stuff around that is important.

weego 15y ago

I'm not sure it really proves any of those things at all, but it does prove that no matter how good you are at something, chances are you will come across someone better than you at some point in your life. When you thing is security and the other person is feeling malicious I guess it can be an ugly outcome.

chrisjsmith 15y ago
It's not about being quantifiably better - it's about perception. Security is wholly percieved. It doesn't actually exist.
- joe24pack 15y ago
  okay, I'll bite, would you care to explain how security does not exist?
  - wnight 15y ago
    Secure vs who? With what budget? Are you content with achieving 'security' by shredding the server or do you plan to hook it up to a network?
    - joe24pack 15y ago
      So security is relative compared to a threat. That's a assumption that any thoughtful person can make. Yes, the resources available to you will greatly affect your ability to achieve a particular level of security. Just because you connect your server to a network does not mean that the security of your server disappears. Whatever level of security you've managed to achieve is still there. It just may be that the attackers you face are able to overcome your security measures. If by security one means absolute security against all threats present and future, then yes security is not only illusory but also meaningless.
      - wnight 15y ago
        So you do a lot of work and achieve what you might call "near-perfect real-world security" and are not hacked, are you secure? When you later find out you were vulnerable. Were you secure? Does knowing that an undetectable root-kit could have been installed during this time, change your perception of the state of your current security? Would it matter if the newly-released insecurity was a one-in-a-billion thing? For instance when's the last time you actually took measures to guard against a trojaned compiler? If you did get hacked because of a one-in-a-billion thing which nobody could have predicted did it happen because you weren't secure or did it happen despite your security? It's a subtle difference in perceptions. Does your perception of your security level change if you realize the crooked CEO conspired with the security consultant to arrange a back door and that the one-in-a-billion thing was a virtual certainty? It goes deeper than simply being all relative, you always make some assumptions - even incredibly large ones. Even a tiny mistake can totally scupper system robustness. In crypto and security a system is often weaker than its weakest link and that includes designer assumptions, operator errors, and customer specifications as well as expected issues such as programming errors. Speaking of security as a thing that can be achieved is mostly wrong and confuses many.

deleted 15y ago

[deleted]

pasbesoin 15y ago

My concern is that the physical layer is more limited and is indeed disrupt-able / controllable. We need some neutrino transceivers. And a few other orthogonal communication technologies. Edit: I guess it is also a comment on the situation that I deleted my comment before reconsidering and deciding to repost it. When opinions can no longer be expressed without fear of (arbitrary and/or extra-judicial) retribution, things have really started to go too far. The physical media are too constrained. Even if you're not into "black arts" (and I'm not), you may have increasingly limited trust in the powers controlling the infrastructure (not so much the engineers, but the people who pay them and/or put them in jail).

chrisjsmith 15y ago
We have amateur radio (pirate or registered), AX25, APRS mail, USB-stick sneaker-net, UUCP, modems, dialups, OTP encrypted SMS still. It's low bandwidth but important information is actually really small. IPv4/6 may die but there are still ways of shifting stuff around that is important.