4 ms·

> is not a controversial statement in the software security community. Funny how often this happens. Maybe we need to do a better job of conveying these sorts

> is not a controversial statement in the software security community. Funny how often this happens. Maybe we need to do a better job of conveying these sorts of things - happens all the time that the security community at large considers X or Y to be obvious and well known, and then you find that actually very large portions of the larger tech community don't know that at all.

tptacek 5y ago
I want to be careful not to be seen as speaking for that whole community; I'm just saying, if you were in a gathering of vulnerability researchers, and you said "OpenBSD's security reputation is really overrated", you'd get shrugs, not gasps.
saagarjha 5y ago
The issue here is that there is seldom consensus in the software security community when it comes to opinions of certain projects. This is doubly so when the project makes some good choices, and some not-so-good choices, like OpenBSD does. For a similar discussion, ask your local security engineer what they think about WhatsApp or Signal.
numpad0 5y ago
Or maybe that’s how consensus work in general. There’s some proposition or statement that are truthful in the end, but until it has been orthographically formatted, individually verified, and/or accepted by the majority, remains unproven. So you might know something for a obvious fact, like “hey it’s raining”, and you might be objectively right, but it could be literally not-a-fact until at least everyone in the room also agrees. Some security researchers might “just know” the OpenBSD security is “duh, ha ha”, but until someone formally compose it in a text format as “OpenBSD security is overrated”, they don’t necessarily has the words to put it together. And once it has been written down, security sub-community would agree, and the greater software engineering community then has to verify the phrase and the agreement process within the security minded, and only then the phrase can become a “well-known fact that everyone knew about since forever”. But I think that’s how facts and consensus work.

tptacek 5y ago

I want to be careful not to be seen as speaking for that whole community; I'm just saying, if you were in a gathering of vulnerability researchers, and you said "OpenBSD's security reputation is really overrated", you'd get shrugs, not gasps.

saagarjha 5y ago

The issue here is that there is seldom consensus in the software security community when it comes to opinions of certain projects. This is doubly so when the project makes some good choices, and some not-so-good choices, like OpenBSD does. For a similar discussion, ask your local security engineer what they think about WhatsApp or Signal.

numpad0 5y ago

Or maybe that’s how consensus work in general. There’s some proposition or statement that are truthful in the end, but until it has been orthographically formatted, individually verified, and/or accepted by the majority, remains unproven. So you might know something for a obvious fact, like “hey it’s raining”, and you might be objectively right, but it could be literally not-a-fact until at least everyone in the room also agrees. Some security researchers might “just know” the OpenBSD security is “duh, ha ha”, but until someone formally compose it in a text format as “OpenBSD security is overrated”, they don’t necessarily has the words to put it together. And once it has been written down, security sub-community would agree, and the greater software engineering community then has to verify the phrase and the agreement process within the security minded, and only then the phrase can become a “well-known fact that everyone knew about since forever”. But I think that’s how facts and consensus work.