5 ms·

Much enjoyed your episode on CA's with Ryan Sleevie that talked quite a bit about DANE/DNSSEC. You're doing gods work here! [1] transcript (search for DNSSEC o

Much enjoyed your episode on CA's with Ryan Sleevie that talked quite a bit about DANE/DNSSEC. You're doing gods work here! [1] transcript (search for DNSSEC or DANE): https://securitycryptographywhatever.buzzsprout.com/1822302/9146390-how-to-be-a-certificate-authority-feat-ryan-sleevi https://securitycryptographywhatever.buzzsprout.com/1822302/...

tialaramex 5y ago
In some sense that podcast episode is much more interesting than a 2015 article of course. The transcript you linked in particular is a giggle if you actually know what's going on because of course it's wrong all over the place in ways somebody who doesn't know can't fix. A few of them are generic (e.g. it's normal for English speakers to say "fifty-two eighty" to mean 5280 and then of course the transcript renders that as 52 80, and it's normal to pronounce ETSI "Etsy") but many more are not (if you know Ryan is saying PKIX then you can recognise that, but if you don't then "Peak X" or indeed "Peacocks" is a fair stab). [Maybe one of the many PKIX implementations should name itself "Peacocks" in the same way that "Secret Rabbit Code" stands out from other Sample Rate Converter libraries] I assume the transcript is at least human curated to be as coherent as it is, but maybe not. Ryan doesn't mention it on that podcast because it wasn't official yet, but much of the public role of Ryan (Sleevi) is now played by Ryan (Dickson). The entire "How to be a Certificate Authority" podcast premise seems to be er, what if the "Honest Achmed" Bugzilla ticket, but a podcast. Which you know, fine but you are very late people - did you already do a "Steamed Hams" episode? Also, I'd be fascinated to hear from anybody, in any sector with auditors, who thinks they're actually getting something like that Affleck / Kendrick movie "The Accountant". Maybe Thomas thinks he's Ben Affleck? I've worked with auditors, both internal and external. They're like a code review from a junior. They might see something you missed but they aren't going to find anything you actually hid. Thus audit is valuable, until it isn't. Should I talk about that? In fact Thomas has already brought up Symantec so why not, if you go back and look at that, one of the things I highlighted very early there was that Symantec are relying on auditors, and we know auditors are the worst option other than nothing. So, this is the right choice if your alternative was nothing, but Symantec had lots of better alternatives and didn't take them. And this is one of the many places where I think Thomas is just obviously wrong, he describes CAs as "A force for evil" but er, no. We don't see a lot of evil. Now, honestly I'm not looking for evil, but even if I looked I don't expect to find much. What we see are the usual human failings: Laziness and incompetence. Maybe some greed. But mostly laziness and incompetence. I talked about hiding earlier. Isn't that evil? Nope. Just laziness again. You could fix the problem but it's a lot of work, so lie instead. Not evil, just lazy.
- tptacek 5y ago
  Definitely a real interesting flex suggesting that Ryan Sleevi is "wrong all over the place in ways somebody who doesn't know can't fix" about WebPKI.
  - tialaramex 5y ago
    Huh? The transcript is wrong. Here's an example picked quickly: "this became, what's known as lid peacocks. And so lippy kicks is, like six layers of sea macros" Did Ryan say that on your podcast? No? Because he was talking about libPKIX.
    - tptacek 5y ago
      Oh. HAH! Sorry, I knee-jerk snarked at you. I'll try not to do that going forward. The transcripts here are really funny.
      - tialaramex 5y ago
        For a technical podcast they're not very helpful but they are funny. Does a human curate them? I'm genuinely curious how automatic or otherwise they are now. And thanks for trying. Realistically alas being snarky at each other is unlikely to make any difference to whether DNSSEC is more or less successful. Otherwise presumably many of the things we both agree are a good idea would long since be universal...
        tptacek 5y ago
        They are extremely automatic. They're generated from Descript, and they're not just a transcript; in theory, we can edit the podcast by editing that transcript. (We just hired an editor to do this for us, and I'm probably going to start proofing the transcripts --- we definitely don't do that now).
tptacek 5y ago
We have another episode coming with a special DNSSEC-relevant guest making the case against Ryan here. :) (I revere Sleevi and, while I think he's totally wrong about this, I believe he's grudgingly wrong about it, not gleefully wrong like the people who got Slack into this mess.)

tialaramex 5y ago

In some sense that podcast episode is much more interesting than a 2015 article of course. The transcript you linked in particular is a giggle if you actually know what's going on because of course it's wrong all over the place in ways somebody who doesn't know can't fix. A few of them are generic (e.g. it's normal for English speakers to say "fifty-two eighty" to mean 5280 and then of course the transcript renders that as 52 80, and it's normal to pronounce ETSI "Etsy") but many more are not (if you know Ryan is saying PKIX then you can recognise that, but if you don't then "Peak X" or indeed "Peacocks" is a fair stab). [Maybe one of the many PKIX implementations should name itself "Peacocks" in the same way that "Secret Rabbit Code" stands out from other Sample Rate Converter libraries] I assume the transcript is at least human curated to be as coherent as it is, but maybe not. Ryan doesn't mention it on that podcast because it wasn't official yet, but much of the public role of Ryan (Sleevi) is now played by Ryan (Dickson). The entire "How to be a Certificate Authority" podcast premise seems to be er, what if the "Honest Achmed" Bugzilla ticket, but a podcast. Which you know, fine but you are very late people - did you already do a "Steamed Hams" episode? Also, I'd be fascinated to hear from anybody, in any sector with auditors, who thinks they're actually getting something like that Affleck / Kendrick movie "The Accountant". Maybe Thomas thinks he's Ben Affleck? I've worked with auditors, both internal and external. They're like a code review from a junior. They might see something you missed but they aren't going to find anything you actually hid. Thus audit is valuable, until it isn't. Should I talk about that? In fact Thomas has already brought up Symantec so why not, if you go back and look at that, one of the things I highlighted very early there was that Symantec are relying on auditors, and we know auditors are the worst option other than nothing. So, this is the right choice if your alternative was nothing, but Symantec had lots of better alternatives and didn't take them. And this is one of the many places where I think Thomas is just obviously wrong, he describes CAs as "A force for evil" but er, no. We don't see a lot of evil. Now, honestly I'm not looking for evil, but even if I looked I don't expect to find much. What we see are the usual human failings: Laziness and incompetence. Maybe some greed. But mostly laziness and incompetence. I talked about hiding earlier. Isn't that evil? Nope. Just laziness again. You could fix the problem but it's a lot of work, so lie instead. Not evil, just lazy.

tptacek 5y ago
Definitely a real interesting flex suggesting that Ryan Sleevi is "wrong all over the place in ways somebody who doesn't know can't fix" about WebPKI.
- tialaramex 5y ago
  Huh? The transcript is wrong. Here's an example picked quickly: "this became, what's known as lid peacocks. And so lippy kicks is, like six layers of sea macros" Did Ryan say that on your podcast? No? Because he was talking about libPKIX.
  - tptacek 5y ago
    Oh. HAH! Sorry, I knee-jerk snarked at you. I'll try not to do that going forward. The transcripts here are really funny.
    - tialaramex 5y ago
      For a technical podcast they're not very helpful but they are funny. Does a human curate them? I'm genuinely curious how automatic or otherwise they are now. And thanks for trying. Realistically alas being snarky at each other is unlikely to make any difference to whether DNSSEC is more or less successful. Otherwise presumably many of the things we both agree are a good idea would long since be universal...
      - tptacek 5y ago
        They are extremely automatic. They're generated from Descript, and they're not just a transcript; in theory, we can edit the podcast by editing that transcript. (We just hired an editor to do this for us, and I'm probably going to start proofing the transcripts --- we definitely don't do that now).

tptacek 5y ago

We have another episode coming with a special DNSSEC-relevant guest making the case against Ryan here. :) (I revere Sleevi and, while I think he's totally wrong about this, I believe he's grudgingly wrong about it, not gleefully wrong like the people who got Slack into this mess.)