4 ms·

That isn't a praise of GUIs, it is a damnation of OpenSSL The exact opposite of *NIX philosophy. Don't do just one thing well, be Swiss Army knife, the largest

That isn't a praise of GUIs, it is a damnation of OpenSSL The exact opposite of *NIX philosophy. Don't do just one thing well, be Swiss Army knife, the largest one you have ever seen, with a lot of the blades poking part way out, so you may lacerate yourself at any moment.

car_analogy 4y ago
I heard rumors on HN that security agencies had a hand in making the protocols overly complex, hoping that would cause bugs in implementations they could exploit.
- dymk 4y ago
  Sounds unfalsifiable
- LeoPanthera 4y ago
  I mean, that's almost a textbook conspiracy theory. "Heard from a friend", hard to prove, hard to disprove.
  - mise_en_place 4y ago
    No conspiracy needed, they deliberately sabotaged certain standards to make them weak/easy to break, until it was caught by the security community and they were rightly rebuked for it. Like DES
  - car_analogy 4y ago
    "Heard a rumor" was there to provide an estimate of how (un)reliable the information was. My hope was someone would be able to confirm it, and it was not my intent to pass it off as confirmed fact. Regardless, as the sibling poster noted, they have already been caught weakening standards.
- hannob 4y ago
  This may sound plausible at first, but if you've watched these kinds of things for a while there's an entirely plausible other explanation. Everyone wants to have their little special case feature in, and nobody says "No!". Very few people actively try to avoid complexity and favor simplicity in standardization processes, even fewer did up until a few years ago. "Avoiding complexity is good for security" is the thing that everyone will claim to agree if you say it, but hardly anyone follows in practice.
  - Too 4y ago
    Sprinkle in some security by obscurity; “If we just use our own variant of the algorithm , the hackers can not use common exploits!!” Scare of liability is another plausible reason. Nobody wants to be famous for picking the wrong default algorithm that exposed the whole internet. Easier to blame each individual user for choosing the wrong exponent or number of padding-bits.
- soraminazuki 4y ago
  Security agencies have spent hundreds of millions of dollars per year in its efforts to undermine internet encryption standards and implementations. One well-known case is Dual_EC_DRBG, in which the NSA backdoored a NIST encryption standard and bribed companies to implement it in widely used products. All of this is well documented by numerous major news outlets, especially since 2013. I wonder if people screaming "conspiracies!" are doing so in good faith. [1]: https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encry... [2]: https://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html https://www.nytimes.com/2013/09/06/us/nsa-foils-much-interne... [3]: https://finance.yahoo.com/news/juniper-breach-mystery-starts-clear-130016591.html https://finance.yahoo.com/news/juniper-breach-mystery-starts... [4]: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
  - Thorrez 4y ago
    Dual_EC_DRBG was a little different. It introduced an asymmetric key that only the NSA had the private key for. So only the NSA was able to exploit it. If they were to make stuff complex generically with the hope of it being buggy, it would lead to bugs that other intelligence agencies could exploit.
    - proto_lambda 4y ago
      This still assumes that intelligence agencies are good at keeping their backdoors to themselves, which is not necessarily the case.
    - soraminazuki 4y ago
      Do they really care though? NSA's previous handling of zero days [1] suggest that they care more about advancing their offensive capabilities even if it means putting critical public infrastructure at risk. [1]: https://news.ycombinator.com/item?id=12365629 https://news.ycombinator.com/item?id=12365629
tenebrisalietum 4y ago
This is what you get when you have something that's entirely in the application layer when part of it should be in lower layers. Cf. HTTP3/QUIC However, it's good that it's there, so you can add it if the lower layers aren't providing.
- kortex 4y ago
  I wish we had a layer 6-ish security protocol that "just worked" the way HTTP just works. Something analogous to an ssh tunnel, where once you establish the correct keys (via a single, simple operation), clients and servers can just talk with no extra application-level configuration. Currently if I want to use HTTP2/3, I have to fuss with openssl, self-signed certs (which never seems to work reliably for me), messing with /etc/hosts... it's always just painful for me for some reason.
  - Too 4y ago
    When using kubernetes you have Service Mesh. Not the most easy. Outside of that there is like you say SSH tunnel or other forms of VPN. Except those are usually more global and expect all players inside the network to be dmz.

car_analogy 4y ago

I heard rumors on HN that security agencies had a hand in making the protocols overly complex, hoping that would cause bugs in implementations they could exploit.

dymk 4y ago
Sounds unfalsifiable
LeoPanthera 4y ago
I mean, that's almost a textbook conspiracy theory. "Heard from a friend", hard to prove, hard to disprove.
- mise_en_place 4y ago
  No conspiracy needed, they deliberately sabotaged certain standards to make them weak/easy to break, until it was caught by the security community and they were rightly rebuked for it. Like DES
- car_analogy 4y ago
  "Heard a rumor" was there to provide an estimate of how (un)reliable the information was. My hope was someone would be able to confirm it, and it was not my intent to pass it off as confirmed fact. Regardless, as the sibling poster noted, they have already been caught weakening standards.
hannob 4y ago
This may sound plausible at first, but if you've watched these kinds of things for a while there's an entirely plausible other explanation. Everyone wants to have their little special case feature in, and nobody says "No!". Very few people actively try to avoid complexity and favor simplicity in standardization processes, even fewer did up until a few years ago. "Avoiding complexity is good for security" is the thing that everyone will claim to agree if you say it, but hardly anyone follows in practice.
- Too 4y ago
  Sprinkle in some security by obscurity; “If we just use our own variant of the algorithm , the hackers can not use common exploits!!” Scare of liability is another plausible reason. Nobody wants to be famous for picking the wrong default algorithm that exposed the whole internet. Easier to blame each individual user for choosing the wrong exponent or number of padding-bits.
soraminazuki 4y ago
Security agencies have spent hundreds of millions of dollars per year in its efforts to undermine internet encryption standards and implementations. One well-known case is Dual_EC_DRBG, in which the NSA backdoored a NIST encryption standard and bribed companies to implement it in widely used products. All of this is well documented by numerous major news outlets, especially since 2013. I wonder if people screaming "conspiracies!" are doing so in good faith. [1]: https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encry... [2]: https://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html https://www.nytimes.com/2013/09/06/us/nsa-foils-much-interne... [3]: https://finance.yahoo.com/news/juniper-breach-mystery-starts-clear-130016591.html https://finance.yahoo.com/news/juniper-breach-mystery-starts... [4]: https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- Thorrez 4y ago
  Dual_EC_DRBG was a little different. It introduced an asymmetric key that only the NSA had the private key for. So only the NSA was able to exploit it. If they were to make stuff complex generically with the hope of it being buggy, it would lead to bugs that other intelligence agencies could exploit.
  - proto_lambda 4y ago
    This still assumes that intelligence agencies are good at keeping their backdoors to themselves, which is not necessarily the case.
  - soraminazuki 4y ago
    Do they really care though? NSA's previous handling of zero days [1] suggest that they care more about advancing their offensive capabilities even if it means putting critical public infrastructure at risk. [1]: https://news.ycombinator.com/item?id=12365629 https://news.ycombinator.com/item?id=12365629

tenebrisalietum 4y ago

This is what you get when you have something that's entirely in the application layer when part of it should be in lower layers. Cf. HTTP3/QUIC However, it's good that it's there, so you can add it if the lower layers aren't providing.

kortex 4y ago
I wish we had a layer 6-ish security protocol that "just worked" the way HTTP just works. Something analogous to an ssh tunnel, where once you establish the correct keys (via a single, simple operation), clients and servers can just talk with no extra application-level configuration. Currently if I want to use HTTP2/3, I have to fuss with openssl, self-signed certs (which never seems to work reliably for me), messing with /etc/hosts... it's always just painful for me for some reason.
- Too 4y ago
  When using kubernetes you have Service Mesh. Not the most easy. Outside of that there is like you say SSH tunnel or other forms of VPN. Except those are usually more global and expect all players inside the network to be dmz.