5 ms·

https://github.com/golang/go/issues/30141#issuecomment-464278183 https://github.com/golang/go/issues/30141#issuecomment-46427... I don't have a full list of al

https://github.com/golang/go/issues/30141#issuecomment-464278183 https://github.com/golang/go/issues/30141#issuecomment-46427... I don't have a full list of all posts at hand (some of which may be removed), but I've seen some other similar stuff as well; it's not an isolated incident. I was reading through the previous thread on this issue (goproxy sending loads of requests) and this one was posted as an example there.

Semaphor 4y ago
Thanks, that is indeed not the greatest of comments.
- dcow 4y ago
  [flagged]
  - morelisp 4y ago
    > personal vendetta This is a weird definition of "personal", like PGP kicked his dog or something. The arguments he makes against it are detailed and the agreement of most working cryptographers, even if they don't agree with his specific deprecation schedule. Some people would call that "good engineering".
    - dcow 4y ago
      “Good engineering” would be to meticulously develop and standardize a replacement before idealistically purging the world of alleged “bad software”. Since this endeavor has yet to be undertaken, PGP it is. Good engineers understand this reality. Look, you can make solid arguments till you are blue in the face about why PGP is unclean and unfit for modern cryptography. And you can be 100% right. But that doesn't mean people who disagree are wrong. There are 100% valid arguments and use cases for PGP too. It takes a mature personality to understand this nuance. And to understand that sharing a mic drop piece about why PGP sucks, getting your security buddies to laugh with you, and then trying to rip it out of existence is incredibly short sighted, ill mannered, and not in the least bit “good engineering”.
      - SSLy 4y ago
        > develop and standardize a replacement https://en.wikipedia.org/wiki/S/MIME https://en.wikipedia.org/wiki/S/MIME ok, I jest.
      - morelisp 4y ago
        > rip it out of existence Come the fuck off this "mature personality" shit if you're going to write like this. He proposed freezing a module no one wanted to maintain in a library specifically meant to host stuff with weaker compat guarantees, he didn't hop in a DeLorean and kill Zimmermann's grandpa. Meanwhile, the critical project Drew insisted he keep it for is... deprecated and unmaintained!
        dcow 4y ago
        [flagged]
        morelisp 4y ago
        [flagged]
        tptacek 4y ago
        In the context we're talking about here, "arguments they don't understand" is incredibly rude and also inaccurate. Please be more careful.
        dcow 4y ago
        That was referencing past conversations I've had where it was very much like I describe. I'll admit I'm channeling some past frustrations and stereotyping and apologize for not making the distinction clear. I am not referring to you or anyone here or anyone on the golang thread, for the record.
        akerl_ 4y ago
        What's the use case for PGP that doesn't have an alternative?
  - Beltalowda 4y ago
    > I’m glad people spoke up. You could reasonably agree or disagree with Filippo take, and after quite a bit of discussion it was decided to not deprecate the opengpg[1]. I'm pretty sure that Drew's comment contributed exactly 0% to that decision. [1]: It was deprecated a two years later as no one stepped up to maintain it, so it bitrotted even further, and there are other (better) 3rd party implementations anyway. Speaking up is nice, actually doing the work is better.
    - aborsy 4y ago
      PGP is difficult to replace. It’s very well supported, and frankly works sufficiently well (sure, it’s outdated, but so is SSH, TLS etc). There are other software that might be more secure and user friendly, but PGP is also secure. A lot of extremely sensitive information is encrypted with pgp.
  - tptacek 4y ago
    Virtually nobody uses PGP, and it is not at all pivotal. It is one of the least important widely-known cryptosystems on the Internet; like the book "Applied Cryptography", it has a cheering section because of the era in which it was released, and a generation of lay-engineers has taken PGP as a synecdoche for all privacy cryptography. It is also badly broken and has an archaic design. Most notably: Filippo had nothing to do with EFail, which was one of the most important cryptographic results of the last 5 years. You don't so much need Drew Devault to tell you that; it's peer-reviewed research.
    - dcow 4y ago
      I am no cheering fan, for sure, but I think it's disingenuous to say PGP is one of the least important systems on the internet. Debian package distribution, notably, depends rather pivotally on PGP to ensure authenticity. Keybase uses PGP as it's root trust mechanism. There are plenty of email services that use PGP to secure messages. I've even come across some recent (as in the last few years) startups using PGP to implement their internal or application-level trust relationships (run by quite sane and well adjusted individuals nonetheless). I worked at a Unicorn in the last 10 years that implemented secret storage and distribution using GPG tooling. In fact, recently and close to home for me, we implemented some application level key exchanges and the security person we consulted with for a 2nd set of eyes actually said (paraphrasing), "I don't like this thing it's custom but if you use ElGamal I'd be more comfortable because at least it's well understood." Of course these are all things that can and probably should be replaced by something more palatable. So why haven't they? If it's not obvious, my argument is neither for nor against PGP, really. It's that I'm tired of hearing about how much PGP sucks without also hearing about the solution. I think the burden is on the people wishing to eradicate it to muster up the blesséd alternative and shepherd it into the vernacular.
      - tptacek 4y ago
        It is one thing to make a case for the continued maintenance of PGP, or even to say that it has a place in modern cryptography (that's an outré thing to say among cryptography engineers, but, whatever). It's another thing entirely to say that any cryptography engineer critical of PGP must have a weird personal vendetta against it, as you did upthread. Harsh criticism of the failings of PGP is practically an orthodoxy among cryptography engineers. It is not a good design by modern standards, and lots of cryptographers would dearly love to be rid of it. Push back on them because you don't think it's worth the time for Debian to switch to minisign, fine, but don't slander people while you're doing it.
shortlived 4y ago
Since GH requires login to see minimized comments, here it is: ddevault on Feb 15, 2019 "EFAIL" is an alarmist puff piece written by morons to slander PGP and inflate their egos. The standards don't need to change to fix the problems it mentions. The proposals help... marginally. The problem is not and was never with OpenPGP, it's with poorly written email clients (e.g. all email clients).
- Beltalowda 4y ago
  Oh right, I didn't know you had to login to see that.
- tptacek 4y ago
  Well, that is a take.
ddevault 4y ago
I was indeed in the wrong when I made this comment four years ago. I have since apologized for it. I don't intend to re-litigate anything on HN at this point, but I have good reason to believe that this incident is unrelated to the reason I am presently banned. The linked comment was indeed out of line, and perhaps you feel justified in thinking that it should be sufficient grounds for a permanent expulsion from the community. I won't argue with that, fair enough. However, I don't think it's reasonable to use it as grounds to suggest that anyone should have their servers DoSed by Google with no recourse, and I think blocking Google is a reasonable move given two years of inaction from the Go team to resolve the issue.
- tptacek 4y ago
  Obviously, your expulsion from the Go issue tracker for abusive conduct is a separable issue from the Go module proxy, as you can see from Go project participants reiterating that the offer to exclude you from the refresh list still stands.
  - ddevault 4y ago
    1. We would like to have a more complex discussion than saying "1" or "0" to this specific offer 2. This specific offer is not satisfactory: https://news.ycombinator.com/item?id=34313802 https://news.ycombinator.com/item?id=34313802
    - tptacek 4y ago
      Clearly it was not satisfactory to you, since it was made over 8 months ago, and you didn't take them up on it. I'm objecting here only to the framing you've created that your ouster from the Go issue forum --- which we can see was done with cause --- is what precipitated this situation.
      - ddevault 4y ago
        We can behave like adults, ask why it's not satisfactory, and come to a more agreeable mutual solution, or we can blithely offer an incomplete solution, muzzle the other party, and just continue our DDoS.

Semaphor 4y ago

Thanks, that is indeed not the greatest of comments.

dcow 4y ago
[flagged]
- morelisp 4y ago
  > personal vendetta This is a weird definition of "personal", like PGP kicked his dog or something. The arguments he makes against it are detailed and the agreement of most working cryptographers, even if they don't agree with his specific deprecation schedule. Some people would call that "good engineering".
  - dcow 4y ago
    “Good engineering” would be to meticulously develop and standardize a replacement before idealistically purging the world of alleged “bad software”. Since this endeavor has yet to be undertaken, PGP it is. Good engineers understand this reality. Look, you can make solid arguments till you are blue in the face about why PGP is unclean and unfit for modern cryptography. And you can be 100% right. But that doesn't mean people who disagree are wrong. There are 100% valid arguments and use cases for PGP too. It takes a mature personality to understand this nuance. And to understand that sharing a mic drop piece about why PGP sucks, getting your security buddies to laugh with you, and then trying to rip it out of existence is incredibly short sighted, ill mannered, and not in the least bit “good engineering”.
    - SSLy 4y ago
      > develop and standardize a replacement https://en.wikipedia.org/wiki/S/MIME https://en.wikipedia.org/wiki/S/MIME ok, I jest.
    - morelisp 4y ago
      > rip it out of existence Come the fuck off this "mature personality" shit if you're going to write like this. He proposed freezing a module no one wanted to maintain in a library specifically meant to host stuff with weaker compat guarantees, he didn't hop in a DeLorean and kill Zimmermann's grandpa. Meanwhile, the critical project Drew insisted he keep it for is... deprecated and unmaintained!
      - dcow 4y ago
        [flagged]
        morelisp 4y ago
        [flagged]
        tptacek 4y ago
        In the context we're talking about here, "arguments they don't understand" is incredibly rude and also inaccurate. Please be more careful.
        dcow 4y ago
        That was referencing past conversations I've had where it was very much like I describe. I'll admit I'm channeling some past frustrations and stereotyping and apologize for not making the distinction clear. I am not referring to you or anyone here or anyone on the golang thread, for the record.
        akerl_ 4y ago
        What's the use case for PGP that doesn't have an alternative?
- Beltalowda 4y ago
  > I’m glad people spoke up. You could reasonably agree or disagree with Filippo take, and after quite a bit of discussion it was decided to not deprecate the opengpg[1]. I'm pretty sure that Drew's comment contributed exactly 0% to that decision. [1]: It was deprecated a two years later as no one stepped up to maintain it, so it bitrotted even further, and there are other (better) 3rd party implementations anyway. Speaking up is nice, actually doing the work is better.
  - aborsy 4y ago
    PGP is difficult to replace. It’s very well supported, and frankly works sufficiently well (sure, it’s outdated, but so is SSH, TLS etc). There are other software that might be more secure and user friendly, but PGP is also secure. A lot of extremely sensitive information is encrypted with pgp.
- tptacek 4y ago
  Virtually nobody uses PGP, and it is not at all pivotal. It is one of the least important widely-known cryptosystems on the Internet; like the book "Applied Cryptography", it has a cheering section because of the era in which it was released, and a generation of lay-engineers has taken PGP as a synecdoche for all privacy cryptography. It is also badly broken and has an archaic design. Most notably: Filippo had nothing to do with EFail, which was one of the most important cryptographic results of the last 5 years. You don't so much need Drew Devault to tell you that; it's peer-reviewed research.
  - dcow 4y ago
    I am no cheering fan, for sure, but I think it's disingenuous to say PGP is one of the least important systems on the internet. Debian package distribution, notably, depends rather pivotally on PGP to ensure authenticity. Keybase uses PGP as it's root trust mechanism. There are plenty of email services that use PGP to secure messages. I've even come across some recent (as in the last few years) startups using PGP to implement their internal or application-level trust relationships (run by quite sane and well adjusted individuals nonetheless). I worked at a Unicorn in the last 10 years that implemented secret storage and distribution using GPG tooling. In fact, recently and close to home for me, we implemented some application level key exchanges and the security person we consulted with for a 2nd set of eyes actually said (paraphrasing), "I don't like this thing it's custom but if you use ElGamal I'd be more comfortable because at least it's well understood." Of course these are all things that can and probably should be replaced by something more palatable. So why haven't they? If it's not obvious, my argument is neither for nor against PGP, really. It's that I'm tired of hearing about how much PGP sucks without also hearing about the solution. I think the burden is on the people wishing to eradicate it to muster up the blesséd alternative and shepherd it into the vernacular.
    - tptacek 4y ago
      It is one thing to make a case for the continued maintenance of PGP, or even to say that it has a place in modern cryptography (that's an outré thing to say among cryptography engineers, but, whatever). It's another thing entirely to say that any cryptography engineer critical of PGP must have a weird personal vendetta against it, as you did upthread. Harsh criticism of the failings of PGP is practically an orthodoxy among cryptography engineers. It is not a good design by modern standards, and lots of cryptographers would dearly love to be rid of it. Push back on them because you don't think it's worth the time for Debian to switch to minisign, fine, but don't slander people while you're doing it.

shortlived 4y ago

Since GH requires login to see minimized comments, here it is: ddevault on Feb 15, 2019 "EFAIL" is an alarmist puff piece written by morons to slander PGP and inflate their egos. The standards don't need to change to fix the problems it mentions. The proposals help... marginally. The problem is not and was never with OpenPGP, it's with poorly written email clients (e.g. all email clients).

Beltalowda 4y ago
Oh right, I didn't know you had to login to see that.
tptacek 4y ago
Well, that is a take.

ddevault 4y ago

I was indeed in the wrong when I made this comment four years ago. I have since apologized for it. I don't intend to re-litigate anything on HN at this point, but I have good reason to believe that this incident is unrelated to the reason I am presently banned. The linked comment was indeed out of line, and perhaps you feel justified in thinking that it should be sufficient grounds for a permanent expulsion from the community. I won't argue with that, fair enough. However, I don't think it's reasonable to use it as grounds to suggest that anyone should have their servers DoSed by Google with no recourse, and I think blocking Google is a reasonable move given two years of inaction from the Go team to resolve the issue.

tptacek 4y ago
Obviously, your expulsion from the Go issue tracker for abusive conduct is a separable issue from the Go module proxy, as you can see from Go project participants reiterating that the offer to exclude you from the refresh list still stands.
- ddevault 4y ago
  1. We would like to have a more complex discussion than saying "1" or "0" to this specific offer 2. This specific offer is not satisfactory: https://news.ycombinator.com/item?id=34313802 https://news.ycombinator.com/item?id=34313802
  - tptacek 4y ago
    Clearly it was not satisfactory to you, since it was made over 8 months ago, and you didn't take them up on it. I'm objecting here only to the framing you've created that your ouster from the Go issue forum --- which we can see was done with cause --- is what precipitated this situation.
    - ddevault 4y ago
      We can behave like adults, ask why it's not satisfactory, and come to a more agreeable mutual solution, or we can blithely offer an incomplete solution, muzzle the other party, and just continue our DDoS.