3 ms·

I'm respectful of your qualifications, but annoyed when you use your credentials without qualification. A paranoid man might assume your comments are strategica

I'm respectful of your qualifications, but annoyed when you use your credentials without qualification. A paranoid man might assume your comments are strategically placed to benefit parties you're aligned with, based on how little context there is here; I know better, others might not. "These are good guys. This paper is the real deal." I appreciate what you bring to HN, but that this is the top comment worries me, particularly when it comes to security of all things. There's valuable comments that are contrary to your opinion surrounding you, and I wish you'd explain your side a bit more clearly in cases like this.

tptacek 14y ago
You caught me. I'm a secret shill for Ross Anderson.
- jsprinkles 14y ago
  That wasn't the gist of my comment, but okay. I'm disappointed that you feel the rest of my comment wasn't worth your time, and you chose to attach to a throwaway hypothetical. Alas, it was worth a shot.
  - tptacek 14y ago
    I find it exhausting to have to write things defensively just to ward off drama. The fact that I had to offer was very simple: that the security group at Cambridge is very credible. And you knew that, because you acknowledged in your comment. I'm left wondering why you commented at all.
    - jsprinkles 14y ago
      Excellent! They are credible. Why? Because you said so? That is good information, but just hearing your reasoning would make your comment a lot more credible itself without your reputation, which many people aren't familiar with. Other people here are making the case that the motives behind this research aren't perfectly pure, so, presenting the unique insight that you have on the credibility of this group would be awesome and potentially shift the topic of conversation. It isn't just this particular instance that is driving my comment (in which I acknowledge your reputation, and nobody else's, a small oversight in your reply). The driving force is more your showing up in threads, saying something either plainly obvious or, worse, absolutely confusing, and then expecting your reputation to carry your comment the rest of the way. Most of the time, the reasoning behind your comment is completely unclear. It isn't avoiding drama to elaborate, it's making your point clearer and not relying upon a name you've created for yourself in this community when the rationale behind your opinion is unclear to those of us without your ability. The other comment that annoyed me recently, and most front of mind, was this one about nginx[1]: "This is a very bad bug, and you should fix it ASAP. Don't wait." Two things here: 1. Thank you, Captain Obvious. What an enlightening comment. 2. What does "very bad" mean? The actual situation related to that vulnerability was much more complex, and the threat fairly small. You, however, glossed right over that and skipped to basically informing the lay to panic, then got really snarky when people questioned you on the motivation. I don't believe that making the lay panic is the right way to achieve greater security, regardless of your credentials, and this is one of those cases where the reasoning behind your comment would have gone a long way. Think about what a novice admin walks away from that comment with. Yes, he upgrades, awesome. That's exactly what we expect of administrators. There's something more sinister underlying your end result, though, which is that you've trained an administrator to act on what you and other security professionals say when it comes to security, without any explanation or reason. Security would be a much better place if people started gaining the ability to think for themselves and understand the issue, and you're working to reverse that. I see this crap with bcrypt, too. "Just use bcrypt." "Why?" "Because smart people said so." Now what if you fuck up? What if you give bad advice?[2] Half of this community is going to take you at face value, because you don't present supporting facts for your position to be debated openly. Because it's 'tiring'. You are quite unmatched in the security arena with your technical prowess. There's no question of that. It's comments like these, however, that make me annoyed that you're using said reputation inappropriately, and any questioning you receive on the matter leads to single-sentence snark like the pointless gray comment in this thread. Before asking why I commented, consider your own comments and the different standard you hold your own commentary to in this forum. [1]: http://news.ycombinator.com/item?id=3709269 http://news.ycombinator.com/item?id=3709269 [2]: I fully expect a snarky reply to this hypothetical, so make it good.
      - tptacek 14y ago
        I am sorry that it upset you that I was unable to share details about a bug, but I am unwilling to withhold heads-ups to the other people here running apps behind nginx just to save your feelings. I think if you use the search box at the bottom of the screen, you'll have no trouble at all finding thousands and thousands of words spelling out in great detail what I think about bcrypt. I am a person, not a web service. You cannot file bugs every time I don't provide exactly the comments in exactly the tone you're looking for. Or, as you're amply demonstrating, you can, but it's unlikely to do you any good.
        dr_rezzy 14y ago
        I think you guys are talking on different tracks here. jsprinkles brings up a genuine concern. However, he goes ahead and calls your skill unmatched in your domain and I respect that. Honestly, that was a bit of a shocker but I will accept this. Its one thing to be cagey with details and unscientific with your "forum" approach. But it bothers me that you go ahead and underestimate and even disrespect your audience. I can only come to the conclusion that you dont understand. Thats it, this is a very fitting response.
      - SkyMarshal 14y ago
        Pro-tip: If you don't understand or want more clarification, just ask. If you disagree, say why. It's not hard, and usually effective. Skip all the other BS. If tptacek or anyone else wants to speak in Zen koans and leave it up to motivated readers to figure out what he meant, so be it. No one owes anyone anything here, and you should think of it as a chance to sharpen your research and investigative skills. But seriously, omit the entitlement and drama. It's the last thing HN needs.
rdl 14y ago
There's really no debate that Cambridge has probably the top university hardware security analysis program in the world. They published attacks on the IBM 4758 Security Coprocessor, a bunch of attacks on specific smartcards, and are basically the standard bearer for (non classified) research into this kind of stuff. I think some of the chip companies (Intel, IBM) might have better resources for pure silicon debugging, but less security clue to go with it.

tptacek 14y ago

You caught me. I'm a secret shill for Ross Anderson.

jsprinkles 14y ago
That wasn't the gist of my comment, but okay. I'm disappointed that you feel the rest of my comment wasn't worth your time, and you chose to attach to a throwaway hypothetical. Alas, it was worth a shot.
- tptacek 14y ago
  I find it exhausting to have to write things defensively just to ward off drama. The fact that I had to offer was very simple: that the security group at Cambridge is very credible. And you knew that, because you acknowledged in your comment. I'm left wondering why you commented at all.
  - jsprinkles 14y ago
    Excellent! They are credible. Why? Because you said so? That is good information, but just hearing your reasoning would make your comment a lot more credible itself without your reputation, which many people aren't familiar with. Other people here are making the case that the motives behind this research aren't perfectly pure, so, presenting the unique insight that you have on the credibility of this group would be awesome and potentially shift the topic of conversation. It isn't just this particular instance that is driving my comment (in which I acknowledge your reputation, and nobody else's, a small oversight in your reply). The driving force is more your showing up in threads, saying something either plainly obvious or, worse, absolutely confusing, and then expecting your reputation to carry your comment the rest of the way. Most of the time, the reasoning behind your comment is completely unclear. It isn't avoiding drama to elaborate, it's making your point clearer and not relying upon a name you've created for yourself in this community when the rationale behind your opinion is unclear to those of us without your ability. The other comment that annoyed me recently, and most front of mind, was this one about nginx[1]: "This is a very bad bug, and you should fix it ASAP. Don't wait." Two things here: 1. Thank you, Captain Obvious. What an enlightening comment. 2. What does "very bad" mean? The actual situation related to that vulnerability was much more complex, and the threat fairly small. You, however, glossed right over that and skipped to basically informing the lay to panic, then got really snarky when people questioned you on the motivation. I don't believe that making the lay panic is the right way to achieve greater security, regardless of your credentials, and this is one of those cases where the reasoning behind your comment would have gone a long way. Think about what a novice admin walks away from that comment with. Yes, he upgrades, awesome. That's exactly what we expect of administrators. There's something more sinister underlying your end result, though, which is that you've trained an administrator to act on what you and other security professionals say when it comes to security, without any explanation or reason. Security would be a much better place if people started gaining the ability to think for themselves and understand the issue, and you're working to reverse that. I see this crap with bcrypt, too. "Just use bcrypt." "Why?" "Because smart people said so." Now what if you fuck up? What if you give bad advice?[2] Half of this community is going to take you at face value, because you don't present supporting facts for your position to be debated openly. Because it's 'tiring'. You are quite unmatched in the security arena with your technical prowess. There's no question of that. It's comments like these, however, that make me annoyed that you're using said reputation inappropriately, and any questioning you receive on the matter leads to single-sentence snark like the pointless gray comment in this thread. Before asking why I commented, consider your own comments and the different standard you hold your own commentary to in this forum. [1]: http://news.ycombinator.com/item?id=3709269 http://news.ycombinator.com/item?id=3709269 [2]: I fully expect a snarky reply to this hypothetical, so make it good.
    - tptacek 14y ago
      I am sorry that it upset you that I was unable to share details about a bug, but I am unwilling to withhold heads-ups to the other people here running apps behind nginx just to save your feelings. I think if you use the search box at the bottom of the screen, you'll have no trouble at all finding thousands and thousands of words spelling out in great detail what I think about bcrypt. I am a person, not a web service. You cannot file bugs every time I don't provide exactly the comments in exactly the tone you're looking for. Or, as you're amply demonstrating, you can, but it's unlikely to do you any good.
      - dr_rezzy 14y ago
        I think you guys are talking on different tracks here. jsprinkles brings up a genuine concern. However, he goes ahead and calls your skill unmatched in your domain and I respect that. Honestly, that was a bit of a shocker but I will accept this. Its one thing to be cagey with details and unscientific with your "forum" approach. But it bothers me that you go ahead and underestimate and even disrespect your audience. I can only come to the conclusion that you dont understand. Thats it, this is a very fitting response.
    - SkyMarshal 14y ago
      Pro-tip: If you don't understand or want more clarification, just ask. If you disagree, say why. It's not hard, and usually effective. Skip all the other BS. If tptacek or anyone else wants to speak in Zen koans and leave it up to motivated readers to figure out what he meant, so be it. No one owes anyone anything here, and you should think of it as a chance to sharpen your research and investigative skills. But seriously, omit the entitlement and drama. It's the last thing HN needs.

rdl 14y ago

There's really no debate that Cambridge has probably the top university hardware security analysis program in the world. They published attacks on the IBM 4758 Security Coprocessor, a bunch of attacks on specific smartcards, and are basically the standard bearer for (non classified) research into this kind of stuff. I think some of the chip companies (Intel, IBM) might have better resources for pure silicon debugging, but less security clue to go with it.