7 ms·
The most backdoor-looking bug I've ever seen (2021)
- tacitusarc 2y ago[flagged]
- GauntletWizard 2y agoYeah, interchange Woman-in-the-middle if you want to be inclusive; It still flows well off the tongue.
- Voultapher 2y agoI don't find it silly. The language we use, shapes the world we live in.
- croes 2y agoWe still click on the disk icon to save files although many never have seen a disc. Sometimes terms and icons loose their word by word meaning and their own independent one. That's how idioms work.
- lencastre 2y agoYeah, why are we like that? I haven’t seen a floppy disk in weeks. And the noise it makes when I’m saving the drill protocol on which our monthly invoicing depends (+/- hundreds of thousands of euros) gives me cold sweats…
- jraph 2y agoBut the disc is inoffensive. Changing this wouldn't fix anything because we haven't found a clearer / clearly better icon for save afaik, so we stick we what we have. But words shape the images we form in our minds. The issue with man-limited phrases is that we imagine men, specifically. That's also how words work and we know this through studies. So we ought to fix this. But I'm sure OP already know why people seek to get rid of these unwanted gendering in idioms. That's not new anymore. It's mildly annoying because we are used to the old term but that's very temporary, for the time of the transition. But I'm sure OP instantly understood the meaning of Person in the Middle the first time you saw it, so I have troubles understanding why someone would oppose such an evolution. Surely it's not about clarity. We never fixed anything by refusing change and staying in the past.
- huygens6363 2y agoGuys, I know you hate change, but if these terms were all so innocuous and innocent, why the hate against this small change? I’m from Holland and we have this weird thing called Sinterklaas where we dress up as black people and basically make fun of them. However, don’t tell them this because they will tear you a new one. How dare you touch these sacred traditions. I feel the same way about master/slave and gendered bullshit. It’s not the end of the world and let’s not make it bigger than it is, but sometimes you at least just have to admit things are fishy.
- Cthulhu_ 2y agoFor context to the above comment: "things are fishy" is a translation of a Dutch phrase "het klopt niet", which was thrown around during the pandemic, farmer's protests, a short lived qanon phase and other conspiracy thinking waves. It's an empty statement and feels tacked onto the above comment without explaining what exactly is fishy. The push against making the Sinterklaas character of Zwarte Piet less of a racist stereotype is another culture war, provoked by shady organizations. Remember that there's foreign powers in whose interest it is to get people really upset over issues like this; they don't care who "wins", as long as people get upset over it and feel threatened by a boogieman.
- huygens6363 2y agoDutch people demand to know what is fishy about making a black face, dressing up in colonial clothes and acting childish. They think this is “empty talk”. There is a long, long list of these kinds of “cultural” behaviors. Especially the rural area is particularly backwards. I don’t know what to say. Meet some people outside your bubble. It certainly helped me. Anyway, the Dutch and their deep-rooted racism are only superficially related to this issue. My main point was to say that there exists the possibility that you may be wrong about holding on to outdated norms and changing things might be a good idea. Sinterklaas is just a particularly obvious one, but as you show, a lot of people still have some way to go.
- 2y ago
- Cthulhu_ 2y agoNot to be pedantic, but the comment you're replying to didn't mention iconography; "save" is still the word used, but when you think about it, it's a weird word to use for the act of storing something. "Save this file from being lost in case my computer shuts down" kinda thing.
- croes 2y agoThat's why I mentioned terms and idioms further down.
- erik_seaberg 2y agoThat is an odd hypothesis that Sapir and Whorf were never able to prove.
- Voultapher 2y ago> The hypothesis has long been controversial, and many different, often contradictory variations have existed throughout its history.[2] The strong hypothesis of linguistic relativity, now referred to as linguistic determinism, is that language determines thought and that linguistic categories limit and restrict cognitive categories. This was claimed by some of the early linguists before World War II;[3] but, it is generally agreed to be false by modern linguists.[4] Nevertheless, research has produced positive empirical evidence supporting a weaker version of linguistic relativity:[4][3] that a language's structures influence a speaker's perceptions, without strictly limiting or obstructing them. https://en.wikipedia.org/wiki/Linguistic_relativity https://en.wikipedia.org/wiki/Linguistic_relativity So there is empirical evidence that it has a non-zero impact on the way people view the world. What's wrong with Person-In-The-Middle? If we can include more people and make the topic more accessible and move a little stone off of the patriarchy mountain, seems like an easy win to me. Assuming you believe that systemic privileges exist and that they are bad and should be changed.
- strictnein 2y agoI felt like I had seen a number of people move to Machine in the Middle, because that's what it is anyways.
- croes 2y agoThat's misleading because there always at least one machine in the middle unless your smartphones have a direct connection.
- conradludgate 2y agoA colleague of mine says Meddler in the Middle
- hnlmorg 2y agoThat’s a really neat alternative. I might start using that myself
- tgsovlerkhgsel 2y agoAnd this (in addition to the "this is the RIGHT way and if you do it the old way you're implicitly EVIL" self-righteousness) is why I have a problem with all the pseudo-DEI language changes: They hinder communication. Instead of one universally accepted term, you now come across at least half a dozen "better" alternatives for everything, and each time have to figure out what they mean, and whether they're just a more politically correct term for something existing, or imply some kind of actual difference.
- dtech 2y agoWe're talking about cryptographic shorthand here for which it seems perfectly fine. You might as well complain that not all message senders are called Alice.
- croes 2y agoAlice and Bob are not inclusive
- SheepSlapper 2y agoPerson Located Between Two Other Equally Valid Persons doesn't roll off the tongue the same, does it?
- scoopr 2y agoMalice-in-the-Middle
- cshimmin 2y agoMammal in the middle? Surely our threat model doesn’t include avian attackers…
- caf 2y agoSounds like you're working for the lizard people.
- humzashahid98 2y agoThis made me think of that old TV show "Malcolm in the Middle".
- DeepSeaTortoise 2y agoWhat if they only got your best interests in mind™?
- scoopr 2y agoCovert-in-the-Communication Trespasser-in-the-Transit
- dabacaba 2y agoMallory-in-the-Middle
- nilsherzig 2y agoI think it makes sense, since it's an assumption that the attacker is a male. In security it should be a focus to be as precise as possible and not to introduce assumptions which might cloud your ability to judge other details.
- tired-turtle 2y agoOur nascent AI overlord wants a word with you. The assumption that the attacker was a person was deemed culturally insensitive.
- eru 2y ago> The term man (from Proto-Germanic *mann- "person") and words derived from it can designate any or even all of the human race regardless of their sex or age. In traditional usage, man (without an article) itself refers to the species or to humanity (mankind) as a whole. https://en.wikipedia.org/wiki/Man_(word) https://en.wikipedia.org/wiki/Man_(word) Of course, the meaning of words change over time. But also, the meaning of words in a compound expression can be different from the meaning of the word on its own. (See also how a pickpocket is not a type of pocked, nor is a cutthroat a kind of throat.)
- Dylan16807 2y ago> since it's an assumption that the attacker is a male It most certainly is not. I could talk about linguistics but instead I'll just point out that the default attacker is a woman named Eve.
- tgsovlerkhgsel 2y agoI find the "precise" language excuse insulting. The purpose of these forced changes is an American understanding of DEI, pretending it's not about that feels like a lie, and being told a transparent lie feels insulting to me because it suggests the person telling the lie considers me dumb enough to not see through it.
- apantel 2y agoIn reality, it is probably 100x more likely to be a man performing a MITM than a woman.
- HL33tibCe7 2y agoHe who shall not be named in the middle
- SPBS 2y agoI can't believe they changed this too. It's like context doesn't matter, as though "Man" wasn't used in a gender-neutral way in the term "Man-In-The-Middle". People are free to choose to say PITM instead of MITM if they feel the original term is offensive, but it shouldn't be forced onto everyone (e.g. GitHub issues nagging maintainers to change MITM to PITM in order to be more "inclusive").
- dathos 2y agoIt being removed is good, but the lack of communication about such a major part of the security being this weak erodes the little trust I had for Telegram
- plugin-baby 2y ago> In text I can't do justice to the facial expressions of cryptographers when you mention Telegram's protocol, so just believe me that it's weird. Seems like a red flag.
- SCUSKU 2y agoI wonder what the author’s other reservations about Telegram are? Hand rolled crypto is definitely a massive reason to be suspicious, but are there other issues the author is alluding to?
- plugin-baby 2y agoThere are a few mentioned in the footnotes.
- int0x29 2y agoThis isn't terribly specific but its an encrypted chat app from an authoritarian country that in practice is accepted and used by the government. It has further managed to survive an increasingly tight enviornment for censorship and free expression that is distinctly worse than when the app launched.
- josh2600 2y agoAlmost all chats on telegram are in fact unencrypted. The only chats that use their e2ee protocol are the ones that use the secret chat functionality which almost no one uses.
- dclowd9901 2y agoAnd is also often recommended for use by phishers and scammers. The whole fucking thing should die in a fire.
- surfingdino 2y agoUnless backed with solid evidence intent and use, assuming incompetence rather than malice is sufficient explanation of errors in security protocols' design and implementation. This stuff is hard and any shortcuts you take are quickly proven to be the weak points, any weak points become back doors.
- computerfriend 2y ago> any shortcuts you take This wasn't a shortcut, they added extra complexity to to the protocol.
- surfingdino 2y agoI meant mental shortcuts like thinking that "if we make the protocol more complex it will be more secure".
- eviks 2y agoIt was a shortcut to protect weaker clients "nonce was there to protect clients with weak random number generators. "
- eru 2y agoThat's the justification they cooked up. But that doesn't mean that was the motivation.
- zrobotics 2y agoExactly. Adding a nonce like that was exactly what I did in a CS100 level course when I was over complicating a blackjack exercise that was intended to teach us about stack data structures. I'm really grateful to my prof who took the time to point out the issues with my RNG code instead of being annoyed that I'd turned in ~3x the average LOC. This is such a basic cryptographic fail that one has to assume either the telegram team is incompetent or they were introducing a backdoor. Given that the excuse is so weak, one tends to assume the latter. I get rolling one's one crypto is hard, but this is a such an easily caught fundamental error that those are the options, and neither is good.
- deleted 2y ago[deleted]
- ccvannorman 2y agoNot your keys, Not your convos
- deleted 2y ago[deleted]
- dang 2y agoRelated: The most backdoor-looking bug I’ve ever seen (2021) - https://news.ycombinator.com/item?id=30013192 https://news.ycombinator.com/item?id=30013192 - Jan 2022 (77 comments) Discussed at the time: The Most Backdoor-Looking Bug I’ve Ever Seen - https://news.ycombinator.com/item?id=25726068 https://news.ycombinator.com/item?id=25726068 - Jan 2021 (208 comments) Cryptography Dispatches: The Most Backdoor-Looking Bug I’ve Ever Seen - https://news.ycombinator.com/item?id=25721990 https://news.ycombinator.com/item?id=25721990 - Jan 2021 (1 comment)
- rokkitmensch 2y ago[flagged]
- heinternets 2y agoHow does this term bring out so much anger? I hope everything is ok in your life
- rfoo 2y agoIt is cool to have different abbrev. for Meet-in-the-Middle and Man-in-the-Middle, it was both MitM before and sometimes cause confusion. But reading 'People-in-the-Middle' I also feel offended to the same level when people try to find alternative terms for pseudo-terminal (pty) master and pty slave.
- jraph 2y agoWhy would you feel offended because of those terms?
- nilsherzig 2y agoWell the attacker might very well not be a man. Besides the inclusivity thing it would be helpful not to jump to conclusions regarding any detail of the attacker if you try to investigate an attack.
- ai_what 2y agoDo you genuinely think investigators would assume that they are dealing with a man based on that term? Hyphens included even? At that rate the attacker might as well just state he ( or she ;) didn't do it and we can just close the case right away.
- nilsherzig 2y agoYou know what's funny? I'm always just barely interested in changes like this (git "master" to "main" f.ex.) and I would probably simply not care enough to rename my repos to main. Then I read something like your comment and think to myself, that I really don't want to support your side of this argument and I start using whatever "newspeak" someone made up.
- medo-bear 2y agoI use Telegram as a better Discord, not as a better Signal
- _xnmw 2y agoKeep in mind this is likely a hit piece in a press war. Telegram and Signal regularly attack each other, accusing the other of security and privacy failures. The number of times the author uses subjective words like “weird” and “bizarre” in a strictly technical analysis exposes their bias. See Durov’s (Telegram founder) recent announcement regarding Signal. https://t.me/durov/274 https://t.me/durov/274 > A story shared by Jack Dorsey, the founder of Twitter, uncovered that the current leaders of Signal, an allegedly “secure” messaging app, are activists used by the US state department for regime change abroad > Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones. Signal refused to add reproducible builds for iOS, closing a GitHub request from the community. And WhatsApp doesn’t even publish the code of its apps, so all their talk about “privacy” is an even more obvious circus trick .
- iforgotpassword 2y ago> Keep in mind this is likely a hit piece in a press war. I don't use either but if the article isn't completely made up this does at least look super incompetent and not just like picking on random things about the other messenger.
- _xnmw 2y agoIt is worded as an accusation for what might’ve been an innocent mistake. Look how many times the author uses the word “weird”, a very subjective word to use in a seemingly technical analysis.
- Dylan16807 2y agoIn this case does bias just mean an opinion? It's fine to have an opinion about a flaw like this. If you want to suggest this is an improper "press war" hit piece you need a lot more to back that up.
- deleted 2y ago[deleted]
- 2y ago
- whenlambo 2y agoNikolai Durov, who developed the Telegram encryption system, lives in St. Petersburg. He has retired from working in Pavel's companies - their roads with his brother have diverged. Now Nikolai is a senior researcher at the Russian Academy of Sciences = working for the Russian government.
- InfiniteLoup 2y agoAs far as I know, Nikolai Durov is heavily involved in the development of the Telegram-based TON cryptocurrency protocol and ecosystem.
- WilTimSon 2y agoDo you have a source for him living in Russia? He may be an honorary researcher, which is more likely, considering the two of them escapes Russia years ago with no intention to return.
- whenlambo 2y agoFrom April 17, 2024: https://snob.ru/amp/3092067/ https://snob.ru/amp/3092067/
- WilTimSon 2y agoThe article seems to make the claim he lives there but it's not really backed up by anything. I checked his Wikipedia and the last update is him studying at the University of Bonn, way back in 2007. Doesn't seem like it's possible to verify the claim of his residency.
- cbxyp 2y agoI guess the most backdoor-looking bug I've ever seen (referring of course to Signal Desktop's usage of React's __dangerouslySetInnerHTML to render user-supplied messages in a Node.js privileged context) is below the technical authors paygrade. (https://thehackerblog.com/i-too-like-to-live-dangerously-accidentally-finding-rce-in-signal-desktop-via-html-injection-in-quoted-replies/ https://thehackerblog.com/i-too-like-to-live-dangerously-acc...) - CVE-2018-11101
- andreyvit 2y agoA very under appreciated aspect of Telegram’s protocol is that it’s designed by very, very weird people. Telegram scooped up a lot of winners of ACM ICPC contests in Russia, some of whom I’ve personally met, and the design of the protocol is exactly in line with the code these people generally write. It’s really a showcase of how very high IQ and outstanding mathematical abilities mix with a distrust of existing technologies and a lack of expert intuition coming from more normal industry experience. Just try implementing MTProto, or at least read the low-level docs, and you’ll see for yourself. Crypto isn’t the weirdest part. The whole thing is an attempt to define a binary protocol in terms of grandiose mathematical concepts most of which didn’t even end up ever used in the actual protocol. And there’s zero thought given to what’s actually important, making a bullet-proof syncing between server and client states (and that results in numerous bugs to this day). Can’t discount malice, but I don’t believe that’s the case.
- lxgr 2y agoThere are few things more dangerous to a software engineering project than the lead engineer(s) being a bit too much in love with their own abilities.
- matthewdgreen 2y agoWhen Telegram first launched this was exactly my hypothesis. They found some mathematicians and (to paraphrase Bruce Schneier) they immediately tried to re-invent cryptography -- badly. Which is fine. I assumed that after a few years and some success, Telegram would get more serious about this and replace its crypto with something better (maybe Signal protocol) in the same way that WhatsApp did. I also thought they'd eventually back up their privacy claims by deploying default end-to-end encryption for non-broadcast chats. After all that's the trend everywhere: even Facebook Messenger is now encrypted! But Telegram never, ever did this. They kept on making loud claims to be a privacy-preserving messenger, but they never added real privacy.
- sambazi 2y agonot being controlled by a nato-country might be a relevant security feature for some ppl
- syngrog66 2y agoTelegram is near the top of a private list of tools/bizs I keep I call "Too Russian to Touch" Technically I try to boycott everything with too strong of a connection to any of the so-called CRINK nations (ie. China, Russia, Iran, North Korea.) Its hard to enforce it perfectly. But where its easy enough for me to do, I do.