7 ms·

Dear "forgotusername". David Sanger is a Pulitzer prize winning reporter and Chief White House correspondent for the NY Times where he has been for a spectacula

Dear "forgotusername". David Sanger is a Pulitzer prize winning reporter and Chief White House correspondent for the NY Times where he has been for a spectacular 30 year career. He worked with the US administration to determine what data in that article was safe to publish and what would compromise ongoing ops.

forgotusername 14y ago
Making an appeal to authority doesn't change anything. Most people seem to fail to grasp that there is an $8bn industry spanning the globe who thrive on secret software vulnerabilities. Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager. But ignore reality, pepper dramatic terms like Iran, cyber war, espionage, license to kill around liberally and see what effect it has on your freedom to use your computer in coming years. That may be the only tangible result of all this hot air. You should also be aware that same industry stands to make the most direct gain from any increase in public perception of information security, and any resulting regulation.
- Xylakant 14y ago
  > Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager. Apart from the fact that flame used a previously unknown chosen prefix collision attack against MD5? I'd love to meet that bored teenager... [see http://news.ycombinator.com/item?id=4080240 http://news.ycombinator.com/item?id=4080240]
- tptacek 14y ago
  The raw compute time to calculate the MD5 collision used in Flame costs tens to hundreds of thousands of dollars --- there's a window of time within which the calculation has to complete --- and does not appear to have used the HashClash code that Marc Stevens published after the RapidSSL exploit. Flame wasn't a bored teenager.
deleted 14y ago
[deleted]
uvdiv 14y ago
So a sufficiently famous and prestigious scientist could get away with keeping all his data, methodology, and calculations secret, publishing only his conclusions, and have the world accept it all unquestioningly because of his "career" and "status"? No wonder journalism is such a disaster, if this is all we except of it.

forgotusername 14y ago

Making an appeal to authority doesn't change anything. Most people seem to fail to grasp that there is an $8bn industry spanning the globe who thrive on secret software vulnerabilities. Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager. But ignore reality, pepper dramatic terms like Iran, cyber war, espionage, license to kill around liberally and see what effect it has on your freedom to use your computer in coming years. That may be the only tangible result of all this hot air. You should also be aware that same industry stands to make the most direct gain from any increase in public perception of information security, and any resulting regulation.

Xylakant 14y ago
> Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager. Apart from the fact that flame used a previously unknown chosen prefix collision attack against MD5? I'd love to meet that bored teenager... [see http://news.ycombinator.com/item?id=4080240 http://news.ycombinator.com/item?id=4080240]
tptacek 14y ago
The raw compute time to calculate the MD5 collision used in Flame costs tens to hundreds of thousands of dollars --- there's a window of time within which the calculation has to complete --- and does not appear to have used the HashClash code that Marc Stevens published after the RapidSSL exploit. Flame wasn't a bored teenager.

deleted 14y ago

[deleted]

uvdiv 14y ago

So a sufficiently famous and prestigious scientist could get away with keeping all his data, methodology, and calculations secret, publishing only his conclusions, and have the world accept it all unquestioningly because of his "career" and "status"? No wonder journalism is such a disaster, if this is all we except of it.