4 ms·

Yeah, while it's unfortunate that it happened the way it happened, his conclusions/insinuations seem a tad ridiculous. Similar stories happen all the time for

Yeah, while it's unfortunate that it happened the way it happened, his conclusions/insinuations seem a tad ridiculous. Similar stories happen all the time for features with zero connection to security or the NSA. It's simply a sad fact of human nature and society that people act this way; conspiracy theories are not necessary (and are often harmful, as they distract from the real, if boring, issues). "Never attribute to malice that which is adequately explained by stupidity" and all that.

marshray 13y ago
Sometimes the stupidity cannot be adequately explained by stupidity.
- mbreese 13y ago
  If you try to make something idiot-proof, they'll just go and find a bigger idiot. Never underestimate the human capacity for stupidity.
  - marshray 13y ago
    We're talking about some of the most respected and professional protocol engineers of the public internet here, not some global "biggest idiot" contest.
    - teeja 13y ago
      John Gilmore (born 1955)is one of the founders of the Electronic Frontier Foundation, the Cypherpunks mailing list, and Cygnus Solutions. I should be such an 'idiot'.
      - snogglethorpe 13y ago
        Er, but the "stupidity" being hypothesized in this case is not John Gilmore's but rather the kernel maintainer he thinks was showing "malice." There are tons of people out there, yes, even kernel maintainers, who are technically skilled and smart but for whatever reasons, prove to be bad at tasks like this and make bad decisions. It's usually not a conspiracy, and John Gilmore's vague handwaving isn't a very convincing demonstration that it was in this case either... :]
        marshray 13y ago
        http://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html http://www.mail-archive.com/cryptography@metzdowd.com/msg123... Every once in a while, someone not an NSA employee, but who had longstanding ties to NSA, would make a suggestion that reduced privacy or security, but which seemed to make sense when viewed by people who didn't know much about crypto. For example, using the same IV (initialization vector) throughout a session, rather than making a new one for each packet. Or, retaining a way to for this encryption protocol to specify that no encryption is to be applied.
    - mbreese 13y ago
      For what it's worth, I wasn't talking about anyone... just commenting on the parent's assertion about stupidity in general.

marshray 13y ago

Sometimes the stupidity cannot be adequately explained by stupidity.

mbreese 13y ago
If you try to make something idiot-proof, they'll just go and find a bigger idiot. Never underestimate the human capacity for stupidity.
- marshray 13y ago
  We're talking about some of the most respected and professional protocol engineers of the public internet here, not some global "biggest idiot" contest.
  - teeja 13y ago
    John Gilmore (born 1955)is one of the founders of the Electronic Frontier Foundation, the Cypherpunks mailing list, and Cygnus Solutions. I should be such an 'idiot'.
    - snogglethorpe 13y ago
      Er, but the "stupidity" being hypothesized in this case is not John Gilmore's but rather the kernel maintainer he thinks was showing "malice." There are tons of people out there, yes, even kernel maintainers, who are technically skilled and smart but for whatever reasons, prove to be bad at tasks like this and make bad decisions. It's usually not a conspiracy, and John Gilmore's vague handwaving isn't a very convincing demonstration that it was in this case either... :]
      - marshray 13y ago
        http://www.mail-archive.com/cryptography@metzdowd.com/msg12325.html http://www.mail-archive.com/cryptography@metzdowd.com/msg123... Every once in a while, someone not an NSA employee, but who had longstanding ties to NSA, would make a suggestion that reduced privacy or security, but which seemed to make sense when viewed by people who didn't know much about crypto. For example, using the same IV (initialization vector) throughout a session, rather than making a new one for each packet. Or, retaining a way to for this encryption protocol to specify that no encryption is to be applied.
  - mbreese 13y ago
    For what it's worth, I wasn't talking about anyone... just commenting on the parent's assertion about stupidity in general.