6 ms·

http://attrition.org/errata/charlatan/steve_gibson/ http://attrition.org/errata/charlatan/steve_gibson/ > Steve Gibson is somewhat of a "fringe" charlatan. In

• richardjs 13y ago
  Not to use a debate cliché, but isn't this a ridiculously shameless ad hominem? He's published the protocol and disavowed any intellectual property claim to it. Let's focus on critiquing the protocol.
  • dsl 13y ago
    An ad hominem attack would be attacking him for unrelated traits, i.e. "we can't trust people with blue eyes!" I believe his history as a snake oil salesman is highly relevant to his current "security" work.
    • richardjs 13y ago
      Sure, if you're using an appeal to authority as part of the argument in favor of the protocol. Hopefully we're relying more on logical analysis of the protocol than we are on the proposer's authority, in any security context. Isn't that one of the points of open protocols?
    • bargl 13y ago
      Actually it's still ad hominem. The fact that you completely ignored the original post and instead attacked Steve Gibson, is indicative of an ad hominem attack. If you'd even said, this new idea is ridiculous because QR codes are inherently insecure (which is false) you'd be fine. Sources: http://plover.net/~bonds/adhominem.html http://plover.net/~bonds/adhominem.html I think this example is pretty much what you did. A: "All rodents are mammals, but a weasel isn't a rodent, so it can't be a mammal." B: "I'm sorry, but I'd prefer to trust the opinion of a trained zoologist on this one." B's argument is ad hominem: he is attempting to counter A not by addressing his argument, but by casting doubt on A's credentials. Note that B is polite and not at all insulting. If you want further reading from other sources you can go to any of the following links. en.wikipedia.org/wiki/Ad_hominem http://www.nizkor.org/features/fallacies/ad-hominem.html http://www.nizkor.org/features/fallacies/ad-hominem.html http://c2.com/cgi/wiki?AdHominem http://c2.com/cgi/wiki?AdHominem
      • ubernostrum 13y ago
        It is never fallacious to point out the historical unreliability of a source. It is doubly never fallacious to point out the unreliability of a source, on a given topic, when discussing a new claim, on that topic, from that source, because that information is relevant to how we approach and evaluate the new claim (i.e., claims from historically-unreliable sources should be subjected to greater initial scrutiny). Also, you've presented no actual rebuttal of whether Gibson's history is relevant to evaluating his present claims. Rather you've merely stated the name of a logical fallacy. Which is, itself... http://en.wikipedia.org/wiki/Argument_from_fallacy http://en.wikipedia.org/wiki/Argument_from_fallacy
    • diminoten 13y ago
      It's still an ad hominem - the merits of his argument should stand independent to who he is or his history on any topic. Doesn't mean it's not worth talking about, though. After all, science is entirely founded on a kind of inductive reasoning, so logical fallacies aren't crazy to consider.
      • anateus 13y ago
        Note: https://yourlogicalfallacyis.com/ad-hominem https://yourlogicalfallacyis.com/ad-hominem Gibson's personality isn't the thing in question here, the quotation above is specifically about his history in security. If the comment was about how he's a major asshole (just an example, I'm not saying that) in conferences or something like that, it would be an ad hominem, as that sort of information would not be relevant.
        • bargl 13y ago
          I disagree. He doesn't address the actual topic here at all. All he is doing is saying that Steve Gibson is a charlatan. His history as a security professional has no bearing on the actual content here. We are all talking about an idea SQRL not Steve Gibson. If you said, "SQRL isn't worth my time because I don't trust Steve Gibson" that's fine, but the author made no note on SQRL at all, he just attacked Steve Gibson and let it be. Sure there may be precedence to say that SQRL isn't worth your time, but Steve's credentials don't affect this idea at all. For all you know he may have been given the idea by a team of security researchers who wanted to see if the top post on Hacker News would be some bull shit argument about Steve Gibson. Obviously not the case, but come on let's talk about the freaking content here not the man. The saying "throwing the baby out with the bath water" comes to mind. Let's look at SQRL and see if it actually makes any sense before we throw it all away.
        • gcr 13y ago
          How is the quote about his history? It provides none of the following: - Examples of Gibson's previous ideas that have been proven fake - Examples of Gibson's previous projects that have security flaws - Examples of projects that Gibson is purported to "peddle" through his "snake oil salesmanship" - A quotable, referrable, expert opinion of Gibson's standing, or lack thereof, in the broader security community The post includes none of those things. It is no better than saying "$NAME is a bad person!"; it merely uses more words to say so. note that i am not affiliated with grc; my name is permuted :)
  • anateus 13y ago
    There are a few types of ad hominem but they all involve using some property of a person that is only tangentially related. This note about how the majority of the security community sees Steve Gibson speaks directly to an assessment of his ability in this field.
  • hamburglar 13y ago
    Personally, even if the design is ok, I don't care to give this chucklehead any publicity. Maybe the blind squirrel found a nut (see what I did there? SQRL?) by getting a design right. Doesn't mean it's anything particularly clever, or that we should use it and give him something to base his incessant self-promotion on for the next 20 years.
    • gcr 13y ago
      For not wanting to give Gibson any publicity, you sure are talking about him a lot. note that i am not affiliated with grc, my name is simply permuted :)
      • hamburglar 13y ago
        I stand corrected. I don't mind giving him publicity of the "this guy is a complete idiot" variety.
• chj 13y ago
  His idea as it is now is new (at least to me) and practical. Most people don't have the time to care what he said or did before.
• BarryGrw 13y ago
  Looks more like a simple character attack than anything. Steve is prolific, experimental, and has been around a while, so it's understandable he hasn't done everything right, but I haven't found any other instances where he is considered a "charlatan" by other security professionals.
• jccalhoun 13y ago
  Gibson is prone to hype and proclaiming that the sky is falling which is why I rarely listen to his show. However, a lot of these are nitpicks where he either gave the wrong meaning of an acronym or oversimplified something while trying to explain it.
• B-Con 13y ago
  I can't make him out to be a buzzword slinger. I've listened to quite a bit of his show (although admittedly very little from the past year or so) and he definitely demonstrates good knowledge. Listening to him talk, my impression is that he brings the security mindset[1] to the table, rare among snake-oil peddlers or charlatans. I think one of the main problems is that people in a field are generally critical of people who translate that field to a wide audience. You see that play itself out over and over. And that's what Steve does with his show, he tries to explain security to, more or less, laymen. And he only has an audio medium, which adds some difficulty. So, yes, he simplifies some things and this no doubt troubles a lot of security gurus. Of course he's made mistakes on the show. I can recall a few, but most of them were caught and corrected later. He doesn't script it, so I'm sure you can find many examples of poor word choices or incorrect acronyms over the 300+ shows he's done. I do think he's over-played the practical usefulness of some security products that he advertises on the show. I have experience with none of them (to my knowledge), but some of them just sound, to the trained ear, minimally useful. But, sadly, that's audio content advertising for you. From the link, we have statements like: > For whatever reason, Gibson tries to explain the Metasploit project as a "malware exploitation framework" OK, that's a bad description. But he was describing Metasploit in passing using a description of Metasploit as it pertained to the subject at hand. And, if you read the actual transcript that they linked to, it was being used for malware exploitation. Seems like a silly nit-pick. > You can't simply raise the spectre of global spying and hidden rootkits planted by Microsoft without either proving or disproving the allegation No. If you see something alarming, you totally can. He didn't panic either. > Steve said SSL connections are not susceptible to man-in-the-middle (MiTM) attacks? This is absolutely false. Please. SSL/TLS has had vulnerabilities that allowed MITM attacks. They're ad-hoc and eventually get fixed. You can't just expect to MITM a random SSL connection. SSL is designed to be MITM-resistent, and saying "SSL prevents MITM attacks" is not in any way a bad description, especially when you're communicating to laymen. > Further, having a switch does not absolutely prevent sniffing traffic. The popular Dsniff tool lets you do this. Yep, he got that wrong. > Close Steve, CSMA stands for Carrier Sense Multiple Access. Yep, he got that acronym wrong. But I decided to check the next show[2]... > [Steve] Also, I mangled an acronym, and I hate when I do that, especially acronyms that I know so well. I talked about CSMA, and I called it Collision Sense Multiple Access instead of Carrier Sense Multiple Access. And it has a CD on the end which stands for Collision Detection. [...] So the real acronym for Ethernet is CSMA/CD, which is Carrier Sense Multiple Access with Collision Detection So he switched a word in an acronym, then corrected it next episode. But they complained anyway. I couldn't have scripted it any better to what I said above. Those examples were skimmed from the first three links. The authors came across like they had a vendetta to nit-pick everything they could. They've blown their own credibility already as far as needless nit-picking, missing the forest for the trees, and not checking to see when he corrects his own mistakes (aka, doing their homework). I'd hardly summarize all that as a "fringe charlatan". He may be a bit fringe-ish, but I don't see how he's a charlatan. [1] https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html https://www.schneier.com/blog/archives/2008/03/the_security_... [2] https://www.grc.com/sn/sn-017.txt https://www.grc.com/sn/sn-017.txt