8 ms·

>> https://news.ycombinator.com/item?id=6942165 https://news.ycombinator.com/item?id=6942165 tptacek 5 hours ago | link I am not generally a believer in the th

by smtddr 13y ago

>> https://news.ycombinator.com/item?id=6942165 https://news.ycombinator.com/item?id=6942165 tptacek 5 hours ago | link I am not generally a believer in the theory that NSA actively subverts Internet standards† †(my best guess is that the standards NSA was actively subverting were about international telephony; subverting the IETF is a little like subverting the Linux kernel --- doable, but bad tradecraft) Does this count?(not trying to be sarcastic or a smart-a##), I just want to get a handle on what I should or should not trust these days. Seeing that RSA SecurID VPN dongle pic in the article scared me. I've pretty much been looking to your comments to give me a baseline.

guelo 13y ago
Personally, I think one of the things you can't trust these days are comments by tptacek.
- napoleond 13y ago
  Either you're insinuating that 'tptacek is a malicious actor, or that he's incompetent. That's a pretty serious allegation to make without providing any evidence whatsoever. Do you have any? I'm sure you can dig up a few examples of things that he said which were incorrect, but very few of those will not have been followed by a correction at some point, and either way your insinuations seem to go beyond "being wrong some of the time". HN is incredibly fortunate to count members like 'tptacek as part of its community. We should be behaving in ways which encourage more comments and commenters of his ilk, not less.
  - ewoodrich 13y ago
    Unsurprisingly you're already being down-voted. For a community that prides itself on being rational and home to spirited debate, when it comes to the NSA, any contrarian opinions (or even alternative perspectives) tend to be quickly attacked and silenced. If you read some of the first threads when the NSA revelations broke out, there are heated discussions with various viewpoints and arguments. Now, it appears that most of these users have become tired of being instantly downvoted, and instead avoid these subjects entirely. I hope that tptacek continues to participate in these security policy discussions, not only for his extensive domain knowledge, but also because he is not afraid to voice beliefs that disagree with prevailing opinion. And right or wrong, its very refreshing.
    - PavlovsCat 13y ago
      > If you read some of the first threads when the NSA revelations broke out, there are heated discussions with various viewpoints and arguments. Always mixed with a steady groan of "enough of NSA stories" and "none of this is surprising". The heated discussions were in no small part about wether this was even the problem it was made out to be and wether it should even be discussed (to this extent). Not that I agree with downvoting instead of replying, or with bashing tptacek (Everybody loves telling experts "I told you so". Doesn't make us experts tho :P), but I don't agree with your narrative either. It's not falsifiable, anyway. People might just as well have given up on trying to downplay this, and walked away instead, which would be even worse. Why speculate. Bashing and downvoting for disagreement without argument sucks either way.
  - onebaddude 13y ago
    >Do you have any? Don't really have a dog in this fight, but: up until today, there was no evidence "the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products". Were people wrong to be suspicious?
    - nitrogen 13y ago
      There was previous evidence, it just wasn't as conclusive as a contract with RSA: https://en.wikipedia.org/wiki/Dual_EC_DRBG#Controversy https://en.wikipedia.org/wiki/Dual_EC_DRBG#Controversy
  - belorn 13y ago
    > Either you're insinuating that 'tptacek is a malicious actor, or that he's incompetent. There is a large area missed called psychological bias. People who has close friends working in highly controversial areas has a tendency to become a bit irrational in the view of the controversy. An attack on the NSA becomes an attack of the friend. If NSA is immoral and wrong, the friends choice of occupation must be wrong, thus the friend must be wrong, thus an attack on NSA is an attack of the friend.
- angersock 13y ago
  As much as he can get under one's skin, and as much as he can be abrasive, and any number of other things, I trust his opinions on security and crypto. He's rational to a fault--unfortunately, that means that when facts change he may be left with egg on his face. I don't think there's anything wrong with how he's handled this stuff.
  - obstacle1 13y ago
    >...I trust his opinions on security and crypto. And here, ladies and gents, is exactly why we'll continue to inhabit an exploitable world forevermore.
    - angersock 13y ago
      You've got to trust something, eventually.
    - nitrogen 13y ago
      Trusting tptacek in the form of completing and learning from the Matasano crypto challenges would lead to a much less exploitable world forevermore. It's okay to provisionally trust the word of someone who has previously and clearly demonstrated actual competence.
      - dobbsbob 13y ago
        I'm also doing the Matasano crypto challenges and they are pretty priceless, don't know of anywhere else who offers a similar learning experience by breaking stuff, for free even.
  - bmelton 13y ago
    I find tptacek's remarks to be enjoyable, generally speaking. In regards to crypto, I value his opinion highly, especially compared to my own novice opinion. That said, I seldom trust anything I cannot verify. In matter s of crypto, that often means that I accept some things as magically working, and accept that the magic could wear off at any minute. Same thing with CPUs. I know generally how they work, and understand bitwise logic, but for the most part, they're just magic boxes that I've got enough experience with to have an expectation of. In matters of the government, the fault I find with tptacek's arguments (and I hadn't even realized that it was a thing until this thread, but now I'm caught up) is that I think it is naive to trust the government. The federal government is something that our founding fathers encouraged us to be suspicious of. They specifically prescribed that, in order for our democracy to thrive, that we should be ever vigilant in regards to those we entrust with power. Assuming good faith on the part of the NSA is naive, whether or not they're acting scandalously. Assuming good faith on the part of any politician is naive. That isn't to suggest that we should never trust anything the government does, but if there's ever the potential for abuse, we should expect that potential to be abused at some point. If there's a loophole that could be exploited in any way, we should expect that it will be. This diatribe isn't really directed at this comment, per se, but at your "have to trust __something__" comment, which I completely agree with as a generality. As humans, we routinely put trust into a great deal of people and things all the time, but I disagree that a government, even a pristine, flawless, immaculate government, is deserving of that trust, and it is our duty as citizens to thoroughly distrust it.
- InclinedPlane 13y ago
  I disagree with many of tptacek's opinions but honestly he's one of the reasons this site is great. He is capable of arguing with people with strongly opposing views with civility, which is something that is entirely too rare these days. He's also capable of admitting when he's wrong and being gracious when proven right. Also entirely too rare these days. I'd rather have a thousand tptaceks on this site than zero.
  - MisterWebz 13y ago
    https://news.ycombinator.com/item?id=6944628 https://news.ycombinator.com/item?id=6944628 > Jesus, what a tool you are. How very civil and gracious.
    - antiterra 13y ago
      Sometimes it's tough to contain righteous internet rage. I think he knows that crossed the line and that is why he deleted the comment.
      - anoncowherd 13y ago
        .. or he's doing Image Management.
    - PavlovsCat 13y ago
      He deleted, i.e. retracted it. In full. To harp on about it instead of talking about the story kinda sucks. We're talking about mass surveillance and everything being recorded, and look at what we are doing. Repeat after me: every day is a new day.
    - InclinedPlane 13y ago
      He's a human being, and thus imperfect. He's still much easier to have a conversation with than 99% of the posters on HN.
  - bane 13y ago
    > He is capable of arguing with people with strongly opposing views with civility You're clearly talking about a different tptacek, widely known on this site for his coarsely abrasive, impossibly high friction, social interactions and not admitting he's wrong on issues trivial or important. He's also widely known for a being an expert in his field. All that being said, I agree with you that this site is more valuable with him on it and regularly participating. He's one of the actual experts in their field that makes this a much better forum than any other. IMHO, it's well worth the comment burn to talk and debate (friendly or not) with somebody of his caliber. And being wrong every once in a while (regardless of his rightness in this case) does not make him either incompetent or malicious. It just makes him human.
- lawnchair_larry 13y ago
  You can definitely trust technical information from tptacek. But you should treat his speculation as you would anyone else.
- paveldurov 13y ago
  After reading tptacek's comments in the latest thread about Telegram https://news.ycombinator.com/item?id=6940665 https://news.ycombinator.com/item?id=6940665 I can only agree. He insisted Telegram team should abandon its custom solution without providing any actual proof that it's vulnerable. His advice was to rely only on "modern" algorithms (mostly the ones included in "NSA Suite B Cryptography"), but he provided zero evidence why these algorithms should be more secure than the ones already in use.
  - Confusion 13y ago
    You guys are still failing to appreciate that your composition of cryptographic primitives is unproven, which means it is probably broken. Why is it probably broken? Because most compositions of crypto primitives are broken and your adversary is so formidable he will find the smallest problem. In cryptography, you either prove it is safe or you consider it broken. Your choice should be considered broken until you prove otherwise.
  - lawnchair_larry 13y ago
    This is a really bad and somewhat frustrating comment (if you're trolling, nicely done). He's absolutely correct about Telegram and this is not how you run crypto contests. This isn't even a tptacek opinion, it's a "everybody who has any reputation in the crypto field" opinion. Edit: Oh, you're the Telegram employee who designed the contest. I encourage you to read moxie's blog post, and Schneiers rebuttals to crypto contests that are probably linked all over your other threads.
    - phpnode 13y ago
      I think Pavel is providing the financial backing for Telegram, rather than being an employee -http://en.wikipedia.org/wiki/Pavel_Durov http://en.wikipedia.org/wiki/Pavel_Durov
      - lawnchair_larry 13y ago
        Ah, the Telegram HN account just said he "proposed the contest", so I assumed employee. If he is the financier, then it is not surprising that he doesn't understand why his crypto contest is a bad idea.
- deleted 13y ago
  [deleted]
tedunangst 13y ago
Seeing that RSA SecurID VPN dongle pic in the article scared me. Why do you think they put it there?
yuhong 13y ago
IETF is very different from the NIST.
strictfp 13y ago
RSA SecurID was already compromised in 2011, and RSA more or less tried to hush-hush it: digitaltrends.com/computing/rsa-securid-data-stolen-by-a-nation-state/
deleted 13y ago
[deleted]

by smtddr 13y ago

guelo 13y ago

Personally, I think one of the things you can't trust these days are comments by tptacek.

napoleond 13y ago
Either you're insinuating that 'tptacek is a malicious actor, or that he's incompetent. That's a pretty serious allegation to make without providing any evidence whatsoever. Do you have any? I'm sure you can dig up a few examples of things that he said which were incorrect, but very few of those will not have been followed by a correction at some point, and either way your insinuations seem to go beyond "being wrong some of the time". HN is incredibly fortunate to count members like 'tptacek as part of its community. We should be behaving in ways which encourage more comments and commenters of his ilk, not less.
- ewoodrich 13y ago
  Unsurprisingly you're already being down-voted. For a community that prides itself on being rational and home to spirited debate, when it comes to the NSA, any contrarian opinions (or even alternative perspectives) tend to be quickly attacked and silenced. If you read some of the first threads when the NSA revelations broke out, there are heated discussions with various viewpoints and arguments. Now, it appears that most of these users have become tired of being instantly downvoted, and instead avoid these subjects entirely. I hope that tptacek continues to participate in these security policy discussions, not only for his extensive domain knowledge, but also because he is not afraid to voice beliefs that disagree with prevailing opinion. And right or wrong, its very refreshing.
  - PavlovsCat 13y ago
    > If you read some of the first threads when the NSA revelations broke out, there are heated discussions with various viewpoints and arguments. Always mixed with a steady groan of "enough of NSA stories" and "none of this is surprising". The heated discussions were in no small part about wether this was even the problem it was made out to be and wether it should even be discussed (to this extent). Not that I agree with downvoting instead of replying, or with bashing tptacek (Everybody loves telling experts "I told you so". Doesn't make us experts tho :P), but I don't agree with your narrative either. It's not falsifiable, anyway. People might just as well have given up on trying to downplay this, and walked away instead, which would be even worse. Why speculate. Bashing and downvoting for disagreement without argument sucks either way.
- onebaddude 13y ago
  >Do you have any? Don't really have a dog in this fight, but: up until today, there was no evidence "the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products". Were people wrong to be suspicious?
  - nitrogen 13y ago
    There was previous evidence, it just wasn't as conclusive as a contract with RSA: https://en.wikipedia.org/wiki/Dual_EC_DRBG#Controversy https://en.wikipedia.org/wiki/Dual_EC_DRBG#Controversy
- belorn 13y ago
  > Either you're insinuating that 'tptacek is a malicious actor, or that he's incompetent. There is a large area missed called psychological bias. People who has close friends working in highly controversial areas has a tendency to become a bit irrational in the view of the controversy. An attack on the NSA becomes an attack of the friend. If NSA is immoral and wrong, the friends choice of occupation must be wrong, thus the friend must be wrong, thus an attack on NSA is an attack of the friend.
angersock 13y ago
As much as he can get under one's skin, and as much as he can be abrasive, and any number of other things, I trust his opinions on security and crypto. He's rational to a fault--unfortunately, that means that when facts change he may be left with egg on his face. I don't think there's anything wrong with how he's handled this stuff.
- obstacle1 13y ago
  >...I trust his opinions on security and crypto. And here, ladies and gents, is exactly why we'll continue to inhabit an exploitable world forevermore.
  - angersock 13y ago
    You've got to trust something, eventually.
  - nitrogen 13y ago
    Trusting tptacek in the form of completing and learning from the Matasano crypto challenges would lead to a much less exploitable world forevermore. It's okay to provisionally trust the word of someone who has previously and clearly demonstrated actual competence.
    - dobbsbob 13y ago
      I'm also doing the Matasano crypto challenges and they are pretty priceless, don't know of anywhere else who offers a similar learning experience by breaking stuff, for free even.
- bmelton 13y ago
  I find tptacek's remarks to be enjoyable, generally speaking. In regards to crypto, I value his opinion highly, especially compared to my own novice opinion. That said, I seldom trust anything I cannot verify. In matter s of crypto, that often means that I accept some things as magically working, and accept that the magic could wear off at any minute. Same thing with CPUs. I know generally how they work, and understand bitwise logic, but for the most part, they're just magic boxes that I've got enough experience with to have an expectation of. In matters of the government, the fault I find with tptacek's arguments (and I hadn't even realized that it was a thing until this thread, but now I'm caught up) is that I think it is naive to trust the government. The federal government is something that our founding fathers encouraged us to be suspicious of. They specifically prescribed that, in order for our democracy to thrive, that we should be ever vigilant in regards to those we entrust with power. Assuming good faith on the part of the NSA is naive, whether or not they're acting scandalously. Assuming good faith on the part of any politician is naive. That isn't to suggest that we should never trust anything the government does, but if there's ever the potential for abuse, we should expect that potential to be abused at some point. If there's a loophole that could be exploited in any way, we should expect that it will be. This diatribe isn't really directed at this comment, per se, but at your "have to trust __something__" comment, which I completely agree with as a generality. As humans, we routinely put trust into a great deal of people and things all the time, but I disagree that a government, even a pristine, flawless, immaculate government, is deserving of that trust, and it is our duty as citizens to thoroughly distrust it.
InclinedPlane 13y ago
I disagree with many of tptacek's opinions but honestly he's one of the reasons this site is great. He is capable of arguing with people with strongly opposing views with civility, which is something that is entirely too rare these days. He's also capable of admitting when he's wrong and being gracious when proven right. Also entirely too rare these days. I'd rather have a thousand tptaceks on this site than zero.
- MisterWebz 13y ago
  https://news.ycombinator.com/item?id=6944628 https://news.ycombinator.com/item?id=6944628 > Jesus, what a tool you are. How very civil and gracious.
  - antiterra 13y ago
    Sometimes it's tough to contain righteous internet rage. I think he knows that crossed the line and that is why he deleted the comment.
    - anoncowherd 13y ago
      .. or he's doing Image Management.
  - PavlovsCat 13y ago
    He deleted, i.e. retracted it. In full. To harp on about it instead of talking about the story kinda sucks. We're talking about mass surveillance and everything being recorded, and look at what we are doing. Repeat after me: every day is a new day.
  - InclinedPlane 13y ago
    He's a human being, and thus imperfect. He's still much easier to have a conversation with than 99% of the posters on HN.
- bane 13y ago
  > He is capable of arguing with people with strongly opposing views with civility You're clearly talking about a different tptacek, widely known on this site for his coarsely abrasive, impossibly high friction, social interactions and not admitting he's wrong on issues trivial or important. He's also widely known for a being an expert in his field. All that being said, I agree with you that this site is more valuable with him on it and regularly participating. He's one of the actual experts in their field that makes this a much better forum than any other. IMHO, it's well worth the comment burn to talk and debate (friendly or not) with somebody of his caliber. And being wrong every once in a while (regardless of his rightness in this case) does not make him either incompetent or malicious. It just makes him human.
lawnchair_larry 13y ago
You can definitely trust technical information from tptacek. But you should treat his speculation as you would anyone else.
paveldurov 13y ago
After reading tptacek's comments in the latest thread about Telegram https://news.ycombinator.com/item?id=6940665 https://news.ycombinator.com/item?id=6940665 I can only agree. He insisted Telegram team should abandon its custom solution without providing any actual proof that it's vulnerable. His advice was to rely only on "modern" algorithms (mostly the ones included in "NSA Suite B Cryptography"), but he provided zero evidence why these algorithms should be more secure than the ones already in use.
- Confusion 13y ago
  You guys are still failing to appreciate that your composition of cryptographic primitives is unproven, which means it is probably broken. Why is it probably broken? Because most compositions of crypto primitives are broken and your adversary is so formidable he will find the smallest problem. In cryptography, you either prove it is safe or you consider it broken. Your choice should be considered broken until you prove otherwise.
- lawnchair_larry 13y ago
  This is a really bad and somewhat frustrating comment (if you're trolling, nicely done). He's absolutely correct about Telegram and this is not how you run crypto contests. This isn't even a tptacek opinion, it's a "everybody who has any reputation in the crypto field" opinion. Edit: Oh, you're the Telegram employee who designed the contest. I encourage you to read moxie's blog post, and Schneiers rebuttals to crypto contests that are probably linked all over your other threads.
  - phpnode 13y ago
    I think Pavel is providing the financial backing for Telegram, rather than being an employee -http://en.wikipedia.org/wiki/Pavel_Durov http://en.wikipedia.org/wiki/Pavel_Durov
    - lawnchair_larry 13y ago
      Ah, the Telegram HN account just said he "proposed the contest", so I assumed employee. If he is the financier, then it is not surprising that he doesn't understand why his crypto contest is a bad idea.
deleted 13y ago
[deleted]

tedunangst 13y ago

Seeing that RSA SecurID VPN dongle pic in the article scared me. Why do you think they put it there?

yuhong 13y ago

IETF is very different from the NIST.

strictfp 13y ago

RSA SecurID was already compromised in 2011, and RSA more or less tried to hush-hush it: digitaltrends.com/computing/rsa-securid-data-stolen-by-a-nation-state/

deleted 13y ago

[deleted]