6 ms·

Response to the request to remove CFRG co-chair

72 points by jkbyc 13y ago

ash 13y ago
The message is easier to read it on Gmane: http://article.gmane.org/gmane.ietf.irtf.cfrg/2337 http://article.gmane.org/gmane.ietf.irtf.cfrg/2337
- jkbyc 13y ago
  It's also very readable by displaying the source code of the page.
  - aaronem 13y ago
    Or by giving the PRE element a "white-space: pre-wrap;" attribute via Firebug, Safari Web Inspector, or your favorite equivalent.
Loic 13y ago
I have no ideas who Lars Eggert really is, but the quality of the rebuttal is very good. In such a critical field where non expert cannot understand what is going on and where we can only trust the experts, such a nice response on a very controversial and emotionally charged topic is very appreciable.
- jkbyc 13y ago
  I thought so too first but then I read Trevor Perrin's response to Lars Eggert: http://www.ietf.org/mail-archive/web/cfrg/current/msg03778.html http://www.ietf.org/mail-archive/web/cfrg/current/msg03778.h... and it seems quite clear that Eggert failed to consider a number of important aspects, just one example from Perrin's mail: > So unlike the title "co-chair" might imply, and unlike in many other organizations, IRTF co-chairs are little more than group secretaries. The chair is far more than a "group secretary". As RFC 2014 section 5.3 states: """ The Research Group Chair is concerned with making forward progress in the areas under investigation, and has wide discretion in the conduct of Research Group business. [...] The Chair has ultimate responsibility for ensuring that a Research Group achieves forward progress. """
- fit2rule 13y ago
  Funny .. I think he did a lousy job. I'd call this a snow job if I ever saw one. Moved the goalposts, changed the target, and arrived at a conclusion that is not going to be popular, in order to avoid 'controversy'. Screw controversy. Are we going to be protected by the CFRG or not? At this point, it seems likely that we are not. Goodbye, CFRG.
- smoyer 13y ago
  I agree ... it's well-reasoned and well-writen. But gently deciding to do nothing is also the easiest thing to do and gives you the option to back-pedal later saying "more information has come to light".
andyjohnson0 13y ago
Previous discussion: https://news.ycombinator.com/item?id=6942145 https://news.ycombinator.com/item?id=6942145
teddyh 13y ago
> The IRTF and IETF have always welcomed participation by all, […] As I wrote previously¹: “We have a tacit assumption that all participants have realized that better standards (and strong crypto, more secure systems) will lead to the betterment of all. This is the default assumption. However, now that the U.S. government, and the NSA and its collaborators in particular, have been shown to explicitly not have this goal – in fact, their goal has been to strive for less secure systems and more difficult standards – what should be done? The logical thing to do is to exclude any person or organization revealed to have an agenda explicitly contrary to the group.” Having an all-inclusionist policy is “Geek Social Fallacy #1”². This case illustrates why you cannot let an inclusionist policy be all-overriding. Toxic people and representatives of explicitly adversarial organizations cannot be allowed to participate in, and thereby sabotage, both the work and goodwill of a committee. 1) https://news.ycombinator.com/item?id=6945314 https://news.ycombinator.com/item?id=6945314 2) http://www.plausiblydeniable.com/opinion/gsf.html http://www.plausiblydeniable.com/opinion/gsf.html
- mattlutze 13y ago
  There is a shadow of McCarthy's red scare in the suggestion that no NSA affiliated people be allowed to participate. How would you determine if a participant had affiliation? How many degrees of separation must there be before a person is trustworthy in their neutrality? As well, it would require an approval process for new participants, closing the working groups. Even should the folks decide to abandon the current model of participation, how would you determine someone new wasn't affiliated, and who has the right to decide who is trustworthy? It's argued often here that extreme transparency is the cure for shadowy practices, and I don't think it gets much more transparent than group review of any changes to any specs. To expect that excluding publicly aligned NSA folks would solve any problem is fool-hearty, given that it's an intelligence agency and I'm sure fully capable of installing clandestine participants. Therefore, I would argue that exclusion is very much an illogical choice. The logical thing to do here would be to increase scrutiny on any changes. (To note, this comment is not about removing the co-chair privileges from Igoe; if the position is really as powerful as some say, yeah let someone else do it. I'm just saying don't start suggesting people be banned from participating).
ajays 13y ago
And Trevor Perrin's response: http://thread.gmane.org/gmane.ietf.irtf.cfrg/2337 http://thread.gmane.org/gmane.ietf.irtf.cfrg/2337 I concur: Kevin Igoe should resign, if nothing else then to remove the cloud of suspicion, given the revelations of NSA sabotage.
- e28eta 13y ago
  I have a feeling if Kevin Igoe truly has the best interests of the group in mind, he would. On the other hand, if his mission is to sabotage their work I think that's much less likely to happen, particularly with Lars' support. I wonder if the resulting increased scrutiny will cripple the working group.
  - rjzzleep 13y ago
    sorry lol, i just had a witchhunt moment. if she's a witch the place will be a better place without her, but if she isn't she will become a martyr in the name of god. not exactly a fan of the nsa, and on top of that i think a lot of companies like to spy even without the help of the nsa, but come on guys is that really the level we're arguing on?
colinbartlett 13y ago
It's astounding to me that they are allowing him to retain his position. If for no other reason than the message it sends. How disturbing.
salient 13y ago
Sometimes those in power can refuse to kick out others alongside them that are in power. Friendships could've been formed etc. So the logical conclusion is to request the removal of the CFRG chair, too, and replace him him with someone who will remove the NSA co-chair. Or just start boycotting and ignoring everything this group is proposing from now on in cryptography - whichever way works. > Should we then eliminate all individuals affiliated with the NSA from participating? Um - hell yes?! After all that's happened and everything NSA has been trying to do to undermine the security of the web and US infrastructure, too? Of course the answer to that is YES! Otherwise, I personally have no trust in everything this group or IETF on the whole, will be releasing from now on, if that's their attitude about this. International security standards should be created without the involvement of spy agencies - especially when they've already been discovered to be trying to implement hardware backdoors on multiple occasions (even in the recent UAE satellite). NSA is hostile to security and to security standards. They've proven it already. So treat them as being hostile.
tptacek 13y ago
I wrote a short summary about what this was about a few weeks ago: https://news.ycombinator.com/item?id=6942145 https://news.ycombinator.com/item?id=6942145 (Shorter: CFRG is the IETF's crypto review† board, and one of its co-chairs is an NSA employee). This outcome was a near-certainty, for the simple reason that nobody came up with (or even nominated) a replacement for Igoe. IETF people have worked with Igoe, in person, for years. He is probably a very nice, very earnest person. Removing him from the CFRG without even having a replacement would have been demonstratively hostile without improving the quality of the research group. Unfortunately, despite a few threads of very solid crypto discussion on CFRG during the Igoe debate, most of it was marked by shrill, repetitive, and often mistaken political commentary. The mailing list had the tenor of a Wikipedia "Articles for Deletion" debate that had been circulated on Reddit. IETF long-timers were visibly irritated. There was also an unhelpful strain of back-and-forth between Dan Harkins, the author of the (flawed) Dragonfly PAKE whose CFRG endorsement started this mess, and Harkins' detractors. At times, the whole thing looked a little petty, especially since Dragonfly is now a dead letter anyways. It remains weird that IETF's crypto-review board is chaired by an NSA employee. But it doesn't have to stay that way. Igoe has been on the job for many years now, and, from my remove, that job seems pretty thankless. What needs to happen is for someone else to be floated as a new co-chair for the group. I wouldn't be surprised if Igoe voluntarily stepped aside for the right name. † (David McGrew, the group's other co-chair, disputes this characterization, but the facts on the ground seem to argue that "review board" is the CFRG function that matters)
- salient 13y ago
  I propose Dan Bernstein. Now let's do this.
  - tptacek 13y ago
    You can't just do that. Bernstein has to want to do it, and agree, and if you don't want to look silly that has to happen before his nomination is posted to the mailing list.
    - salient 13y ago
zequel 13y ago
I'm just not sure how you can ignore the fact that his employer is NSA. By proxy, he's doing evil (at least imo). He chooses to work for an agency that breaks the law. Do we just turn a blind eye? If he was answering phones there, it'd be one thing, but he's a cryptography expert. I'd imagine he'd be only a degree or two removed from something nefarious. Just following orders is not an excuse if you have a conscience. e - grammar
- MichaelGG 13y ago
  What if he worked for local police, which help keep order around the NSA headquarters? Or chooses to operate a US based company, sending more tax money to fund the NSA? At any rate, if the NSA wanted to continue to participate, they'd just hire people not officially associated with the NSA.

72 points by jkbyc 13y ago

ash 13y ago

The message is easier to read it on Gmane: http://article.gmane.org/gmane.ietf.irtf.cfrg/2337 http://article.gmane.org/gmane.ietf.irtf.cfrg/2337

jkbyc 13y ago
It's also very readable by displaying the source code of the page.
- aaronem 13y ago
  Or by giving the PRE element a "white-space: pre-wrap;" attribute via Firebug, Safari Web Inspector, or your favorite equivalent.

Loic 13y ago

I have no ideas who Lars Eggert really is, but the quality of the rebuttal is very good. In such a critical field where non expert cannot understand what is going on and where we can only trust the experts, such a nice response on a very controversial and emotionally charged topic is very appreciable.

jkbyc 13y ago
I thought so too first but then I read Trevor Perrin's response to Lars Eggert: http://www.ietf.org/mail-archive/web/cfrg/current/msg03778.html http://www.ietf.org/mail-archive/web/cfrg/current/msg03778.h... and it seems quite clear that Eggert failed to consider a number of important aspects, just one example from Perrin's mail: > So unlike the title "co-chair" might imply, and unlike in many other organizations, IRTF co-chairs are little more than group secretaries. The chair is far more than a "group secretary". As RFC 2014 section 5.3 states: """ The Research Group Chair is concerned with making forward progress in the areas under investigation, and has wide discretion in the conduct of Research Group business. [...] The Chair has ultimate responsibility for ensuring that a Research Group achieves forward progress. """
fit2rule 13y ago
Funny .. I think he did a lousy job. I'd call this a snow job if I ever saw one. Moved the goalposts, changed the target, and arrived at a conclusion that is not going to be popular, in order to avoid 'controversy'. Screw controversy. Are we going to be protected by the CFRG or not? At this point, it seems likely that we are not. Goodbye, CFRG.
smoyer 13y ago
I agree ... it's well-reasoned and well-writen. But gently deciding to do nothing is also the easiest thing to do and gives you the option to back-pedal later saying "more information has come to light".

andyjohnson0 13y ago

Previous discussion: https://news.ycombinator.com/item?id=6942145 https://news.ycombinator.com/item?id=6942145

teddyh 13y ago

> The IRTF and IETF have always welcomed participation by all, […] As I wrote previously¹: “We have a tacit assumption that all participants have realized that better standards (and strong crypto, more secure systems) will lead to the betterment of all. This is the default assumption. However, now that the U.S. government, and the NSA and its collaborators in particular, have been shown to explicitly not have this goal – in fact, their goal has been to strive for less secure systems and more difficult standards – what should be done? The logical thing to do is to exclude any person or organization revealed to have an agenda explicitly contrary to the group.” Having an all-inclusionist policy is “Geek Social Fallacy #1”². This case illustrates why you cannot let an inclusionist policy be all-overriding. Toxic people and representatives of explicitly adversarial organizations cannot be allowed to participate in, and thereby sabotage, both the work and goodwill of a committee. 1) https://news.ycombinator.com/item?id=6945314 https://news.ycombinator.com/item?id=6945314 2) http://www.plausiblydeniable.com/opinion/gsf.html http://www.plausiblydeniable.com/opinion/gsf.html

mattlutze 13y ago
There is a shadow of McCarthy's red scare in the suggestion that no NSA affiliated people be allowed to participate. How would you determine if a participant had affiliation? How many degrees of separation must there be before a person is trustworthy in their neutrality? As well, it would require an approval process for new participants, closing the working groups. Even should the folks decide to abandon the current model of participation, how would you determine someone new wasn't affiliated, and who has the right to decide who is trustworthy? It's argued often here that extreme transparency is the cure for shadowy practices, and I don't think it gets much more transparent than group review of any changes to any specs. To expect that excluding publicly aligned NSA folks would solve any problem is fool-hearty, given that it's an intelligence agency and I'm sure fully capable of installing clandestine participants. Therefore, I would argue that exclusion is very much an illogical choice. The logical thing to do here would be to increase scrutiny on any changes. (To note, this comment is not about removing the co-chair privileges from Igoe; if the position is really as powerful as some say, yeah let someone else do it. I'm just saying don't start suggesting people be banned from participating).

ajays 13y ago

And Trevor Perrin's response: http://thread.gmane.org/gmane.ietf.irtf.cfrg/2337 http://thread.gmane.org/gmane.ietf.irtf.cfrg/2337 I concur: Kevin Igoe should resign, if nothing else then to remove the cloud of suspicion, given the revelations of NSA sabotage.

e28eta 13y ago
I have a feeling if Kevin Igoe truly has the best interests of the group in mind, he would. On the other hand, if his mission is to sabotage their work I think that's much less likely to happen, particularly with Lars' support. I wonder if the resulting increased scrutiny will cripple the working group.
- rjzzleep 13y ago
  sorry lol, i just had a witchhunt moment. if she's a witch the place will be a better place without her, but if she isn't she will become a martyr in the name of god. not exactly a fan of the nsa, and on top of that i think a lot of companies like to spy even without the help of the nsa, but come on guys is that really the level we're arguing on?

colinbartlett 13y ago

It's astounding to me that they are allowing him to retain his position. If for no other reason than the message it sends. How disturbing.

salient 13y ago

Sometimes those in power can refuse to kick out others alongside them that are in power. Friendships could've been formed etc. So the logical conclusion is to request the removal of the CFRG chair, too, and replace him him with someone who will remove the NSA co-chair. Or just start boycotting and ignoring everything this group is proposing from now on in cryptography - whichever way works. > Should we then eliminate all individuals affiliated with the NSA from participating? Um - hell yes?! After all that's happened and everything NSA has been trying to do to undermine the security of the web and US infrastructure, too? Of course the answer to that is YES! Otherwise, I personally have no trust in everything this group or IETF on the whole, will be releasing from now on, if that's their attitude about this. International security standards should be created without the involvement of spy agencies - especially when they've already been discovered to be trying to implement hardware backdoors on multiple occasions (even in the recent UAE satellite). NSA is hostile to security and to security standards. They've proven it already. So treat them as being hostile.

tptacek 13y ago

I wrote a short summary about what this was about a few weeks ago: https://news.ycombinator.com/item?id=6942145 https://news.ycombinator.com/item?id=6942145 (Shorter: CFRG is the IETF's crypto review† board, and one of its co-chairs is an NSA employee). This outcome was a near-certainty, for the simple reason that nobody came up with (or even nominated) a replacement for Igoe. IETF people have worked with Igoe, in person, for years. He is probably a very nice, very earnest person. Removing him from the CFRG without even having a replacement would have been demonstratively hostile without improving the quality of the research group. Unfortunately, despite a few threads of very solid crypto discussion on CFRG during the Igoe debate, most of it was marked by shrill, repetitive, and often mistaken political commentary. The mailing list had the tenor of a Wikipedia "Articles for Deletion" debate that had been circulated on Reddit. IETF long-timers were visibly irritated. There was also an unhelpful strain of back-and-forth between Dan Harkins, the author of the (flawed) Dragonfly PAKE whose CFRG endorsement started this mess, and Harkins' detractors. At times, the whole thing looked a little petty, especially since Dragonfly is now a dead letter anyways. It remains weird that IETF's crypto-review board is chaired by an NSA employee. But it doesn't have to stay that way. Igoe has been on the job for many years now, and, from my remove, that job seems pretty thankless. What needs to happen is for someone else to be floated as a new co-chair for the group. I wouldn't be surprised if Igoe voluntarily stepped aside for the right name. † (David McGrew, the group's other co-chair, disputes this characterization, but the facts on the ground seem to argue that "review board" is the CFRG function that matters)

salient 13y ago
I propose Dan Bernstein. Now let's do this.
- tptacek 13y ago
  You can't just do that. Bernstein has to want to do it, and agree, and if you don't want to look silly that has to happen before his nomination is posted to the mailing list.
  - salient 13y ago

zequel 13y ago

I'm just not sure how you can ignore the fact that his employer is NSA. By proxy, he's doing evil (at least imo). He chooses to work for an agency that breaks the law. Do we just turn a blind eye? If he was answering phones there, it'd be one thing, but he's a cryptography expert. I'd imagine he'd be only a degree or two removed from something nefarious. Just following orders is not an excuse if you have a conscience. e - grammar

MichaelGG 13y ago
What if he worked for local police, which help keep order around the NSA headquarters? Or chooses to operate a US based company, sending more tax money to fund the NSA? At any rate, if the NSA wanted to continue to participate, they'd just hire people not officially associated with the NSA.