8 ms·
he didn't add anything new to the discussion but his opinion. Crypto scholars are excellent at cryptography and security theory, but when it comes to actually i
by davidj 16y ago
he didn't add anything new to the discussion but his opinion. Crypto scholars are excellent at cryptography and security theory, but when it comes to actually implementing secure systems (exception being crypto algorithms), and securing systems, Crypto scholars are horrible. For example he mentions that it would be better to just find an existing vulnerability instead of planting an FBI backdoor in the OpenBSD code: good luck Schneier, obviously you don't know that much about OpenBSD security culture and history. Plus the NSA has a history of putting backdoors into solutions. This is just my opinion from experience.
- frisco 16y agoBruce Schneier isn't some random academic. He's extremely highly respected, and is the Chief Security Technology Officer of BT Communications. He has tons of experience with securing systems in the real world, and to say he "obviously [doesn't] know that much about OpenBSD security culture and history" is crazy.
- borism 16y agoI highly respect Bruce Schneier, but he obviously has no clue on current subject like most anybody else.
- davidj 16y agosorry I didn't mean to appear to disrespect Bruce Schneier, I've met him, gone to his book signings, own all his books, I even buy his books for gifts to my friends. I'm a huge fan of his work. We need people like him who have done highly advance studies in the security field; he is the best and an amazingly lucid writer. I never said he was a random academic or that his overall research should be disregarded. I really don't think you understand my original comment. Theory is not practice; they are two separate things. I guess I should have just said that. do you see my point now?
- tptacek 16y agoI am not so much a Schneier fan, so if you feel like you need cover for leveling any kind of criticism against anything he says, don't worry too much. Are you sure you believe Schneier would know anything about the code quality of a specific IPSEC implementation --- or really, about the code quality of any IPSEC implementation?
- bl4k 16y agoAlright, I will bite. What are your reasons for not liking Bruce? (I can't wait for this)
- tptacek 16y agoI don't so much "not like him". But, compare cite records: http://scholar.google.com/scholar?q=Serge+Vaudenay&hl=en&btnG=Search&as_sdt=400001&as_sdtp=on http://scholar.google.com/scholar?q=Serge+Vaudenay&hl=en... http://scholar.google.com/scholar?q=hans+dobberton&hl=en&btnG=Search&as_sdt=400001&as_sdtp=on http://scholar.google.com/scholar?q=hans+dobberton&hl=en... http://scholar.google.com/scholar?hl=en&q=eli+biham&btnG=Search&as_sdt=400000&as_ylo=&as_vis=0 http://scholar.google.com/scholar?hl=en&q=eli+biham&... http://scholar.google.com/scholar?hl=en&q=bruce+schneier&btnG=Search&as_sdt=400000&as_ylo=&as_vis=0 http://scholar.google.com/scholar?hl=en&q=bruce+schneier...
- bl4k 16y agooh is that all. An entire generation were taught cryptography on the back of AC, so he definitely the widest read crypto dev.
- tptacek 16y agoI'll go out on a limb and say this right now: Bruce Schneier almost certainly doesn't know much about OpenBSD security culture and history. He is, as I am fond of saying lately, "many good things", but.
- deleted 16y ago[deleted]
- glhaynes 16y agoPlus the NSA has a history of putting backdoors into solutions. Have there been proven (or at least credibly shown probable) to be NSA backdoors into shipping products?
- deleted 16y ago[deleted]
- uxp 16y agoThe Clipper Chip[1] immediately comes to mind as the most publicized case of the NSA wanting a backdoor in consumer products. There are also recent stories of the US Government wanting similar encryption disabling mechanisms in other technology[2]. Coupled with the Patriot Act and it letting the NSA eavesdrop on communications, it gives a precedent. A quote I am reminded of is "If you are on the internet, you aren't being paranoid enough". [1] http://en.wikipedia.org/wiki/Clipper_chip http://en.wikipedia.org/wiki/Clipper_chip [2] http://www.wired.com/threatlevel/2010/09/fbi-backdoors/ http://www.wired.com/threatlevel/2010/09/fbi-backdoors/
- kgo 16y agoYeah, but 'wanted' doesn't equal 'did' like the OP claims.
- moe 16y agoI had always considered the Clipper-Chip incident to hint at the tip of an iceberg. Do you really think that was an isolated one-time event?
- kgo 16y agoThe Clipper Chip was introduced in the open. They tried to push it through legislation. It's not like the NSA blackmailed Intel executives to include the capabilities secretly in their Pentium Processors without notifying their customers. Same with the new proposed legislation. But all that demonstrates is that the NSA has an interest in being able to (legally) monitor encrypted communications. Which everyone already knows. If someone had 'busted' the NSA trying to do something sneaky and/or covert and/or illegal, then you could argue that it's the tip of some iceberg of nefarious activity. But like I said this was all done out in the open. You might as well say that because we know the FBI wiretaps phones through legally obtained court orders, that's the tip of the iceberg that points to millions of illegal wiretaps. It's a bad inference.
- deleted 16y ago[deleted]
- 16s 16y agoHe's just pointing out that a big project will have bugs and he's right. That's not a matter of opinion. Not much fuzz testing has been done on OpenBSD since the early 2000s. When Theo did fuzz test back then, he found bugs. He claims to have found two just now while doing the audit in the crypto code. Code has bugs. Large projects have many bugs.
- ShabbyDoo 16y agoOr pointing out how hard it would be to get a "bug" inserted into such a codebase. He's not saying that either endeavor is easy. His only point was that, given a budget of $X and an embarrassment cost of (abstract) $Y for getting caught attempting to degrade the security of OpenBSD [my interpretation of "risky"], spending those $X on the identification of existing exploits would be the more rational course of action.
- tptacek 16y agoIn the early 2000's I was still speaking to Theo, and I don't believe that during that time period he ever did systemic fuzz testing on OpenBSD. SPIKE wasn't even released until 2002. Also: while we use fuzzers to probe for specific kinds of crypto flaws, the kind of fuzzing being done then (and for the most part today) does not identify crypto flaws. We are, let's be clear, talking about a project that appears to have managed to ship IPSEC code that didn't verify packet authenticators for something like a year.