IETF Logo Mail Archive

Re: Bruce Schneier's Proposal to dedicate November meeting to saving the Internet from the NSA

Phillip Hallam-Baker <hallam@gmail.com> Sat, 07 September 2013 13:39 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: ietf@ietfa.amsl.com
Delivered-To: ietf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC84A21E80AB for <ietf@ietfa.amsl.com>; Sat, 7 Sep 2013 06:39:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.549
X-Spam-Level:
X-Spam-Status: No, score=-2.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, HTML_MESSAGE=0.001, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bu0NpauTeIkh for <ietf@ietfa.amsl.com>; Sat, 7 Sep 2013 06:39:45 -0700 (PDT)
Received: from mail-la0-x22b.google.com (mail-la0-x22b.google.com [IPv6:2a00:1450:4010:c03::22b]) by ietfa.amsl.com (Postfix) with ESMTP id E85F621E8091 for <ietf@ietf.org>; Sat, 7 Sep 2013 06:39:44 -0700 (PDT)
Received: by mail-la0-f43.google.com with SMTP id ep20so3656091lab.16 for <ietf@ietf.org>; Sat, 07 Sep 2013 06:39:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=rBK964+jMuzxyIZZYybxI3Ju3Srapj2YggKSrqZaZZI=; b=QWqfV0oGwtZdqG3+38TgkRHeQbWavLue7SFEu7hYOi3Isi1qgt6RDgVqpM5vjnZ157 /ZQV5x3aenjPSqjUcYfz6OHU6uFHdfCqTokY0ygj1MMSeYUfLrgftem+OuaFi76o3/81 IgHT0FoD3OpntxAHAl0NW27cdbjHA+6mPQTY9idlNDV+n71/gYjD3p7l8KNuZCDb7Bbr bqt8eivzxv5vQonprw0+Ft2YuVEldzbnQxeZ4Lik5lrl9NIx1jD4/232GcKnuaHZXjqT gvkLC7nP17Jx9+qSth8Y60cNYpVo3toFypW0Wi3nXiVc/DUvLhVafk2IiuWgPIQUClgZ QAoQ==
MIME-Version: 1.0
X-Received: by 10.152.116.7 with SMTP id js7mr7065811lab.11.1378561183912; Sat, 07 Sep 2013 06:39:43 -0700 (PDT)
Received: by 10.112.148.165 with HTTP; Sat, 7 Sep 2013 06:39:43 -0700 (PDT)
In-Reply-To: <CAHBU6itwDc8DiY4B_2GGe0xWZ3Zs_ctx3BkKkzdGTZT2PfgMkA@mail.gmail.com>
References: <alpine.BSF.2.00.1309051743130.47262@hiroshima.bogus.com> <52293197.1060809@gmail.com> <5C7FECAB-8A22-4AF1-B023-456458E1B288@nominum.com> <522949C2.8010206@gmail.com> <52294C6D.7090206@gmail.com> <m2ppsmzgs5.wl%randy@psg.com> <5229686A.5090308@gmail.com> <31078634-5AEA-4FC9-80A8-2E77650BA530@piuha.net> <20130906072539.GJ5700@besserwisser.org> <9AC2A86F-250C-4B3C-B9BA-8DF44C937B41@nominum.com> <20130906210638.GC3428@besserwisser.org> <158C3418-AE87-4843-BFD5-3E2AC3495631@virtualized.org> <CAHBU6itwDc8DiY4B_2GGe0xWZ3Zs_ctx3BkKkzdGTZT2PfgMkA@mail.gmail.com>
Date: Sat, 07 Sep 2013 09:39:43 -0400
Message-ID: <CAMm+Lwj0hHkTLaGr2y6WXY8noW+ELrM2DPtkZ3y5u7Y4pt3SNw@mail.gmail.com>
Subject: Re: Bruce Schneier's Proposal to dedicate November meeting to saving the Internet from the NSA
From: Phillip Hallam-Baker <hallam@gmail.com>
To: Tim Bray <tbray@textuality.com>
Content-Type: multipart/alternative; boundary="001a11c2672aab191e04e5cb4970"
Cc: Måns Nilsson <mansaxel@besserwisser.org>, "ietf@ietf.org list" <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 07 Sep 2013 13:39:46 -0000

On Fri, Sep 6, 2013 at 6:02 PM, Tim Bray <tbray@textuality.com> wrote:

> How about a BCP saying conforming implementations of a wide-variety of
> security-area RFCs MUST be open-source?
>
> *ducks*
>

And the user MUST compile them themselves from the sources?

Nobody runs open source, (unless its an interpreted language). They run the
compiled version and there is no infrastructure to check up on the
compilation.

Nor does being open source provide any additional security, only review
provides security and it is hard enough getting people to review other
people's code when you pay them to do that. Expecting people to spend their
time reviewing other people's code for fun is naive. Kerberos had a major
architectural flaw that went unnoticed for over a decade.





-- 
Website: http://hallambaker.com/

v2.23.0 | Report a Bug | By Email