And now we can say it publicly https://www.akamai.com/blog/security/akamai-anthropic-collective-defense-project-glasswing
Remote
rsalz
@rsalz@ioc.exchange
mastodon 4.8.0-alpha.3+glitchAkamai, IETF, QuicTLS.
Previously DataPower->IBM, OpenSSL.
745 Followers
519 Following
50 Posts
Joined November 18, 2022
Spokeperson:
No
Pronouns:
he/his/him
(Skimpy) Website:
richsalz.com
Replying to
@mikalai@privacysafe.social @djb@mastodon.cr.yp.to @letoams@defcon.social again, nothing is being removed. Nothing. In fact what is being added is explicitly not recommended.
Replying to
Everything I wrote is simple and consistent and, if you look at the context of when they were made, easy to follow. For those just jumping in.
-
As a long-time person involved with the IETF I have not seen any hidden/coercive NSA involvement.
-
I accept that the EFF budget piece is accurate.
-
The term "crazy conspiracy thinking" referred to your blog posts on this topic.
I do not argue with NSA/NIST and pointed out why they could do that in the past. I find it amusing that ISO refused to standardize NSA's Simon and Speck. Perhaps they're not as good at influence as they used to be.
Replying to
@mattblaze fascinating, thanks. On a lighter note, Service Request #1: What Happens When I Call 311? - 99% Invisible https://99percentinvisible.org/episode/service-request-01-311/
Replying to
@djb @darkuncle I didn't dispute the RSA thing. I don't know about the other things you claimed.
We're building out a bunch of tools and such for our customers to use. Any recommendations for good dev-rel sites we can look at, life advice from, etc?
"90% of women leave tech within 10 years," according to an Akamai study. https://www.computerweekly.com/news/366642319/Almost-90-of-women-leave-tech-industry-within-10-years
Replying to
@argv_minus_one
"Do you have another explanation for the inexplicable push for the IETF to specify non-hybrid ML-KEM?" I don't know why you see it as inexplicable. Some people want it for various reasons, and not because they are NSA fronts.
I can see various places where the size differential (time, bits on the wire, CPU cost) are not negligible to the environment, or where the cost of eventually transitioning off hybrid are not practical (subs, satellites, zillions of telephone poles, etc).
Replying to
@djb@mastodon.cr.yp.to @darkuncle@infosec.exchange no I do not, but that does not mean that the NSA is corrupting the IETF.
Replying to
@darkuncle as an active participant in many of the working groups, and colleagues with NSA and others, I do not believe there is any covert influence happening. His arguments have devolved to little more than ad hominem attacks. Kind of sad. I've known him for 30 years.
Replying to
@darkuncle I don't recall Dan suspecting dual EC but I may just be forgetting that. NIST, however did learn their lesson and sponsored global contests for AES post quantum etc. Not NSA.
What's next for PQ crypto? https://www.akamai.com/blog/security/post-quantum-cryptography-whats-next-edge-security Wherein I name-check many people smarter than I am.
Replying to
@djb@mastodon.cr.yp.to @letoams@defcon.social has money prevented you from participating Dan?
Replying to
@djb@mastodon.cr.yp.to @darkuncle@infosec.exchange I presumed nothing. Read what I wrote. Twisting words to win an argument. Your better than this Dan.
Replying to
@djb@mastodon.cr.yp.to @letoams@defcon.social you clearly are pretending not to know what community means
Replying to
@darkuncle Yes, erring on the side of extreme caution is right. But you completely discount Bas Westerban, Sophie Schmeig, etc?
Replying to
@huitema@social.secret-wg.org You think it will be published? I'm not sure sure it has consensus.
Replying to
@encthenet@flyovercountry.social didn't know about tcpenc. Disagree with you on the pq draft.
Replying to
@argv_minus_one Well, I don't presume to know all the operating environments. Are you sure you do? :)
Replying to
@jzb To answer your questions:
-
If it were only the NSA, sure, be suspicious. But it's not (IEEE, Ericsson I believe, others) and I do not believe they were all cofrupted.
-
Sure, the IETF is having that discussion. See what you think of https://github.com/tlswg/draft-ietf-tls-mlkem/pull/14/changes for example.
Replying to
@huitema@social.secret-wg.org @pedromj@mastodon.social I'll assume you read the draft and the PR with the revised security considerations. You also know that pushing on social media doesn't much impact IETF, unless you're trying to do brigading which I do not think you are.
Replying to
@djb@mastodon.cr.yp.to @letoams@defcon.social Giving people template text and encouraging them to take a stand where they have never participated before is not participation.
I've noticed that this kind of blind literalism is often seen in untrained people playing lawyer, or perhaps US Supreme Court justices. Also not uncommon with people "on the spectrum."
I do not think you are stupid, nor are you a Justice and I am not qualified to diagnose. Therefore, I still believe you are therefore just acting in bad faith to get what you want, no matter how justified you think the end result is.
Replying to
@djb I have no idea who NSA paid. I do not dispute that the IETF approved an RFC that standardized their Dual EC. Again, what I have said multiple times is that I have seen no involvement *since Dual EC* that the NSA influenced IETF decisions. This is tiresome. I'm done.
Replying to
@djb I am glad your work on cryptography is better than your comprehension of what I write. "you presume this doesn't include the IETF since the document doesn't _specifically_ name the IETF." Ye gods man, read it again.
Replying to
@mikalai@privacysafe.social @letoams@defcon.social @djb@mastodon.cr.yp.to if you let vendors sell you things you think are insecure sounds like you are responsible.
Replying to on mastodon.cr.yp.to
@djb@mastodon.cr.yp.to @letoams@defcon.social I am not inventing new rules Dan. We disagree over the meaning of participation, and you are changing the subject rather than trying to convince me that you are right. More bad faith from you, sadly.
I have no idea what the NSA told its vendors. Do you have links or proof? All I know is Scott F from Cisco mentioned the government wants this.
I thought doing a new WGLC made sense. And I am not surprised some long-time participants spoke up given the heated feelings about it.
Can you explain why what you're doing is encouraging participation? If you;re upset about Jenkins email, do you feel any remorse about what you're doing?
Replying to
@mikalai@privacysafe.social @djb@mastodon.cr.yp.to @letoams@defcon.social nobody is stopping you from implementing hybrid key exchange. In fact pure post quantum key exchange is not recommended. So what, exactly, is the problem here?
Apropos of nothing, I just got this in a private email: Captain Appeal and his DoS attacks. I wonder who they are thinking of?
Replying to on mastodon.cr.yp.to
@djb@mastodon.cr.yp.to @damienmiller@hachyderm.io I treat any kind of praise, as opposed to a withering negative comment, is high praise from you indeed.
Replying to
@djb@mastodon.cr.yp.to @letoams@defcon.social the chairs asked the working group, not generic people. You know this, why mislead? Because you're in the minority?
Replying to
@djb@mastodon.cr.yp.to @letoams@defcon.social and you Dan are trying to redefine participate as participate in a sock puppet drive by comment without ever actually participating.
Replying to
@mikalai@privacysafe.social @letoams@defcon.social @pluralistic@mamot.fr @eff@mastodon.social i suggest you learn more about how the IETF operates.
Replying to
@djb@mastodon.cr.yp.to @letoams@defcon.social again you try to twist the meaning of participate to include those who do one drive by email.
Replying to
@adamshostack@infosec.exchange I thought it was under half an hour, although it did seem like almost 90 minutes...
Replying to
@darkuncle At the time of Dual_EC, NIST was required by law to take NSA's advice. They no longer are. But what history of seeing conspiracy where it did exist are you thinking of?
Replying to
Replying to
@mikalai@privacysafe.social @djb@mastodon.cr.yp.to @letoams@defcon.social it is only summer in half the world. The ietf meets your round. We have another face-to-face meeting in July, we have it every july. It's not a vote . From your post, I can only assume you are not at a regular ietf participant.
Replying to
@djb@mastodon.cr.yp.to @letoams@defcon.social anyone can JOIN the IETF. Not the same as what you are doing.
Replying to
@darkuncle@infosec.exchange @encthenet@flyovercountry.social I have known him for about 30 years. Back in the Usenet days. Lately, he will twist and cherry pick people's words to reinforce his point. Sorry, I admit that this may be on me, but I no longer think he is operating in good faith and I do not trust him or what he says anymore. He did it with me, here on this platform, so I am speaking from experience.
Replying to
@grumpybozo@toad.social yeah it is really overboard. Everything goes through the template library. If all you have is a hammer...
Replying to
@mikalai@privacysafe.social @letoams@defcon.social @djb@mastodon.cr.yp.to @eff@mastodon.social and one random person getting vehement on social media doesn't make much of an impact on me, sorry.
Replying to on mastodon.cr.yp.to
@djb@mastodon.cr.yp.to @letoams@defcon.social Boy, you'll throw anything to see what sticks. Your attempt to engender guilt doesn't work because I know you're deceptive, misleading, and a liar.
Akamai latest state of the internet/security report is out. Unsurprisingly, the focus is on risks of AI to enterprises. https://www.akamai.com/resources/state-of-the-internet/enterprise-ai-risk-report Looking at the takeaways on the first screen, most people here will not be surprised, but maybe some bosses could stand to learn.