Hacker News Reader

Comment by diafygi | Hacker News Reader

> The fact that it is simultaneously a "hobby" and an "attempt to help activists communicate securely" is emblematic of the whole problem here.

Isn't that the way it usually gets done for most non-profit altruistic efforts, though? If I'm a church and run a soup kitchen for the homeless, the volunteers who come in an prepare meals and serve patrons are probably not going to be trained professional chefs. They are going to be people who just want to help and are volunteering as a hobby to try to do some good.

I'm sure soup kitchens deal with this kind of situation all the time, where you have a volunteer complain about this or that, and then an outsider say that soup kitchen is a shit show. That doesn't mean soup kitchens shouldn't exist. It's just the drama you have to deal with when running a soup kitchen.

View on HN

Soup kitchens rarely position themselves as being secure against CIA poisoning attacks.

Can you please explain a bit more about these CIA poisoning attacks? As far as I know, the vulnerability here is just flooding keys with spam signatures so much that the public keys crash sks keyservers and gpg when downloaded. That seems like just a basic DoS attack. Where is the CIA poisoning?

Right upthread, from the very same author of the gist:

https://gist.github.com/rjhansen/f716c3ff4a7068b50f2d8896e54...

This is the difference between a soup kitchen and a neurosurgery clinic.

I believe an apt analogy might be "the lack of a neurosurgery clinic is not a reason to avoid building a health clinic."

Health clinics rarely trumpet themselves as solutions to brain injuries they clearly aren’t capable of working on.

And yet, if I am suffering from a brain injury and no one in the last 30 years has seen fit to build anything other than a health clinic in my town, I'm probably pretty happy there's a nurse practitioner available.

Let's not make the perfect the enemy of the good.

And with all respect to the professionals in the field, casting operational stones at a technically valid solution seems... myopic.

The professionals are trying very hard to tell you it’s not a technically valid solution. The math on public key encryption is not the issue, it’s operationalizing it. Openpgp is a disaster there.

Note I’m not a professional in this field but I occasionally drink with them.

In what way is this not a solvable problem?

From the article, the only issues seem to be (1) poor SDLC practices leading to toxic, frozen code, (2) the difficulty in performing protocol / standard upgrades on a decentralized network.

Reply on news.ycombinator.com