Hacker News Reader

Comment by tptacek | Hacker News Reader

You haven't offended me.

You did however launch a "contest" to demonstrate the soundness of using browser Javascript cryptography to protect user secrets, and made exactly the kind of slip-up that trivially demonstrates what a bad idea browser JS crypto is: to wit, your application couldn't even protect its own pages, let alone use them to safely deliver crypto code; you provided an ambiguous address and didn't properly lock the server down to SSL, so you couldn't even rely on users getting to your app under SSL.

Your app wouldn't have demonstrated any of the security value (largely nonexistent) of browser JS crypto even if it had been careful about SSL hygiene. But you spared Moxie the trouble of making that case.

Somehow I doubt Moxie cares too much about the $1000, but: you screwed up, lost the contest, and then (from what I can see) weaseled. The real point isn't "pay Moxie $1000"; it's, "don't try to run contests like this".

View on HN

You can say it's a dumb contest, just like I will, but you can't say he weaseled. Unless you would like to first admit to a reading disability.

It says, plainly, he wouldn't click unless there was a valid SSL cert. Do you know what sslstrip does? I know you do, so stop playing dumb.

"I won't promise to log in if you can't provide a valid SSL certificate :)"

Apologize to absherwin and admit you were wrong, or it is you who is the weasel.

I can live with your belief that I'm a weasel. I think Adam Sherwin owes Moxie $1000. I stand by my opinion.

That aside, is there a reason you're naming and shaming? It seems a little malicious. You know that your announcement is going to come up under search results for his real name.

If that wasn't intentional and you hadn't considered it, it would be classy to delete that. Granted "absherwin" is not totally anonymous, your derogatory proclamation attached to the proper form of his name is a bit much. He's misguided, not malicious.

Naming and shaming who? Unlike you, Sherwin has never been anonymous. Like me, when he criticizes people online, he signs his name.

> Naming and shaming who?

Again, stop playing dumb.

Type his Firstname Lastname into the search bar at the bottom - your "name and shame" post is the only result.

> Unlike you, Sherwin has never been anonymous.

News flash: Moxie Marlinspike isn't Moxie's real name either.

Moxie Marlinspike is not hiding behind an alias, and neither is Sherwin. I didn't sleuth his name from anywhere; it was public at least since last night, on Twitter. Presumably, the guy who starts a contest under an HN nick with his name in it and then emails numerous people from an address with his name in it is not trying to hide his identity.

Nobody is playing dumb with you. I'm not afraid to be wrong in a debate with you; I just haven't had the opportunity to be, yet.

Yes, my name is public. I don't really care about you mentioning it. What I care about is my name being mentioned in a way that implies my dishonesty which is all lawnchair_larry originally argued. His argument had two components: You're making a false accusation and it's more harmful because you're using my real name.

You chose to reassert that you believe your accusation is true without responding to the specific points raised and turn the focus of the discussion to the subsidiary point.

I am not making a false accusation. I understand that you believe I have, but we both know I don't agree with that. You and I also both know why I haven't delved into whatever specific points you think need delving-into.

You introduced your name into the discussion, presumably because you're confident enough to sign your name to your opinions and arguments, which is admirable. It is thus not a valid argument to suggest that acknowledging your (public) name is a malicious act. But the obvious invalidity of the argument clearly didn't stop 'lawnchair_larry from making it!

If it helps you any, you can peruse the rest of my comments on HN. Whenever it's reasonable, I try not to use nicks and handles; I call 'patio11 "Patrick", I call Paul Graham "Graham" (I don't know him in person), &c.

Have you noticed how, despite you repeatedly insinuating that I'm knowingly making false statements about you, I'm not huffing and puffing about it? That's because the huffing and puffing is dreadfully boring and teaches us nothing about anything whatsoever. I think we can all agree this nitpicky little subthread isn't teaching anything either, so I'll concede it to you and 'lawnchair_larry, and respond to you elsewhere on the substantial points.

Look, the fact is you're directly attaching Firstname Lastname to a derogatory claim, signed by a respected expert, to the permanent record of the searchable internet over something rather petty.

Is it worth dragging someone through the mud over? He said he didn't appreciate it, just edit it out. It's more important than "being right."

Reply on news.ycombinator.com