Can I Be Trusted?
schneier.com
schneier.com
Trust is the inverse of what most people think it is.
Trust isn't about what someone will do, it's about what they won't do.
You might trust a guy with your life by asking him to hold a ladder whilst you climb up it, but you probably wouldn't trust the same guy with your medical history and insights into your state of mind and personal relationships.
Yet you would trust a doctor with your medical history, and you would trust a psychiatrist with your mental wellbeing.
The basis of trust is a belief that the person/entity you are trusting won't do something. In the case of that ladder, that the guy won't let go. In the case of the physician and psychiatrist that they won't share information about you.
The NSA stuff can be seen in that light, there is a betrayal of trust as the basis for trust in a government spy agency was that they wouldn't do a certain thing... spy on their own people. The rest is all forgiveable (you pretty much should expect them to spy on everyone else whether you agree with it or not, that's their purpose).
When it comes to Bruce Schneier the question is "Do you trust Bruce Schneier?", but this seems to just beg the next question, "To not do what?".
I trust Bruce Schneier to not sacrifice his own principles and belief system in backdooring some code or otherwise compromising his work.
But I don't necessarily trust Bruce Schneier to hold a ladder that I'm standing on (he may well have a sense of humour that reflects silent cinema, and being up a ladder was never a good thing when a Loki character was holding it).
If you had read really short article, the "next question" is: "To not mislead us about what he has read in the leaked NSA documents."
> I trust Bruce Schneier to not sacrifice his own principles and belief system in backdooring some code or otherwise compromising his work.
To mislead would be to compromise his own work.
As much as we all might respect Bruce we should remain reasonably open to the idea that he can be wrong (maliciously or otherwise). In essence, we shouldn't let a single expert, now matter how good they appear to be, become a single point of failure in our understanding of a complex subject.
It is open source. You are free to inspect it and see if it has backdoors.
Likewise with Twofish: https://www.schneier.com/twofish.html
This is quite the long con if you think he's been developing, advocating and promoting free (as in speech) software for years just in case this NSA thing got out of hand.
I agree we shouldn't let a single expert become a single point of failure in our understanding of security, but that's missing the point in this discussion. Based on Schneier's long history of work, including advocating open source solutions, he's earned my trust, but the great thing is that because he's such an advocate for open source, you can check the code. Likewise, if you're reading something he's written, you can check his sources. You don't have to trust him. You can do your own fact checking!
http://en.wikipedia.org/wiki/Loki
He's frequently referred to as the `God of Mischief` in that he's a trickster and capricious by nature.
Trust is the inverse of what most people think it is.
Trust isn't about what someone won't do, it's about what they will do.
You might trust a guy with your life by asking him to hold a ladder whilst you climb up it, but you probably wouldn't trust the same guy with your medical history and insights into your state of mind and personal relationships.
Yet you would trust a doctor with your medical history, and you would trust a psychiatrist with your mental wellbeing.
The basis of trust is a belief that the person/entity you are trusting will do something. In the case of that ladder, that the guy will hold it. In the case of the physician and psychiatrist that they will keep your information private. The NSA stuff can be seen in that light, there is a betrayal of trust as the basis for trust in a government spy agency was that they would do a certain thing... spy only on foreign people. The rest is all forgiveable (you pretty much should expect them to spy on everyone else whether you agree with it or not, that's their purpose).
When it comes to Bruce Schneier the question is "Do you trust Bruce Schneier?", but this seems to just beg the next question, "To do what?".
I trust Bruce Schneier to honor his own principles and belief system by not backdooring some code or otherwise compromising his work.
But I don't necessarily trust Bruce Schneier to hold a ladder that I'm standing on (he may well have a sense of humour that reflects silent cinema, and being up a ladder was never a good thing when a Loki character was holding it).
I would argue that we "know" Bruce Schneier from his writings and his works better than we know our doctors. The reason we "trust" our doctors is the implied and understood restrictions on sharing confidential medical data and not the character or works of the individuals (since we don't really know them).
With the NSA, that implied restriction (Constitution, laws) has been breached.
Do you breathe? Wait -- breathe what? Is the sky blue? Which sky? Where? Let's define our terms! Was this message written in English or are you misreading fluent Alienese?
"I trust he WON'T let go of the ladder."
That's the same as
"I trust he WILL keep the ladder secured."
I'd say trust isn't about what you think the person won't do. It's about the person living up to their word or implied contract. It can be phrased either as a will do or a won't do.
Ladder guy holding it implies he will hold it securely. Doctor with private info implies he WON'T share it irresponsibly. That could also be worded as an expectation that he WILL keep it private.
"I trust Bruce Schneier to not sacrifice his own principles and belief system in backdooring some code or otherwise compromising his work."
OR
"I trust Bruce Schneier to be true to his principles and belief systems and maintain the integrity of his work."
The Bruce Schneier you know wouldn't compromise his own principles and beliefs but what if the Bruce Schneier you know isn't real? What if those principles and beliefs never existed?
Now we see why faith is requisite for living.
Luckily there's a book that does that. Liars and Outliers: Enabling the Trust that Society Needs to Thrive
http://www.amazon.com/Liars-Outliers-Enabling-Society-ebook/...
I don't think Schneier is similarly compromised - to give out misleading interpretations of the NSA leaks - but we can't know that with 100% certainty as long as the documents he's commenting on are not public.
[1] http://articles.latimes.com/2009/nov/01/world/fg-germany-sta...
You don't even need computers to piece together shredded work. Iran pieced together the shredded US Embassy documents by hand, and China pieced together shredded Soviet atomic bomb documents. You just need time and lots of people. Shredded material is often not well-mixed, so there is a great deal of spatial locality.
The thing that distinguishes the Stasi case is that they produced a lot more records, and German workers cost more than Iranian or Chinese workers. That's where the computers came in.
These days, with cross-cut and confetti shredders, the computers would become even more important.
They should have just had a barbecue.
So, it's not so much "not trust" as "critically evaluate what he says each time".
He missed the perfect opportunity to quote HPMOR.
> I have heard such requests before, and experience leads me to refuse. Either I will do too good a job of prosecuting myself, and convince you that I am guilty - or else you will decide that my prosecution was too half-hearted, and that I am guilty.
To the extent that he maintains crypto is still a plausible defense, there's a huge asterisk next to 'crypto' that boils down to: you really can't know whether you've actually got strong crypto. [1]
For anyone who doesn't have a burning interest in privacy or security, for the regular joe on the street, Schneier's collected reporting reads: they won, it sucks, we need to fight back at the ballot box.
[1] Due all his reporting on the NSA: tapping every wire; injecting vulnerabilities and backdoors, whenever possible, in crypto libraries, crypto programs, services, operating systems and hardware; by hook or by crook, having access to just about every vendor and service providers keys and internal data. And if they want into your computer, specifically, Schneier maintains they're basically in. Hardly a reassuring word among them.
The better question to ask would be "Why might I be trustworthy" which he could then try to answer. Not that I don't think Schneier is untrustworthy..
This is a "have you stopped beating your wife" question, what could any person say except "there is no evidence that I am untrustworthy". How do you mathematically verify a person?
"Did you stop beating your wife" must be answered wu if you have not been beating your wife. "stopping X" requires the precondition that X was happening at the time of the question.
"Am I trustworthy", as the parent comment pointed out, must be answered wu as well, because it probably is impossible to be universally and unconditionally trustworthy.
Even if it is not, judging if one will be unconditionally trustworthy in all contextes, actions and all possible futures of this situation cannot be estimated with enough confidence, unless your life will end within a very short timespan.
Absence of evidence is evidence of absence. The false statement of that form is "absence of proof is proof of absence".
If absence of evidence wasn't evidence of absence, then, at best, the presence of the event and the presence of evidence are have no bearing on each other & are independent (in the statistical sense, i.e. the "evidence" is not evidence at all), and at worst, presence of evidence corresponds to the event not happening (i.e. the "evidence" is backwards).
One may easily use the absence of evidence of woolly mammoths to conclude that woolly mammoths are extinct. Given their physical size (they are easy to detect) they could not remain hidden from view. We can assume (from our knowledge of other large mammals) that they would leave signs of their presence wherever they trod (footprints, dung, etc.) It is not so easy to use absence of evidence to disprove the existence of neutrinos or tree shrews. Both neutrinos and shrews are hard to detect. There are few people even qualified to attempt to detect them, fewer who are interested, and even fewer who have the resources and opportunity.
A relevant question is "Is it possible for spies to conduct espionage undetected for an extended period of time?" The answer is yes, there is ample evidence of that. Schneier is clearly in a place of trust in his community, making him a high value target. The standards of evidence for betrayal of trust being high (and difficult to define), mean that Schneier could potentially be a spy/collaborator in some capacity, and/or could become one at any time.
Yep, Occam's razor means that absence of evidence is evidence of absece.
Furthermore, I took it as him saying that he could provide a list of reasons that people should not trust him but he won't because it would be the security pundit version of cock-blocking himself.
His work is out in the open for all to see. I'm sure that he has a very large target on his back for what he has accomplished. There are more than a few government tools and internet fools who would consider their careers made if they could point to any technical compromises in his work. They haven't been able to.
I would also be fairly confident that what he says is correct.
When he strays outside of his area of expertise into politics, I think he is naïve.
The point is his suggestions or advice point people in a direction that they or people they trust can verify. If he were spreading false information, by now, he'd be shown to be unreliable. But for many, many years, he has consistently been not proven intentionally false. I word it carefully because he has been wrong, but being wrong is not being false.
</tinfoil>
The top comment on the site pretty much covers it: trust, but verify.
(I do think about this sometimes... I guess I just hope that "with enough eyes, all bugs are shallow". I hope.)