If you read some of the first threads when the NSA revelations broke out, there are heated discussions with various viewpoints and arguments. Now, it appears that most of these users have become tired of being instantly downvoted, and instead avoid these subjects entirely.

I hope that tptacek continues to participate in these security policy discussions, not only for his extensive domain knowledge, but also because he is not afraid to voice beliefs that disagree with prevailing opinion. And right or wrong, its very refreshing.

There is a large area missed called psychological bias. People who has close friends working in highly controversial areas has a tendency to become a bit irrational in the view of the controversy. An attack on the NSA becomes an attack of the friend. If NSA is immoral and wrong, the friends choice of occupation must be wrong, thus the friend must be wrong, thus an attack on NSA is an attack of the friend.

Don't really have a dog in this fight, but: up until today, there was no evidence "the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products".

Were people wrong to be suspicious?

You're clearly talking about a different tptacek, widely known on this site for his coarsely abrasive, impossibly high friction, social interactions and not admitting he's wrong on issues trivial or important. He's also widely known for a being an expert in his field.

All that being said, I agree with you that this site is more valuable with him on it and regularly participating. He's one of the actual experts in their field that makes this a much better forum than any other. IMHO, it's well worth the comment burn to talk and debate (friendly or not) with somebody of his caliber.

And being wrong every once in a while (regardless of his rightness in this case) does not make him either incompetent or malicious. It just makes him human.

> Jesus, what a tool you are.

How very civil and gracious.

And here, ladies and gents, is exactly why we'll continue to inhabit an exploitable world forevermore.

That said, I seldom trust anything I cannot verify. In matter s of crypto, that often means that I accept some things as magically working, and accept that the magic could wear off at any minute. Same thing with CPUs. I know generally how they work, and understand bitwise logic, but for the most part, they're just magic boxes that I've got enough experience with to have an expectation of.

In matters of the government, the fault I find with tptacek's arguments (and I hadn't even realized that it was a thing until this thread, but now I'm caught up) is that I think it is naive to trust the government. The federal government is something that our founding fathers encouraged us to be suspicious of. They specifically prescribed that, in order for our democracy to thrive, that we should be ever vigilant in regards to those we entrust with power.

Assuming good faith on the part of the NSA is naive, whether or not they're acting scandalously. Assuming good faith on the part of any politician is naive.

That isn't to suggest that we should never trust anything the government does, but if there's ever the potential for abuse, we should expect that potential to be abused at some point. If there's a loophole that could be exploited in any way, we should expect that it will be.

This diatribe isn't really directed at this comment, per se, but at your "have to trust __something__" comment, which I completely agree with as a generality. As humans, we routinely put trust into a great deal of people and things all the time, but I disagree that a government, even a pristine, flawless, immaculate government, is deserving of that trust, and it is our duty as citizens to thoroughly distrust it.

That aside, your challenge smacks of snake oil. I gave an analogy earlier that captures the essence of the complaints:

Suppose I am selling fire-proof safes. These are designed to protect your documents and valuables from thieves and from fire and other events.

The normal way people set up tests is to put some documents and valuables in a box and actually try to break it (MythBusters style, bringing out cool machinery and trying different ways). For fire resistance, there is a rating system (https://en.wikipedia.org/wiki/Fire-resistance_rating) and a standard way to test.

The Telegram proposition is: we are going to place the safe in Fort Knox. If you can't break the safe that is in Fort Knox, then clearly our safe is secure.

People are arguing that in order to break the safe, you have to break into Fort Knox. And for all intents and purposes that's not going to happen. You could have put a cardboard box in Fort Knox but no one can tell the difference because of the way you structured the challenge.

In that sense, you aren't testing the real-life security.

In cryptography, you either prove it is safe or you consider it broken. Your choice should be considered broken until you prove otherwise.

Edit: Oh, you're the Telegram employee who designed the contest. I encourage you to read moxie's blog post, and Schneiers rebuttals to crypto contests that are probably linked all over your other threads.