Hacker News Reader

Comment by fensipens | Hacker News Reader

Is there some other story that I'm not aware of here?

If it's from Goodin, you should always take it with a teaspoon of salt. He is often in way over his head with certain subjects he decides to write about, best example being BADBIOS, the story about a hearsay BIOS uber-virus. Made everybody shit their pants for days (even the MSM picked it up) and after weeks of waiting, the swarm of curious FW/BIOS analysts that were demanding dumps from Goodins source finally declared the story BS.

That aside, the following paragraph alone says a lot about Goodin's ham-handed journalism:

Still, it's not clear whether it makes sense to dump massive amounts of cash to refurbish code in such disrepair.

I glimpsed over the 1.4 branch for a few minutes (I bet longer than Goodin) and while some parts look complicated, it is not remotely as ugly as for example fetchmail or certain parts of the glibc.

View on HN

That's not fair. I've talked to Dan Goodin a number of times regarding some pretty complicated stuff, and he's listened carefully, demanded clarification when I was unclear, and didn't cherry-pick a splashy quote or two and then ignore the substance of the interview. Most people I've talked to seem to agree with me that Goodin is one of the better journalists covering security topics.

BADBIOS is a particularly unreasonable thing to hold over his head. Goodin is a journalist, not a security researcher. He depends on researchers as sources for his story (and in that regard, he is unusually well-sourced; possibly second only to Krebs). Security researchers were not unanimous about BADBIOS. Some of them --- Robert Graham jumps to mind --- were happy to entertain the idea that Dragos really did have a mysterious malware infection. It doesn't help that so many researchers are friends of Dragos.

Matthew Green is a radiant cut emerald of a crypto source. He's a professor of cryptography at Johns Hopkins and a former appsec consultant at Avi Rubin's old company. As far as news sources go, he's extraordinarily well-connected to crypto research; much more so than Schneier, who is reverently quoted everywhere without a peep from HN.

I think Green is being a bit unfair to GPG in this piece, and that it's reasonable to take issue with that. I don't think it's reasonable to direct that ire at Goodin.

I pitch stories regularly to reporters. Dan is by far one of the best reporters in the business, and is the person I go to whenever I have something that is interesting, but far too technical for the mainstream press. He always does an excellent job with it, particularly if I give him a few days.

I've worked with plenty of unprofessional reporters who butcher stuff, and don't care about the details. Dan isn't like that.

> Goodin is a journalist, not a security researcher. He depends on researchers as sources for his story

My main issue with the article was the way he presented the story as if it was based on facts instead of a few unproven claims. Subsequently, the story spread to other non-technical platforms, re-reported as fact.

> Robert Graham (...)

Well, that doesn't really matter.. extraordinary claims were made in the complete absence of extraordinary proof. And then a multi-page story was written based on nothing.

> I think Green is being a bit unfair to GPG in this piece

I agree, his comments were slightly smug.

Reply on news.ycombinator.com