Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Feb 18, 2009, at 12:02 AM, Dean Anderson wrote:

> On Fri, 13 Feb 2009, Paul Jarc wrote:
>
>> Dean Anderson <[email protected]> wrote:
>>>
>>> Kaminsky's formula and the correct formula are in two messages I  
>>> sent
>>> from DNSEXT.
>>
>> I didn't ask about errors in Dan Kaminsky's math.  I asked about  
>> Kevin
>> Day's.
>
> I didn't read that PDF---I read Day's and Kaminsky's email text to me.
> I don't usually open PDF's from blackhats if I don't have to, since  
> the
> format can contain javascript exploits which can elude my virus  
> scanner.

First of all... Whoa, you're saying you've been arguing this whole  
time without even reading the paper you're arguing against? The same  
paper I emailed you a couple of weeks before making public, that you  
kept telling me you were just too busy to read?

If I had known you had an aversion to PDFs, I would have given you a  
copy in another format. It simply doesn't spit out into ASCII very  
well because of some tables. If I post the .tex source to make the  
PDF, would that be okay? .tex = essentially plain text. You can look  
for javascript or whatever you want and make your own PDF/PS from it.

Second... "blackhat"? I have never done anything in my life that could  
be categorized as "blackhat" material. If you want us to believe the  
technical arguments you're presenting, try to stick to the facts  
everywhere else.

> But I was in communication with both Day and Kaminsky, who say they  
> are
> working together, and I have no reason to think their analyses differ.

I'm beginning to think you aren't reading any of this, or are choosing  
not to believe it.

 From one of my first emails about this:

On Feb 10, 2009, at 9:32 PM, Kevin Day wrote:
> This is why I think you're either confusing me with someone else,  
> and/or are looking at the wrong patches.
>
> 1) Dan Kaminksy and I have never worked together on anything. I have  
> sent a grand total of maybe 10 emails to the guy in my life. I have  
> talked to YOU more than him.  I've followed his work, but we  
> honestly have done nothing together. The extent of his involvement  
> with the djbdns weaknesses I researched can be boiled down to: "Hey,  
> Dan... I know you've been looking at DNS poisoning lately, can you  
> look at this and see if I've missed anything?"  "Looks like you've  
> found something interesting, Kevin. See if you can exploit it, and  
> I'll check your work."
>
> I have nothing against Dan, but it's incorrect to say that there  
> could possibly be anything called "the Day/Kaminsky proposed  
> changes." I don't believe there has been any overlap in anything the  
> two of us have ever done.
>

What you and Dan appear to have been talking about before he cc'ed me  
into one of his replies way way back in August has little to do with  
any of this.


It's not that we're arguing over who is right or wrong about this  
stuff, it's that you appear to be having a completely different  
argument than the rest of us about something unrelated.

-- Kevin