Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Wed, 18 Feb 2009, David Nicol wrote:

> I'm going to jump in again because I like the popcorn popper metaphor.
> 
> On Wed, Feb 18, 2009 at 12:45 AM, Dean Anderson <[email protected]> wrote:
> 
> > You are mixing apples and oranges. The first scenario, unmodified
> > DNScache, requires a birthday attack which we can analyze. The
> > second scenario Kaminksy/Day/King DNScache changes, depends on
> > changes suggested by a blackhat hacker and lowers the randomness of
> > the port usage.  Imagine a popcorn popper that runs a lot slower.
> > Slow enough to follow.
> 
> calling each other names is called an "ad hominem fallacy" and is
> out-of-bounds in constructive collaborative search for truth.

"Sure, Mr. Skilling you can run my company, inspite of the Enron stuff."  
My point is that reputation, when it is discrediting, is relevant. Being
relevant, it is not ad hominem.  The association of the changes with
blackhats is enough to dissuade most people to stop looking at these
changes. Blackhats usually produce exploits (benchmarks), not plans for
changes.

BTW, even if I was actually 'looney', it might still not be relevant.  
John Nash was as nutty as they come, institutionalized, but was still a
nobel prize winning mathematician. But, I'm not John Nash, and I'm not
actually looney, and the blackhats don't really think I am looney. Its
just an example of irrelevant name-calling, which is an ad hominem.

While the blackhats call me names (looney being among the more
printable), they never have any honest example or explanation of what it
is that was looney or whatever; they misquote me or sometimes just lie
outright. [eg SORBS claim that 130.105/16 and 198.3.136/21 are hijacked,
threatening to block legitimate email to ARIN or IETF is spam if I
oppose them] I keep being vindicated, and they keep being discredited.  
Most people I know think that kind of reputation is good for me and bad
for them.  As Truman said, 'its not what they say about you that
matters. Its whether they get something on you'.  They have nothing on
me, but I have a lot on them.


> About the popcorn popper (yum, popcorn!  Suddenly typing sounds like
> popping popcorn) metaphor: if the birthday attack is equivalent to
> placing a little basketball hoop inside the big popcorn popper and
> winning when a popcorn flies through it, someone who wants popcorn to
> fly through the hoop wants the popper to run fill tilt rather than
> slower.

:-) But the birthday attack is not actually equivalent to the variation
of the popcorn analogy that you describe.

> A moderate conservative here is opposed to /any change/ without a
> demonstrable exploit, so the cruder tools of benchmarking can be used
> in preference to the faith-based tools of analysis.  He hears
> Anderson's fears about "blackhats" and notes that said alleged
> blackhats call Anderson a loony, which actually supports Anderson's
> claim against them, then Anderson proposes a change too, also based on
> analysis rather than benchmarking, which supports their claim against
> him.

Blackhats usually produce example exploits (benchmarks), not plans for
changes.  So the absence of a benchmark is stranger for the blackhat
view than for my analysis.

But analysis is not faith-based. It is math-based---a branch of
mathematics, actually. Engineering is based on analysis, Cryptography is
based on analysis.  


But, it does seem that we are at a deadlock, though.

- If people don't think I have analyzed this correctly, and don't think
that Kaminsky/Day have either, then no choice can be made. Those people
will probably avoid both changes.

- If one agrees that reducing the number of ports consumed might affect
the entropy of the port number, then Kaminsky/Day have gotten it wrong
(again). And one must consider if this is an honest mistake or a trick.  
If one agrees that my changes do not affect entropy, and that the
birthday attack is indeed the easiest attack, then I have gotten it
right.  Those people will choose my changes.

- If one thinks that my analysis is wrong, and sees no problems with
Kaminsky/Day, because of their reputation for blackhat, or their changes,
then that person's choice is just as plain.

I'll create my distribution, and try to identify those other
distributions which take changes from blackhats, and let the public
decide who is more trustworthy and which solution is better.  Works for
me.

		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000