Re: update on the djbdns bugs? (fwd)

On Thu, 11 Mar 2010, Kevin wrote:

> Sorry, but you're reading things that aren't there. Read what you just
> pasted again, looking for the word "patches" or "code" or anything
> like that. The only mention of "patches" in any of what you pasted
> below is from you.

I just sent an email with highlights of statements from //you//.

And this is a message from Jeff King on August, 9 2008
                                        ^^^^^^
http://marc.info/?l=djbdns&m=121824413130252&w=2

=====================
I have written a patch that should address the problem (my name was
given to Kevin because of my previous activity on this list). I am not
posting the patch right at this moment because:

  - it is undergoing quality testing right now. A few people are running
    the patch on their servers to give it some real world testing.

  - Kevin, myself, and others are trying to get the details right for
    presenting a coherent argument that this is actually a problem. In
    other words, we don't want to post a patch and say "this fixes a
    security problem" until we are sure that it _is_ a problem.
=====================

You are plainly working with Jeff King and Dan Kaminsky on the patch and
its design, and talking to me about it October 2008.  But later (and
now) you deny it having anything to do with the patch.  I believe that
King may have controlled the source repository and drew out the final
patch diff in April, but I think you (Kevin) and Dan are programmers,
and that King shared the code with you, and that you actually
collaborated on both the code and its design.

Now Kevin wants us to believe his role was just to document what was
written (like some technical writer making a manual)...  My email with
Kevin doesn't support such a limited role.

> I was working on a *document* detailing my investigation, nowhere do I
> say I've written any code. Dan just got involved because I asked him
> some questions, nowhere does he say he wrote any code. I was
> originally planning on releasing a *document* without any patches, but
> Jeff stepped forward and created a patch.

The record shows otherwise.  Jeff stepped in with a patch some 2 months
/before/ our discussions in October, and didn't release the patch until
April 2009, six months /after/ our discussions.

> From the very beginning, the web site I threw together
> (http://www.your.org/dnscache/) said: "These patches were developed by
> Jeff King, and are released into the public domain."  That was there
> from day one.
> 
> To sum up:
> 
> Kevin: Wrote a PDF discussing the weakness.
> Jeff: Wrote the patch.
> Dan: Not involved at all, other than me sharing my PDF with him before it was made public.

This is not supported by the email I have. Dan, along with you (Kevin),
was talking to me about the patch and its design in October.

> > Then Jeff King turns up with the patches.  And "Mark Johnson"  
> > distributes them anonymously with no accountability, with more tweaking.  
> > Struck me as just like money-laundering. I called it reputation and
> > accountability laundering.
> 
> I distributed these patches long before Mark did. I'm easily traceable
> to being on the internet for 15 years or so. 

Yeah, but you claim that Jeff King is responsible for them.  Now just
"Mark Johnson".  Decreasing accountablity.

  "Success has many fathers, but failure [and crooked activity] is an 
   orphan."  --unknown

Decreasing accountability just doesn't make sense if you think the patch
is truly important.

> Part of the reason that nobody was understanding your previous
> critiques was that you were discussing an attack technique that has
> nothing to do with what the paper described,

Balderdash. The offlist email shows differently. We discussed your
version, and I discredited those ideas.

> largely because you're assuming that everything we've been talking
> about is somehow a replica of Dan Kaminsky's work.

I didn't say "replica". I think the evidence is that you were working on
it //together// from the beginning.

That is my point: You are a //collaborator// with the con-artist.  

> You're making this far more complicated than it is. :)

No, I'm just getting all the loose ends tied up.  Ensuring that 
accountability isn't actually decreased.

		--Dean


-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 256 5494