Can I Be Trusted?

http://www.schneier.com/blog/archives/2013/10/can_i_be_truste.html

by fejr • 13 years ago

142 52 13 years ago

jeanjq• 13 years ago

No, I do not. I have no reason to distrust him but equally no reason to unthinkingly trust. I listen to his opinions and take them into account.

Dirlewanger• 13 years ago

Seriously, this is the only rational response. This is what rational people do: weigh opinions and make their own decision. It's as if we're trusting this guy with our bank account information or something.

phaemon• 13 years ago

I trust the real Bruce Schneier, not his NSA clone!

mixmax• 13 years ago

So far, I haven't seen the good reasons why I might be untrustworthy. I'd help, but that seems unfair.

The better question to ask would be "Why might I be trustworthy" which he could then try to answer. Not that I don't think Schneier is untrustworthy..

juskrey• 13 years ago

Yes, he just have disclosed the reason not to be trusted. He conflates absence of evidence with evidence of absence.

epo• 13 years ago

No, he is suggesting "innocent until proven guilty", you are suggesting the opposite.

This is a "have you stopped beating your wife" question, what could any person say except "there is no evidence that I am untrustworthy". How do you mathematically verify a person?

dbaupp• 13 years ago

He conflates absence of evidence with evidence of absence.

Absence of evidence is evidence of absence. The false statement of that form is "absence of proof is proof of absence".

If absence of evidence wasn't evidence of absence, then, at best, the presence of the event and the presence of evidence are have no bearing on each other & are independent (in the statistical sense, i.e. the "evidence" is not evidence at all), and at worst, presence of evidence corresponds to the event not happening (i.e. the "evidence" is backwards).

mhurron• 13 years ago

I took it as a joke, not a statement of evidence.

rdl• 13 years ago

I think a fair bit of his non-cryptography security advice of the past 10+ years has been...different than a lot of people I know better and have direct evidence of their competence would give. Increasingly so recently (the past year or two). As a cryptographer, particularly on the symmetric side, he does a good job (at least, the other people who I know who are good at that also think he does a good job; I understand number theoretic cryptology better than I understand the more complex details in designing symmetric stuff). He also went way far over to the "high level policy/politics" side post-BT acquisition vs. actual implementation work, other than crypto competition entries, as far as I can tell.

So, it's not so much "not trust" as "critically evaluate what he says each time".

mikehotel• 13 years ago

Bears repeating: trust but verify. Trust the math but not personalities because allegiances can change. And as cperciva writes (http://www.daemonology.net/blog/2013-09-10-I-might-be-a-spoo...), verify through actual code reviews.

DodgyEggplant• 13 years ago

Thats a recursion

tiatia• 13 years ago

Always funny http://www.schneierfacts.com/facts/top

Amadou3• 13 years ago

After the wall came down, the stasi shredded a lot of their files. But they were reassembled a few years ago and they revealed that some of the dissidents at the time were snitching on their fellows in return for less harsh treatment.[1]

I don't think Schneier is similarly compromised - to give out misleading interpretations of the NSA leaks - but we can't know that with 100% certainty as long as the documents he's commenting on are not public.

[1] http://articles.latimes.com/2009/nov/01/world/fg-germany-sta...

growt• 13 years ago

It's a little offtopic, but those shredded files were put together with software (they scanned all the scraps and put them back together with algorithms). Here is a link to the research article (couldn't find a free source, sorry): http://link.springer.com/article/10.1007/s00287-004-0395-8

AlexDanger• 13 years ago

Wow. anyone got an English free link describing this work?

buro93• 13 years ago

You'd have to define trust to understand and then answer the question.

Trust is the inverse of what most people think it is.

Trust isn't about what someone will do, it's about what they won't do.

You might trust a guy with your life by asking him to hold a ladder whilst you climb up it, but you probably wouldn't trust the same guy with your medical history and insights into your state of mind and personal relationships.

Yet you would trust a doctor with your medical history, and you would trust a psychiatrist with your mental wellbeing.

The basis of trust is a belief that the person/entity you are trusting won't do something. In the case of that ladder, that the guy won't let go. In the case of the physician and psychiatrist that they won't share information about you.

The NSA stuff can be seen in that light, there is a betrayal of trust as the basis for trust in a government spy agency was that they wouldn't do a certain thing... spy on their own people. The rest is all forgiveable (you pretty much should expect them to spy on everyone else whether you agree with it or not, that's their purpose).

When it comes to Bruce Schneier the question is "Do you trust Bruce Schneier?", but this seems to just beg the next question, "To not do what?".

I trust Bruce Schneier to not sacrifice his own principles and belief system in backdooring some code or otherwise compromising his work.

But I don't necessarily trust Bruce Schneier to hold a ladder that I'm standing on (he may well have a sense of humour that reflects silent cinema, and being up a ladder was never a good thing when a Loki character was holding it).

Amadou3• 13 years ago

When it comes to Bruce Schneier the question is "Do you trust Bruce Schneier?", but this seems to just beg the next question, "To not do what?".

If you had read really short article, the "next question" is: "To not mislead us about what he has read in the leaked NSA documents."

buro93• 13 years ago

I did read it, and the answer remains the same:

I trust Bruce Schneier to not sacrifice his own principles and belief system in backdooring some code or otherwise compromising his work.

To mislead would be to compromise his own work.

tslathrow• 13 years ago

Astute. edit: thanks (didn't know what a Loki was)

buro93• 13 years ago

Loki is a Norse God.

http://en.wikipedia.org/wiki/Loki

He's frequently referred to as the `God of Mischief` in that he's a trickster and capricious by nature.

stinos• 13 years ago

I think I get your point, but I feel you should try to bring it in a different way, without reverting to pure semantics play. To illustrate: I might as well say "In the case of that ladder, that the guy will hold on tight. In the case of the physician and psychiatrist that they will keep your information for themselves." And suddenly trust is all about what someone will do.

frogpelt2• 13 years ago

Think of it this way: if a person won't tell a lie that person is always truthful. But if a person will tell the truth, that person may or may not always be truthful.

relate• 13 years ago

You'd have to define trust to understand and then answer the question.

Trust is the inverse of what most people think it is.

Trust isn't about what someone won't do, it's about what they will do.

Yet you would trust a doctor with your medical history, and you would trust a psychiatrist with your mental wellbeing.

The basis of trust is a belief that the person/entity you are trusting will do something. In the case of that ladder, that the guy will hold it. In the case of the physician and psychiatrist that they will keep your information private. The NSA stuff can be seen in that light, there is a betrayal of trust as the basis for trust in a government spy agency was that they would do a certain thing... spy only on foreign people. The rest is all forgiveable (you pretty much should expect them to spy on everyone else whether you agree with it or not, that's their purpose).

When it comes to Bruce Schneier the question is "Do you trust Bruce Schneier?", but this seems to just beg the next question, "To do what?".

I trust Bruce Schneier to honor his own principles and belief system by not backdooring some code or otherwise compromising his work.

cpt1138• 13 years ago

Thats a very interesting way of putting it. But why do you trust your doctor or psychiatrist?

I would argue that we "know" Bruce Schneier from his writings and his works better than we know our doctors. The reason we "trust" our doctors is the implied and understood restrictions on sharing confidential medical data and not the character or works of the individuals (since we don't really know them).

With the NSA, that implied restriction (Constitution, laws) has been breached.

Tloewald• 13 years ago

This is a silly bunch of pedantic twaddle along the lines of "never assume, when you assume you make an ass out of u and me". The tacit assumption is that we're trusting (or not) Bruce Schneier as a source of information in his subject domain, and not as a mental health professional or holder of ladders.

Do you breathe? Wait -- breathe what? Is the sky blue? Which sky? Where? Let's define our terms! Was this message written in English or are you misreading fluent Alienese?

grannyg00se• 13 years ago

That's an interesting way to look at trust but it's highly dependent on your own internal thought process and phrasing.

"I trust he WON'T let go of the ladder."

That's the same as

"I trust he WILL keep the ladder secured."

I'd say trust isn't about what you think the person won't do. It's about the person living up to their word or implied contract. It can be phrased either as a will do or a won't do.

Ladder guy holding it implies he will hold it securely. Doctor with private info implies he WON'T share it irresponsibly. That could also be worded as an expectation that he WILL keep it private.

"I trust Bruce Schneier to not sacrifice his own principles and belief system in backdooring some code or otherwise compromising his work."

"I trust Bruce Schneier to be true to his principles and belief systems and maintain the integrity of his work."

frogpelt2• 13 years ago

Based on your definition of trust (which I tend to agree with) you have to know the other party pretty intimately to know whether you can trust them.

The Bruce Schneier you know wouldn't compromise his own principles and beliefs but what if the Bruce Schneier you know isn't real? What if those principles and beliefs never existed?

Now we see why faith is requisite for living.

cruise02• 13 years ago

You'd have to define trust to understand and then answer the question.

Luckily there's a book that does that. Liars and Outliers: Enabling the Trust that Society Needs to Thrive

http://www.amazon.com/Liars-Outliers-Enabling-Society-ebook/...

kbart• 13 years ago

I kinda trust a person whose best advice is "trust math". Of course, to a certain level as still the best advice is "trust noone"..

chattoraj• 13 years ago

I'd help, but that seems unfair.

He missed the perfect opportunity to quote HPMOR.

I have heard such requests before, and experience leads me to refuse. Either I will do too good a job of prosecuting myself, and convince you that I am guilty - or else you will decide that my prosecution was too half-hearted, and that I am guilty.

known• 13 years ago

Verify and Trust

gadders• 13 years ago

I trust Bruce Schneier to believe what he says when it comes to cryptography.

I would also be fairly confident that what he says is correct.

When he strays outside of his area of expertise into politics, I think he is naïve.

forgotAgain• 13 years ago

Yes, I do trust him.

His work is out in the open for all to see. I'm sure that he has a very large target on his back for what he has accomplished. There are more than a few government tools and internet fools who would consider their careers made if they could point to any technical compromises in his work. They haven't been able to.

alan_cx• 13 years ago

On a "what do I do?" practical level, its not about trusting him.

The point is his suggestions or advice point people in a direction that they or people they trust can verify. If he were spreading false information, by now, he'd be shown to be unreliable. But for many, many years, he has consistently been not proven intentionally false. I word it carefully because he has been wrong, but being wrong is not being false.

johnjhayes• 13 years ago

Trust is not boolean. I have a reasonable amount of trust in Bruce Schneier based on the information I have available.

r0muald• 13 years ago

No.

lucb1e• 13 years ago

Well for one, he uses Windows on his super secure airgapped computer. That must mean he is in bed with the NSA!

</tinfoil>

The top comment on the site pretty much covers it: trust, but verify.

spin• 13 years ago

Haha. And I use Linux -- and I usually leave SELinux turned on... so my OS is infested with NSA-written software.

(I do think about this sometimes... I guess I just hope that "with enough eyes, all bugs are shallow". I hope.)

roc• 13 years ago

If the goal of the hypothetically-compromised Bruce Schneier is to reinstate public trust in weak crypto, he's doing an exceptionally bad job.

To the extent that he maintains crypto is still a plausible defense, there's a huge asterisk next to 'crypto' that boils down to: you really can't know whether you've actually got strong crypto. [1]

For anyone who doesn't have a burning interest in privacy or security, for the regular joe on the street, Schneier's collected reporting reads: they won, it sucks, we need to fight back at the ballot box.

[1] Due all his reporting on the NSA: tapping every wire; injecting vulnerabilities and backdoors, whenever possible, in crypto libraries, crypto programs, services, operating systems and hardware; by hook or by crook, having access to just about every vendor and service providers keys and internal data. And if they want into your computer, specifically, Schneier maintains they're basically in. Hardly a reassuring word among them.

skue• 13 years ago

Reading the comments below Schneier's post, I was reminded again just how much the Internet has changed how we interact. Here is an expert creating a space and inviting anyone with an opinion to gather and discuss whether he can be trusted, while he quietly (and amusedly?) observes. I can't imagine anything analogous to this IRL.

squozzer• 13 years ago

It depends on what's at risk. So far he hasn't asked me to meet him in a cornfield or other out-of-the-way location.

Can I Be Trusted?

Related Stories