The Internet Is Being Protected By Two Guys Named Steve

http://www.buzzfeed.com/chrisstokelwalker/the-internet-is-being-protected-by-two-guys-named-st

by smacktoward • 12 years ago

178 95 12 years ago

buzzfeed.com

dang6• 12 years ago

We changed the title to be less linkbaity. If anyone can suggest a better one, please do.

conroy• 12 years ago

dang, thanks for explanations around title changes. It makes the whole process less mysterious.

jackalope• 12 years ago

IMHO, the original title reflects the tone and content of the article. I didn't feel cheated when I clicked on it, so I don't really consider it linkbait.

smacktoward• 12 years ago

I actually liked the original title better, as it communicated the main point of the article -- that a ton of critical infrastructure is riding on the shoulders of a very small number of people -- better. Changing it to "Steve Marquess and Stephen Henson of OpenSSL" doesn't really get that point across, since it doesn't make clear that Marquess and Henson essentially are OpenSSL.

EDIT: It is definitely refreshing to see editorial decisions like this being explained clearly, though, and the community being asked to provide feedback. So my thanks to dang for that, even if we disagree about the title :-D

vezzy-fnord• 12 years ago

Damn. Never thought I'd see a BuzzFeed article here. About as low as the web gets.

This is surprisingly good from them, however.

alternize2• 12 years ago

this was quite unexpected, indeed. the article is well written and has a good narrative.

danso• 12 years ago

Buzzfeed, AFAIK, was blacklisted from HN for awhile, but it looks like the new mod regime has taken off the blanket ban...and that's a good thing. The majority of Buzzfeed is still linkbait but they do have sections written by real reporters, with some of the best writing and research I've seen from online outlets. My personal favorite was this in-depth exoneration of MSG: http://www.buzzfeed.com/johnmahoney/the-notorious-msgs-unlik...

disclosure: one of my former colleagues is a Buzzfeed editor (http://www.usatoday.com/story/money/columnist/rieder/2014/02...), and he's been in charge of hiring an investigations team. He's a Pulitzer winner himself and just hired one of this year's Pulitzer winners, as well as a Pulitzer finalist (HN user jsvine)...the late Michael Hastings was doing investigative reporting for Buzzfeed before his untimely death. So the investment they're putting into non-listicle-journalism is non-trivial.

dublinben• 12 years ago

It's really too bad that they're mixing the in-depth coverage and the crap on the same domain. It indelibly taints their better articles with the stink of their low-quality drivel. On the whole, the site is a worthless spam farm that steals content from reddit and other sources. The existence of a handful of good stories isn't enough to overcome that reputation.

rtpg• 12 years ago

Buzzfeed has some great longform articles too. Their piece on the history of the AUMF is great (especially for those who weren't paying attention/were too young to care at the time).

http://www.buzzfeed.com/gregorydjohnsen/60-words-and-a-war-w...

dang6• 12 years ago

Buzzfeed seem to be partly rebranding themselves with high-quality long articles. I thought this was excellent: http://www.buzzfeed.com/bensmith/tom-lehrer (and posted it to HN to no avail). So yes, we've upgraded Buzzfeed from banned (stories get auto-killed) to lightweight (stories get a penalty, which moderators can override). A moderator saw the OP and marked it as solid.

Lightweight sites are an uncanny valley for HN. We can't un-penalize them without the site being overrun with fluff. But we don't want to miss any solid articles, either. It requires human intervention to tell the two apart, and we neither see everything nor necessarily see things in time.

I have some ideas for writing software to help with this conundrum, but won't be able to get to that (or the dozens of other things on our list) until my ongoing moderation-comment blitz subsides.

dredmorbius4• 12 years ago

Buzzfeed have done themselves very considerable harm with their earlier tactics. Enough that I look on the URL with extreme prejudice.

I've got a custom CSS I apply to the site (I refer to it as "unbuzzed") which strips all the viral crap from it. And checking quickly w/o my CSS applied, I see that while some of the site's content may be quality, much of it still matches my recollection of it.

Given that, I feel that supporting the site in any way condones a behavior which is, IMO, very highly toxic.

I'd prefer "banned unless moderator overrides" be in place, and I think actually, keeping the ban in place would be even better. It's weaponized clickbait.

More: http://www.reddit.com/r/dredmorbius/comments/23twec/weaponiz...

As for lightweight stories: they're, net net, toxic.

If there's lightweight coverage of a topic, there's almost certainly a heavyweight coverage somewhere. Almost always upstream (source study, report, release, comments), occasionally in a detailed analysis commentary.

My focus for much of the past year and some has been "big issues": population, resources, sustainability. Of which a significant component is energy. The good news is that there's huge amount of research going into advanced energy technology: new methods of capturing, converting, storing, or using it. And virtually ALL of it is absolute, total, complete, 2000% bullshit in terms of actual informational value.

In one case (the Haberno enhanced geothermal well project in Australia), I found that reading the company in question's own financial filings with the Australian securities regulator was far more informative than the ... whitewashed is putting too pretty a face on it ... completely useless press "progress" report. If attaining 2% of your initial generation goal in 5x the time and 10x the budget is "success", well, I don't know what to say.

The problem is when the crap reporting of useless bullshit makes it difficult to see through crap reporting of the good stuff out there. The US Navy Research Lab's recently (past month) publicized research on electricity-to-fuel synthesis from seawater was abysmal. But the underlying technology and story are actually among the better prospects out there in terms of not only providing moderate-scale liquid fuel sources for the future, but very large (national or global) potential, with high-but-tractable costs, and with applications to utilizing surplus intermittent generating capacity for fuel synthesis and long-term storage (diesel fuel stores well). But the 1) profusion of crap elsewhere and 2) abysmal quality of the reporting on this technology made this almost impossible to see.

I still think my own write-up (which could use some improving) is among the best there is on the topic:

http://www.reddit.com/r/dredmorbius/comments/22k71x/us_navy_...

So: my war on Buzzfeed remains.

pdeuchler• 12 years ago

Serious question: Does the HN moderating staff have any ethical concerns about supporting Buzzfeed, regardless of article quality? Not even delving into their business model (which can be politely defined as "parasitic"), I'd guess at least half of all their content is blatantly plagiarized... at best "lightly" ripped from others. Last time I checked they also continued to use copyrighted and restricted licensed content without permission or payment.

pronoiac2• 12 years ago

In fact, a quirk of the U.S. legal system meant that cryptography was, until the late 1990s, placed on the U.S. Munitions List, alongside semi-automatic firearms and tanks.

Should this be in the past tense? I thought crypto exports from the US were still restricted.

alternize2• 12 years ago

it's still restricted, but not on the munitions list anymore:

  Legal challenges by Peter Junger and other civil libertarians and privacy advocates, the widespread availability of encryption software outside the U.S., and the perception by many companies that adverse publicity about weak encryption was limiting their sales and the growth of e-commerce, led to a series of relaxations in US export controls, culminating in 1996 in President Bill Clinton signing the Executive order 13026 transferring the commercial encryption from the Munition List to the Commerce Control List. Furthermore, the order stated that, "the software shall not be considered or treated as 'technology'" in the sense of Export Administration Regulations. This order permitted the United States Department of Commerce to implement rules that greatly simplified the export of commercial and open source software containing cryptography, which they did in 2000.

http://en.wikipedia.org/wiki/Export_of_cryptography_from_the...

pronoiac2• 12 years ago

It looks like most of the OpenSSL team[1] is outside the US, except Marquess, the businessman. It looks like OpenBSD is developed and released from Canada.[2]

I tried reading the Wikipedia article you linked, and something from the Bureau of Industry and Security[3], and my eyes glazed over. I think the upshot is developing an open source crypto library in the US just won't work.

[1] https://www.openssl.org/about/

[2] http://www.openbsd.org/goals.html

[3] http://www.bis.doc.gov/index.php/policy-guidance/encryption/...

shard9724• 12 years ago

Damn, I wanted my Dogecoins to be munitions.

0x0• 12 years ago

At least Apple makes you jump through a bunch of hoops by asking if your product contains crypto when you submit anything to the app stores.

It's not exactly clear either if this applies even to apps that happen to pass a https url into a UIWebView.

pmorici• 12 years ago

"Marquess, a consultant for the Department of Defense"

Maybe I haven't been following this close enough but has anyone questioned whether or not it is perhaps a conflict of interest to be a consultant for the "Department of Defense" while also being a principal contributor to a project like OpenSSL?

exelius2• 12 years ago

I think it's about the only way to do so. Navigating a complex bureaucracy like the DoD requires an insider's knowledge. Not everyone who works for complex bureaucracies is evil; many are trying to help them be better (or at least direct its energies at things that are productive to the public).

The bigger problem that seemed to surface through this article is the sense of the "ubercoder" who singlehandedly runs a major project because they can't work with anyone else. I don't know if it was sensationalized by the author of the article, but it does strike me as a major problem in a lot of open source software. IMO, something like OpenSSL is important enough that it should be run by a non-profit.

ballard• 12 years ago

Does "ultimatum" and "raft of complicated last-minute changes" not raise anyone else's tinfoil paranoia alarms?

Those commits should get significant scrutiny, because it sounds like US/CA govt were given an indirect opportunity to push whatever changes it wanted AND rushed code isn't necessarily the best either.

(Also I'm glad FIPS mode is dead in LibreSSL.)

jsmeaton• 12 years ago

I read that part as the approval process required X changes that the OpenSSL team had to implement themselves. I don't believe the approving party was asking the OpenSSL team to commit code they were supplying.

tragic• 12 years ago

Hmmm... Never ascribe to conspiracy what can be adequately explained by bureaucracy. The feds love them some standards.

SeanDav• 12 years ago

Once upon a time I used to believe this. Post Snowden, I tend to believe the reverse.

trevelyan2• 12 years ago

"a quirk of the U.S. legal system meant that cryptography was, until the late 1990s, placed on the U.S. Munitions List, alongside semi-automatic firearms and tanks."

This was no quirk. The US government made deliberate efforts to limit the availability of encryption software, even adding it to international export control lists where it previously did not exist:

http://cryptome.org/jya/wass-suks.htm

colechristensen7• 12 years ago

I may be outspoken on this, but I think that it was an appropriate move to keep cryptography (or some kinds of cryptography) on such munitions lists.

shard9724• 12 years ago

Can you explain why you think that?

VMG4• 12 years ago

The kind of cryptography that lets people communicate securely? Belongs on the same list as physical objects that intended to pierce walls and flesh?

I'd also like a more in-depth explanation.

exelius2• 12 years ago

It kind of made sense during the pre-Internet Cold War days when the only people with use for strong cryptography were nations and their militaries. These days it's just silly.

gioele• 12 years ago

We should remember that DJB was a key person in making cryptography fully legal in the US.

«The State Department was unsympathetic to Bernstein's situation and told Bernstein he would need a license to be an arms dealer before he could simply post the text of his encryption program on the Internet. They also told him that they would deny him an export license if he actually applied for one, because his technology was too secure.

The Electronic Frontier Foundation pulled together a top-notch legal team and sued the United States government on behalf of Dan Bernstein. The court ruled, for the first time ever, that written software code is speech protected by the First Amendment. The court further ruled that the export control laws on encryption violated Bernstein's First Amendment rights by prohibiting his constitutionally protected speech. As a result, the government changed its export regulations.» From https://www.eff.org/about/history

http://cr.yp.to/export/status.html

http://en.wikipedia.org/wiki/Bernstein_v._United_States

001sky2• 12 years ago

Decided: December 9, 1996

interesting_guy2• 12 years ago

Berenstain Bear

uuid_to_string• 12 years ago

So who should we entrust with protecting our communications over the open Internet?

The US defense contractor and the reclusive gentleman in the UK whose code (for whatever reasons) has a rather poor security record,

the math professor whose code (qmail, daemontools, djbdns, etc.) generally has an excellent security record?

Who enforces better quality control?

Does that matter?

Or maybe we should be asking how much these men are paid? (As are the journalists and their readers.)

We know from the statements of the US Steve that the UK Steve does not get paid much for his work.

Maybe it's really not about the money?

Nevermind. I'm sure the journalists have it right.

vishnugupta• 12 years ago

I believe (citation needed :-)) there was (is?) restriction on the maximum length of private key. This was arrived at based on the computing resources available with NSA so that they be able to break a cypher by brute force.

There's a very interesting passage in the book "The Code Book" towards the end as to how the inventor of PGP was harassed by slapping him with charges under Arms Export Control Act[1].

Zimmermann's law [2] is also very relevant to be mentioned here.

[1] http://en.wikipedia.org/wiki/Phil_Zimmermann#Criminal_invest...

[2] http://en.wikipedia.org/wiki/Phil_Zimmermann#Zimmerman.27s_L...

trevelyan2• 12 years ago

Yeah. I seem to remember the limit being 64-bit at the time, although maybe it was only 56-bit. Netscape used to have different download links for "American" and "International" users and put up a stern warning on the US link saying that international users couldn't grab it.

So, of course, everyone just downloaded the American edition... :)

zhte4152• 12 years ago

I find it a great shame that literally a handful of independent individuals take on responsibility compensated at a minuscule fraction those that directly benefit from it: ISPs, Certificate Providers (particularly certificate providers, absolving themselves of accountability for potential loss) and Hosting Providers.

QuantumChaos• 12 years ago

That's a consequence of being open source. All the main open source licenses mean that anyone would be able to use OpenSSL without paying a cent to the creators.

Advocates of open source often claim that creators of open source software can make money by selling services to users, like consulting services. As this article (and others) describe, this approach also didn't work that well for the OpenSSL team.

pyre• 12 years ago

Another possibility is that CommercialSSL becomes a product that takes a page from the Oracle playbook and panders to selling to these large enterprises, with little care for the needs of smaller businesses.

zhte4152• 12 years ago

Open source > indeed, I agree.

My perspective is principally the harmony or conflict of the open source -ness of OpenSSL, and the Tragedy of the Commons https://en.wikipedia.org/wiki/Tragedy_of_the_commons of all using a resource while few feeling the need to compensate.

It is interesting that open source has often found solutions around this 'tragedy' - ownership (contributing or forking) vs access (using) - but I feel a shame that those that work hard towards creating a public good (OpenSSL) only receive recognition when things go wrong, while those that have criticised (the possibly competing consultancies, perhaps) have themselves not forked or recreated a better solution, as it seems having the ability, confidence or willingness to carry the risk to credibility (for a better solution), or knowingly taken advantage of an exploit, is more profitable than giving back.

tl;dr I admire these Steves and other contributors very much, and wish they get what they deserve. I guess the world of Star Trek is still somewhat way off.

colechristensen7• 12 years ago

I don't.

I find no shame in people choosing to give something away without asking for compensation.

I find no shame in an economy which contains a significant amount of resources given gratis by choice.

I do find shame in the insistence that everyone who gets a whiff of usefulness of some creation owes the creator (or the descendants of the owner of the creation) a toll.

6cxs2hd6• 12 years ago

Yes, but GP wasn't advocating some sort of Disneyesque intellectual property regime. On the contrary, GP is pointing out that a lot of big, rich companies and their investors have been freeloading off the volunteer work of these 2 guys. So it's a "shame" in the sense of being an unfortunate situation. It's not illegal. Maybe it's not even unethical. But it is a damn shame.

midas007• 12 years ago

As a creator and a consumer, I think one has to not resent giving away something. Don't expect compensation, but ask for it if it's necessary to accomplish something as a stretch goal up from free. Also, there is value derived from street cred and it's better than a résumé.

https://github.com/steakknife

NamTaf• 12 years ago

You would've thought that after getting bitten by it, the Zucks, Brins, etc. of the would would've been happy to kick in a few million a piece to ensure part of the critical underpinning of their services is a bit more bulletproof.

Without having any idea of the numbers otherwise, could this not be a reasonably cost-effective approach to security? Making sure the OSS projects you draw on are properly funded so they can shoulder some of the security responsibility must be easier than employing your own army of security savants to do the same thing internally? I'd love to hear more info on whether this is or isn't a good approach.

Tyrannosaurs• 12 years ago

I suspect that most corporates use FOSS not because of any philosophical support for it but simply because it's cheap and available.

If it's going to start costing them money then it would raise the question why not spend that money internally where they have complete control of the direction of the project and where only they (rather than their competitors) will get the benefit from it.

That's not to say that what you say isn't workable, just that it's not aligned with much default corporate thinking which makes it somewhat less likely.

mattmanser• 12 years ago

That happened already, like 4 days ago:

http://arstechnica.com/information-technology/2014/04/tech-g...

ilaksh• 12 years ago

Right but the amount 3.9 million to support not only OpenSSL but multiple other projects is so miniscule relatively speaking it is astounding. This "civilization"s priorities are so ludicrous. 3.9 million is probably a tiny fraction of the amount Google earned through ads selling blowjob videos last year.

celebril• 12 years ago

No mention of Steve Jobs?

Disappointed.

Everybody knows that Apple's OS X is the most advanced and secure OS.

If Steve Jobs isn't one of the people who are responsible for protecting the Internet I don't know who else is.

socrates1998• 12 years ago

Honestly, I don't get why super talented people work for free.

I haven't worked on any open source projects, so maybe that's why I don't get it, but it just seems that developers often devalue themselves too much.

You see it all the time. Business "idea" types come in and supply the "idea", while developers do all the work and don't get paid enough.

I just wish as an industry, developers would stand up for themselves more. I see good, smart and talented people getting walked over too much.

oxalo• 12 years ago

I think being genuinely talented at something usually comes with an inability to sell oneself. The super talented types enjoy solving problems and learning complex things much more than they care about making money, and probably doubt their own ability.

cmyr• 12 years ago

There are a lot of really interesting problems and projects in the world that nobody is interested in paying for. If you want to do these interesting things, you have to do it outside of the marketplace.

Alternatively, there is a trade-off in selling your labour in the marketplace: you are no longer in a position to dictate the terms of your labour, and you potentially lose control over the product of your labour.

hackuser2• 12 years ago

Honestly, I don't get why super talented people work for free.

In some cases it's a better way of accomplishing what you want than doing it for money. If you want to give people more security, for example, you'll probably get a wider audience and more impact with FOSS software.

Should Tim Berners-Lee have charged for his new idea? You might not be reading this in a web browser if he did.

hackuser2• 12 years ago

Have you ever tried inventorying the free software you use and paying a fair price for it?

I looked into it for a small IT business. For one thing, the list was very long, longer than I expected; just consider browser extensions. For another, inventorying the free software and especially making all those small payments is very time-consuming. Finally, the costs add up. Given the money and especially time involved in paying, I wouldn't be using a lot of these programs (again, think of browser extensions).

I know micro-transactions aren't a new idea, but our payment system is a debilitating bottleneck; transactions are far too slow for the speed at which I can obtain new products. What happened to micro-transactions?

The Internet Is Being Protected By Two Guys Named Steve

Related Stories