Dan Geer

Reminds me of a Dan Greer talk he gave at NSA from 2014 http://geer.tinho.net/geer.nsa.26iii14.txt the basic gist is in the event of a cyberwar you could brick millions of peoples routers and their only natural solution would be to go to BestBuy to get a new one... which almost certainly is running a 4-5yr old linux/firmware version that is equally vulnerable. Of course this requires some remote access or lateral entry from other systems on the network, but it's an interesting thought experiment regardless.

> Obfuscation may be our best digital weapon. From Dan Geer's portentous talk "Cybersecurity as Realpolitik"[1][2]: >> Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself. [1] https://www.youtube.com/watch?v=nT-TGvYOBpI [2] http://geer.tinho.net/geer.blackhat.6viii14.txt

This talk by Dan Geer is really great. Worth watching, or reading [1]. [1] http://geer.tinho.net/geer.blackhat.6viii14.txt

More like a theorem. And Dan Geer is totally worth reading. http://geer.tinho.net/geer.rsa.28ii14.txt https://encrypted.google.com/search?hl=en&q=site%3Ahttp%3A%2F%2Fge…

It has been a while since I read it but the first thing that came to mind is this talk by Dan Geer (who is closely connected to US intelligence agencies): http://geer.tinho.net/geer.blackhat.6viii14.txt

It's clear to me that this is nowhere near accurate and I'm not sure why you insist on making these sort of claims. One only has to look at self-driving cars to disprove you. Dan Geer also entirely disagrees with what you wrote [1] [2] and you're no Dan Geer, sorry to say.. [1] http://geer.tinho.net/geer.indiana.19x17.txt [2] http://geer.tinho.net/geer.uncc.5x16.txt

OK when do we restart the software liability discussion? http://geer.tinho.net/geer.blackhat.6viii14.txt https://www.google.com/webhp?sourceid=chrome-instant&ion=1&esp…

You realize that the gTLDs they're selling are not going to work reliably? Single label names always resolve first on the local domain. Except when they don't. This isn't currently a problem because no admin in their right mind would name their servers "com", "org", or "net". It's a tacit convention that's now being broken. I can think of a few security problems this creates, lord knows how many we haven't thought of yet. ICANN is selling names in a namespace they don't control. As Dan Geer puts it, "ICANN has devolved into nothing but a protection racket." http://geer.tinho.net/ieee/ieee.sp.geer.1107b.pdf

> If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers. Source: http://geer.tinho.net/geer.blackhat.6viii14.txt Video: https://www.youtube.com/watch?v=nT-TGvYOBpI&t=36m45s