Are non-sequiturs always malicious? For example, suppose you have a news site, and it has a story about Ukraine, followed by a story about school shootings. Even if two links next to one another are unrelated, that doesn't prove that they're not genuine.
Alex Oh worked for a law firm which represents Exxon. That law firm was accused of obstructing a deposition to avoid providing answers to the other side. [1]
>ORDERS defense counsel to show cause by May 14, 2021 why sanctions should not be imposed under Rule 11 (b)(3) for alleging that plaintiffs' counsel was agitated, disrespectful, and unhinged during the deposition despite a lack of record evidence supporting those allegations. See Mem. Op. 29-31.
>ORDERS defendants to serve a copy of this order on Ms. Oh.
Was Alex Oh specifically responsible for this conduct? The order doesn't say.
What does this have to do with Clinton? Nothing, except in a six-degrees-of-kevin-bacon sense.
Believe it or not, I was already aware of all of those things, having followed a number of criminal defense blogs.
If you read the article and appellate decision which is linked, it says what I just said:
>On Wednesday, the appellate court sided with the defense [PDF] and sent the case back to a lower court directing the judge to compel Cybergenetics to make the TrueAllele code available to the defense team.
The prosecutor isn't unilaterally deciding whether the DNA evidence is valid. There will be a public hearing where both the prosecution and defense show evidence about the validity of the DNA evidence, and a court will rule based on that evidence.
>My prediction: this firm will probably try to get removed from the case, rather than open source their shitty code.
That isn't necessarily their choice. The prosecutors will make the decision about whether to withdraw the DNA evidence. They probably won't, given that they would need to give the defendant a new trial, which could lead to an accused murderer getting off. A bad look for any prosecutor.
More to the point, if the firm withdraws from any case where their credibility is questioned, what does that say to law enforcement agencies who are thinking about using their software?
>First, the client makes an unauthenticated request to the server to retrieve the password salts associated with the username. If no user is found, an error is returned to the client. If a user is found, the server sends the client the user's password salt and password token salt, which the client uses to rebuild the password token. The password token is then passed to the server for authentication. To prevent brute force password guesses, clients get 25 incorrect attempts in a row before the server locks the user out of their account for 24 hours (Note we are aware this introduces a DoS vulnerability. Our first priority is to protect user data. We plan to implement a more sophisticated lockout mechanism in the future).
Hang on, so the process of retrieving the salt gives the remote client information about whether the user exists? Doesn't this mean that an attacker could take a list of possible usernames, and confirm which of them are using your service?
Seems like you could return a salt even when the user doesn't exist, and that would prevent this information disclosure.
The article also suggests that COVID was maybe an inside job, and that it's unpatriotic to follow health restrictions. (Not in exactly those words, but it warns about "acquiescing" to government restrictions.)
This doesn't seem to work that well. If you type invalid syntax, like '.[' then the window suddenly resizes to accomodate the error message, but not all of the text boxes resize.
>It's therefore trivial to have both protocols coexist, even on the same UDP port, without any negotiation whatsoever. You simply need to discard packets that don't decrypt, which is what WireGuard already does.
If both ends will automatically fall back to v1, how do you prevent protocol downgrade attacks? An adversary dropping v2 packets looks exactly like the other end not supporting v2 packets.
>It's dangerous to include a downgrade-capable negotiation in your VPN protocol.
I agree. It's a hard problem to solve. But it's going to have to be solved eventually.
>In contrast, a hypothetical WireGuard protocol v2 can offer just two suites, the old one and the new one, with simple advice: use the new one if you can, and allow the old one for old nodes until they’re upgraded. There’s nothing unusual about this, except you don’t need to be a cryptography expert to configure it.
I don't think this is going to be as simple as the author thinks. Look at Git's migration away from SHA1. There was no designed mechanism for switching hash functions, and lots of code assumed 20-byte hashes. Three years after the first SHA1 collision was discovered, Git has not switched to a new hash function. I don't mean to be alarmist - no one has created a practical attack on Git objects, but the time to switch cryptographic primitives is when they start showing weakness, not after they are definitely broken.
IPSec has a standard method for supporting multiple cipher suites, and negotiating a common suite. It might be very complicated, but we have no way of comparing it to WireGuard, because WireGuard doesn't implement the same feature.