Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of zikula.org
	designates 74.125.82.177 as permitted sender)
	client-ip=74.125.82.177; envelope-from=drak@zikula.org;
	helo=mail-we0-f177.google.com; 
MIME-Version: 1.0
In-Reply-To: <20140103054515.GL3180@nl.grid.coop>
References: <52A3C8A5.7010606@gmail.com>
	<1795f3067ba3fcdd0caf978cc59ff024.squirrel@fruiteater.riseup.net>
	<52A435EA.7090405@gmail.com> <201312081237.24473.luke@dashjr.org>
	<CANAnSg2OrmQAcZ+cZdtQeADicH3U29QOgYPfP1AQhOMP6+P1wg@mail.gmail.com>
	<CAAS2fgR0khyJxmz9c2Oc87hOFgiNuiPJuaeugGajdo_EcKEW9w@mail.gmail.com>
	<20131212205106.GA4572@netbook.cypherspace.org>
	<CANAnSg3nPhrk2k=yDKf39AuBQnSuTWJbgANdMhGe=soiOy0NTw@mail.gmail.com>
	<CAAS2fgTmWRMxYweu3sNn_X7grgjUqTQujM-DbZRxG_YMZnD=7g@mail.gmail.com>
	<20140103054515.GL3180@nl.grid.coop>
From: Drak <drak@zikula.org>
Date: Fri, 3 Jan 2014 09:59:15 +0000
Message-ID: <CANAnSg0esEMQ+G=9F2zK6okcewT6NdYBFnXHmyHz8VR4AAp0nw@mail.gmail.com>
To: Troy Benjegerdes <hozer@hozed.org>
Content-Type: multipart/alternative; boundary=047d7b66f9cba9aa3204ef0df7eb
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Dedicated server for bitcoin.org,
	your thoughts?
Precedence: list

--047d7b66f9cba9aa3204ef0df7eb
Content-Type: text/plain; charset=UTF-8

On 3 January 2014 05:45, Troy Benjegerdes <hozer@hozed.org> wrote:

> On Tue, Dec 31, 2013 at 05:48:06AM -0800, Gregory Maxwell wrote:
> > On Tue, Dec 31, 2013 at 5:39 AM, Drak <drak@zikula.org> wrote:
> > > The NSA has the ability, right now to change every download of
> bitcoin-qt,
> > > on the fly and the only cure is encryption.
>
> No, the only cure is the check the hashes. We should know something
> about hashes here. TLS is a big pile of 'too big to audit'. Spend
> a couple of satoshis and put the hash of the source tar.gz and the
> binaries in the blockchain. Problem solved.


Which is why, as pointed out several times at 30c3 by several renowned
figures, why cryptography has remained squarely outside of mainstream use.
It needs to just work and until you can trust the connection and what the
end point sends you, automatically, it's a big fail and the attack vectors
are many.

<sarcasm>I can just see my mother or grandma manually checking the hash of
a download... </sarcasm>

Drak

--047d7b66f9cba9aa3204ef0df7eb
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On 3=
 January 2014 05:45, Troy Benjegerdes <span dir=3D"ltr">&lt;<a href=3D"mail=
to:hozer@hozed.org" target=3D"_blank">hozer@hozed.org</a>&gt;</span> wrote:=
<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-lef=
t:1px #ccc solid;padding-left:1ex">

On Tue, Dec 31, 2013 at 05:48:06AM -0800, Gregory Maxwell wrote:<br>
&gt; On Tue, Dec 31, 2013 at 5:39 AM, Drak &lt;<a href=3D"mailto:drak@zikul=
a.org">drak@zikula.org</a>&gt; wrote:<br>
&gt; &gt; The NSA has the ability, right now to change every download of bi=
tcoin-qt,<br>
&gt; &gt; on the fly and the only cure is encryption.<br>
<br>
No, the only cure is the check the hashes. We should know something<br>
about hashes here. TLS is a big pile of &#39;too big to audit&#39;. Spend<b=
r>
a couple of satoshis and put the hash of the source tar.gz and the<br>
binaries in the blockchain. Problem solved.</blockquote><div><br></div><div=
>Which is why, as pointed out several times at 30c3 by several renowned fig=
ures, why cryptography has remained squarely outside of mainstream use. It =
needs to just work and until you can trust the connection and what the end =
point sends you, automatically, it&#39;s a big fail and the attack vectors =
are many.=C2=A0</div>

<div><br></div><div>&lt;sarcasm&gt;I can just see my mother or grandma manu=
ally checking the hash of a download... &lt;/sarcasm&gt;</div><div><br></di=
v><div>Drak</div><div><br></div><div><br></div></div></div></div>

--047d7b66f9cba9aa3204ef0df7eb--