adrtessier

That statement comes somewhat ironically from a founder that now does not appear to have much of a technology at all.

Agreed. I couldn't figure it out at all without navigating around a bit. Someone with some HTML/CSS ability should attempt to donate some time to fixing this web page's messaging issues to get the product across better, to those technical or otherwise.

> political freedom from authority is only ever won via extreme violence.

Eh, that's the most extreme end. Political freedom from authority is won by having more power, period. That power can come in many forms, but at its most primal can come from having the capability of lethal force. The power of a representative government is supposed to be in being able to vote out those that are destroying you, not in you having to take up arms to solve the issue.

> WEP and WPA are completely different protocols.

Nope, I'm not thinking of WPA/WPA2; I'm just destroyed here by a lack of my own ability to properly communicate things sometimes.

At the high level, "SSL" is a term for an obsolete standard that encrypts connections, protocols be damned, supplanted by the term and the protocol changes that make up TLS. WEP is an obsolete standard for encrypting wireless connections (so is WPA), and WPA2 is the newest version. However, often we'll hear technical and non-technical people talk about how they implement "SSL" even though that's not technically the correct term to use anymore. Rarely do people use "WEP" to mean WPA.

Does that make more sense?

> If you do a lot of network infiltration, these boxes are among the most useful targets; unlike routers running JunOS, the VPN concentrators have a large outside-the-packet-filter attack surface, and everyone runs them.

Don't forget that the newer SRX-series VPN gateways are JunOS-based, and seem to be recommended by most Juniper sales people these days. There are certainly a ton of ScreenOS devices, but Juniper seems to have mostly deprecated them in their messaging.

The primary Juniper security track certifications are JunOS-focused, and there's only a basic specialization available from them for ScreenOS. Juniper has mostly staked their future on JunOS from what I can tell.

Seriously. I can understand non-engineering-types calling SSL "SSL" still, but there's a point at which I will begin to date or discredit people's knowledge of "SSL" if they're still referring to it as such (and not to one of the libraries like polar, open, boring, etc.) I don't generally like being a pedant, but SSL and TLS are different things that attempt to solve the same problem, much like WEP and WPA. Most people don't call WPA WEP anymore.

From p.65:

> Overall, resilient public cyber key terrain could prove a double-edged sword: enabling DoD to project power, both in terms of information as well as cyberspace operations, but also enabling enemies of the United States to do the same, and with a lower barrier of entry than before.

I think you could argue this is a bit what the government already thinks of the Tor Project, although they call it 'loosely decentralized'.

I seriously whether or not politically we will actually head down this path; which each successive government I'm beginning to see the fear that cypherpunk-utopia, anarchocapitalist-style decentralization may bring to nation-states and the risks inherent to some citizens in that process.

From a politician's (very misguided) view of laws solving problems, it's easy to smash the "resilient public cyber key terrain", while still getting the edge of the sword you want (allowing these technologies to provoke unrest in countries you don't like) - you pass laws that ruthlessly enforce the use of Tor et al on your own territory, run a lot of psychological operations against the use of those tools by your citizenry, and then spread the shit out of that same technology through covert channels to everywhere else in the world, for those ballsy enough to be "separatists" in their own countries. The politician will think that assuming a powerful security organization and steep enough penalties domestically, you can probably eke a net benefit out of the technology outside of your nation-state with little downsides within you own.

This leads to a scary way of blunting the edge of the sword that a politician thinks could hurt them domestically, and I'm afraid that perhaps in some ways we're going down that path (RIPA 2000 is a good example of that, any type of forced-key-disclosure type of thing, or any type of key escrow and tying laws to requiring key escrow.) In the end it doesn't really work, but it does shed a lot more blood in the process.

> Why is Juniper using Dual_EC DRBG anyways?

As a follow-on question: was NetScreen using Dual_EC_DRBG before Juniper bought them (and with it ScreenOS?) If so, it might be good to scrutinize the original NetScreen owners and where they are now (hint: They now run Fortinet and Palo Alto Networks. Are they at risk of interesting, compromised security choices, now, too?)

And you're right. Juniper could still have their own e, which renders the security pointless.

I'd like to argue Snowden is as pure as many of us wish he was in this case, but he, too, must unfortunately play the games of the nation-states that are more powerful than him.

Snowden is right in talking about MTProto's issues, and this is a case where he can talk about something both he and the Russian government dislike, albeit for different reasons. It's a fine line to walk to maintain integrity.

Why the statement from Juniper, then? To try to CYA so they don't end up looking as shitty to the community as RSA did post-bribe?

EDIT: The conspiracy theorist in me would say "this is intentional, too." Changing a value to 31 from 32, or adding a single global assignment in a different function, wouldn't be caught on first review most likely, especially since where the '31' is, 31 is also used all over the code to refer to X9.31.

I'm curious: who will they turn to if (when) Yahoo shuts the service down? Bing?

The male:female ratio feels like it's 50:1. It actually is skewed male in the Valley proper.

I am eagerly awaiting the incident report on this, although I find it unlikely we'll ever hear anything more than this from JTAC and friends. If this is the work of an intelligence agency, it will likely be gagged under the guise of "national security" unless there's a press-worthy indictment coming out of it.