[39778] in Cypherpunks
Re: NSA and Netscape Crack
daemon@ATHENA.MIT.EDU (Christian Wettergren)
Thu Sep 21 14:48:39 1995
To: jsw@neon.netscape.com (Jeff Weinstein)
Cc: cypherpunks@toad.com
In-Reply-To: Your message of 21 Sep 1995 05:04:58 GMT.
<43qrpq$gd5@tera.mcom.com>
Date: Thu, 21 Sep 1995 10:35:00 -0700
From: Christian Wettergren <cwe@Csli.Stanford.EDU>
| Believe it or not we don't like being trashed for
| being stupid all over the net, print media, and TV. As far as I know
| the NSA have not given us any advice about how to make our system
| stronger. I've heard rumors that they were quite upset when they
| learned that SSLs 40-bit RC4 was actually 40-bit secret and 88-bit salt.
It is dangerous that the general reaction is that of
'them being stupid', since that will prevent others
from stepping forward and reveal their own 'holes'.
I decree that 'all holes look stupid once located'.
But 'any non-trivially large program is bound to have
holes' => 'all programmers are stupid' (except me,
because I found the hole?)
Jeff, your and Netscape prompt response to this is
what counts - holes will always be uncovered, it's the
time before they are patched that really matters.
/Christian
