Re: library/binding for sftp?

["Randy Brukardt" <randy@rrsoftware.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2162 bytes --]

"Björn Persson" <bjorn@xn--rombobjrn-67a.se> wrote in message 
news:20130808133709.09dfef98@hactar.xn--rombobjrn-67a.se...
Dmitry A. Kazakov wrote:
>> Firstly, there is no protection against targeted attack. Secondly,
>> regarding spies, they aren't any good in programming. Obscuring is
>> the best method against unfocused surveillance which works only with
>> known protocols.
>
>Four false statements in a row.

There are only three here, and the first is generally accepted as true (see 
below).

>Dmitry isn't going to change his mind so I won't debate this with him
>further, but to everybody else: Don't listen to Dmitry. He doesn't
>understand basic information security and is giving dangerous advice.

Then you better debate it with me, because at least part of Dmitry's advice 
matches what I would give.

Everything I read about security says that there is "no practical defense 
against a determined attacker". That's a bit more nuanced than Dmitry's 
statement, but it's repeated all of the time by the security experts I read. 
You might be able to stop such an attack by unplugging all of your internet 
connections and shutting down all of your computers, but even that isn't 
certain. And who can do that for long?

And Dmitry's point about spies (like the NSA) using "known protocols" is 
certainly true. They are much less likely to generally monitor what they 
don't know about. Of course, if they are targetting you directly, see 
statement 1.

Honestly, your attitude is dangerously naive. Probably the best strategy of 
all is to have no secrets that need protecting, as in today's environment 
you should assume all information is being read (or could be read) by 
someone.

When RRS was doing business with the NSA back in the 1980s, we used to 
occassionally talk to the light fixtures to remind ourselves of the 
possibility of survialence. We thought it was reasonably likely that we were 
spied upon even then, and it's 100 times easier today (we didn't have a 
network - we used sneaker-net - and weren't connected to any public network 
until we started working on Ada 9x).

                                              Randy.