Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

nytimes.com

Post reply on HN
Print view View original

91–100 of 130 posts

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#91

Post by Evgeny »

discardorama wrote: post #41
Evgeny wrote: post #5

A few weeks later, he and other VKontakte executives folded 5000-ruble notes — worth about $155 at the time — into paper airplanes and threw them out an office window, sparking a fight in the street below. I'm wondering if that can be qualified as "mean". Doesn't look like a nice thing to do. I also can't see what was the motivation other than "Look, I'm rich".

Is this significantly different from that guy who goes around putting gold coins in Salvation Army buckets?

I'm not sure what you mean, but what I meant was that if you're throwing money into the crowd, you should expect people to start fighting for it. In Russia, at least, but I'm sure in many other countries too. I don't think donating to Salvation Army starts any physical fights.

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#92

Post by alex_sf »

darkhorn wrote: post #73
alex_sf wrote: post #63

Earlier quoted context omitted.

Do you realize who you're replying to?

Yes, to the/a guy who is developing a security application which works only with Android. But can you tell me how can you communicate over TextSecure when your friends are using iOS. Also how can you be so sure about your privacy when TextSecure is located/developed at the USA? http://en.m.wikipedia.org/wiki/Open_WhisperSystems

Yeah, no, you clearly don't know who you're replying to.

http://en.wikipedia.org/wiki/Moxie_Marlinspike

If there's one person that I would trust with my privacy, it's Moxie.

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#93

Post by 01Michael10 »

darkhorn wrote: post #73
alex_sf wrote: post #63

Earlier quoted context omitted.

Do you realize who you're replying to?

Yes, to the/a guy who is developing a security application which works only with Android. But can you tell me how can you communicate over TextSecure when your friends are using iOS. Also how can you be so sure about your privacy when TextSecure is located/developed at the USA? http://en.m.wikipedia.org/wiki/Open_WhisperSystems

Does anyone remember when Hacker News didn't have so many trolls?

Gee, sorry TextSecure is not on your platform of choice yet...

I can think of worse things then something being located/developed in the USA...

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#94

Post by smtddr »

electic wrote: post #89
sdevlin wrote: post #68

Earlier quoted context omitted.

Source code doesn't really matter as much as you'd think. In fact, it can be deceptive in some cases. I would call source code a nice-to-have. In contrast, observing the network traffic, debugging the application, and examining the decompiled binary will tell you exactly what's going on.

Telegram bashing aside, this is very wrong. It is always better to have the source code to inspect the entire package. Without the source code, there is no way to fully verify the security of a solution. For Telegram and WhatsApp, the clients and server code should be released if you want to make sure.

No, you're wrong.

People can give you whatever source code they want. That doesn't meant it's the same as what's running in production. While this is tin-foil-hat paranoia, when it comes to encryption software in this post-snowden world it is definitely more reliable to reverse-engineer the binary & network traffic than to just believe the provided source-code to encryption in a popular social app. Or compile the app from source that has been verified by trusted people. Definitely not believing that a binary blob running on your hardware is the same as the provided source.

That said, it's also good to ask for source code so later on when reverse-engineering shows something different you've now caught the offending party in a lie; which is something good to have on record to refer to later on.

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#95

Post by wglb »

electic wrote: post #89
sdevlin wrote: post #68

Earlier quoted context omitted.

Source code doesn't really matter as much as you'd think. In fact, it can be deceptive in some cases. I would call source code a nice-to-have. In contrast, observing the network traffic, debugging the application, and examining the decompiled binary will tell you exactly what's going on.

Telegram bashing aside, this is very wrong. It is always better to have the source code to inspect the entire package. Without the source code, there is no way to fully verify the security of a solution. For Telegram and WhatsApp, the clients and server code should be released if you want to make sure.

this is very wrong: No, it is quite correct. It is slightly more convenient to have the source code, But then again, it can be misleading, as you don't know if that source code is actually corresponding to the binary that is actually executing.

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#96

Post by walshemj »

osipov wrote: post #8
michaelhealy wrote: post #6

Pavel seems to be a great person, building a gift to society & mankind. He puts the users/people before himself, stands behind their rights and believes in strong ideals such as freedom of speech and privacy. I don't think you can say the same about many other internet companies/services. If you look at his previous company VK. It is by far a superior experience to Facebook, given how intuitive, fast and sleek it is.…

Pavel is widely seen by the Russian developer community as a sort of a douchebag who flaunts his wealth in ways that would seem crass to someone from Silicon Valley. Just look at the guy throwing paper planes made from money at a crowd of onlookers: http://youtu.be/2pxTpFqX6rI?t=25s

Flaunting your wealth in ways that other Russians think crass now that is impressive :-)

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#97

Post by huhtenberg »

sdevlin wrote: post #68
tonymon wrote: post #64

Earlier quoted context omitted.

But how you can be sure about that if WhatsApp code is not opensourced? Telegram has at least iOS and Android code opensourced.

Source code doesn't really matter as much as you'd think. In fact, it can be deceptive in some cases. I would call source code a nice-to-have. In contrast, observing the network traffic, debugging the application, and examining the decompiled binary will tell you exactly what's going on.

The thing is however that any cryptosystem can be trivially compromised by making its PRNG predictable.

This cannot be caught by observing the network traffic and it is really hard to catch by reversing or tracing the binary. Especially if the compromise is not an outright srand(0), but an algorithmic weakness. Then, even if it is found, then it's virtually impossible to determine whether it was benign or deliberate. Now further consider the implications if an app uses a 3rd party PRNG such as those supplied by the operating system or the hardware or if it gets its PRNG seed data from an inherently untrusted sources (such as the OS).

I mean ... the source code being open is obviously irrelevant to the security of a pre-built binary and the adherence to the open specs is not much of an assurance either, because of the PRNG angle. In practical terms it really means that you have to have trust in a product vendor. Period. Because there is always a way for them to screw you over and to get away with it.

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#98

Post by sdevlin »

huhtenberg wrote: post #97
sdevlin wrote: post #68

Earlier quoted context omitted.

Source code doesn't really matter as much as you'd think. In fact, it can be deceptive in some cases. I would call source code a nice-to-have. In contrast, observing the network traffic, debugging the application, and examining the decompiled binary will tell you exactly what's going on.

The thing is however that any cryptosystem can be trivially compromised by making its PRNG predictable. This cannot be caught by observing the network traffic and it is really hard to catch by reversing or tracing the binary. Especially if the compromise is not an outright srand(0), but an algorithmic weakness. Then, even if it is found, then it's virtually impossible to determine whether it was benign or deliberate.…

All of these points are orthogonal as to whether source code is required for a security audit.

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#99

Post by trhway »

ajuc wrote: post #3

> 67 years ago Stalin defended from Hitler his right to suppress Soviet people Great quote.

it isn't a great quote. It gives way too much credit to Stalin in typical manner of idolizing him even if Durov may consciously have not intended to do it. Just like a pretty much any Russian he couldn't resist it subconsciously. (note : i'm a Russian)

Re: Once Celebrated in Russia, Programmer Pavel Durov Chooses Exile

#100

Post by thanksgiving »

wglb wrote: post #95
electic wrote: post #89

Earlier quoted context omitted.

Telegram bashing aside, this is very wrong. It is always better to have the source code to inspect the entire package. Without the source code, there is no way to fully verify the security of a solution. For Telegram and WhatsApp, the clients and server code should be released if you want to make sure.

this is very wrong : No, it is quite correct. It is slightly more convenient to have the source code, But then again, it can be misleading, as you don't know if that source code is actually corresponding to the binary that is actually executing.

Open sourcing/Making available for inspection the source code of an application is not enough if the herd just uses the pre built binaries instead of compiling it themselves. Perhaps we can someday have free and open source software with reproducible builds[0]?

[0] https://wiki.debian.org/ReproducibleBuilds

Post reply on HN