Discussion:
Anelok: OTF proposal
Werner Almesberger
2015-11-03 21:37:26 UTC
Permalink
During the last days, Dave and I
have prepared a proposal and I've submitted it just now.
OTF have reviewed our proposal. Unfortunately, they rejected it.

I'm asking for permission to post the review here. Also, Dave and
I are preparing a response to the review results.

To be continued ...

- Werner
Paul Boddie
2015-11-03 23:56:48 UTC
Permalink
Post by Werner Almesberger
During the last days, Dave and I
have prepared a proposal and I've submitted it just now.
OTF have reviewed our proposal. Unfortunately, they rejected it.
I'm asking for permission to post the review here. Also, Dave and
I are preparing a response to the review results.
To be continued ...
I guess you read this...

"""
We did not get the OTF grant.

This was quite upsetting, not because we need the money (which we do), but
because the rejection was justified by an incredibly flawed interpretation of
our application. I am obviously not impartial enough to accurately judge
whether that was our fault for communicating poorly, or their fault for not
reading it carefully enough - but being rejected based on a misunderstanding
is incredibly frustrating.
"""

https://www.mailpile.is/blog/2015-10-19_Major_UI_Updates.html

It would be interesting to read the review, perhaps because we might get a
feeling for what the reviewers feel is worthy in this day and age, and also
because we might be able to play the game of "identify the reviewers", who
might be anonymous but may still be picked from the team members listed on the
OTF site.

Maybe they think that password and credentials management is a solved problem,
which could certainly be argued if the solution involves a relatively small
number of people coping, with everyone else struggling in the curated anarchy
delivered by policies providing mere damage limitation for businesses and the
denial of online privacy and safety for everybody else.

Paul
Werner Almesberger
2015-11-09 13:48:18 UTC
Permalink
Post by Paul Boddie
It would be interesting to read the review,
Waiting for a response to the request for permission to publish
it.

The review has mostly negative points. Let me paraphrase them:

1) not clearly within OTF's purview,
2) we didn't explain how we plan to achieve market dominance,
3) we didn't explain in detail what users are doing wrong today
and how that would change,
4) our cost and time estimates look reasonable, but
5) it's not clear how the project would sustain itself.

1) is indeed a valid concern, especially since Open Hardware is
still something new, so even if it meets the objectives of some
funding program, it may simply not have been considered when
defining the details.

2) sounds like an exaggerated criticism, and aiming to create a
monopoly and thus monoculture sounds like a rather dangerous
proposition when it comes to security.

3) also seems exaggerated, given that what we submitted was a
"concept note", not a doctoral thesis.

4) phew :)

5) is a fair point. We mentioned that the next step would be
crowdfunding but didn't talk about what's beyond. But then, the
form for the concept note didn't ask about a business plan or
sustainability considerations, so I expected such questions to
be raised at a later point. Besides, they could just have asked.

To sum it up, I'd consider 1) the weak spot of our proposal. We
can try to suggest why it may fit despite outward appearances,
but we can't demand that they widen their scope for us. The
other points all seem a little unfair and shall be challenged.
Post by Paul Boddie
perhaps because we might get a
feeling for what the reviewers feel is worthy in this day and age,
The folks over at the Core Infrastructure Initiative (sounds
like what's before been at OTF. Did they move ?) have a brief
but interesting discussion here:

http://lists.coreinfrastructure.org/pipermail/cii-discuss/

There, the main point is sustainability. So the beancounters
may have a lot of weight in the discussion, which may not be a
bad thing in this case. This echoes point 5) from the review.
Post by Paul Boddie
Maybe they think that password and credentials management is a
solved problem,
Yes, the review mentions that there are other password managers
and tokens, so this may indeed be considered a "solved" problem.
As if ... :-)

- Werner
Paul Boddie
2015-11-17 22:24:38 UTC
Permalink
Post by Werner Almesberger
Post by Paul Boddie
It would be interesting to read the review,
Sorry for the delay in responding, by the way!
Post by Werner Almesberger
Waiting for a response to the request for permission to publish
it.
1) not clearly within OTF's purview,
2) we didn't explain how we plan to achieve market dominance,
3) we didn't explain in detail what users are doing wrong today
and how that would change,
4) our cost and time estimates look reasonable, but
5) it's not clear how the project would sustain itself.
1) is indeed a valid concern, especially since Open Hardware is
still something new, so even if it meets the objectives of some
funding program, it may simply not have been considered when
defining the details.
I guess they want stuff that gets deployed surreptitiously within
dictatorships, not stuff that keeps the average American safe from criminal
exploitation (amongst other things).
Post by Werner Almesberger
2) sounds like an exaggerated criticism, and aiming to create a
monopoly and thus monoculture sounds like a rather dangerous
proposition when it comes to security.
Indeed.
Post by Werner Almesberger
3) also seems exaggerated, given that what we submitted was a
"concept note", not a doctoral thesis.
I'll come back to this in a moment.
Post by Werner Almesberger
4) phew :)
:-)
Post by Werner Almesberger
5) is a fair point. We mentioned that the next step would be
crowdfunding but didn't talk about what's beyond. But then, the
form for the concept note didn't ask about a business plan or
sustainability considerations, so I expected such questions to
be raised at a later point. Besides, they could just have asked.
Indeed.
Post by Werner Almesberger
To sum it up, I'd consider 1) the weak spot of our proposal. We
can try to suggest why it may fit despite outward appearances,
but we can't demand that they widen their scope for us. The
other points all seem a little unfair and shall be challenged.
If you had said that it's for people living in dictatorships unaligned with US
interests (if I may be cynical for a moment), then maybe the attitude would
have been rather different.
Post by Werner Almesberger
Post by Paul Boddie
perhaps because we might get a
feeling for what the reviewers feel is worthy in this day and age,
The folks over at the Core Infrastructure Initiative (sounds
like what's before been at OTF. Did they move ?) have a brief
http://lists.coreinfrastructure.org/pipermail/cii-discuss/
There, the main point is sustainability. So the beancounters
may have a lot of weight in the discussion, which may not be a
bad thing in this case. This echoes point 5) from the review.
Sustainability has multiple aspects, as we all know. Keeping yourselves funded
so that you see things through to completion is just one of those. I think the
open hardware aspect, where other people can make sure that the dream lives
on, is another.
Post by Werner Almesberger
Post by Paul Boddie
Maybe they think that password and credentials management is a solved problem,
Yes, the review mentions that there are other password managers
and tokens, so this may indeed be considered a "solved" problem.
As if ... :-)
I was reading Which? magazine again recently (it's like the UK version of
Consumer Reports, I guess), and in their exposé of bad Internet banking
practices, they singled out password strength testing as something various
banks weren't doing, thus getting them deductions from their eventual
percentage-based scores. However, I didn't see any mention of people managing
strong passwords using password managers, which means that this problem isn't
even on their radar yet. *That* is how close this is to being a "solved"
problem.

Paul

P.S. Another thing that came up about banks was that they weren't necessarily
using their special code generator gadgets as much as they perhaps should have
been. I came away from all of this being fairly unsurprised that UK banks seem
to be common "phishing" targets.
Werner Almesberger
2015-12-03 01:46:03 UTC
Permalink
Post by Paul Boddie
I guess they want stuff that gets deployed surreptitiously within
dictatorships, not stuff that keeps the average American safe from criminal
exploitation (amongst other things).
Yes, I suppose there could be an agenda of this sort.
Post by Paul Boddie
I think the
open hardware aspect, where other people can make sure that the dream lives
on, is another.
Yes, I think the large degree of vendor/manufacturer/designer/developer
independence of Open Hardware is a unique and important proposition that
is often given too little attention. The challenge is to successfully
use it for marketing advantage.
Post by Paul Boddie
P.S. Another thing that came up about banks
Well, the cool new thing seem to be those two-factor "soft tokens"
running on smartphones. What could possibly go wrong ? :-)

- Werner
Paul Boddie
2015-12-03 13:02:35 UTC
Permalink
Post by Werner Almesberger
Well, the cool new thing seem to be those two-factor "soft tokens"
running on smartphones. What could possibly go wrong ? :-)
It's certainly worth considering what these solutions actually offer. My
impression is that the phones have some kind of hardware unit for storing keys
in a similar manner to smartcards [1] - it could well be the SIM that provides
this, given the relationship between SIM and smartcard technologies - and that
phones use this mechanism to issue tokens [2].

All of this from a quick tour of Wikipedia based on previous assumptions and
memories. ;-)

Paul

[1] https://en.wikipedia.org/wiki/Smart_card
[2] https://en.wikipedia.org/wiki/Security_token
Bas Wijnen
2015-12-03 15:42:17 UTC
Permalink
Post by Paul Boddie
Post by Werner Almesberger
Well, the cool new thing seem to be those two-factor "soft tokens"
running on smartphones. What could possibly go wrong ? :-)
It's certainly worth considering what these solutions actually offer. My
impression is that the phones have some kind of hardware unit for storing keys
in a similar manner to smartcards [1] - it could well be the SIM that provides
this, given the relationship between SIM and smartcard technologies - and that
phones use this mechanism to issue tokens [2].
Even if it looks great on paper, there is always the issue that phones are
among the biggest targets of the NSA, as far as I know. They're almost
certainly filled with backdoors. I would expect the same to happen to any
significant crypto device that gets sold in the USA, though.

Thanks,
Bas

Loading...