You've misread Patrick's messages to spectacular effect, leaving me with the impression that you were simply champing at the bit to jump at him and his silly bingo card site.

Tor chose world governments as their adversary, and if $1MM was all it took to buy unmasking of users, they failed. That's important information, and regardless of CMU's ethics (and I think this was an ethical lapse), the revelation that there is or was a flaw of that scale is a service to the Internet.

While his passion for the issue has made his message more aggressive than you'd like, don't dismiss his claim because you believe he's just full of piss and vinegar. Looking past the totally unrelated arguments about his identity, I don't have any difficulty believing what he's said. I know several folks in American academia who have stated unequivocally that the amount of computing power and data analysis ability available to them would make Dr. Evil blush.

Let's be honest and set emotional responses and character assault aside here. If you take the emotion out of what he said, can you honestly say the rest of it is bullshit? It rings true to me, and he's right: if academia, which is generally held by the public to be above the sort of cloak and dagger stuff that happened with Tor, lost its way and tossed their ethics out the window ... Well, that's a Bad Thing in ways we can only begin to understand. Who's left for us to trust?

I don't even think I disagree with the second part of 'AMEDICALRe's root comment. But of course, that comment has very little to do with what Patrick actually said. Patrick is responding to the fact that an anti-surveillance tool that chose as its adversaries all the world's governments was broken for a sum of money any angel investor in SFBA could have coughed up.

http://www.bloomberg.com/news/articles/2015-09-22/russia-s-p...

I don't understand what you're trying to say. Surely, if the primary intention of Tor is to protect users from persecution by nation-states, then their adversaries are world governments?

perhaps nitpicking, and a bit tangential to this debate, but I can't imagine the $1m on its own would be enough to break it.

I imagine they have some fairly beefy research budget with an existing infrastructure with a substantial computing power and prior research experience to begin with. So quite a tall giant to stand on. If I had to guess, the $1m was only there to cover time spent on this very specific task at hand, and for allocating researchers' time away from other tasks...

Right on all points regarding Tor's failures, except this above is the crux of the problem. Specifically, that the researchers did NOT disclose this to either the Tor project or the broader security community. They disclosed it to the Feds, pulled their presentation, and sat on it presumably forever until third parties smelled something fishy.

Patrick and you are correct in your criticism of the criticism, but the fact that academic security researchers have become obsequious functionaries to state power is a MUCH larger issue here, so much so that you are arguing at completely orthogonal purposes to many of us.

My guess is that this orthogonality is lost on AMEDICALRe, and theirs on you.

No, the big story here is that Tor was broken for a pittance. But that story is a lot less fun than demanding scalps from CMU, because it suggests that you might not in fact be able to thwart national SIGINT agencies with volunteer open source projects, and we nerds demand a monopoly on technological skill.

That was my prediction and take-away from this. I've constantly warned against relying on Tor to stop nation-states. It's requirements, especially synchronous and performance, make the anonymity goal ridiculously difficult.

That the attacks are still so inexpensive is more disturbing. Opens up doors to non-nation-state attackers that have money and connections to smart people.

They're not anonymized?

When I'm asked to provide data to medical researchers it also has to be anonymized.