I know the authors so I’m aware of the intense amount of responsible disclosure they’ve been doing, and the very substantial behind-the-scenes impact this is having. So maybe the difference is the scope of this, the number of protocols and vendors they were able to detect and attack in one go, and also the way they’re approaching disclosure. In other words they’re being much more systematic in every aspect of the research, disclosure and re-analysis. I expect some people won’t take seriously and there will be more papers in the future.

I mean another way to put this is: maybe there’s a problem if you can say “there’s loads of previous work” and yet massive and systemic problems still exist. Where that problem is (holistic nature of the research or the disclosure process) is probably something you could drill down into. But you’ve basically admitted the previous research didn’t do the job, so all we’re doing is haggling about the price.

>But you’ve basically admitted the previous research didn’t do the job, so all we’re doing is haggling about the price.

it's a poor metric -- research doesn't exist to drive policy, but it does aid in decision making.

There are global policies around the world that make no damn sense from even a basic scientific understanding, with little to no research done.

If some research is done, a policy maker is pointed at it, and the only response is a shoulder-shrug you don't shit-can the research and do it over -- you appoint vocal political types to campaign on the existing research.

I’ve been involved in research that lead to major changes in TLS deployments across the Internet and so I can tell you that (1) research absolute can and should be structured to drive security improvements! You’re crazy if you think that isn’t an important goal. And (2) the way you structure, identify and disclose findings matters a lot when considering how well you achieve this goal.

Just to give an example of effective change-driving work: I would argue that persistent efforts via tools like Shodan and Censys have done a huge amount to clean up the Internet, at least as compared to one-off research efforts followed by “appoint activists to do the rest.” The reason is that companies respond to persistent measurement campaigns in a way that they don’t respond to one-off PR dings.

Most of the research you cite is pretty obscure and you’d have to search for it. Most of it didn’t get a lot of follow-up. When some of the firms with unencrypted backhauls were contacted by the current researchers, they didn’t even know that their backhauls were unencrypted. Finding and communicating this stuff, then following up on it relentlessly is the difference between “we knew and nobody did anything” and “it got fixed.”

Also don’t think for a second the vocal political types can do this work without constant communication from researchers who are willing to continue this work over a period of years.