savara

Some questions I ask myself when reading random posts with grand and important claims on any subject:

Where is this from? Who originally wrote it? Is this text’s origin really a random Facebook post, from a pseudonymous author with a cartoon profile picture and no claim of any serious credentials in the subject at hand? (Whether epidemiology or anything else)

Regardless of the merits of the text’s post (which I do not claim to be able to judge) all evidence has to be analysed for context as well as content. Simple “common sense” claims (with a couple of big words to impress non-epidemiologists like me) are made to debunk the models: where is the evidence rather than rhetoric, even some basic citations, and/or examples of or links to counter-modelling? The post doesn’t even link to the original model files from Imperial that they’re claiming to critique.

It’s perfectly _possible_ that the claims made in this Facebook post are correct, but it doesn’t mean anyone should take this post (and its conclusions) remotely seriously without asking some very robust questions of it.

Sure, I agree -- but that's not what the page claims. It says "insecure protocol versions and choices of algorithms are not supported, by design" -- the protocols and modes that I listed are known to have various insecurities, and it still supports them. I agree that to be useful it's necessary to support old, less secure or even insecure modes, but this is at odds with the above stated goal.

My point is about the imprecise description.

The page claims: "[...] insecure protocol versions and choices of algorithms are not supported, by design",

followed by:

"TLS 1.0, TLS 1.1 and TLS 1.2 are supported", "3DES/CBC encryption algorithms are supported", and "SHA-1 [is supported]"

Sad-face.

I was expecting Big-Oh notation.