[linkregister]

It might sound blasphemous but I (as a non-expert in crypto) would be satisfied if either you or Bruce didn't cite their writing about crypto.

Yes, appeal to authority and all that, but I don't have time to fully learn a field to find out if a cryptographer is mistaken.

Also, the point I was making is that if he wants to leave work uncited, it should at least be the work he has actual credibility in.

[SilasX]

Citations aren't simply about "is this valid?", but about enabling others to audit the basis of the clais -- was the author they saying it based on their more nebulous "general expertise" (speaking ex cathedra), or were they relying on the credibility of other source? If the later, that makes it easier to fix when the same error was propagating through several sources to the point that became common knowledge.

(Interestingly enough, that sounds like a point Schneier would make :-p )

In fact, there's a general problem in belief updating (Bayesian or otherwise) where you may over-credit others' opinions by treating them as independent when they were both actually relaying the same data point. You can only detect this error if you can inspect the source of those opinions.

[tptacek]

Ngah. No. You should definitely want references from me, too!

[linkregister]

On second thought, I do want references. I thoroughly enjoy watching you and other cryptographers arguing on HN. Especially when the topic of DNSSEC comes up.

[AnimalMuppet]

That works for you, but on the subject of security, tptacek is on a different level than most of the rest of us. It's perfectly valid for him to say that he wants to see Schneier's references, and for you to say that you will take it on trust from either of them.

> Also, the point I was making is that if he wants to leave work uncited, it should at least be the work he has actual credibility in.

A totally valid point. Way too often, people smuggle credibility from an area where they have expertise (and therefore deserve the credibility) to areas where they don't. In this case, though, the real credibility is Schneier's honesty, not his expertise, since he's passing on (obscured) reports from others.

[linkregister]

My point is that his honesty is actually not existent, as it has been tainted by his provably incorrect speculation from 2013-2016.

I think it's absolutely valid for tptacek to demand citations from Schneier!

[AnimalMuppet]

> My point is that his honesty is actually not existent, as it has been tainted by his provably incorrect speculation from 2013-2016.

What are you referring to here?

And, taking your statement at face value: If he speculated, and was clear that he was speculating, and was wrong, that doesn't destroy his honesty - merely his reputation as a speculator.

[linkregister]

Indeed in my original comment I assert that he speculates without appropriately labeling it as such. Hence, why my viewpoint is controversial on HN. Most HNers believe Mr. Schneier is an authority on computer security. I believe he takes his genuine expertise in cryptography and mistakes it for understanding of computer security that he doesn't actually possess.

His shortcomings are especially apparent when applied to APT, memory corruption, and computer network intrusion/defense.