Title: I was recently reading reddit &#x2F;r&#x2F;netsec, about the New York Times using WebRTC to gather local&#x2F;vpn ip&#x27;s (Thanks to Dan Kaminsky).<p>http:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;netsec&#x2F;comments&#x2F;3dgwee&#x2F;how_the_new_york_times_uses_webrtc_to_gather&#x2F;<p>https:&#x2F;&#x2F;webrtchacks.com&#x2F;dear-ny-times&#x2F;<p>In that thread, I noticed something very interesting, that apparently one of the same guys involved in the NSA backed Pentagon paper touting Extended Random on top of Dual Elliptic Curve, Eric Rescorla, is now working at Mozilla, and has some say in keeping the WebRTC setup in Mozilla working like it is.<p>https:&#x2F;&#x2F;bugzilla.mozilla.org&#x2F;show_bug.cgi?id=959893<p>http:&#x2F;&#x2F;www.reuters.com&#x2F;article&#x2F;2014&#x2F;03&#x2F;31&#x2F;uk-usa-security-nsa-rsa-idUKBREA2U0U620140331<p>So far any attempts to get a comment out of Mozilla about hiring someone who was known to participate in weakening crypto has been met with silence as far as I can tell.<p>The question that this brings up in my mind is what should companies and communities built around those companies do with programmers who have been involved in such subversions? It&#x27;s entirely possible Eric Rescorla was unaware of the purposeful weakening proposed in the 2008 paper, and that it was the NSA contributor who performed this function, but the fact that Mozilla declines to comment on the matter and that this is a person who has quite a bit of say over a very commonly used browser raises concern.<p>As leaks like Snowdens become more and more prevalent, how should programmers who have been known to be potentially hostile to user privacy or other user concerns be treated, both by the community and by the companies that employ them?
Upvote: