If you are reading this, you owe your online safety to him
May 1, 2021 1:13 PM Subscribe
Metafilter's own effugas, aka Dan Kaminsky, has passed. He was well known in computer security industry for his work on attacks against DNS (mefi), as well as his work publicising the Sony Rootkit fiasco.
He was one of seven keyholders for the DNSSEC root recovery shard.
An online memorial by Defcon is planned for May 2nd.
The New York Times notes that "in a community known for its biting, sometimes misogynistic discourse on Twitter, Mr. Kaminsky stood out for his empathy."
He passed of diabetic ketoacidosis on April 23rd at the age of 42, at his home in San Francisco.
SFChronicle, NYTimes, Wikipedia.
The New York Times notes that "in a community known for its biting, sometimes misogynistic discourse on Twitter, Mr. Kaminsky stood out for his empathy."
He passed of diabetic ketoacidosis on April 23rd at the age of 42, at his home in San Francisco.
SFChronicle, NYTimes, Wikipedia.
How the fuck can a First World country allow its best and brightest to die from a lack of insulin?
The whole Internet will be less safe without Dan around.
My condolences to his family.
posted by flabdablet at 1:42 PM on May 1, 2021 [22 favorites]
The whole Internet will be less safe without Dan around.
My condolences to his family.
posted by flabdablet at 1:42 PM on May 1, 2021 [22 favorites]
.
posted by May Kasahara at 1:46 PM on May 1, 2021
posted by May Kasahara at 1:46 PM on May 1, 2021
Wow, that SF Chronicle article is great. His mom sounds terrific, as does his grandmother.
And from the Wikipedia article:
. for Dan.
How fortunate we all are that he was among us.
Thank you for posting this, fragmede.
posted by kristi at 1:50 PM on May 1, 2021 [5 favorites]
And from the Wikipedia article:
At various points in his career, Kaminsky shifted his focus to work on projects related to his friends' and family's health, developing an app that helps colorblind people, working on hearing aid technology, and developing telemedicine tools related to AIDS among refugees for Academic Model Providing Access to Healthcare (AMPATH). According to his mother, "he did things because they were the right thing to do, not because they would elicit financial gain."(From the OP: "He was one of seven keyholders for the DNSSEC root recovery shard." Can someone explain the significance of that, and whether someone else will now become the seventh, or if there will just be six now?)
. for Dan.
How fortunate we all are that he was among us.
Thank you for posting this, fragmede.
posted by kristi at 1:50 PM on May 1, 2021 [5 favorites]
How the fuck can a First World country allow its best and brightest to die from a lack of insulin?
I doubt he died of being unable to afford insulin. Managing type 1 diabetes is a fairly complex task, and many people struggle even with full support. I have a relative who's still alive more because of luck than anything else.
.
posted by praemunire at 1:55 PM on May 1, 2021 [11 favorites]
I doubt he died of being unable to afford insulin. Managing type 1 diabetes is a fairly complex task, and many people struggle even with full support. I have a relative who's still alive more because of luck than anything else.
.
posted by praemunire at 1:55 PM on May 1, 2021 [11 favorites]
.
Edit to add this link to background on the DNSSEC keyholders.
posted by novelgazer at 2:06 PM on May 1, 2021 [3 favorites]
Edit to add this link to background on the DNSSEC keyholders.
posted by novelgazer at 2:06 PM on May 1, 2021 [3 favorites]
.
posted by Don.Kinsayder at 2:12 PM on May 1, 2021
posted by Don.Kinsayder at 2:12 PM on May 1, 2021
.
posted by The Bellman at 2:15 PM on May 1, 2021
posted by The Bellman at 2:15 PM on May 1, 2021
.
posted by The Ardship of Cambry at 2:16 PM on May 1, 2021
posted by The Ardship of Cambry at 2:16 PM on May 1, 2021
Managing type 1 diabetes is a fairly complex task
My daughter has it, so I understand that. But given the state of blood glucose monitoring and insulin delivery technology today, what I find hard to understand is how anybody as switched-on as Dan could have wound up dying of ketoacidosis unless deprived of the kind of access to gear and supplies that little ms flabdablet has.
I dunno. Maybe grief and shock are just making me lash about for somebody or something to blame. 42 is way too young.
posted by flabdablet at 2:32 PM on May 1, 2021 [16 favorites]
My daughter has it, so I understand that. But given the state of blood glucose monitoring and insulin delivery technology today, what I find hard to understand is how anybody as switched-on as Dan could have wound up dying of ketoacidosis unless deprived of the kind of access to gear and supplies that little ms flabdablet has.
I dunno. Maybe grief and shock are just making me lash about for somebody or something to blame. 42 is way too young.
posted by flabdablet at 2:32 PM on May 1, 2021 [16 favorites]
.
posted by Silvery Fish at 2:34 PM on May 1, 2021
posted by Silvery Fish at 2:34 PM on May 1, 2021
How the fuck can a First World country allow its best and brightest to die from a lack of insulin?
Per praemunire, it was almost certainly complications of managing his condition rather than a simple lack. I'm not privy to his financials but it's unlikely that he was lacking for funds for health care. Many people in security do not use the cutting edge diabetes biomedical devices because they often have big security issues and someone like Dan had legitimate concern about being targeted.
I only interacted with him in-person once but he radiated positivity and creativity. To borrow from someone else's description of him, he would both help elevate people's skills and talents but also meet them at whatever level they were at without a bit of shaming. The security world has a lot of big egos and Dan had both the intellect and follow-through to lay claim to being one of the greats but wouldn't flaunt it or distain newbies.
After he passed, quite a few people (particularly women and minorities) shared stories of him paying out of pocket to get them to conferences etc. that they couldn't have afforded to go to otherwise because he felt they needed to be there. The vast majority of the stories being told were not of his technical achievements but his empathy and humanity.
He also contributed code and probably money to interactive art projects as well.
Apparently he was trashed here in 2019 because he said that Richard Stallman shouldn't be made homeless, which is frankly not a good look, and serves as a good illustration that writing someone off after reading a few tweets may not be the wisest course of action. The enforced pithiness of the medium can lead to misunderstanding.
posted by Candleman at 2:52 PM on May 1, 2021 [37 favorites]
Per praemunire, it was almost certainly complications of managing his condition rather than a simple lack. I'm not privy to his financials but it's unlikely that he was lacking for funds for health care. Many people in security do not use the cutting edge diabetes biomedical devices because they often have big security issues and someone like Dan had legitimate concern about being targeted.
I only interacted with him in-person once but he radiated positivity and creativity. To borrow from someone else's description of him, he would both help elevate people's skills and talents but also meet them at whatever level they were at without a bit of shaming. The security world has a lot of big egos and Dan had both the intellect and follow-through to lay claim to being one of the greats but wouldn't flaunt it or distain newbies.
After he passed, quite a few people (particularly women and minorities) shared stories of him paying out of pocket to get them to conferences etc. that they couldn't have afforded to go to otherwise because he felt they needed to be there. The vast majority of the stories being told were not of his technical achievements but his empathy and humanity.
He also contributed code and probably money to interactive art projects as well.
Apparently he was trashed here in 2019 because he said that Richard Stallman shouldn't be made homeless, which is frankly not a good look, and serves as a good illustration that writing someone off after reading a few tweets may not be the wisest course of action. The enforced pithiness of the medium can lead to misunderstanding.
posted by Candleman at 2:52 PM on May 1, 2021 [37 favorites]
.
posted by Old Kentucky Shark at 2:58 PM on May 1, 2021
posted by Old Kentucky Shark at 2:58 PM on May 1, 2021
Ketoacidosis can move really fast. I've generally had pretty good access to whatever the latest treatment tools are (and boy, have they come a long way in just my lifetime) and I've still had two episodes so bad that I was told after I came to that my family had been informed not to get their hopes up. And one of the first things they teach you after diagnosis is YDMV - Your Diabetes May Vary. Different people's individual bodies can react to different factors in some pretty unpredictable ways.
That's not to say that there aren't people suffering terribly because of the robber barons making insane profits on insulin. But even people with good insurance and affordable prescriptions aren't immune to potential tragedies.
The world is a worse place without Dan, and I'm grateful for the time we had him.
posted by The Underpants Monster at 3:00 PM on May 1, 2021 [18 favorites]
That's not to say that there aren't people suffering terribly because of the robber barons making insane profits on insulin. But even people with good insurance and affordable prescriptions aren't immune to potential tragedies.
The world is a worse place without Dan, and I'm grateful for the time we had him.
posted by The Underpants Monster at 3:00 PM on May 1, 2021 [18 favorites]
.
posted by of strange foe at 3:19 PM on May 1, 2021
posted by of strange foe at 3:19 PM on May 1, 2021
what I find hard to understand is how anybody as switched-on as Dan could have wound up dying of ketoacidosis unless deprived of the kind of access to gear and supplies that little ms flabdablet has.
I watched a friend's brother die by inches over about a ten year period mainly because he was too absent-minded, absorbed in his work, and cussed to manage his diabetes properly. This happened shortly before the advent of the kind of gear you're talking about (or at least its widespread availability), in the 90s, but I don't think it would have been any different if he had had access to it. Personality seems to be a big factor in successful management.
RIP + thank you, Dan.
posted by ryanshepard at 3:32 PM on May 1, 2021 [4 favorites]
I watched a friend's brother die by inches over about a ten year period mainly because he was too absent-minded, absorbed in his work, and cussed to manage his diabetes properly. This happened shortly before the advent of the kind of gear you're talking about (or at least its widespread availability), in the 90s, but I don't think it would have been any different if he had had access to it. Personality seems to be a big factor in successful management.
RIP + thank you, Dan.
posted by ryanshepard at 3:32 PM on May 1, 2021 [4 favorites]
.
posted by lock robster at 3:43 PM on May 1, 2021
posted by lock robster at 3:43 PM on May 1, 2021
One other paraphrase, this time of Dan. There's no patch that can eliminate human kindness (in the context of doing something like holding a secure door for someone that appears to be struggling, and even if there were, it would be a detriment to the world to use it. Instead, security practitioners should design systems that can enforce needed controls without trying to damage the humans that need to use them.
posted by Candleman at 4:08 PM on May 1, 2021 [14 favorites]
posted by Candleman at 4:08 PM on May 1, 2021 [14 favorites]
.
posted by FallibleHuman at 4:35 PM on May 1, 2021
posted by FallibleHuman at 4:35 PM on May 1, 2021
.
posted by moons in june at 4:37 PM on May 1, 2021
posted by moons in june at 4:37 PM on May 1, 2021
He seems to have been a mensch. He was a technical wizard. I wish he hadn't had diabetes. He was one of the good ones, by all evidence.
.
posted by wenestvedt at 5:16 PM on May 1, 2021 [4 favorites]
.
posted by wenestvedt at 5:16 PM on May 1, 2021 [4 favorites]
.
posted by JoeXIII007 at 5:33 PM on May 1, 2021
posted by JoeXIII007 at 5:33 PM on May 1, 2021
0x01 0x2E
posted by introp at 6:57 PM on May 1, 2021 [1 favorite]
posted by introp at 6:57 PM on May 1, 2021 [1 favorite]
.
posted by Joey Michaels at 7:53 PM on May 1, 2021
posted by Joey Michaels at 7:53 PM on May 1, 2021
I met Dan briefly a couple of times at conferences and I have a very vivid memory of him saying something nice about a project I had worked on - completely unprompted. That memory has stuck with me for over a decade - it seems like such a small thing (probably a thirty second conversation) but every time I've seen his name I thought back to that, and it inspired me to say nice things to people about their work since then.
Everything I've read about him in the past few days has reinforced the impression I got in that moment - he was kind, generous, empathetic and spread good feelings everywhere. What an inspiring way to live.
posted by simonw at 7:59 PM on May 1, 2021 [12 favorites]
Everything I've read about him in the past few days has reinforced the impression I got in that moment - he was kind, generous, empathetic and spread good feelings everywhere. What an inspiring way to live.
posted by simonw at 7:59 PM on May 1, 2021 [12 favorites]
I tweeted with Dan a few times and tested his colorblind helper app, cleverly named DanKam, and he always just seemed like the rare combination of brightest and kindest guy in the room.
posted by jrishel at 8:27 PM on May 1, 2021 [2 favorites]
posted by jrishel at 8:27 PM on May 1, 2021 [2 favorites]
.
Holy shit. This make me so sad - what a fucking legend.
I remember in 2004 lining up outside in the crazy late July Las Vegas midday heat to sit in a stupidly hot tent at the Alexis Park for Defcon 12 watching his Black Ops of TCP/IP talk. Voice over DNS! SSH over DNS! Cats living with dogs!
Dan was amazing. Having a beer for him tonight. I hope he’s somewhere getting up to some sweet sweet hacking mischief with Barnaby Jack in the afterlife.
posted by inflatablekiwi at 8:46 PM on May 1, 2021 [4 favorites]
Holy shit. This make me so sad - what a fucking legend.
I remember in 2004 lining up outside in the crazy late July Las Vegas midday heat to sit in a stupidly hot tent at the Alexis Park for Defcon 12 watching his Black Ops of TCP/IP talk. Voice over DNS! SSH over DNS! Cats living with dogs!
Dan was amazing. Having a beer for him tonight. I hope he’s somewhere getting up to some sweet sweet hacking mischief with Barnaby Jack in the afterlife.
posted by inflatablekiwi at 8:46 PM on May 1, 2021 [4 favorites]
Dan was a dear, dear friend and it's both a shock and gratifying to see him memorialized here. He truly was a gift.
I'm moving this weekend, so I demurred from a slot at the wake, but I'll be listening.
Be kind to one another. In one of our last conversations, we decided our credo is "trust wins", which in infosec goes against nearly everything our work teaches us.
posted by foxtongue at 10:52 PM on May 1, 2021 [14 favorites]
I'm moving this weekend, so I demurred from a slot at the wake, but I'll be listening.
Be kind to one another. In one of our last conversations, we decided our credo is "trust wins", which in infosec goes against nearly everything our work teaches us.
posted by foxtongue at 10:52 PM on May 1, 2021 [14 favorites]
.
posted by lalochezia at 12:34 AM on May 2, 2021
posted by lalochezia at 12:34 AM on May 2, 2021
I only dealt with him professionally once, when he wanted to scrutinize a proof-of-concept tool my organization had written to exercise a vulnerability, to see if it was linked to another vulnerability he suspected.
His request came to me because I sometimes act as my organization's security officer (which doesn't mean that I do the same kind of work Dan did. My role is more "security cleanup in aisle six, please make sure that gets handled responsibly" -- still work worth doing but not requiring the expertise or creativity that his work did. Dan Kaminsky was the real deal.)
Anyway, Dan was one of the few people I can think of who had the credibility and the good will in the industry that he could make such a request and our reply would be "of course, Dan, just please don't share it with anyone who will treat it less carefully than we know you will."
There was a minor problem, however, which was that while we were willing to deliver undisclosed proof-of-concept code to Dan Kaminsky, we weren't quite so willing to deliver it to an electronic correspondent claiming to be Dan Kaminsky. While realizing from other context that it almost certainly was the real Kaminsky, performing my role responsibly meant I couldn't settle for "almost certainly", as the proof-of-concept tool could easily have been weaponized against tens of thousands of unpatched systems. Eventually the stalemate was resolved by finding a party known to both of us who could verify his identity for me. I didn't usually move in his rarefied circles but I had previously worked for Paul Vixie so Paul wound up serving as our guarantor of authenticity and it was, in fact, the real Kaminsky.
I've dealt with many people who would have reacted with irritation to my hesitancy and insistence on verification, but true to the principles he espoused in public, he was completely understanding and even complimentary about the need to establish his identity.. which you would hope could be taken for granted but sadly not everyone manages to live their values or set aside their ego the way he seems to have.
posted by Nerd of the North at 12:52 AM on May 2, 2021 [18 favorites]
His request came to me because I sometimes act as my organization's security officer (which doesn't mean that I do the same kind of work Dan did. My role is more "security cleanup in aisle six, please make sure that gets handled responsibly" -- still work worth doing but not requiring the expertise or creativity that his work did. Dan Kaminsky was the real deal.)
Anyway, Dan was one of the few people I can think of who had the credibility and the good will in the industry that he could make such a request and our reply would be "of course, Dan, just please don't share it with anyone who will treat it less carefully than we know you will."
There was a minor problem, however, which was that while we were willing to deliver undisclosed proof-of-concept code to Dan Kaminsky, we weren't quite so willing to deliver it to an electronic correspondent claiming to be Dan Kaminsky. While realizing from other context that it almost certainly was the real Kaminsky, performing my role responsibly meant I couldn't settle for "almost certainly", as the proof-of-concept tool could easily have been weaponized against tens of thousands of unpatched systems. Eventually the stalemate was resolved by finding a party known to both of us who could verify his identity for me. I didn't usually move in his rarefied circles but I had previously worked for Paul Vixie so Paul wound up serving as our guarantor of authenticity and it was, in fact, the real Kaminsky.
I've dealt with many people who would have reacted with irritation to my hesitancy and insistence on verification, but true to the principles he espoused in public, he was completely understanding and even complimentary about the need to establish his identity.. which you would hope could be taken for granted but sadly not everyone manages to live their values or set aside their ego the way he seems to have.
posted by Nerd of the North at 12:52 AM on May 2, 2021 [18 favorites]
I met him a few times years ago, and since then I realise he took a place in my head that must exist in worlds with superheroes in. Regular people in the MCU walking around just understanding, ok, yeah, gods and wizards are real. This is an enormous loss.
.
posted by DangerIsMyMiddleName at 5:51 AM on May 2, 2021
.
posted by DangerIsMyMiddleName at 5:51 AM on May 2, 2021
.
posted by oozy rat in a sanitary zoo at 7:35 AM on May 2, 2021
posted by oozy rat in a sanitary zoo at 7:35 AM on May 2, 2021
.
This makes me unspeakably sad. I wish I had known this man.
posted by bluesky43 at 7:53 AM on May 2, 2021
This makes me unspeakably sad. I wish I had known this man.
posted by bluesky43 at 7:53 AM on May 2, 2021
.
posted by Alterscape at 3:43 PM on May 2, 2021
posted by Alterscape at 3:43 PM on May 2, 2021
.
posted by hydropsyche at 4:59 AM on May 3, 2021
posted by hydropsyche at 4:59 AM on May 3, 2021
.
posted by exlotuseater at 6:52 AM on May 3, 2021
posted by exlotuseater at 6:52 AM on May 3, 2021
.
I remember some of his posts as effugas but never made the connection. Or if I did, I thought "Cool!" and then promptly forgot. In any case, I'll miss his posts here.
As I wrote elsewhere, he was one of those people the universe needs more of. Hint hint.
posted by suetanvil at 4:59 AM on May 4, 2021
I remember some of his posts as effugas but never made the connection. Or if I did, I thought "Cool!" and then promptly forgot. In any case, I'll miss his posts here.
As I wrote elsewhere, he was one of those people the universe needs more of. Hint hint.
posted by suetanvil at 4:59 AM on May 4, 2021
i met him once when he keynoted a conference i helped organize, and i was floored by his words and thoughts and actions; He was one of those rare people you are actually thrilled have a position of responsibility bc you could just tell he wasn't in it to exploit anyone.
He truly lived the adage "leave the world a better place than you found it."
posted by spoh at 3:06 PM on May 26, 2021
He truly lived the adage "leave the world a better place than you found it."
posted by spoh at 3:06 PM on May 26, 2021
« Older Simplifier | A UFO by any other name would sound less crazy Newer »
This thread has been archived and is closed to new comments
posted by fragmede at 1:14 PM on May 1, 2021 [3 favorites]