For the interested, someone [1] is putting together a collection of videos of him, so you can probably find a whole lot more in the replies to that thread even if you don't wait for the playlist to be made.
I briefly met him at Toorcon in the early 2000s and was impressed with how he combined that eccentricity with high-energy: if the internet didn't get more secure, it wasn't for lack of trying on his part.
Wow... I remember recreating his DNS cache poisoning attack in one of the courseworks I did in my second year of university. I always thought it was incredibly clever...
or drug overdose or vaccine side effect or private health condition... so many things could be speculated, I think they probably just mean that friends and family won’t want to see/read the speculation comments, regardless of what it is (but especially if it’s controversial)
Unfortunately this is always an unrealistic request for anyone with a public profile. Those that have no desire to speculate won’t, and it’s not going to stop the curious. Frankly I tend to agree it is moreover an unreasonable request as long as no one is actively invading the privacy of the family.
No, I don't think it's a reasonable request. The best way to forestall speculation is to just say what happened. Presumably his family already knows so it's not going to shock them.
>Presumably his family already knows so it's not going to shock them.
Or only some of his family know, and it may be best that for those that haven't heard yet the best people to tell them would be the other family members that do know.
Families choose to hide AND lie about suicide and addiction deaths. I know from multiple first hand experiences.
THIS IS BAD FOR EVERYONE!
Yes, it's embarrassing for the family (though it shouldn't be) because they feel like they can do more.
But, it the prevalence needs to made public so we treat these things like the crisis they are!
And worse, in this case, people are even drawing ties to the vaccine!?!? What an insane intellectual lottery to play. But that speculation WILL cause direct negative outcomes!
Ugh, just ranting b/c as mentioned I have first hand experience with "it wasn't alcohol/drugs/suicide, it was cardiac arrest."
This is a complete non sequitur as a reply. The commenter you're replying to asked people to prioritise his grieving family's wishes over your own curiosity. He/she was absolutely right to do so.
Your reply talks about other families who lie and state a false cause of death, which would be morally wrong but in this case is completely irrelevant because that's not what's happened.
The one bit of your comment which is relevant, I think, is wrong: namely "the prevalence needs to made public so we treat these things like the crisis they are". We have anonymised statistics on suicide and overdose deaths. That is not the same as demanding a specific person's cause of death - and the sense of generalised academic interest you're alluding to is plainly not the reason for which people are curious about how he died. I wish we would get a grip on ourselves here, because it must be upsetting for anyone who knew him and is reading these comments, as surely some of those people are.
Edit: I died of a heroin overdose, briefly, before I was resuscitated. If I'd died permanently, my family may well have wanted to keep that information off the record permanently (easier in my case of course because I'm not a public figure). It's easy to think in the age of Wikipedia that all information is in the public domain and belongs to everyone. It's not, and it doesn't.
Look at everyone else in this thread, celebrating the life and accomplishments of an amazing hacker that is no longer with us. Then read your comment again and ask yourself if this is the time and place to rant. Maybe not?
I don’t think anyone questioning is reprehensible. I simply don’t think it’s too much to ask to keep that discussion to less public channels in the aftermath of his death, as it’s a fairly reasonable and low burden request.
They don’t need to do anything. People aren’t morally entitled to demand information from a grieving family just because it would sate their curiosity.
I demanded nothing. I simply pointed out that lack of information will always produce curiosity. If they don't want people curious, they have it in their power to stop them from being curious. Or they can be silent and leave people curious.
Perhaps I've missed the actual point of their request. As I think about it further, I wonder if they are simply requesting that people not spread baseless rumors, which is certainly a legitimate reminder for anybody to give at any time. Still, speculation seems to me to be more along the lines of an educated guess, rather than a baseless rumor.
Oh I see, you mean you were just making the descriptive statement that people will speculate if they are not given information? I took you to be saying that they (the family or whoever has the right to give out that information) were actually obliged to tell people.
In that case, sorry about the misunderstanding. I agree with you in that descriptive sense, that people will speculate.
I also think they ought not to speculate or demand information, and that it's quite l̶u̶r̶i̶d̶ [edit: morbid, rather] of them to do so. I understand the psychology behind it, because generally information is transparent and accessible by default these days. And generally that's a good thing. But people may not want to share certain information when grieving a loved one's death - and when they may still need to tell people who were close to him, rather than letting them find out from a trending Twitter topic. They may even never want the manner of their loved one's death to be an open fact on Wikipedia, like for instance David Carradine's family might have wished. I'm sympathetic in either case. I think we internet people as a whole really ought to be sympathetic too. Some of the comments on this thread are appalling in their sense of entitlement to know this information.
How do you know they have facts? It takes some time for a coroner / medical examiner to produce a report. The death certificate will have minimal information.
And your claim that speculation is reduced by releasing details is incorrect. Imagine a person dies a self-inflicted death -- there will then be speculation about whether or not this is suicide or misadventure, and what the causes were.
The tweet says “Please keep speculation to yourself”. Whether you think it’s appropriate or not, asking if anyone knows what happened is not the same as asking for speculation.
The tweet specifically asks us not to speculate and the parent article makes mention that the conditions of his death have not been made public.
I’m not sure how others feel, personally I am conflicted: respect the death of an icon and not pry (even if others are speaking on his behalf) or satisfy my curiosity.
I don't think the curiosity to know is just for curiosity alone. I think it serves a purpose for everyone to bear witness to the kinds of things that take us.
Unless he was killed by a bear and that bear is still on the loose, or something like that, then I think we can probably wait a few days for his family to be informed.
There are a lot of people here making very high-minded comments about how it’s deeply important to the sum total of human knowledge that we learn the cause of his death so that we can reflect on our mortality, and so on and so forth. I can’t help but feel those comments are a bit insincere. It’s morbid curiosity, let’s be honest, and it’s not enough to justify speculating when his family and friends are probably reading these comments and possibly haven’t found out.
I guess it's the caveman in all of us who really needs to know what happened to his buddy so that he can avoid it. And I guess those without this curiosity in their DNA died out rather soon...
So it might not be insincerity but genetics.
This is certainly an inventive argument! But I would argue in response that your odds of being killed by whatever killed Dan Kaminsky, in the next 24 hours or so, purely because you weren't told soon enough how he died, are rather low!
May you live until tomorrow and may your genes prosper to fight another day ;)
> Dan struggled for years with diabetes and was even recently hospitalized because of it. This tragedy has nothing to do with the COVID-19 vaccination and unfortunately everything to do with diabetic ketoacidosis.
Dan is a legend and great defender of the internet. His research made us safer, and his guidance made us more secure. We will miss you Dan, and may your memory and spirit resolve and soar through the clouds.
I will miss him terribly. He was the guy who let me crash in his room at Defcon when I was a minor and was too young to book my own room. This kicked off 20 years of friendship. He was brilliant, zany, ADD x 1000, and always endearing and loving.
In 2008 I was lucky to collaborate on DNS issues with Dan when he discovered a new form of DNS cache poisoning and spent years helping the Internet upgrade and defend against a serious and significant vulnerability. We all owe him a debt of gratitude for this and so much of his other work.
He was a hacker's hacker, and the guy you want in your corner. Very sad to hear this news.
I saw him speak at BlackHat in 2008 when he presented that work -- _everyone_ was there. It was an amazing presentation, and I was properly filled with respect for Dan.
I was there that year, too. And the year before and after. And at ToorCon that year, which was tiny and it was great to talk to him there. Many of my journeys to conferences were because he was on the docket.
Thanks for the link; would you like to submit that as a separate HN submission as well, including [video] in the title? (I think that'd be within the site guidelines[1])
Might post it myself if you'd prefer not to; I figured it might make sense for you to claim the credit/karma.
Additional mitigations started to come in to play after that to make it both impractical, detectable, and improbable. It's just shy of impossible now, and in the very unusual scenarios where it's possible, it's so easily detectable.
Dan's work pushed the adoption of BCP38, segmentation of authoritative and recursive resolvers, and better source port randomization. Entirely new mitigations were developed like 0x20, source address randomization, and double response detection.
I had dinner with Dan once, he ”social engineered” me and claimed he forgot to bring money. I knew what he was doing, but also knew that if picking up the tab was the price i had to pay for getting to hang out with him, I got the better end of the Deal. Rest In Peace
For what it’s worth, he had left his wallet elsewhere at a large dinner where a friend ended up paying for the group anyway.
They didn’t expect him to pay and yet he paid them back fairly promptly and actually gave a few cents more than he technically owed - which he claimed was interest at the prevailing rate.
I certainly don’t see him “hacking” his way to a free dinner on a(n) (un)suspecting victim.
Agreed. I've eaten and had many drinks with Dan. He was generous. Never cared about throwing a few bucks down to help someone else eat or drink. We often had very large group dinners at conferences and Dan typically threw in a few extra to cover those who weren't as well off. (Standard practice for these things.) Definitely feels like a misread.
I agree, this was clearly voiced very respectfully and with good intentions, but I’m astonished the commenter couldn’t see what a classless thing this is to imply – especially about someone who just died. I was pretty dumbfounded reading this.
I read comments like this and wonder whether--after I die--everybody will mock me for every moment I forgot my wallet.
I maybe forget my wallet once per year, but I'd like to think that my friends have forgiven me for it. (And I always Venmo my share of the bill anyway.)
I think you got the better end of the deal. Similar things have happened to me and I am happy to have known them and the joy they added to our transient lives.
Dan was at Santa Clara in the spring of 1998 when I was there on an exchange. Unbeknownst to me, I was watching South Park in the dorm’s TV lounge next to a future internet legend. We later made the connection through mutual friends and he became a technical advisor to my startup.
Dan was always generous with his time and expertise. He was the kind of person whom you could expect could easily become very rich, but was entirely unmotivated by money. Dan was fascinated to learn the inner workings of things we all take for granted - such as the DNS. A true hacker.
I’m not in the industry. But I instantly recognize the name from the occasional touches I have with info sec. that tells me all I need to know About how big of a loss this is.
215 comments
[ 3.4 ms ] story [ 267 ms ] threadHe always had a certain eccentricity to him. I never met him in person. He always was the prototypical nerd judging from his talks and mannerisms.
[1] - https://twitter.com/thedarktangent/status/138595909778312806...
Just curious on what exactly happened.
Or only some of his family know, and it may be best that for those that haven't heard yet the best people to tell them would be the other family members that do know.
THIS IS BAD FOR EVERYONE!
Yes, it's embarrassing for the family (though it shouldn't be) because they feel like they can do more.
But, it the prevalence needs to made public so we treat these things like the crisis they are!
And worse, in this case, people are even drawing ties to the vaccine!?!? What an insane intellectual lottery to play. But that speculation WILL cause direct negative outcomes!
Ugh, just ranting b/c as mentioned I have first hand experience with "it wasn't alcohol/drugs/suicide, it was cardiac arrest."
/End rant
Your reply talks about other families who lie and state a false cause of death, which would be morally wrong but in this case is completely irrelevant because that's not what's happened.
The one bit of your comment which is relevant, I think, is wrong: namely "the prevalence needs to made public so we treat these things like the crisis they are". We have anonymised statistics on suicide and overdose deaths. That is not the same as demanding a specific person's cause of death - and the sense of generalised academic interest you're alluding to is plainly not the reason for which people are curious about how he died. I wish we would get a grip on ourselves here, because it must be upsetting for anyone who knew him and is reading these comments, as surely some of those people are.
Edit: I died of a heroin overdose, briefly, before I was resuscitated. If I'd died permanently, my family may well have wanted to keep that information off the record permanently (easier in my case of course because I'm not a public figure). It's easy to think in the age of Wikipedia that all information is in the public domain and belongs to everyone. It's not, and it doesn't.
That's a bit of an assumption. Working out how someone died can be tricky.
Do you really talk like that?
I don't mind them not giving facts. I just think it's silly to not give facts and then tell people not to speculate.
The story of how he died could be a valuable cautionary tale for people, as much as his talent and work was inspirational.
"I don't mind them not giving facts."
I demanded nothing. I simply pointed out that lack of information will always produce curiosity. If they don't want people curious, they have it in their power to stop them from being curious. Or they can be silent and leave people curious.
Perhaps I've missed the actual point of their request. As I think about it further, I wonder if they are simply requesting that people not spread baseless rumors, which is certainly a legitimate reminder for anybody to give at any time. Still, speculation seems to me to be more along the lines of an educated guess, rather than a baseless rumor.
In that case, sorry about the misunderstanding. I agree with you in that descriptive sense, that people will speculate.
I also think they ought not to speculate or demand information, and that it's quite l̶u̶r̶i̶d̶ [edit: morbid, rather] of them to do so. I understand the psychology behind it, because generally information is transparent and accessible by default these days. And generally that's a good thing. But people may not want to share certain information when grieving a loved one's death - and when they may still need to tell people who were close to him, rather than letting them find out from a trending Twitter topic. They may even never want the manner of their loved one's death to be an open fact on Wikipedia, like for instance David Carradine's family might have wished. I'm sympathetic in either case. I think we internet people as a whole really ought to be sympathetic too. Some of the comments on this thread are appalling in their sense of entitlement to know this information.
How do you know they have facts? It takes some time for a coroner / medical examiner to produce a report. The death certificate will have minimal information.
And your claim that speculation is reduced by releasing details is incorrect. Imagine a person dies a self-inflicted death -- there will then be speculation about whether or not this is suicide or misadventure, and what the causes were.
https://youtu.be/RAGwol-keXM
So what happened? Drugs? COVID?
I’m not sure how others feel, personally I am conflicted: respect the death of an icon and not pry (even if others are speaking on his behalf) or satisfy my curiosity.
I’m going to go with the former, for now.
I don't think the curiosity to know is just for curiosity alone. I think it serves a purpose for everyone to bear witness to the kinds of things that take us.
There are a lot of people here making very high-minded comments about how it’s deeply important to the sum total of human knowledge that we learn the cause of his death so that we can reflect on our mortality, and so on and so forth. I can’t help but feel those comments are a bit insincere. It’s morbid curiosity, let’s be honest, and it’s not enough to justify speculating when his family and friends are probably reading these comments and possibly haven’t found out.
I guess it's the caveman in all of us who really needs to know what happened to his buddy so that he can avoid it. And I guess those without this curiosity in their DNA died out rather soon... So it might not be insincerity but genetics.
May you live until tomorrow and may your genes prosper to fight another day ;)
I'd like to know what happened to my friend, who was himself always in pursuit of the truth.
Speculation is precisely what I don't want, though. If you don't have the data, please hold your tongue.
https://twitter.com/sarahbrie/status/1386384261133922310
You can see many of his CCC talks here:
https://media.ccc.de/search/?q=Dan+Kaminsky
@dang can we get a black bar please?
In 2008 I was lucky to collaborate on DNS issues with Dan when he discovered a new form of DNS cache poisoning and spent years helping the Internet upgrade and defend against a serious and significant vulnerability. We all owe him a debt of gratitude for this and so much of his other work.
He was a hacker's hacker, and the guy you want in your corner. Very sad to hear this news.
So very sad that he's gone so young.
A true inspiration in infosec.
https://www.youtube.com/watch?v=7Pp72gUYx00
Might post it myself if you'd prefer not to; I figured it might make sense for you to claim the credit/karma.
[1] - https://news.ycombinator.com/newsguidelines.html
A really good, and really detailed, overview of what Kaminsky found: http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.htm... Kaminsky references this from the sidebar in his blog.
I have known him for decades, and I have never seen him take advantage of another person. Not ever. Not even once.
If he said he forgot to bring money, then he probably did.
Let us raise a cup to his name. A kind soul and an inspiration to us all.
They didn’t expect him to pay and yet he paid them back fairly promptly and actually gave a few cents more than he technically owed - which he claimed was interest at the prevailing rate.
I certainly don’t see him “hacking” his way to a free dinner on a(n) (un)suspecting victim.
Very true. Either way, I didn't feel taken advantage of. He truly was special, and I'm incredibly happy I got to spend some time with him.
I don't know how many years ago this was, but he's been a man of independent means for longer ago than whenever this happened.
I think you intended this as a sharing of a cool moment you had with the recently deceased, but you thoroughly missed the mark.
I maybe forget my wallet once per year, but I'd like to think that my friends have forgiven me for it. (And I always Venmo my share of the bill anyway.)
Dan was always generous with his time and expertise. He was the kind of person whom you could expect could easily become very rich, but was entirely unmotivated by money. Dan was fascinated to learn the inner workings of things we all take for granted - such as the DNS. A true hacker.
Thank you for sharing.
Condolences to those who knew him.