While Lopp’s expertise on privacy and cybersecurity is robust and many people would do well to heed his advice on related matters, when Lopp originally reviewed Lowery’s thesis, Lopp didn’t even take the time to read the full thesis. He relied upon Lowery’s podcast interviews in which Lowery had verbally articulated his thesis via extemporaneous conversation.

Obviously this means that Lopp’s initial review of Lowery’s thesis was in fact a review of an incomplete, lesser articulation of the thesis than the actual thesis. Yes, Lowery’s podcast articulations should be reasonably accurate to the thesis, but the thesis contains a lot more than Lowery is able to deliver in a 2 hour podcast.

Lopp’s review of Lowery’s thesis is technically a strawman because it addresses an incomplete, reduced version of the thesis, not the thesis itself. It may fail to acknowledge things Lowery did include in the thesis but did not mention in any of the podcast interviews Lowery did that Lopp heard.

It’s probably a good read either way, but it should also probably be taken with a grain of salt.