3 ms·
You know, I'm not really all that certain that it's intellectually difficult to get crypto right; it feels more likely that it's organisationally and process-wi
by zeveb 10y ago
You know, I'm not really all that certain that it's intellectually difficult to get crypto right; it feels more likely that it's organisationally and process-wise difficult to get crypto right.
What I mean is that folks want to take an existing product and layer crypto atop it, when really they need to start from the crypto and built a product over it. They want to do things which are mathematically impossible (e.g. let you read data, but not let you say that data to someone else). They want to hand the crypto to a junior developer instead of someone who knows what he's doing.
Crypto's not hard to do; organisations are bad at doing crypto.
- LoSboccacc 10y agospot on with one minor nitpick: crypto is not hard to use (as in, relying on existing libraries/standards/practices) - doing, as in writing your own crypto, otoh...
- brainbrane 10y agoCrypto is indeed hard to use. https://www.nds.rub.de/media/nds/veroeffentlichungen/2011/10/22/HowToBreakXMLenc.pdf https://www.nds.rub.de/media/nds/veroeffentlichungen/2011/10... https://en.wikipedia.org/wiki/CRIME https://en.wikipedia.org/wiki/CRIME
- amelius 10y ago> You know, I'm not really all that certain that it's intellectually difficult to get crypto right; it feels more likely that it's organisationally and process-wise difficult to get crypto right. Replace "crypto" by just about any software engineering endeavor, and what you say is still correct.