4 ms·

Here's the effect that this ultimately has, as far as I can see: The most reasonable people, who we would ultimately like to see build something that people use

Here's the effect that this ultimately has, as far as I can see: The most reasonable people, who we would ultimately like to see build something that people use, get discouraged and go work on something else. The most stubborn, unreasonable people then charge ahead, and eventually a few of them break through via marketing and win millions or billions of users, with whatever they put together. It's a net loss. I don't understand the value of pointing to something that died 5 years ago and where nobody even wrote a single test as a model to learn from. There's got to be better models to follow, if our goal is to point people at things to learn from. There's no need to turns things ad hominem by shifting the focus to authorship and away from the actual merits of the software: design, code quality, test coverage.

tptacek 10y ago
That's not what I see happening. What I see is a gradual shift from DIY crypto to a few vetted components and designs --- Nacl, Signal Protocol, Scrypt --- and objections, often from non-experts, when new systems avoid those components. Things look hopeful to me. Meanwhile: Look, you are much smarter than I am about this stuff. I'm just a pentester with a former life as a software developer. Are you honestly telling me that you think a good way to learn how to build safe crypto is to start de novo a new secure messaging application? Of all the things you could do to introduce yourself to the field, and what work in the field is really about, that's what you think smart people should be spending their time on?