17 ms·
Unless no programs ever need to worry about that case (which is untrue), why not mention in a security gist purporting to be a list of crypto implementation sug
by jjnoakes 10y ago
Unless no programs ever need to worry about that case (which is untrue), why not mention in a security gist purporting to be a list of crypto implementation suggestions?
Why not be complete and list the caveat, instead of incomplete and possibly lead that one in a thousand down the wrong path?
- Dylan16807 10y agoFar more than one in a thousand will use it as an excuse to do the wrong thing. And lots of articles about best practice leave out very rare edge cases. No advice is always always right.
- jjnoakes 10y ago> lots of articles about best practice leave out very rare edge cases I don't think that's an argument in support of leaving out edge cases, and even if you disagree in general, I think security articles should be more diligent than random best-practices articles. > Far more than one in a thousand will use it as an excuse to do the wrong thing. If an article says "always do X" and someone does X and the implementation is subtly wrong or insecure, that's an argument to improve the article (which is what I'm suggesting). But if an article says "almost always do X, and be aware of this edge case" and someone gets it wrong by not following instructions, then I don't think the article is at fault. I would personally want my security advice to cover any edge case I could think of, even if only in the footnotes.