4 ms·

Instead of digging through OP's Reddit history, it would have been much more useful for everyone if you lent OP your trained eyes and had a look through his pro

• lvh 10y ago
  FWIW; OP posted that article and it got on HN where said reddit thread was linked; it is not accurate to describe this as "digging through their reddit history" as if there's some kind of weird malicious character assassination thing going on.
  • Cyph0n 10y ago
    Whoops, must have missed that, my bad!
    • loup-vaillant 10y ago
      For the record, that big criticism on Reddit helped me quite a bit. I was able to revise my article afterwards. Such constructive criticism is a big reason why I submit my writings to aggregators. In the present case however that will be harder. We're talking over 1K lines of extremely critical code, and that's much harder to review than a 300 lines blog post.
• lvh 10y ago
  Why is it necessary to volunteer expert time every time someone publishes a new piece of code that by their own admission is not a significant improvement over TweetNaCl? Time is limited; if something doesn't do a good job arguing why you need it, pointing people to things that are packaged, updated, have been consistently maintained and reviewed is _solid engineering advice_.
  • Cyph0n 10y ago
    > Why is it necessary to volunteer expert time every time someone publishes a new piece of code I would agree if the author presented a very clearly flawed and poorly thought out implementation, but this is clearly not the case here. There is a quality threshold after which spouting out "No, use NaCl!" becomes a waste of time. > by their own admission is not a significant improvement over TweetNaCl? Not everything in the real world has to be a significant improvement. > [...] if something doesn't do a good job arguing why you need it Not everyone is good at marketing his/her creations. It's pretty tough to do well in my opinion, and there's always "that guy" who's never satisfied by any explanation. > [...] _solid engineering advice_ I would agree with you in most other scenarios, but the author of this library mentioned NaCl in the first paragraph. The author also took the time to list the motivation behind this work, as well as the reasons why this could provide potential improvements over prior work. So I don't see how "NO, use NaCl!" is 'solid' advice in this case.
    • lvh 10y ago
      But we've engaged with those motivations, and found them lacking -- so libsodium is still what tqbf and I recommend. (Not NaCl! libsodium is sufficiently interestingly different that you should use it, not NaCl.) It is not true that any attempt at new crypto software will just be shut down; for example, I think Noise is awesome. I think STROBE is pretty cool too, but I'm not telling people to implement STROBE. I'm telling people to use libsodium. Telling people to use the probably-already-packaged, carefully reviewed, random-nonce supporting package they had available yesterday _is_ solid engineering advance, and I stand by that claim.
      • Cyph0n 10y ago
        I definitely agree that going around adopting freshly written and poorly tested crypto libraries is A BAD IDEA EVERY TIME. Absolutely no argument there. I still got a very "stop what you're doing and move on" vibe from the parent comment as well as the response on the Reddit thread, and I feel that it wasn't fair in this case. I apologize if I misunderstood.
• tptacek 10y ago
  Since nobody here screamed "NO!" about anything, I'd appreciate it if you took a moment to retract this.
  • Cyph0n 10y ago
    The Reddit comment you linked to - essentially a huge "NO" - is the focus of my reply. So I agree that your comment in and of itself claimed nothing of the sort. But if you insist, I can request that HN mods delete my comment, as I can't edit/delete it anymore.
    • tptacek 10y ago
      Nope, that ack totally suffices.