4 ms·

Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners? The crypto comm

by Kalium 9y ago

Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners? The crypto community has repeatedly been burned by overeager beginners with false senses of competence making rather nasty mistakes. Consequences can be dire, from destroying companies to getting people killed. On the lighter end, you have things like Decrytocat. In some arenas, it's appropriate and a good practice to assume that everyone reading is a beginner who needs 101-level info on everything. Webdev is a good example - CSS, or cascading style sheets, are good for handling the display logic of semantic markup. The stakes are low and the costs for screwing up trivial. With cryptography, it needs to be driven home to the idle reader that this is serious stuff.

tptacek 9y ago
Decryptocat isn't the lighter end of things. Snowden used it to communicate with Glenn Greenwald's associates during the same time period Decryptocat was found (there are worse flaws in that software than Decryptocat, by the way). Now you see the issue!
lisper 9y ago
> Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners? Not at all. I'm not actually expecting anything. All I'm saying is that as a matter of common courtesy (in any field) if you're going to say, "You just have to know X" then you should do at least one of the following: 1. Check that if someone doesn't know X that they can get at least a lead on how to learn about it by searching for X. 2. Provide a pointer for someone who wants to learn about X to follow as a starting point 3. Provide a brief in-line primer on X If none of those conditions hold then it's not constructive to say, "You just have to know X." What you're really doing in that case is not providing useful information, but rubbing your audience's nose in the fact that they are ignorant and you are not, and worse, that you acquired your knowledge through some privileged channel to which they do not have ready access. Honestly, what possible reaction could you reasonably expect other than frustration?
- tptacek 9y ago
  If someone posted a message on HN about doing DIY appendectomies with Arduino-controlled robots and I pointed out that you need to go to med school to do surgeries, you would not in fact be harping on me for not having explained why.
  - davidw 9y ago
    I think it's perfectly normal to be curious about a field and want to know more without necessarily wanting to charge off and do it yourself.
    - deleted 9y ago
      [deleted]
    - Kalium 9y ago
      You're right! That's perfectly normal and extremely common. People are skittish about this in the realm of cryptography because the costs of getting it wrong can be very high. Further, programmers have a culture where experimenting by writing something yourself is perfectly reasonable and extremely common. When these two meet in the context of crypto, I know just enough to get worried that someone's going to get overconfident from a primer and do something they believe to be very clever. History has a nasty tendency to validate fear this as well-intentioned clever people do things that they believe are good enough.
  - lisper 9y ago
    Not at all. If I don't know how to sign up for med school, I can find out by searching for "How do I sign up for med school?" or even "How do I become a doctor?" If I search for "How do I sign up for crypto school" the results are far less helpful.
    - tptacek 9y ago
      I think you are arguing yourself into an absurd corner here, because I know for a fact that you can name off the top of your head five university crypto programs, and I'm sure you realize that for each of the ones you can name, there are 10 more that others can name. And: for what it's worth, I don't think going to school is the only way to learn this stuff. I just don't think putting end-users at risk, especially since they can't possibly be expected to tell the difference between Dan Boneh and some guy who assembled a broken ECDH out of random npm libraries.

by Kalium 9y ago

tptacek 9y ago

Decryptocat isn't the lighter end of things. Snowden used it to communicate with Glenn Greenwald's associates during the same time period Decryptocat was found (there are worse flaws in that software than Decryptocat, by the way). Now you see the issue!

lisper 9y ago

> Is it possible that you are expecting the cryptography community to be one organized around being newbie-friendly and encouraging to beginners? Not at all. I'm not actually expecting anything. All I'm saying is that as a matter of common courtesy (in any field) if you're going to say, "You just have to know X" then you should do at least one of the following: 1. Check that if someone doesn't know X that they can get at least a lead on how to learn about it by searching for X. 2. Provide a pointer for someone who wants to learn about X to follow as a starting point 3. Provide a brief in-line primer on X If none of those conditions hold then it's not constructive to say, "You just have to know X." What you're really doing in that case is not providing useful information, but rubbing your audience's nose in the fact that they are ignorant and you are not, and worse, that you acquired your knowledge through some privileged channel to which they do not have ready access. Honestly, what possible reaction could you reasonably expect other than frustration?

tptacek 9y ago
If someone posted a message on HN about doing DIY appendectomies with Arduino-controlled robots and I pointed out that you need to go to med school to do surgeries, you would not in fact be harping on me for not having explained why.
- davidw 9y ago
  I think it's perfectly normal to be curious about a field and want to know more without necessarily wanting to charge off and do it yourself.
  - deleted 9y ago
    [deleted]
  - Kalium 9y ago
    You're right! That's perfectly normal and extremely common. People are skittish about this in the realm of cryptography because the costs of getting it wrong can be very high. Further, programmers have a culture where experimenting by writing something yourself is perfectly reasonable and extremely common. When these two meet in the context of crypto, I know just enough to get worried that someone's going to get overconfident from a primer and do something they believe to be very clever. History has a nasty tendency to validate fear this as well-intentioned clever people do things that they believe are good enough.
- lisper 9y ago
  Not at all. If I don't know how to sign up for med school, I can find out by searching for "How do I sign up for med school?" or even "How do I become a doctor?" If I search for "How do I sign up for crypto school" the results are far less helpful.
  - tptacek 9y ago
    I think you are arguing yourself into an absurd corner here, because I know for a fact that you can name off the top of your head five university crypto programs, and I'm sure you realize that for each of the ones you can name, there are 10 more that others can name. And: for what it's worth, I don't think going to school is the only way to learn this stuff. I just don't think putting end-users at risk, especially since they can't possibly be expected to tell the difference between Dan Boneh and some guy who assembled a broken ECDH out of random npm libraries.