4 ms·

Looking at the specialization of knowledge, is easy to see how much society and experts are more and more unable to make something new by themselfs and or study

Looking at the specialization of knowledge, is easy to see how much society and experts are more and more unable to make something new by themselfs and or study something they don't know at all, but most importantly blindly taking for granted the crap they use every day. Look at the recent INTEL spectre failure, you can see how extremely complicated systems were flawed at their very bottom and few young enlighted minds were able to shake our world.

detaro 9y ago
> Looking at the specialization of knowledge, is easy to see how much society and experts are more and more unable to make something new by themselfs and or study something they don't know at all, but most importantly blindly taking for granted the crap they use every day. Do you really think if there were no widespread recommendations of crypto systems considered good people would suddenly start becoming expert cryptographers (and companies would suddenly pay for them doing that)? History suggests that they'd rather grab something random of GitHub/Stack Overflow or make up their own without understanding it properly. Every security conference is providing you with tons of examples of people getting it horribly wrong despite there being good free resources available providing them with the tools to avoid their failures.
- gioscarab 9y ago
  Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. I do not see many forums experimenting in new ways to encrypt or analyze methods proposed by others, I do see a higher number of threads discussing pseudo-scientifically that is stupid to even try to learn something in this field. So I am not saying that a newbe will do a better job than experienced experts. I am saying that we will not have many experienced experts without seeing today newbies making mistakes. To me seems not a complicated concept.
  - dozzie 9y ago
    > what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. It's not. People not wanting to learn cryptography systematically make impossible for themselves to grasp the basics of crypto. There are a lot of topics to be covered, which goes way, way beyond encrypting stuff. People dabbling with making their own cipher or implementing DES on their own would learn exactly nothing of the cryptography. You really need to be shown a lot of stuff to understand where the industry and research were decades ago, much less where they are now, and you can't really learn that on your own, you need a guide to show you where your knowledge is still lacking.
  - viraptor 9y ago
    What? I think you very much misunderstand "don't roll your own crypto". It was never meant about learning, experimenting, and analysis. It was about actually using your creation. If you want to learn about cryptography there's lots of resources (uni courses, books, and informal tutorials like matasano crypto challenge). If you're interested enough to learn, there's nothing stopping you. For the record, I've done all 3 and apart from some practical cryptography stuff, I really learned one thing: don't roll your own crypto - it's super tricky :-D We will have new experts though. There are people interested enough to continue and learn and they will get their work reviewed by standard bodies one day.
  - dsacco 9y ago
    > Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. To be brutally frank with you: most people are not qualified to implement their own cryptography, and you cannot become qualified if you skip the significant prerequisites. Much like computer science in general, cryptography is not comparable to software engineering or programming. You can learn e.g. web development in a piecemeal, circuitous fashion. You cannot learn cryptography that way - you’d first need to understand advanced mathematics (abstract algebra, number theory, probability theory, maybe some game semantics) and computational complexity. Then you need to thoroughly understand the existing algorithms before you figure out how they can be (safely) improved. Attempting to develop novel cryptosystems (“roll your own crypto”) without this background is irresponsible. It’s not that it’s impossible to grasp the basics, rather it’s that you need to be willing to work through a significant amount of material before you can even understand what your “unknown unknowns” might be. To put it very succinctly, would you attempt to publish new research in computer science or mathematics without significant training in either?
dsacco 9y ago
> Look at the recent INTEL spectre failure, you can see how extremely complicated systems were flawed at their very bottom and few young enlighted minds were able to shake our world. Are you aware that virtually all of the researchers behind the Spectre and Meltdown attacks are academics, right? Of those not presently in academia, they still mostly have PhDs and work in private research labs. Your comment here about “few young enlightened minds” implies that scrappiness, grit and an unorthodox perspective from outside the system enabled them to find these vulnerabilities. That’s not all the case. All the researchers involved are highly trained by the same institution your criticizing. They are quite literally in the same group of specialists and experts you hold in such contempt.
viraptor 9y ago
> society and experts are more and more unable to make something new by themselfs Are you sure that's not just your view of some specific group you know? People are definitely able to learn. Experts even more so - but they choose their discipline already. Anyway, I'm not sure why this is a response to "here's an example of people whose income is directly related to the quality of their crypto implementation, see how they fail".

detaro 9y ago

> Looking at the specialization of knowledge, is easy to see how much society and experts are more and more unable to make something new by themselfs and or study something they don't know at all, but most importantly blindly taking for granted the crap they use every day. Do you really think if there were no widespread recommendations of crypto systems considered good people would suddenly start becoming expert cryptographers (and companies would suddenly pay for them doing that)? History suggests that they'd rather grab something random of GitHub/Stack Overflow or make up their own without understanding it properly. Every security conference is providing you with tons of examples of people getting it horribly wrong despite there being good free resources available providing them with the tools to avoid their failures.

gioscarab 9y ago
Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. I do not see many forums experimenting in new ways to encrypt or analyze methods proposed by others, I do see a higher number of threads discussing pseudo-scientifically that is stupid to even try to learn something in this field. So I am not saying that a newbe will do a better job than experienced experts. I am saying that we will not have many experienced experts without seeing today newbies making mistakes. To me seems not a complicated concept.
- dozzie 9y ago
  > what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. It's not. People not wanting to learn cryptography systematically make impossible for themselves to grasp the basics of crypto. There are a lot of topics to be covered, which goes way, way beyond encrypting stuff. People dabbling with making their own cipher or implementing DES on their own would learn exactly nothing of the cryptography. You really need to be shown a lot of stuff to understand where the industry and research were decades ago, much less where they are now, and you can't really learn that on your own, you need a guide to show you where your knowledge is still lacking.
- viraptor 9y ago
  What? I think you very much misunderstand "don't roll your own crypto". It was never meant about learning, experimenting, and analysis. It was about actually using your creation. If you want to learn about cryptography there's lots of resources (uni courses, books, and informal tutorials like matasano crypto challenge). If you're interested enough to learn, there's nothing stopping you. For the record, I've done all 3 and apart from some practical cryptography stuff, I really learned one thing: don't roll your own crypto - it's super tricky :-D We will have new experts though. There are people interested enough to continue and learn and they will get their work reviewed by standard bodies one day.
- dsacco 9y ago
  > Not at all, what I am saying is that "Don't roll your own crypto" mono-culture makes impossible for people to grasp the basics of crypto. To be brutally frank with you: most people are not qualified to implement their own cryptography, and you cannot become qualified if you skip the significant prerequisites. Much like computer science in general, cryptography is not comparable to software engineering or programming. You can learn e.g. web development in a piecemeal, circuitous fashion. You cannot learn cryptography that way - you’d first need to understand advanced mathematics (abstract algebra, number theory, probability theory, maybe some game semantics) and computational complexity. Then you need to thoroughly understand the existing algorithms before you figure out how they can be (safely) improved. Attempting to develop novel cryptosystems (“roll your own crypto”) without this background is irresponsible. It’s not that it’s impossible to grasp the basics, rather it’s that you need to be willing to work through a significant amount of material before you can even understand what your “unknown unknowns” might be. To put it very succinctly, would you attempt to publish new research in computer science or mathematics without significant training in either?

dsacco 9y ago

> Look at the recent INTEL spectre failure, you can see how extremely complicated systems were flawed at their very bottom and few young enlighted minds were able to shake our world. Are you aware that virtually all of the researchers behind the Spectre and Meltdown attacks are academics, right? Of those not presently in academia, they still mostly have PhDs and work in private research labs. Your comment here about “few young enlightened minds” implies that scrappiness, grit and an unorthodox perspective from outside the system enabled them to find these vulnerabilities. That’s not all the case. All the researchers involved are highly trained by the same institution your criticizing. They are quite literally in the same group of specialists and experts you hold in such contempt.

viraptor 9y ago

> society and experts are more and more unable to make something new by themselfs Are you sure that's not just your view of some specific group you know? People are definitely able to learn. Experts even more so - but they choose their discipline already. Anyway, I'm not sure why this is a response to "here's an example of people whose income is directly related to the quality of their crypto implementation, see how they fail".