3 ms·

One starts looking at things differently as years pass. I've been working with computers for >25 years now, and I've learned that long-term thinking is importan

by jwr 8y ago

One starts looking at things differently as years pass. I've been working with computers for >25 years now, and I've learned that long-term thinking is important. Remember '.bz' files that were all the rage? Yeah. Bzip1, not '.bz2'. Good luck trying to read that. For my data, I will stick to things that have been around for a long time and that are likely to stay. Those fancy 'nacl/box' thingies? I'm willing to make a bet that they won't be around in 5 years time. As to PGP, it is hard to understand, so people don't use it and are not interested in developing it. Which is a shame, we could all use more good end-to-end encryption. I also find this article rather funny, as I'm happily encrypting/decrypting data with OpenPGP, using the agent to authenticate to my SSH servers, and keep my keys securely on a YubiKey. I do hope these "modern alternatives" have good answers for storing my keys on a YubiKey, because otherwise the whole thing isn't really worth the effort.

blattimwind 8y ago
> Those fancy 'nacl/box' thingies? I'm willing to make a bet that they won't be around in 5 years time. crypto_box is Curve25519 + XSalsa20-Poly1305.
wrs 8y ago
Those fancy box thingies are very well specified and fit into 100 tweets worth of public domain ANSI C with no dependencies. If you want your format to last 100 years, I’m not sure how to ensure it better than that. https://tweetnacl.cr.yp.to/ https://tweetnacl.cr.yp.to/
- eropple 8y ago
  Yup--unless you think future you isn't going to be able to lay hands on a C compiler, you can literally tuck a copy of it alongside all your backups forever and ever anon.
eropple 8y ago
Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". While it's drying up and disappearing, is it going to take with it things like rbnacl which both use it transitively, package it for their environments, and also have some pretty great documentation on how it works? Is it going to take with it the public definitions of Curve25519 and XSalsa20+Poly1305? Are we going to get all neuralyzed and just...lose it? Look, I'm no security wonk. I have some interest in it, but that's it. And even I realize that libsodium as a thing you can use if you need to will probably outlive both you and I. Also, FWIW, it took me literally one Google search to find a bzip decompressor. I did have to read a page first, though.
- throwaway415415 8y ago
  Did Tink rely on NaCl or libsodium?
  - eropple 8y ago
    http://google.github.io/tink/javadoc/tink/1.0.0/com/google/crypto/tink/subtle/NaClCryptoBox.html http://google.github.io/tink/javadoc/tink/1.0.0/com/google/c... Tink implements it, though it does not rely on it.
- agumonkey 8y ago
  Google is not necessarily forever
  - e12e 8y ago
    Memento Alta Vista
  - eropple 8y ago
    Yeah, and neither are any of us. The idea that we're just going to lose incredibly central open-source projects in five years--or, frankly, fifty--is bonkers and your objection is to the color of the bikeshed.
- jwr 8y ago
  > Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". I didn't write about libsodium. I wrote about tools I can actually use to access my data — while writing my own utilities to decode my stuff is fun, it is not necessarily how I choose to spend my time. And the fact that something was written by HN celebrities doesn't change much — being revered in HN circles is not necessarily indicative of real-life performance and certainly not of software longevity :-)
  - eropple 8y ago

by jwr 8y ago

blattimwind 8y ago

> Those fancy 'nacl/box' thingies? I'm willing to make a bet that they won't be around in 5 years time. crypto_box is Curve25519 + XSalsa20-Poly1305.

wrs 8y ago

Those fancy box thingies are very well specified and fit into 100 tweets worth of public domain ANSI C with no dependencies. If you want your format to last 100 years, I’m not sure how to ensure it better than that. https://tweetnacl.cr.yp.to/ https://tweetnacl.cr.yp.to/

eropple 8y ago
Yup--unless you think future you isn't going to be able to lay hands on a C compiler, you can literally tuck a copy of it alongside all your backups forever and ever anon.

eropple 8y ago

Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". While it's drying up and disappearing, is it going to take with it things like rbnacl which both use it transitively, package it for their environments, and also have some pretty great documentation on how it works? Is it going to take with it the public definitions of Curve25519 and XSalsa20+Poly1305? Are we going to get all neuralyzed and just...lose it? Look, I'm no security wonk. I have some interest in it, but that's it. And even I realize that libsodium as a thing you can use if you need to will probably outlive both you and I. Also, FWIW, it took me literally one Google search to find a bzip decompressor. I did have to read a page first, though.

throwaway415415 8y ago
Did Tink rely on NaCl or libsodium?
- eropple 8y ago
  http://google.github.io/tink/javadoc/tink/1.0.0/com/google/crypto/tink/subtle/NaClCryptoBox.html http://google.github.io/tink/javadoc/tink/1.0.0/com/google/c... Tink implements it, though it does not rely on it.
agumonkey 8y ago
Google is not necessarily forever
- e12e 8y ago
  Memento Alta Vista
- eropple 8y ago
  Yeah, and neither are any of us. The idea that we're just going to lose incredibly central open-source projects in five years--or, frankly, fifty--is bonkers and your objection is to the color of the bikeshed.
jwr 8y ago
> Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". I didn't write about libsodium. I wrote about tools I can actually use to access my data — while writing my own utilities to decode my stuff is fun, it is not necessarily how I choose to spend my time. And the fact that something was written by HN celebrities doesn't change much — being revered in HN circles is not necessarily indicative of real-life performance and certainly not of software longevity :-)
- eropple 8y ago