4 ms·
If X=crypto, then never.
by qrbLPHiKpiux 7y ago
If X=crypto, then never.
- squirrelicus 7y agoWhoever downvoted this deserves to have their license to code revoked. It's malpractice to roll your own crypto.
- dpratt 7y agoAmen. This is equivalent to an attorney strongly encouraging a client to represent themselves in court.
- username90 7y agoHe got down-voted for posting a meme in a mostly unrelated topic, not for the validity of the advice.
- segmondy 7y ago... and how do you know the person rolling their own crypto doesn't have the skills? Isn't the crypto libraries out there written by humans? If you're rolling your own crypto because you believe in security by obscurity then you're probably not smart enough to roll your own. But if you're willing to open it up to the world because you have a new trick up your sleeves then sure if you have the background. I still think that ties into the original question, when does it make sense to roll your own? If it's not part of your core business and doesn't give you an edge, then it never makes sense, unless you're doing it for the fun of it.
- squirrelicus 7y agoIf you have the skill, we already know who you are. You have millions in the project and a dozen PhDs working with you, and you've already authored public papers demonstrating the weaknesses of things previously believed to be strong. If you are not at least one of those things, it's malpractice for you to even consider letting your employer pay for your crypto "invention"s. That's like a nurse building her own OR and insisting the hospital let her cut people open in it. No. Don't. Stop.
- dpratt 7y agoYou’re likely being downvoted due to the pithiness of your comment, but you make an excellent point. I’ve always promoted the three Iron Laws of never implementing 1) Encryption 2) Date/time math 3) Distributed locking/concurrency primitives All of these are of sufficient complexity to virtually guarantee that you’re going to miss a score of subtle edge cases, and the consequences thereof are likely simultaneously pervasive, silent and catastrophic.
- polskibus 7y agoWhich open source distributed locking libraries would you recommend?
- _Nat_ 7y agoSome of the downvotes may be from crypto-programmers' frustrations, too. I mean, obviously, someone has to code crypto, or else it wouldn't exist. But, whenever you try talking about the topic online -- whether you're doing it professionally or for self-education -- a probably well-meaning chorus of spam comments warn against doing anything. I suspect that some crypto-folks have given up rebutting the don't-roll-your-own stuff and just down-vote reflexively.
- Gibbon1 7y agoMy frustration with don't write you own is you get strongly urged to use either libraries that are nothing but a tinker toy set of primitives. Or sudo apt-get install openssl.