4 ms·

It's clearly research code meant as a proof-of-concept of their paper, not something to take and use in production. If you're going to criticize it, maybe do i

by jrpt 7y ago

It's clearly research code meant as a proof-of-concept of their paper, not something to take and use in production. If you're going to criticize it, maybe do it more respectfully, and also focus on the paper, ideas, and motivation, not the particular proof-of-concept code. I'm decently familiar with this space and haven't read the paper yet, but the problem it's addressing is important.

jfindley 7y ago
The link was to www.churp.io which looks to me much more like a product than a research paper. One of the authors helpfully clarified below, but at least to me it was extremely unclear that this was the case - had it been more obvious I'd have phrased my original comment very differently. On second inspection one of the blue links does point to "full paper" but there's still lots of words that imply that it's a viable working product, which it really isn't.
- leetrout 7y ago
  We posted at the same time. This is exactly right. It looks like it’s trying to be a marketed, accepted solution.
leetrout 7y ago
A branded website that makes claims to solve the problem broadly doesn’t give the impression it’s “just a proof of concept”. It even invites developers to “give it a try”.
emilfihlman 7y ago
You are clearly missing the point. Not even research code should use rand and if you are, you have just lost half of your credibility.
- SquishyPanda23 7y ago
  Ari Juels and Dawn Song know what they're doing. Whether their students use rand in their demo code has zero impact on their credibility.
  - baby 7y ago
    You are all right. These people know what they're doing, but they're also academics and are probably not the best implementers. There are no lessons to be learned here.
    - al_coder 7y ago
      Are you kidding ? There is plenty of of lessons to be learned here - Code involving cryptography should be written with some level of basic rigor, even at that prototype phase, otherwise you lose credibility (evidence above) - Code involving cryptography that's in a prototype phase should not be marketed in a bubbly 'use this now' fashion - Academics should be aware that their code is likely to be taken and used as is I could go on all day. EDIT: I left this out initially, then edited it in, then edited it out, but to claim that "they know what they are doing" so whatever their students do doesn't impact their credibility is so bizarre. Surely these students are supposed to be being taught to go and become implementators or advise implementators. So maybe they should be taught to not use rand(), to have a clear and reproducible project build, to not provide prototype work marketed as usable, etc, etc. Cryptography is usually broken (bypassed) by implementation flaws, afaik, and I'm not even an expert. I'm not taking a position on this code base or paper because I haven't looked much, just on the argument that "they know what they are doing so its fine" and "it's fine that academics can't implement, they are only working on cryptography"
      - baby 7y ago
        Where did I say that this was fine? I think you are over reacting.

by jrpt 7y ago

jfindley 7y ago

The link was to www.churp.io which looks to me much more like a product than a research paper. One of the authors helpfully clarified below, but at least to me it was extremely unclear that this was the case - had it been more obvious I'd have phrased my original comment very differently. On second inspection one of the blue links does point to "full paper" but there's still lots of words that imply that it's a viable working product, which it really isn't.

leetrout 7y ago
We posted at the same time. This is exactly right. It looks like it’s trying to be a marketed, accepted solution.

leetrout 7y ago

A branded website that makes claims to solve the problem broadly doesn’t give the impression it’s “just a proof of concept”. It even invites developers to “give it a try”.

emilfihlman 7y ago

You are clearly missing the point. Not even research code should use rand and if you are, you have just lost half of your credibility.

SquishyPanda23 7y ago
Ari Juels and Dawn Song know what they're doing. Whether their students use rand in their demo code has zero impact on their credibility.
- baby 7y ago
  You are all right. These people know what they're doing, but they're also academics and are probably not the best implementers. There are no lessons to be learned here.
  - al_coder 7y ago
    Are you kidding ? There is plenty of of lessons to be learned here - Code involving cryptography should be written with some level of basic rigor, even at that prototype phase, otherwise you lose credibility (evidence above) - Code involving cryptography that's in a prototype phase should not be marketed in a bubbly 'use this now' fashion - Academics should be aware that their code is likely to be taken and used as is I could go on all day. EDIT: I left this out initially, then edited it in, then edited it out, but to claim that "they know what they are doing" so whatever their students do doesn't impact their credibility is so bizarre. Surely these students are supposed to be being taught to go and become implementators or advise implementators. So maybe they should be taught to not use rand(), to have a clear and reproducible project build, to not provide prototype work marketed as usable, etc, etc. Cryptography is usually broken (bypassed) by implementation flaws, afaik, and I'm not even an expert. I'm not taking a position on this code base or paper because I haven't looked much, just on the argument that "they know what they are doing so its fine" and "it's fine that academics can't implement, they are only working on cryptography"
    - baby 7y ago
      Where did I say that this was fine? I think you are over reacting.