10 ms·
Except encryption. You don't want to roll your own at all.
by ternaryoperator 7y ago
Except encryption. You don't want to roll your own at all.
- yjftsjthsd-h 7y agoI think the advice holds. Cryptographic primitives are vanishingly unlikely to be your core business, even if the things built on them are. Therefore, almost nobody should be building them.
- kstrauser 7y agoSuper important exception. Thanks for mentioning it! Unless you've spent the last 10+ years working on encryption full time, please don't try it yourself. I used to think I could write crypto. Then I learned more and realized it needs specialized knowledge I don't have the time to acquire. Then I spent some time trying to acquire it and figured I was OK to try again. Then I watched many other more experienced organizations crash and burn. My current position is that I know enough about crypto to know I never want anything to do with authoring it.
- ska 7y agoI don't think that's an exception. It's just that encryption isn't actually core functionality for most businesses (even some that think it is). And if it is core functionality, you should have staff qualified to roll their own, and you should all know why you are doing this (i.e. what differentiation you are going after). This really isn't limited to encryption, it's just a hard domain that bumps up against a lot of other domains, so you see more failures than some others. Basically if you are going to build a startup or new program in a hard domain, you need to have the resources to do it properly, and you need to know what those are before you start. This is where being a team of smart and motivated individuals may just not be enough.