34 ms·

Orion looks cool, but i'm curious - where would one learn how to use a library like Orion? Eg, if Orion is aimed at easy to use - i'm still not the target audie

Orion looks cool, but i'm curious - where would one learn how to use a library like Orion? Eg, if Orion is aimed at easy to use - i'm still not the target audience. But, i do write software that i want to allow users to sign. To encrypt their data at rest. To verify signatures. Where would i learn what i need to use smart tools by other people? Where would i learn enough to decide how to choose solving my above problems with Orion vs GPG? That's been my biggest problem with crypto. I know enough to know to be wary, but not much beyond that. Choosing tools with that mindset is difficult. And so far, taking a crypto class is just teaching me fundamentals of building my own protocols - where as i just want to use existing tech, safely, and in the right situations.

vlmutolo 6y ago
That's a good question, and I'd be interested in hearing more about what parts of the library you're hung up on. The intention of the library is definitely to cater to people who don't know anything about crypto. My naive guess, without knowing exactly what the sticking point is for you, is that Orion could do a better job on the modules page [1] explaining exactly what each module is for and when to use it. Right now, I'd say the state of the library, rather than its intention, is that it's extremely usable for people who pretty much know what they want, and fairly hard for the average developer to misuse. But I believe the author would be very interested in something that makes the library cater better to people who don't want to learn crypto, but just want to get things done using it. [1] https://docs.rs/orion/0.15.5/orion/index.html#modules https://docs.rs/orion/0.15.5/orion/index.html#modules EDIT: After some thought, I think I would say that the API for Orion is maybe an 8/10 for beginners, but the documentation is still at maybe 5/10 or 6/10 for beginners. Someone who is familiar with crypto would probably be able to look at the documentation and know what they're doing, but for someone unfamiliar with crypto, I can see how there isn't a ton in the way of explanation of the various primitives. That would be a good area for improvement for the library.
- adkadskhj 6y ago
  Sorry for the delay. Your guess is correct. I reach the modules page with a goal in mind, "I want to sign some data", "I want to generate a key pair to sign some data", etc - and am left questioning where to go next. Now, that sounds lazy, but it's more.. cautious - as i mentioned i am very wary of a potential footgun that would leave me using the wrong tool or the right tool in the wrong way. So without very, very explicit goal oriented documentation i'm left confused, unsure which module should be used to do what i seek. Crypto puts people who know the unknowns in an awkward position. If i was fully ignorant i'd probably find more progress, as i'd be willing to just throw bytes around and see what works. Yet i've seen so many horror stories and tales of caution that i'm left never knowing if it's safe to do X in Y scenario. Combine that with my goal of using this code in Desktop, Mobile, WASM (maybe web, definitely mobile, etc) - and a bunch of scary new attack vectors get introduced and compound confusion. It's difficult to know where to start haha. Anyway, hopefully this answers your question :)
kilburn 6y ago
The libsodium's docs [1] are awesome in this regard, particularly the sections (and subsections) on secret-key and public-key cryptography. If you study those docs you'll get the modern terminology used by most other libraries as well as the intended use-cases for the different cryptographic constructs. Your examples point to public-key use-cases, and I don't see any public-key crypto support in this Orion library, so probably you just wouldn't use it ;) [1] https://doc.libsodium.org/ https://doc.libsodium.org/
brycx 6y ago
Author and maintainer of Orion here. I really appreciate your feedback, thank you! After reading this, I think your point-of-view hasn't been taken correctly into account when creating and reviewing the documentation. I'll definitely take this up to consideration in regards to possible improvements.
- adkadskhj 6y ago
  Appreciate it! I also heavily appreciate attempts to make crypto more usable for general software devs. For some more insight (as someone else was asking), i replied with a bit more depth here: https://news.ycombinator.com/item?id=25449538 https://news.ycombinator.com/item?id=25449538 Thanks for the awesome looking library. I'll go ahead and fumble my way through it soon, i'm sure it's not as complex as i'm making it. I'm just not sure what usage is "safe" - so i look forward to documentation that helps me understand Safety in this context :)

vlmutolo 6y ago

That's a good question, and I'd be interested in hearing more about what parts of the library you're hung up on. The intention of the library is definitely to cater to people who don't know anything about crypto. My naive guess, without knowing exactly what the sticking point is for you, is that Orion could do a better job on the modules page [1] explaining exactly what each module is for and when to use it. Right now, I'd say the state of the library, rather than its intention, is that it's extremely usable for people who pretty much know what they want, and fairly hard for the average developer to misuse. But I believe the author would be very interested in something that makes the library cater better to people who don't want to learn crypto, but just want to get things done using it. [1] https://docs.rs/orion/0.15.5/orion/index.html#modules https://docs.rs/orion/0.15.5/orion/index.html#modules EDIT: After some thought, I think I would say that the API for Orion is maybe an 8/10 for beginners, but the documentation is still at maybe 5/10 or 6/10 for beginners. Someone who is familiar with crypto would probably be able to look at the documentation and know what they're doing, but for someone unfamiliar with crypto, I can see how there isn't a ton in the way of explanation of the various primitives. That would be a good area for improvement for the library.

adkadskhj 6y ago
Sorry for the delay. Your guess is correct. I reach the modules page with a goal in mind, "I want to sign some data", "I want to generate a key pair to sign some data", etc - and am left questioning where to go next. Now, that sounds lazy, but it's more.. cautious - as i mentioned i am very wary of a potential footgun that would leave me using the wrong tool or the right tool in the wrong way. So without very, very explicit goal oriented documentation i'm left confused, unsure which module should be used to do what i seek. Crypto puts people who know the unknowns in an awkward position. If i was fully ignorant i'd probably find more progress, as i'd be willing to just throw bytes around and see what works. Yet i've seen so many horror stories and tales of caution that i'm left never knowing if it's safe to do X in Y scenario. Combine that with my goal of using this code in Desktop, Mobile, WASM (maybe web, definitely mobile, etc) - and a bunch of scary new attack vectors get introduced and compound confusion. It's difficult to know where to start haha. Anyway, hopefully this answers your question :)

kilburn 6y ago

The libsodium's docs [1] are awesome in this regard, particularly the sections (and subsections) on secret-key and public-key cryptography. If you study those docs you'll get the modern terminology used by most other libraries as well as the intended use-cases for the different cryptographic constructs. Your examples point to public-key use-cases, and I don't see any public-key crypto support in this Orion library, so probably you just wouldn't use it ;) [1] https://doc.libsodium.org/ https://doc.libsodium.org/

brycx 6y ago

Author and maintainer of Orion here. I really appreciate your feedback, thank you! After reading this, I think your point-of-view hasn't been taken correctly into account when creating and reviewing the documentation. I'll definitely take this up to consideration in regards to possible improvements.

adkadskhj 6y ago
Appreciate it! I also heavily appreciate attempts to make crypto more usable for general software devs. For some more insight (as someone else was asking), i replied with a bit more depth here: https://news.ycombinator.com/item?id=25449538 https://news.ycombinator.com/item?id=25449538 Thanks for the awesome looking library. I'll go ahead and fumble my way through it soon, i'm sure it's not as complex as i'm making it. I'm just not sure what usage is "safe" - so i look forward to documentation that helps me understand Safety in this context :)