4 ms·

Putting aside Zed's abrasiveness, is this just a miscommunication around whether unqualified (to write crypto) developers should attempt to write crypto code at

Putting aside Zed's abrasiveness, is this just a miscommunication around whether unqualified (to write crypto) developers should attempt to write crypto code at all, versus whether they should publish/use said work in production? I'd argue that it's perfectly reasonable for unqualified devs to write crypto code... as long as that code never reaches a production server. I could well be wrong, but with arguments like this I'm always inclined to first consider that the two sides are talking past each other. I can't see any reasonable person arguing either that unqualified devs should release custom crypto into the world, or that they should not even write crypto code as a learning exercise.

busterarm 6y ago
Yes, you've absolutely summed it up. The blog post about Zed's ego is a massive overreaction and also probably a bruised ego. Zed gets accused of gatekeeping when the author themselves was gatekeeping at the start. There's lots of projection going on here. This is why we shouldn't entertain personal attacks period, regardless of who it is.
- some_furry 6y ago
  > The blog post about Zed's ego is a massive overreaction and also probably a bruised ego. It most certainly is not. I'm very used to shouldering insults and ego-bruising without reacting. The problem here isn't about me at all. The problem here is about the consequences of Zed's behavior towards newcomers to computer programming.
  - busterarm 6y ago
    > Zed's behavior towards newcomers to computer programming. You mean his behavior of offering newcomers education resources to get their careers started that for many years he offered completely for free? I think it's pretty clear from the tweet that he wasn't attacking some newcomer but calling into question professional credentials.
    - some_furry 6y ago
      > I think it's pretty clear from the tweet that he wasn't attacking some newcomer but calling into question professional credentials. Calling into question professional credentials is, ceterus paribus, fine and not noteworthy. His metric for evaluating professional credentials was "Has this author done this oddly specific thing to attack a library I don't like?" When asked, he doubled down on this arbitrary litmus test. I even included a personal anecdote for how this kind of behavior can negatively impact newcomers to any field (regardless of actual skill level!). Unnecessary gatekeeping is a problem. Impostor Syndrome sucks.
      - busterarm 6y ago
        No, you are missing the entire point. His comment was a response to your post. Your post discouraged people from writing crypto, because they aren't qualified. This is where you were gatekeeping. His response was, effectively: "well, you're so qualified, but you never said anything about how the industry standard library for crypto was swiss cheese for 20 years". He's basically saying that even the qualified people don't do a good job and that nobody should be discouraged from at least trying. The point is that everyone is fallible and you went out of your way to prove him right.
        soatok 6y ago
        > His comment was a response to your post. Your post discouraged people from writing crypto, because they aren't qualified. This is where you were gatekeeping. Re-read the post carefully. I included examples of people unwittingly trying to gatekeep me in the past. The negative part of that post was about scammers and crackpots who, when confronted with constructive feedback about their designs, doubled down insisting they were smarter than their critics. Being a neophyte doesn't make you a crackpot. From the article: > If you’re reading this blog post and feel like learning about cryptography and cryptanalysis and feel put off by the “don’t roll your own crypto” mantra, and its implied gatekeeping, I hope it’s clear by now who that phrase was mostly intended for and why. (i.e. "NOT YOU" was the implication of that sentence) The post in question is a lot of things, but it's not a gatekeeping piece. For that matter, I also previously wrote this one to resist the tendency of gatekeeping in cryptography: https://soatok.blog/2020/06/10/how-to-learn-cryptography-as-a-programmer/ https://soatok.blog/2020/06/10/how-to-learn-cryptography-as-...
some_furry 6y ago
> Putting aside Zed's abrasiveness, is this just a miscommunication around whether unqualified (to write crypto) developers should attempt to write crypto code at all, versus whether they should publish/use said work in production? I'd argue that it's perfectly reasonable for unqualified devs to write crypto code... as long as that code never reaches a production server. You might be very interested in the previous post (the one Zed mentioned when he tried to shame me for at the beginning of this exchange): https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/ https://soatok.blog/2021/02/09/crackpot-cryptography-and-sec...
- busterarm 6y ago
  You're wrapping your flamebait/personal attacks in a blog post so you can submit it to HN for brownie points. This wouldn't be tolerated in comments and shouldn't be in submissions either. Frankly, some of us aren't interested in your personal spat with someone. Grow up.
- beaconstudios 6y ago
  Thanks - I've read your original post and I agree with your write-up. I still suspect that Zed basically skim-read and misinterpreted your message - he probably has a knee-jerk reaction to the phrase "don't roll your own crypto" and dived on twitter to respond to that, which IMO is a behaviour twitter trains/incentivises people to do (hot takes). The idea that "quantum woo crackpots in crypto are bad" is basically universally agreeable to any reasonable person, including Zed, hence why I think he just knee-jerked in this case.
  - busterarm 6y ago
    I think that's in the ballpark, but Zed also seems to be intuitively aware of something else going on in the infosec community that most people outside of it aren't. There's a huge emphasis on publishing and branding/networking and as a result there are a lot of talking heads. Thing is, most of them are punching _way_ above their weight and it's mostly people just cargo culting their way through the industry. Literally for 20 years, people just looked at OpenSSL and said "well everyone else says it's okay." Knowing a little bit the way Zed is, I think his reaction is because he's sick of the talking heads versus the mediocre output from the "experts" in industry. I thankfully don't work "in infosec", but millions of dollars of infrastructure and its security is my responsibility and I'm not clueless. In fact, I earned my Black Badge doing something legitimately difficult. I'd say that 3/4 of the supposed professionals that I encounter in industry are at least six ways full of shit.
derefr 6y ago
There’s a middle-ground, there, where you’re developing something that you intend purely as a personal learning exercise, but you’re doing it in public — or at least not well-hidden enough — and then someone comes along, finds it, and uses it. (There’s an analogy to make with security researchers who develop exploits while practicing bad OPSEC — they don’t intend to create viruses, but their actions predictably lead to the creation of viruses anyway, since virus-writers watch them closely.) Keep in mind that usually, people just hacking on an idea for a few hours (who aren’t coding celebrities who expect all their repos to be well-trafficked just because they’re their repos) don’t bother to put up a huge warning in the README of a slapdash exercise, to point out that it isn’t for production use. This used to be a bigger deal back when GitHub was the code-host but also didn’t offer free private repos; it effectively forced independent developers and students into working in public. But it’s still somewhat of a big deal, because people will still choose to make their repos public in order to more easily collaborate on them in the context of e.g. school exercises. (Because forming a GitHub org and adding ACLs is extremely onerous when you could just make the repo public and share the URL.) IMHO, code-hosting companies would be well-served by adding a checkbox to the repo setup process (sort of like the ones for adding a .gitignore or a LICENSE) to indicate that the repo contains code written as a learning exercise for $thing; such that checking that box would insert a big flashy warning on the page that the repo is not to be used as a reference for the idiomatic way to use $thing. (And maybe, on top of that, make it impossible to clone the repo through HTTP until the username you’re cloning as has pressed a confirmation button on that warning.)
- beaconstudios 6y ago
  yes there's certainly an issue with the current trend of developing everything in public, and the lack of clarity about what is and is not safe to use. There's also the land-grab issue where as a new language/ecosystem appears, the first people to write libraries for any given purpose get all the installs and thus all the attention & potentially profit, leading to perverse incentives to shit out tons of undertested code when a new platform gains traction. Presumably the mechanism of preventing people from relying on bad code is the typical behaviour of "add the dependency from npm/rubygems/crate/etc that is most popular for the subject", where most learning-exercise code doesn't get pushed to a distribution platform, and if it does, doesn't get widely dispersed. Of course this doesn't protect against people /trying/ to distribute code that is not up-to-press, but that's a social rather than a technical hurdle to overcome.

busterarm 6y ago

Yes, you've absolutely summed it up. The blog post about Zed's ego is a massive overreaction and also probably a bruised ego. Zed gets accused of gatekeeping when the author themselves was gatekeeping at the start. There's lots of projection going on here. This is why we shouldn't entertain personal attacks period, regardless of who it is.

some_furry 6y ago
> The blog post about Zed's ego is a massive overreaction and also probably a bruised ego. It most certainly is not. I'm very used to shouldering insults and ego-bruising without reacting. The problem here isn't about me at all. The problem here is about the consequences of Zed's behavior towards newcomers to computer programming.
- busterarm 6y ago
  > Zed's behavior towards newcomers to computer programming. You mean his behavior of offering newcomers education resources to get their careers started that for many years he offered completely for free? I think it's pretty clear from the tweet that he wasn't attacking some newcomer but calling into question professional credentials.
  - some_furry 6y ago
    > I think it's pretty clear from the tweet that he wasn't attacking some newcomer but calling into question professional credentials. Calling into question professional credentials is, ceterus paribus, fine and not noteworthy. His metric for evaluating professional credentials was "Has this author done this oddly specific thing to attack a library I don't like?" When asked, he doubled down on this arbitrary litmus test. I even included a personal anecdote for how this kind of behavior can negatively impact newcomers to any field (regardless of actual skill level!). Unnecessary gatekeeping is a problem. Impostor Syndrome sucks.
    - busterarm 6y ago
      No, you are missing the entire point. His comment was a response to your post. Your post discouraged people from writing crypto, because they aren't qualified. This is where you were gatekeeping. His response was, effectively: "well, you're so qualified, but you never said anything about how the industry standard library for crypto was swiss cheese for 20 years". He's basically saying that even the qualified people don't do a good job and that nobody should be discouraged from at least trying. The point is that everyone is fallible and you went out of your way to prove him right.
      - soatok 6y ago
        > His comment was a response to your post. Your post discouraged people from writing crypto, because they aren't qualified. This is where you were gatekeeping. Re-read the post carefully. I included examples of people unwittingly trying to gatekeep me in the past. The negative part of that post was about scammers and crackpots who, when confronted with constructive feedback about their designs, doubled down insisting they were smarter than their critics. Being a neophyte doesn't make you a crackpot. From the article: > If you’re reading this blog post and feel like learning about cryptography and cryptanalysis and feel put off by the “don’t roll your own crypto” mantra, and its implied gatekeeping, I hope it’s clear by now who that phrase was mostly intended for and why. (i.e. "NOT YOU" was the implication of that sentence) The post in question is a lot of things, but it's not a gatekeeping piece. For that matter, I also previously wrote this one to resist the tendency of gatekeeping in cryptography: https://soatok.blog/2020/06/10/how-to-learn-cryptography-as-a-programmer/ https://soatok.blog/2020/06/10/how-to-learn-cryptography-as-...

some_furry 6y ago

> Putting aside Zed's abrasiveness, is this just a miscommunication around whether unqualified (to write crypto) developers should attempt to write crypto code at all, versus whether they should publish/use said work in production? I'd argue that it's perfectly reasonable for unqualified devs to write crypto code... as long as that code never reaches a production server. You might be very interested in the previous post (the one Zed mentioned when he tried to shame me for at the beginning of this exchange): https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/ https://soatok.blog/2021/02/09/crackpot-cryptography-and-sec...

busterarm 6y ago
You're wrapping your flamebait/personal attacks in a blog post so you can submit it to HN for brownie points. This wouldn't be tolerated in comments and shouldn't be in submissions either. Frankly, some of us aren't interested in your personal spat with someone. Grow up.
beaconstudios 6y ago
Thanks - I've read your original post and I agree with your write-up. I still suspect that Zed basically skim-read and misinterpreted your message - he probably has a knee-jerk reaction to the phrase "don't roll your own crypto" and dived on twitter to respond to that, which IMO is a behaviour twitter trains/incentivises people to do (hot takes). The idea that "quantum woo crackpots in crypto are bad" is basically universally agreeable to any reasonable person, including Zed, hence why I think he just knee-jerked in this case.
- busterarm 6y ago
  I think that's in the ballpark, but Zed also seems to be intuitively aware of something else going on in the infosec community that most people outside of it aren't. There's a huge emphasis on publishing and branding/networking and as a result there are a lot of talking heads. Thing is, most of them are punching _way_ above their weight and it's mostly people just cargo culting their way through the industry. Literally for 20 years, people just looked at OpenSSL and said "well everyone else says it's okay." Knowing a little bit the way Zed is, I think his reaction is because he's sick of the talking heads versus the mediocre output from the "experts" in industry. I thankfully don't work "in infosec", but millions of dollars of infrastructure and its security is my responsibility and I'm not clueless. In fact, I earned my Black Badge doing something legitimately difficult. I'd say that 3/4 of the supposed professionals that I encounter in industry are at least six ways full of shit.

derefr 6y ago

There’s a middle-ground, there, where you’re developing something that you intend purely as a personal learning exercise, but you’re doing it in public — or at least not well-hidden enough — and then someone comes along, finds it, and uses it. (There’s an analogy to make with security researchers who develop exploits while practicing bad OPSEC — they don’t intend to create viruses, but their actions predictably lead to the creation of viruses anyway, since virus-writers watch them closely.) Keep in mind that usually, people just hacking on an idea for a few hours (who aren’t coding celebrities who expect all their repos to be well-trafficked just because they’re their repos) don’t bother to put up a huge warning in the README of a slapdash exercise, to point out that it isn’t for production use. This used to be a bigger deal back when GitHub was the code-host but also didn’t offer free private repos; it effectively forced independent developers and students into working in public. But it’s still somewhat of a big deal, because people will still choose to make their repos public in order to more easily collaborate on them in the context of e.g. school exercises. (Because forming a GitHub org and adding ACLs is extremely onerous when you could just make the repo public and share the URL.) IMHO, code-hosting companies would be well-served by adding a checkbox to the repo setup process (sort of like the ones for adding a .gitignore or a LICENSE) to indicate that the repo contains code written as a learning exercise for $thing; such that checking that box would insert a big flashy warning on the page that the repo is not to be used as a reference for the idiomatic way to use $thing. (And maybe, on top of that, make it impossible to clone the repo through HTTP until the username you’re cloning as has pressed a confirmation button on that warning.)

beaconstudios 6y ago
yes there's certainly an issue with the current trend of developing everything in public, and the lack of clarity about what is and is not safe to use. There's also the land-grab issue where as a new language/ecosystem appears, the first people to write libraries for any given purpose get all the installs and thus all the attention & potentially profit, leading to perverse incentives to shit out tons of undertested code when a new platform gains traction. Presumably the mechanism of preventing people from relying on bad code is the typical behaviour of "add the dependency from npm/rubygems/crate/etc that is most popular for the subject", where most learning-exercise code doesn't get pushed to a distribution platform, and if it does, doesn't get widely dispersed. Of course this doesn't protect against people /trying/ to distribute code that is not up-to-press, but that's a social rather than a technical hurdle to overcome.