10 ms·

> Putting aside Zed's abrasiveness, is this just a miscommunication around whether unqualified (to write crypto) developers should attempt to write crypto code

> Putting aside Zed's abrasiveness, is this just a miscommunication around whether unqualified (to write crypto) developers should attempt to write crypto code at all, versus whether they should publish/use said work in production? I'd argue that it's perfectly reasonable for unqualified devs to write crypto code... as long as that code never reaches a production server. You might be very interested in the previous post (the one Zed mentioned when he tried to shame me for at the beginning of this exchange): https://soatok.blog/2021/02/09/crackpot-cryptography-and-security-theater/ https://soatok.blog/2021/02/09/crackpot-cryptography-and-sec...

busterarm 6y ago
You're wrapping your flamebait/personal attacks in a blog post so you can submit it to HN for brownie points. This wouldn't be tolerated in comments and shouldn't be in submissions either. Frankly, some of us aren't interested in your personal spat with someone. Grow up.
beaconstudios 6y ago
Thanks - I've read your original post and I agree with your write-up. I still suspect that Zed basically skim-read and misinterpreted your message - he probably has a knee-jerk reaction to the phrase "don't roll your own crypto" and dived on twitter to respond to that, which IMO is a behaviour twitter trains/incentivises people to do (hot takes). The idea that "quantum woo crackpots in crypto are bad" is basically universally agreeable to any reasonable person, including Zed, hence why I think he just knee-jerked in this case.
- busterarm 6y ago
  I think that's in the ballpark, but Zed also seems to be intuitively aware of something else going on in the infosec community that most people outside of it aren't. There's a huge emphasis on publishing and branding/networking and as a result there are a lot of talking heads. Thing is, most of them are punching _way_ above their weight and it's mostly people just cargo culting their way through the industry. Literally for 20 years, people just looked at OpenSSL and said "well everyone else says it's okay." Knowing a little bit the way Zed is, I think his reaction is because he's sick of the talking heads versus the mediocre output from the "experts" in industry. I thankfully don't work "in infosec", but millions of dollars of infrastructure and its security is my responsibility and I'm not clueless. In fact, I earned my Black Badge doing something legitimately difficult. I'd say that 3/4 of the supposed professionals that I encounter in industry are at least six ways full of shit.
  - beaconstudios 6y ago
    That's a reasonable interpretation, but then why is Zed lashing out at OP's original article? I've read through it and it's a reasonable argument that many people in crypto have been making for years. "you don't know anything, you haven't even independently audited OpenSSL for free before it was cool" is not a reasonable response to "there's a problem with woo crackpots trying to gain credibility within crypto", but it is a reasonable (if needlessly inflammatory, but we are talking about Zed) response to "nobody should write crypto except experts like me", which is a common misinterpretation of "don't roll your own crypto". Hence why I suspect it was just a kneejerk reaction to a misinterpretation of the article.

busterarm 6y ago

You're wrapping your flamebait/personal attacks in a blog post so you can submit it to HN for brownie points. This wouldn't be tolerated in comments and shouldn't be in submissions either. Frankly, some of us aren't interested in your personal spat with someone. Grow up.

beaconstudios 6y ago

Thanks - I've read your original post and I agree with your write-up. I still suspect that Zed basically skim-read and misinterpreted your message - he probably has a knee-jerk reaction to the phrase "don't roll your own crypto" and dived on twitter to respond to that, which IMO is a behaviour twitter trains/incentivises people to do (hot takes). The idea that "quantum woo crackpots in crypto are bad" is basically universally agreeable to any reasonable person, including Zed, hence why I think he just knee-jerked in this case.

busterarm 6y ago
I think that's in the ballpark, but Zed also seems to be intuitively aware of something else going on in the infosec community that most people outside of it aren't. There's a huge emphasis on publishing and branding/networking and as a result there are a lot of talking heads. Thing is, most of them are punching _way_ above their weight and it's mostly people just cargo culting their way through the industry. Literally for 20 years, people just looked at OpenSSL and said "well everyone else says it's okay." Knowing a little bit the way Zed is, I think his reaction is because he's sick of the talking heads versus the mediocre output from the "experts" in industry. I thankfully don't work "in infosec", but millions of dollars of infrastructure and its security is my responsibility and I'm not clueless. In fact, I earned my Black Badge doing something legitimately difficult. I'd say that 3/4 of the supposed professionals that I encounter in industry are at least six ways full of shit.
- beaconstudios 6y ago
  That's a reasonable interpretation, but then why is Zed lashing out at OP's original article? I've read through it and it's a reasonable argument that many people in crypto have been making for years. "you don't know anything, you haven't even independently audited OpenSSL for free before it was cool" is not a reasonable response to "there's a problem with woo crackpots trying to gain credibility within crypto", but it is a reasonable (if needlessly inflammatory, but we are talking about Zed) response to "nobody should write crypto except experts like me", which is a common misinterpretation of "don't roll your own crypto". Hence why I suspect it was just a kneejerk reaction to a misinterpretation of the article.