4 ms·
I disagree. Making one specific aspect of incompetent crypto coding “safer” doesn’t solve any of the problems. We can argue about what threshold you need to r
by bigiain 6y ago
I disagree.
Making one specific aspect of incompetent crypto coding “safer” doesn’t solve any of the problems.
We can argue about what threshold you need to reach to be considered “capable” of writing crypto code (that’s not just a learning exercise), but not knowing the deficiencies of random() is clearly well below that bar. Even knowing that is barely past the “don’t eat your crayons” level of skill.
If anything, a hook in your CI pipeline that automatically fires anybody who checks in code using random() in a cryptographic context is a better way to “make all of us safer”.
- aaomidi 6y agoYou could be a great mathematician and not realize what kind of random you're picking. It's not as simple as you put it. This discussion goes for other stuff too. Rust is getting popular because even amazing C and C++ devs make terrible mistakes that cause severe security and privacy problems down the line.
- thekyle 6y agoJust because someone is a great mathematician does not mean they would be a great cryptographer. Mathematics and cryptography are about as related as computer science and cryptography (not that much).