3 ms·

If you ask a surgeon how to become one, they'll tell you to go to pre-med and then medical school and then become a resident and so on. There's a path to get th

by api 4y ago

If you ask a surgeon how to become one, they'll tell you to go to pre-med and then medical school and then become a resident and so on. There's a path to get there. They won't say "don't become a surgeon, go away." If you ask a crypto developer how to become one, they tell you to go away. "Don't roll your own crypto." Not "here's where you go to learn how to do crypto correctly, and here's a test you can take to determine if you're ready to do it." There's no generally accepted path to learn or to test your knowledge. There's just this informal guild of people we think know what they're doing. So no, it's nothing like medicine except in the most superficial sense of them both being hard things.

carapace 4y ago
Keeping with the metaphor, the solution to the situation is to start a medical school, not to encourage people to attempt surgery without any training, eh?
- api 4y ago
  I agree. My criticism is that the majority of the cryptography community just turns up their nose and does neither. They just say "go away," and people are obviously not listening to that and are instead attempting amateur surgery. The solution is to provide better learning materials. BTW some people often say "just use libraries." The problem is that even the best designed cryptographic libraries are easy to misuse if you don't at least understand the basics of what those building blocks are doing. Imagine using a networking library without knowing what a TCP connection is or how it behaves. You don't need to understand the deep internals of TCP but you need to at least know the semantics and what the protocol does.
  - gonehome 4y ago
    I agree with all of this and also experienced it first hand. It makes it harder to learn because instead of people sharing good info or places to learn they just repeat chants of why you shouldn’t learn it.
CRConrad 4y ago
But "roll your own crypto" isn't the same as "become a crypto developer", just like "do your own surgery" isn't the same as "become a surgeon". "You can't roll your own crypto without becoming a crypto developer first" is just as valid as "You can't do your own surgery without becoming a surgeon first". Those crypto developers didn't become crypto developers the first time they fucked up rolling their own crypto; it took lots of failures and probably quite a bit of formal study. Exactly like surgeons do lots of formal studying (and do their first fuck-ups on people who are already dead). So yes, it's pretty much exactly like medicine, down to the most fundamental sense of them both being hard things that one needs to learn by formal studying and lots of preferably harmless fuck-ups.

by api 4y ago

carapace 4y ago

Keeping with the metaphor, the solution to the situation is to start a medical school, not to encourage people to attempt surgery without any training, eh?

api 4y ago
I agree. My criticism is that the majority of the cryptography community just turns up their nose and does neither. They just say "go away," and people are obviously not listening to that and are instead attempting amateur surgery. The solution is to provide better learning materials. BTW some people often say "just use libraries." The problem is that even the best designed cryptographic libraries are easy to misuse if you don't at least understand the basics of what those building blocks are doing. Imagine using a networking library without knowing what a TCP connection is or how it behaves. You don't need to understand the deep internals of TCP but you need to at least know the semantics and what the protocol does.
- gonehome 4y ago
  I agree with all of this and also experienced it first hand. It makes it harder to learn because instead of people sharing good info or places to learn they just repeat chants of why you shouldn’t learn it.

CRConrad 4y ago

But "roll your own crypto" isn't the same as "become a crypto developer", just like "do your own surgery" isn't the same as "become a surgeon". "You can't roll your own crypto without becoming a crypto developer first" is just as valid as "You can't do your own surgery without becoming a surgeon first". Those crypto developers didn't become crypto developers the first time they fucked up rolling their own crypto; it took lots of failures and probably quite a bit of formal study. Exactly like surgeons do lots of formal studying (and do their first fuck-ups on people who are already dead). So yes, it's pretty much exactly like medicine, down to the most fundamental sense of them both being hard things that one needs to learn by formal studying and lots of preferably harmless fuck-ups.