4 ms·

As does ad hominem... Edit: realized I should probably explain. What an administrative assistant does in a social engineering attach has nothing to do with the

As does ad hominem... Edit: realized I should probably explain. What an administrative assistant does in a social engineering attach has nothing to do with the quality of cryptographic research at RSA. Humans are ALWAYS the weak point in cryptography.

yock 15y ago
No, ad hominem is "You're wrong 'cause you're a jerk." DanBC pointed out that their opinion might not be as above reproach as is often assumed because of past lapses in good judgment.
- SoftwareMaven 15y ago
  Ad hominem is an attempt to negate the truth of a claim by pointing out a negative characteristic or belief of the person supporting it.[1] That sounds pretty much like what happened above. The truth item is whether RSA's cipher chops can be respected. The negative characteristic is an HR person succumbing to a social engineering attack. Ad hominem isn't just calling names. Let me put it differently: in what way does the HR rep's mistake reduce the quality of ciphers that have come from RSA? 1. http://en.wikipedia.org/wiki/Ad_hominem http://en.wikipedia.org/wiki/Ad_hominem
  - icebraining 15y ago
    Ad hominem is an attack on the person whose argument you're trying to disprove. Here, that person is the one who wrote the article, not RSA. The argument "X is safe because its creator, Y, has a good reputation" can certainly be refuted by attacking the claim that Y has a good reputation. It's not an ad hominem. The fact that the error by the HR person doesn't actually invalidate RSA's reputation as cryptographers is more a Non sequitur.
tptacek 15y ago
What can you share with us about the quality of cryptographic research at big software companies? And, besides that one: what are some other big companies whose cryptographic research you would rely on when selecting algorithms and crypto constructions? Are you sure you know what you're talking about here? I'm not saying you don't, but most HN'ers who would write a comment like yours don't.
- SoftwareMaven 15y ago
  I can't share anything. All I can do is respect the peer review process. I'm certainly not making the real appeal to authority of "they are a big company, so they make good ciphers". If you have something specific, I'd love to hear it. In particular, I'd like to hear how social engineering negatively impacts cipher algorithms (negatively impacting key security doesn't count).
  - tptacek 15y ago
    What can you tell us about the actual peer review process that you think was involved with PBKDF2? (Me just saying it won't be nearly as impactful, because apparently I'm in the tank for bcrypt). Don't know? This will make a worthwhile 30 minute Googling project. That's what I do when I get in over my head, and I promise, learning about adaptive hashing is going to be more useful than reading court decisions about what does or doesn't constitute a breach of the duty of loyalty for a company director (to cite my last Google dive from HN).
    - SoftwareMaven 15y ago
      You seem to have the mistaken opinion I'm arguing for a particular outcome. My point is simple: you can't say RSA is crap because an admin failed. I'm not saying anything else. If you are reading something else into my statement, stop it. If you have information that is relevant to why you shouldn't trust the ciphers from RSA, dish it up. Like I said, I'd love to read it. It is possible to point out a logical phalacy while having no beliefs (or, in fact, deep knowledge [or, perhaps, religion?]) regarding what the phalacy pertains to.
      - tptacek 15y ago
        No, I'm asking you to take a subject you're obviously engaged in and spend a couple minutes researching it before you write your next comment about it. Not to be a jerk, but because (a) the whole thread would benefit and (b) I can vouch, for you, that this is worth your time as a software developer to do. So: up for it? Is a couple minutes of Google time and the direct attention from several software security experts to learn lots and lots about key derivation functions and password hashes worth it to you?

yock 15y ago

No, ad hominem is "You're wrong 'cause you're a jerk." DanBC pointed out that their opinion might not be as above reproach as is often assumed because of past lapses in good judgment.

SoftwareMaven 15y ago
Ad hominem is an attempt to negate the truth of a claim by pointing out a negative characteristic or belief of the person supporting it.[1] That sounds pretty much like what happened above. The truth item is whether RSA's cipher chops can be respected. The negative characteristic is an HR person succumbing to a social engineering attack. Ad hominem isn't just calling names. Let me put it differently: in what way does the HR rep's mistake reduce the quality of ciphers that have come from RSA? 1. http://en.wikipedia.org/wiki/Ad_hominem http://en.wikipedia.org/wiki/Ad_hominem
- icebraining 15y ago
  Ad hominem is an attack on the person whose argument you're trying to disprove. Here, that person is the one who wrote the article, not RSA. The argument "X is safe because its creator, Y, has a good reputation" can certainly be refuted by attacking the claim that Y has a good reputation. It's not an ad hominem. The fact that the error by the HR person doesn't actually invalidate RSA's reputation as cryptographers is more a Non sequitur.

tptacek 15y ago

What can you share with us about the quality of cryptographic research at big software companies? And, besides that one: what are some other big companies whose cryptographic research you would rely on when selecting algorithms and crypto constructions? Are you sure you know what you're talking about here? I'm not saying you don't, but most HN'ers who would write a comment like yours don't.

SoftwareMaven 15y ago
I can't share anything. All I can do is respect the peer review process. I'm certainly not making the real appeal to authority of "they are a big company, so they make good ciphers". If you have something specific, I'd love to hear it. In particular, I'd like to hear how social engineering negatively impacts cipher algorithms (negatively impacting key security doesn't count).
- tptacek 15y ago
  What can you tell us about the actual peer review process that you think was involved with PBKDF2? (Me just saying it won't be nearly as impactful, because apparently I'm in the tank for bcrypt). Don't know? This will make a worthwhile 30 minute Googling project. That's what I do when I get in over my head, and I promise, learning about adaptive hashing is going to be more useful than reading court decisions about what does or doesn't constitute a breach of the duty of loyalty for a company director (to cite my last Google dive from HN).
  - SoftwareMaven 15y ago
    You seem to have the mistaken opinion I'm arguing for a particular outcome. My point is simple: you can't say RSA is crap because an admin failed. I'm not saying anything else. If you are reading something else into my statement, stop it. If you have information that is relevant to why you shouldn't trust the ciphers from RSA, dish it up. Like I said, I'd love to read it. It is possible to point out a logical phalacy while having no beliefs (or, in fact, deep knowledge [or, perhaps, religion?]) regarding what the phalacy pertains to.
    - tptacek 15y ago
      No, I'm asking you to take a subject you're obviously engaged in and spend a couple minutes researching it before you write your next comment about it. Not to be a jerk, but because (a) the whole thread would benefit and (b) I can vouch, for you, that this is worth your time as a software developer to do. So: up for it? Is a couple minutes of Google time and the direct attention from several software security experts to learn lots and lots about key derivation functions and password hashes worth it to you?