4 ms·

In fairness the dev is a 16 year old. It’s still bad practice but this is a minor mistake all things considered compared to most programming projects by people

In fairness the dev is a 16 year old. It’s still bad practice but this is a minor mistake all things considered compared to most programming projects by people of that age

jiggawatts 3y ago
Perfectly understandable, at that age I only had the vaguest notion of how cryptography works. Unfortunately, nobody else seems to either, which is why my comment is getting downvoted. "Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence. It doesn't matter who's key it is, how it was generated, how it was obtained, etc... The purpose of private keys is to be kept secret. A published private key by definition is worthless. That will have a consequence. Either it'll be make-believe fairytale security, or someone else getting into your product, or what happened here: the third party who's keys were stolen changed the locks. Meanwhile I'm at -4 and clocking down because people struggle to understand how keys and locks work, never mind cryptography.
- admax88qqq 3y ago
  Your understanding in of cryptography appears to be "private means private" > A published private key by definition is worthless. If I publish the AACS _private_ key, is it now worthless?
  - jiggawatts 3y ago
    Yes! It becomes worthless for copy protection. Public-private key pairs only work if the private key is secret. If it’s not secret it doesn’t work. This is a simple fact of how cryptography works. Or passwords, keys, or any secret like an API key, etc… If you publish such things on GitHub, they instantly become “not what you’ve labelled it as”.
    - admax88qqq 3y ago
      > It becomes worthless for... So you admit it's not completely worthless at that point only for specific use cases.
      - jiggawatts 3y ago
        Sure, it has uses: it can be printed on a T-shirt to teach big media a lesson about the futility of copy protection, etc…
        admax88qqq 3y ago
        Plus it lets people decrypt media encrypted by that key that they might otherwise have been unable to. So we've established that a "private key" that is no longer private may still have uses to some people, it is not wholly "worthless." Do you want to revise your earlier statement about the private key in the repo in question? Is it "worthless"? Is it a security problem? Do you know what that key is being used for?
- vore 3y ago
  The repo is a proof of concept. The key provided is used for illustration purposes and worked for the proof of concept. Nobody believes Apple would not revoke that key. But you don't need to talk down to the author for their age like this when they've made clear this is a proof of concept.
- dang 3y ago
  I believe users are downvoting your comments because they are breaking the site guidelines. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and posting more in the intended spirit, we'd appreciate it, and your comments should get fewer downvotes too. See also https://news.ycombinator.com/item?id=38579013 https://news.ycombinator.com/item?id=38579013.

In fairness the dev is a 16 year old. It’s still bad practice but this is a minor mistake all things considered compared to most programming projects by people of that age

jiggawatts 3y ago

Perfectly understandable, at that age I only had the vaguest notion of how cryptography works. Unfortunately, nobody else seems to either, which is why my comment is getting downvoted. "Why is this a problem?" say people when the publishing of a private key is inherently the wrong thing to do, and will always lead to a bad consequence. It doesn't matter who's key it is, how it was generated, how it was obtained, etc... The purpose of private keys is to be kept secret. A published private key by definition is worthless. That will have a consequence. Either it'll be make-believe fairytale security, or someone else getting into your product, or what happened here: the third party who's keys were stolen changed the locks. Meanwhile I'm at -4 and clocking down because people struggle to understand how keys and locks work, never mind cryptography.

admax88qqq 3y ago
Your understanding in of cryptography appears to be "private means private" > A published private key by definition is worthless. If I publish the AACS _private_ key, is it now worthless?
- jiggawatts 3y ago
  Yes! It becomes worthless for copy protection. Public-private key pairs only work if the private key is secret. If it’s not secret it doesn’t work. This is a simple fact of how cryptography works. Or passwords, keys, or any secret like an API key, etc… If you publish such things on GitHub, they instantly become “not what you’ve labelled it as”.
  - admax88qqq 3y ago
    > It becomes worthless for... So you admit it's not completely worthless at that point only for specific use cases.
    - jiggawatts 3y ago
      Sure, it has uses: it can be printed on a T-shirt to teach big media a lesson about the futility of copy protection, etc…
      - admax88qqq 3y ago
        Plus it lets people decrypt media encrypted by that key that they might otherwise have been unable to. So we've established that a "private key" that is no longer private may still have uses to some people, it is not wholly "worthless." Do you want to revise your earlier statement about the private key in the repo in question? Is it "worthless"? Is it a security problem? Do you know what that key is being used for?
vore 3y ago
The repo is a proof of concept. The key provided is used for illustration purposes and worked for the proof of concept. Nobody believes Apple would not revoke that key. But you don't need to talk down to the author for their age like this when they've made clear this is a proof of concept.
dang 3y ago
I believe users are downvoting your comments because they are breaking the site guidelines. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and posting more in the intended spirit, we'd appreciate it, and your comments should get fewer downvotes too. See also https://news.ycombinator.com/item?id=38579013 https://news.ycombinator.com/item?id=38579013.