3 ms·
> I really dislike the "hand rolled is bad" meme. Crypto is notoriously easy to get wrong, even if you know a lot about it - and most people do not. Secondly,
by Sebb767 2y ago
> I really dislike the "hand rolled is bad" meme.
Crypto is notoriously easy to get wrong, even if you know a lot about it - and most people do not. Secondly, proving something secure is pretty hard as well. If the crypto isn't a bog-standard algorithm in a well-known and reviewed implementation, assuming it to be insecure is a pretty good rule of thumb.
- api 2y agoMy take on "don't roll your own" is: The people who take this advice are people who have respect for the difficulty of things like crypto and should be the ones implementing it, or at least on-ramped into learning how to do so. The sorts of people who ship bad crypto because they don't bother to learn anything about the field are going to ignore this advice. So I think as a strategy for fighting bad crypto it's neutral or maybe even net-negative by discouraging the right people from learning crypto and having no effect on overconfident fools.
- deepsun 2y ago> should be the ones implementing it Someone (Bruce Schneier?) said that the best way to get into actually inventing/implementing crypto is to first get handy inventing attacks / hacking into other algorithms and tools.