3 ms·
Do you have any hard evidence that somehow mandating a "cryptography course" fixes this? My guess is that it doesn't help and might even make things worse beca
by tialaramex 2y ago
Do you have any hard evidence that somehow mandating a "cryptography course" fixes this?
My guess is that it doesn't help and might even make things worse because now they'll think "Don't roll your own" was an instruction to plebs who didn't take that one semester cryptography course at school.
- reubenmorais 2y agoThe cryptography course in my bachelor's was good enough to paint a picture of the complexity involved. By then I had already heard the "don't roll your own crypto" mantra, so maybe that primed me, but the semester course helped to get an appreciation for the subtle ways information leaks when you try to contain it. It also gave me some more confidence to push back if for example a colleague tried to convince me that the mantra doesn't apply to them/us. Obviously you can't mandate a high quality course into existence, but I definitely good value out of having it in the required curriculum.
- plorkyeran 2y agoMy primary takeaway from the cryptography course I took was a good understanding of why I shouldn't try to roll my own crypto, but a lot of that came down to the course design. Mine spent significantly more time on covering how various cryptography schemes were broken than on how to implement things, and a course which was the other way around could easily inspire false confidence.