3 ms·
What do you want to hire them for? A lot of it comes down to recognizing the right tools for the job, and writing-from-scratch absolutely as few of those tools
by sk5t 14y ago
What do you want to hire them for?
A lot of it comes down to recognizing the right tools for the job, and writing-from-scratch absolutely as few of those tools as necessary. Even very good practical crypto users can make mistakes... although in this case, Mega has used the plastic end of a screwdriver to pound nails.
- jiggy2011 14y agoI mean more in a theoretical sense. For example I use code that does crypto everyday, probably everyone on the internet does. Web frameworks , operating systems , browsers etc all use crypto and presumably that stuff is written by some mythical person who can do this stuff properly judging by the fact that my credit card hasn't been frauded yet..
- lawnchair_larry 14y agoPretty much every crypto library you use was badly broken, multiple times, during its long history. New attacks are still being found, and browsers and libraries are updated as we learn more. For a small sample, read the wikipedia page for http://en.wikipedia.org/wiki/Secure_Sockets_Layer http://en.wikipedia.org/wiki/Secure_Sockets_Layer and take a look at how many times we all got that wrong. The first rule of crypto is not to write crypto code. Reuse a high level library that already made all the mistakes you're about to. If you absolutely have to break the first rule, you need to budget between 5 and 6 digits for experts to review it against known attacks and best practices.
- jiggy2011 14y agoSo , only use stuff written by google/MS sized companies or very mature OS projects?
- lawnchair_larry 14y agoNo, you don't have to go that far. The same libraries used by those companies are available to all projects, and most crypto uses them (or libraries built on top of them). Mistakes such as those made by Mega result from using a crypto library that makes the author do all the work.