3 ms·

As the lead developer for Cryptocat, this sure rung a bell for me.

thirsteh 14y ago
There's something to be said about encouraging people to use crypto software that might not be well-written, though. To me, it's fine to write whatever you want in any language you want, but if you write an application and market it as "communicate securely and anonymously", or any kind of software that could put people's lives at risk, really--like Tor--you should be confident it is secure, i.e. that you know how to get it right. You are literally putting people's lives at risk, not just writing software that might be buggy, or which some people might not find useful. IMO, the "lol, look at this, pathetic" for using node.js is inexcusable (regardless of what your opinion about node.js, and for the record, mine isn't favorable), but "X application has serious security holes in their software that could put you at risk. Don't use it" is not. For example, I don't consider this "bullying": http://www.schneier.com/blog/archives/2012/08/cryptocat.html http://www.schneier.com/blog/archives/2012/08/cryptocat.html All this being said, I'm glad you powered through (https://blog.crypto.cat/2012/08/moving-to-a-browser-app-model/ https://blog.crypto.cat/2012/08/moving-to-a-browser-app-mode...) and solved the issues. OTR is awesome, and most of the critics have come around, AFAICT. Many others don't listen to this kind of feedback, and so deserve the critique all the more.
- magikarp 14y ago
  Oh absolutely. As Schneier noted in that blog post, we did solve the issues that were presented to us, switched to a signed browser plugin, OTR, got a full audit, and so on. But other than the handful of awesome and helpful critique, man were people assholes on Twitter. I stand by Cryptocat being a usable privacy tool today, and I think we were quite responsible in our development process. There's always media hype making us look like something we're not (a magic bullet for activists and other people in danger to solve all their problems,) but that's why we have warnings everywhere on our website and inside the app itself.
  - thirsteh 14y ago
    Yeah, don't get me wrong. People who have nothing to add can go disappear.
    - magikarp 14y ago
      Thanks, man.

There's something to be said about encouraging people to use crypto software that might not be well-written, though. To me, it's fine to write whatever you want in any language you want, but if you write an application and market it as "communicate securely and anonymously", or any kind of software that could put people's lives at risk, really--like Tor--you should be confident it is secure, i.e. that you know how to get it right. You are literally putting people's lives at risk, not just writing software that might be buggy, or which some people might not find useful. IMO, the "lol, look at this, pathetic" for using node.js is inexcusable (regardless of what your opinion about node.js, and for the record, mine isn't favorable), but "X application has serious security holes in their software that could put you at risk. Don't use it" is not. For example, I don't consider this "bullying": http://www.schneier.com/blog/archives/2012/08/cryptocat.html http://www.schneier.com/blog/archives/2012/08/cryptocat.html All this being said, I'm glad you powered through (https://blog.crypto.cat/2012/08/moving-to-a-browser-app-model/ https://blog.crypto.cat/2012/08/moving-to-a-browser-app-mode...) and solved the issues. OTR is awesome, and most of the critics have come around, AFAICT. Many others don't listen to this kind of feedback, and so deserve the critique all the more.

magikarp 14y ago
Oh absolutely. As Schneier noted in that blog post, we did solve the issues that were presented to us, switched to a signed browser plugin, OTR, got a full audit, and so on. But other than the handful of awesome and helpful critique, man were people assholes on Twitter. I stand by Cryptocat being a usable privacy tool today, and I think we were quite responsible in our development process. There's always media hype making us look like something we're not (a magic bullet for activists and other people in danger to solve all their problems,) but that's why we have warnings everywhere on our website and inside the app itself.
- thirsteh 14y ago
  Yeah, don't get me wrong. People who have nothing to add can go disappear.
  - magikarp 14y ago
    Thanks, man.