4 ms·
As most of you know, this guy's career is very interesting. Every few years he's stepped up to another level of thinking, a higher, more abstract viewpoint of
by B-Con 14y ago
As most of you know, this guy's career is very interesting. Every few years he's stepped up to another level of thinking, a higher, more abstract viewpoint of the world. It's natural for people to learn and abstract, but he does so much of it.
Just look at his books:
* Applied Cryptography - The principles of cryptography and their applications, from a non-theory POV. Basically, "here are some tools".
* Practical Cryptography - Let's look a bit bigger picture. The issue is about how to do what you want and how to not screw it up. Let's look at how to do that.
* Secrets and Lies - Security isn't about crypto, we need to think about the whole of networking and infrastructure. Here's how to think about security more generally.
* Beyond Fear - Security is an innate part of how we think, but we need to understand how to actually think about it in the first place.
* Liars and Outliers - What is security? What does it do, why do we need it, and how does it work at the basic human level?
* Power.com (subject to change) - On the principles of security on the largest human network ever.
It just keeps getting bigger.
- tptacek 14y agoSchneier's career has an interesting arc that is not too dissimilar from that of Eric Raymond, involving early modest-but-significant contributions to the field (cryptologic literature for Schneier, open source software for Raymond), then a marked phase of popularization and evangelism, followed by a full-throttle transition into punditry. I'd definitely push back on the way you characterized _Applied_ and _Practical_ (now called _Cryptography Engineering_). The two books are very different and are the product of different authors; Schneier wrote _Applied_ but co-authored _Practical_. _Applied_ is a broad survey of cryptographic techniques that was good for its time but has aged terribly and probably done more harm than good for the industry†. _Practical_ is an engineering book; unlike _Applied_, which is a sightseeing tour of the field, _Practical_ is a book about actually building system with cryptography. Also unlike _Applied_, _Practical_ is diligent about recognizing the limitations of mass-market technical books; it explains things just as often to convince you not to implement things as it does to motivate you to implement them. _Practical_ does not have a lot of "rah-rah" in it. It's not an evangelistic book. The tone of its prose, a mix of casual, clear, and precise, is all Schneier, but the content is wildly different from _Applied_. It's a narrower book, not a "bigger" one. You might be right about the progression of Schneier's other books. I'm not sold on the idea of a career in information security as a springboard to public policy research on security. Real-world security is not very much like information security at all. On the specific issue of the book he's promoting right now, I think it's worth pointing out that Schneier has been wrong as often as he's been right about macro- Internet security. Example: Schneier was an early opponent of vulnerability research, for instance; he used his Crypto-Gram newsletter to single out eEye for irresponsibly disclosing Windows vulnerabilities. eEye was a pioneer of what we'd now call "Responsible Disclosure" (an Orwellian term whose basic function is to marginalize Metasploit) and employed people Riley Hassell, Derek Soeder, and Barnaby Jack, all of whom are now vulnerability research authorities. † (though you can't necessarily say that for the field of cryptography, which he did more to popularize than anyone; perhaps there are lot of great postdoc crypto people today who got into the field because of _Applied_)
- B-Con 14y ago> _Applied_ is a broad survey of cryptographic techniques that was good for its time > _Practical_ is a book about actually building system with cryptography. Yep. That's pretty much what I said. Applied is about the tools, Practical is about using the tools properly. It's a higher level in the thinking chain, although my original choice of "bigger" isn't necessarily the best word to use there. > probably done more harm than good for the industry† Yes, yes. It gave too many weapons to too poorly educated software developers. We know that.
- tptacek 14y agoI think the opposite is true: _Applied_ considers cryptography at a higher level, covers more concepts, has the broader charter.
- stiff 14y ago_Applied_ is a broad survey of cryptographic techniques that was good for its time but has aged terribly and probably done more harm than good for the industry†. Do you blame Cormen for all the people that don't use library sorting functions but implement their own?
- tptacek 14y agoNo.
- stiff 14y agoDid you mean something else then with done more harm than good for the industry ? I don't know much about crypto or Schneiers work, I am just curious what you meant if what you said wasn't in reference to people choosing to hand code their crypto routines.
- tptacek 14y agoI probably mean what you think I mean. But, among other things, (i) using a broken sort algorithm is nowhere near as bad a problem as getting block cipher modes wrong, and (ii) CLR isn't a mass-popularizing evangelical text about algorithms, and (iii) basic fundamental algorithms and algorithmic analysis isn't a moving target like cryptography is. I am not making a moral judgement about _Applied_. I don't think the guy should wear a hairshirt. As a book, it's a great book; it sold well for a reason. As an instrument of software engineering, though, it's a bit of a curse.
- ibudiallo 14y agoI don't know about you guys but i have never heard of him before. But i am already browsing amazon to get those books.
- snowwrestler 14y agoI saw Schneier debate Jonathan Zittrain and Mike McConnell on the topic of cyberwar. He was authoritative, calm, and pragmatic as he described the security and recovery systems of the Internet, and why it's unlikely that terrorists (for example) could take the whole thing down or permanently damage our banks with cyber attacks. But as he strays more toward topics of motivation, power, and influence in his personal writing, I feel like he is getting more alarmist and shrill. It's not enough to talk about the mechanics of Internet security; now he wants to assign motivations and discuss the secret agendas of the poweful. I just feel like he is on shakier ground with respect to his technical expertise or personal experience. He's a great writer, but I'm not convinced I should privilege his vision of the future over anyone else's.
- tptacek 14y agoI agree that he's an unusually good writer, particularly of technical content. In that sense it is not really fair to compare him to Raymond.