5 ms·

You're making statements like that in a very matter of fact way. Can you please give references? It seems to me like the developers have been earnestly trying

by zainny 13y ago

You're making statements like that in a very matter of fact way. Can you please give references? It seems to me like the developers have been earnestly trying to build and improve on Cryptocat and shore up any weaknesses only to be constantly shit on your typical internet crypto experts.

DanBC 13y ago
> earnestly trying to build and improve on Cryptocat and shore up any weaknesses The release an insecure product. People tell them it's insecure, and that they don't know what they're doing, and that they should stop. They make a tweak, and release a new insecure version. People tell them that it's insecure, and that they don't know what they're doing, and that they should stop. They make another tweak, and release a new insecure version. People tell them that it's insecure, and that they don't know what they're doing, and that they should stop. They make another tweak, and release a new insecure version. At this point, imagine no-one tells them about any bugs. Does that mean the product is secure? Does that mean people should be using it? Here's one thread on HN where they get mostly polite advice (https://news.ycombinator.com/item?id=2855257 https://news.ycombinator.com/item?id=2855257) and the whack-a-mole game of "our software is secure", "here's a bug", tweak "Our software is secure" happens. Here's a nice article about the hype surrounding cryptocat (which, admittedly, isn't the fault of cryptocat) (http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hyping-unproven.html http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hy...)
- zainny 13y ago
  Like I said, the developers seem to be earnestly trying to improve their product based on the feedback they are getting. What more can you ask of them? "You there. Stop. You shouldn't be building this because we the superior internet community think you're a terrible person who will never learn anything, so we're putting our foot down." Screw that. What right do you have to tell these individuals to stop building something they might be actually enjoying building (and learning about crypto)? You have absolutely no right to complain in much the same way I don't have any right to look at your Github repo, tell you you're a terrible developer and you should never touch a computer again.
  - mst 13y ago
    Actually, I'd entirely support your right to do that. And his to tell you to fuck off and ignore you from then on if you did.
  - rschmitty 13y ago
    I think all you should ask of them is honesty, if their track record has truly been this bad. "Here is our secure product for all" vs "Help us make our product secure for all" If someone is learning crypto for fun and enjoyment they should seek advice of experts no matter how much of a jerk the expert may be. This isnt really the same level of a random github project 'convert your old php into haskell with 1 click!' I don't think anyone has expectations of that being 100% accurate. People on HN flipped out over Linode, they made a mistake, they fessed up. People just want honesty. Also, everyone has any right to complain, at least until prism comes a knockin
  - DanBC 13y ago
    > Like I said, the developers seem to be earnestly trying to improve their product based on the feedback they are getting. Cryptographic software isn't something that you can improve by a process of gradual refinement. Crypto can have small, subtle, bugs. Those bugs could mean that the product is worthless. A skilled, knowledgeable researcher could audit the code closely, and report any bugs they find. Cryptocat could fix all of those bugs. Does that mean it's secure? No - because crypto is hard. > What more can you ask of them? I ask that they make the disclaimers much bolder and bigger. I ask that they emphasise the experimental, untested, unscrutinised nature of Cryptocat. > "You there. Stop. You shouldn't be building this because we the superior internet community think you're a terrible person who will never learn anything, so we're putting our foot down." That's a mischaracterisation of the criticism they've got. "You there. Stop! Cryptography is very hard. Don't roll your own; or do but don't release it as a product for end users." followed by "You there. Stop! We suggested that you didn't release it for end users, but you did. Well, here's a list of bugs. Don't just fix these and think everything is good, there are probably other bugs and the whole thing is based on weird wrong ideas." followed by "You there. Stop! No, really, just stop. Here's a list of bugs. These are not subtle hard to find bugs. These are obvious bugs that anyone doing crypto really should have been aware of. The presence of these bugs demonstrates lack-of-clue. Please, stop hyping the product as secure, stop distributing as a tool for end users to use." People get exasperated. It doesn't help that some of the responses from the developers were defensive and aggressive and dismissive. tl;dr have fun with crypto and building stuff. Just don't think it's secure, and especially don't release it as secure. Especially don't release it as a browser plugin ready for naive end users.
- dobbsbob 13y ago
  I noticed similar behaviour with the devs at Guardianproject (supposedly secure android apps). Noble project indeed, but some serious sloppy development. Moxie has been more than helpful to them in repeatedly showing that Gibberbot suffers from practical MITM attacks, yet they make tweaks and cause a dozen new vulnerabilities. It's only a matter of time until a huge blast of shit and twitter beat down explodes until they finally get it.

by zainny 13y ago

DanBC 13y ago

> earnestly trying to build and improve on Cryptocat and shore up any weaknesses The release an insecure product. People tell them it's insecure, and that they don't know what they're doing, and that they should stop. They make a tweak, and release a new insecure version. People tell them that it's insecure, and that they don't know what they're doing, and that they should stop. They make another tweak, and release a new insecure version. People tell them that it's insecure, and that they don't know what they're doing, and that they should stop. They make another tweak, and release a new insecure version. At this point, imagine no-one tells them about any bugs. Does that mean the product is secure? Does that mean people should be using it? Here's one thread on HN where they get mostly polite advice (https://news.ycombinator.com/item?id=2855257 https://news.ycombinator.com/item?id=2855257) and the whack-a-mole game of "our software is secure", "here's a bug", tweak "Our software is secure" happens. Here's a nice article about the hype surrounding cryptocat (which, admittedly, isn't the fault of cryptocat) (http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hyping-unproven.html http://paranoia.dubfire.net/2012/07/tech-journalists-stop-hy...)

zainny 13y ago
Like I said, the developers seem to be earnestly trying to improve their product based on the feedback they are getting. What more can you ask of them? "You there. Stop. You shouldn't be building this because we the superior internet community think you're a terrible person who will never learn anything, so we're putting our foot down." Screw that. What right do you have to tell these individuals to stop building something they might be actually enjoying building (and learning about crypto)? You have absolutely no right to complain in much the same way I don't have any right to look at your Github repo, tell you you're a terrible developer and you should never touch a computer again.
- mst 13y ago
  Actually, I'd entirely support your right to do that. And his to tell you to fuck off and ignore you from then on if you did.
- rschmitty 13y ago
  I think all you should ask of them is honesty, if their track record has truly been this bad. "Here is our secure product for all" vs "Help us make our product secure for all" If someone is learning crypto for fun and enjoyment they should seek advice of experts no matter how much of a jerk the expert may be. This isnt really the same level of a random github project 'convert your old php into haskell with 1 click!' I don't think anyone has expectations of that being 100% accurate. People on HN flipped out over Linode, they made a mistake, they fessed up. People just want honesty. Also, everyone has any right to complain, at least until prism comes a knockin
- DanBC 13y ago
  > Like I said, the developers seem to be earnestly trying to improve their product based on the feedback they are getting. Cryptographic software isn't something that you can improve by a process of gradual refinement. Crypto can have small, subtle, bugs. Those bugs could mean that the product is worthless. A skilled, knowledgeable researcher could audit the code closely, and report any bugs they find. Cryptocat could fix all of those bugs. Does that mean it's secure? No - because crypto is hard. > What more can you ask of them? I ask that they make the disclaimers much bolder and bigger. I ask that they emphasise the experimental, untested, unscrutinised nature of Cryptocat. > "You there. Stop. You shouldn't be building this because we the superior internet community think you're a terrible person who will never learn anything, so we're putting our foot down." That's a mischaracterisation of the criticism they've got. "You there. Stop! Cryptography is very hard. Don't roll your own; or do but don't release it as a product for end users." followed by "You there. Stop! We suggested that you didn't release it for end users, but you did. Well, here's a list of bugs. Don't just fix these and think everything is good, there are probably other bugs and the whole thing is based on weird wrong ideas." followed by "You there. Stop! No, really, just stop. Here's a list of bugs. These are not subtle hard to find bugs. These are obvious bugs that anyone doing crypto really should have been aware of. The presence of these bugs demonstrates lack-of-clue. Please, stop hyping the product as secure, stop distributing as a tool for end users to use." People get exasperated. It doesn't help that some of the responses from the developers were defensive and aggressive and dismissive. tl;dr have fun with crypto and building stuff. Just don't think it's secure, and especially don't release it as secure. Especially don't release it as a browser plugin ready for naive end users.
dobbsbob 13y ago
I noticed similar behaviour with the devs at Guardianproject (supposedly secure android apps). Noble project indeed, but some serious sloppy development. Moxie has been more than helpful to them in repeatedly showing that Gibberbot suffers from practical MITM attacks, yet they make tweaks and cause a dozen new vulnerabilities. It's only a matter of time until a huge blast of shit and twitter beat down explodes until they finally get it.