3 ms·

Do you really think these developers of this are actively trying to sell snake oil? You know what it looks more like to me? A couple of people are earnestly tr

by zainny 13y ago

Do you really think these developers of this are actively trying to sell snake oil? You know what it looks more like to me? A couple of people are earnestly trying to build a secure communication product. They're not perfect, so they've made mistakes. And for every mistake they've made, there is a legion of toxic people from the crypto community who would rather demonstrate how much smarter they are by pointing out those mistakes in a condescending and unhelpful manner rather than simply being friendly, constructive, and helpful. Shit, think of the chilling effect this even has on anyone out there who wants to try to build some security/crypto stuff. Myself I wouldn't even dare try - the hysteria of some of the people in this community is just without equal. It's toxic. Pure toxic.

nknighthb 13y ago
The developers do not know what they are doing. They are not qualified for the task they have taken on. In other words, they are not competent. They have been told this, both politely and less so. It is no longer about them, it is about helping the public by warning that Cryptocat is dangerous snake oil being actively peddled as secure by incompetent developers who are not to be trusted with people's lives. This will not be accomplished by merely providing the developers technical critiques. It will only be accomplished by informing the public in terms the public will understand. "Incompetent" is a suitable English word for that purpose. > Shit, think of the chilling effect this even has on anyone out there who wants to try to build some security/crypto stuff. Good! > Myself I wouldn't even dare try Very good!
- zainny 13y ago
  I absolutely do hear what you are saying, and I understand your point. I think where we disagree is in our assessment of the developers. You think that they are incompetent and unqualified for the task. Whereas I think they are likely qualified for the task (I give them the benefit of the doubt) and the crypto community is overreacting in their criticisms of the issues, making minor mistakes seem much graver than they actually are. I've seen cryptosystems written by brilliant people and thought solid for many years later to be shown to be vulnerable. We still today continue to find issues in critical crypto libraries used around the world. Should we just throw them all out? Declare the authors incompetent? Anybody can make mistakes. And I don't think this making of mistakes invalidates anyones right to fix their mistake and keep pushing forward, as you evidently do.
  - jdiez17 13y ago
    The point is that writing software that uses cryptography is unlike writing software that, say, uses a Twitter API library. In the latter case you can detect errors quite easily because functionality will be compromised if you make a mistake. This is not so in programs that use cryptography; they tend to work without noticeable problems, but they may be shooting themselves in the foot. It's all about preventing known mistakes. For example, say a developer uses a One Time Pad encryption scheme in their application and calls it "secure". Surely if we've had any contact with cryptography we know that a OTP with a reused pad is broken and leaks key bytes, and vulnerable to many other types of attack. These mistakes can be avoided by having proper education in cryptography. I understand cryptocat's developers urge to write it in the same way they've written software the rest of their lives, through trial and error. And that is okay for most software, but not cryptography.
    - IsThisObvious 13y ago
      > And that is okay for most software, but not cryptography. I'd be fine with it if they just slapped big red letters across the top saying "WARNING - EXPERIMENTAL". Why? Because people do need to experiment with topics and that doesn't hurt. What's upsetting is they're basically claiming their product is on the same level as lots of products that have been heavily tested and verified by groups of people when it's an amateur experiment in the topic. That might be fine for most kinds of software, but is irresponsible in crypto, embedded safety systems, etc.
  - nknighthb 13y ago
    > I understand your point. No, you don't, because you continue to make worthless tautological statements like "anyone can make mistakes". I've designed an airplane. I have no experience in doing so. I have no more than a layman's understanding of aerodynamics. I know nothing of materials science. I've hardly even looked inside any kind of engine. I have heard some fancy words before, though, and I'm sure my quick read of various Wikipedia articles has prepared me. I'm going to start building these planes and selling them to the public as a great way to travel. Do you think it is overreacting for an aviation engineer to tell people that my plane is dangerous, just because Boeing sometimes makes mistakes? If you don't, then you shouldn't have a problem with the public being told that Cryptocat is dangerous. If you do think it's overreacting, well, as it happens I'm no more competent to deal with insanity than with aeronautics.
aptwebapps 13y ago
I'm not terribly familiar with this, so I don't what know the average toxicity of the feedback they have received is. Maybe it's unhelpful. But there is a reason that their critics are like that. If they are just learning and want nice and supportive criticism, then they need to present their project in that way, not as serious software. If it were a paint program then no one would care. With something like this, the stakes are too high to just give them a pass.
- nknighthb 13y ago
  Yes, that's exactly the problem. It's not even relevant that it's crypto software vs paint software, what matters is that it's crypto software being presented as something that should be used by the public. Nobody cares if you tinker with crypto in your bedroom. You can even toss it on github and ask for feedback on it if you want. Hell, if you want to put the security of your own data at the mercy of the software you write, go right ahead. What you can't get away with is claiming to build a useful crypto product when you don't even have the first clue what that entails.
iuguy 13y ago
> Shit, think of the chilling effect this even has on anyone out there who wants to try to build some security/crypto stuff. As someone who is currently in the process of building some security/crypto stuff it has certainly made me think a lot about releasing it. Having said that, while I wish the crypto community got out more and interacted with people more often in order to learn how to be less douchey about it, the fact is that I'm now unsure whether releasing my code will be safe. I'm not a pro-cryptographer, just a lowly pentester. Not sure what I'll do now.
- IsThisObvious 13y ago
  > I'm not a pro-cryptographer, just a lowly pentester. Not sure what I'll do now.f Release it with a big "WARNING - EXPERIMENTAL" at the top and don't claim it's a secure solution for end-users? That seems to be what the complaint is about, not that people are experimenting in crypto.

by zainny 13y ago

nknighthb 13y ago

The developers do not know what they are doing. They are not qualified for the task they have taken on. In other words, they are not competent. They have been told this, both politely and less so. It is no longer about them, it is about helping the public by warning that Cryptocat is dangerous snake oil being actively peddled as secure by incompetent developers who are not to be trusted with people's lives. This will not be accomplished by merely providing the developers technical critiques. It will only be accomplished by informing the public in terms the public will understand. "Incompetent" is a suitable English word for that purpose. > Shit, think of the chilling effect this even has on anyone out there who wants to try to build some security/crypto stuff. Good! > Myself I wouldn't even dare try Very good!

zainny 13y ago
I absolutely do hear what you are saying, and I understand your point. I think where we disagree is in our assessment of the developers. You think that they are incompetent and unqualified for the task. Whereas I think they are likely qualified for the task (I give them the benefit of the doubt) and the crypto community is overreacting in their criticisms of the issues, making minor mistakes seem much graver than they actually are. I've seen cryptosystems written by brilliant people and thought solid for many years later to be shown to be vulnerable. We still today continue to find issues in critical crypto libraries used around the world. Should we just throw them all out? Declare the authors incompetent? Anybody can make mistakes. And I don't think this making of mistakes invalidates anyones right to fix their mistake and keep pushing forward, as you evidently do.
- jdiez17 13y ago
  The point is that writing software that uses cryptography is unlike writing software that, say, uses a Twitter API library. In the latter case you can detect errors quite easily because functionality will be compromised if you make a mistake. This is not so in programs that use cryptography; they tend to work without noticeable problems, but they may be shooting themselves in the foot. It's all about preventing known mistakes. For example, say a developer uses a One Time Pad encryption scheme in their application and calls it "secure". Surely if we've had any contact with cryptography we know that a OTP with a reused pad is broken and leaks key bytes, and vulnerable to many other types of attack. These mistakes can be avoided by having proper education in cryptography. I understand cryptocat's developers urge to write it in the same way they've written software the rest of their lives, through trial and error. And that is okay for most software, but not cryptography.
  - IsThisObvious 13y ago
    > And that is okay for most software, but not cryptography. I'd be fine with it if they just slapped big red letters across the top saying "WARNING - EXPERIMENTAL". Why? Because people do need to experiment with topics and that doesn't hurt. What's upsetting is they're basically claiming their product is on the same level as lots of products that have been heavily tested and verified by groups of people when it's an amateur experiment in the topic. That might be fine for most kinds of software, but is irresponsible in crypto, embedded safety systems, etc.
- nknighthb 13y ago
  > I understand your point. No, you don't, because you continue to make worthless tautological statements like "anyone can make mistakes". I've designed an airplane. I have no experience in doing so. I have no more than a layman's understanding of aerodynamics. I know nothing of materials science. I've hardly even looked inside any kind of engine. I have heard some fancy words before, though, and I'm sure my quick read of various Wikipedia articles has prepared me. I'm going to start building these planes and selling them to the public as a great way to travel. Do you think it is overreacting for an aviation engineer to tell people that my plane is dangerous, just because Boeing sometimes makes mistakes? If you don't, then you shouldn't have a problem with the public being told that Cryptocat is dangerous. If you do think it's overreacting, well, as it happens I'm no more competent to deal with insanity than with aeronautics.

aptwebapps 13y ago

I'm not terribly familiar with this, so I don't what know the average toxicity of the feedback they have received is. Maybe it's unhelpful. But there is a reason that their critics are like that. If they are just learning and want nice and supportive criticism, then they need to present their project in that way, not as serious software. If it were a paint program then no one would care. With something like this, the stakes are too high to just give them a pass.

nknighthb 13y ago
Yes, that's exactly the problem. It's not even relevant that it's crypto software vs paint software, what matters is that it's crypto software being presented as something that should be used by the public. Nobody cares if you tinker with crypto in your bedroom. You can even toss it on github and ask for feedback on it if you want. Hell, if you want to put the security of your own data at the mercy of the software you write, go right ahead. What you can't get away with is claiming to build a useful crypto product when you don't even have the first clue what that entails.

iuguy 13y ago

> Shit, think of the chilling effect this even has on anyone out there who wants to try to build some security/crypto stuff. As someone who is currently in the process of building some security/crypto stuff it has certainly made me think a lot about releasing it. Having said that, while I wish the crypto community got out more and interacted with people more often in order to learn how to be less douchey about it, the fact is that I'm now unsure whether releasing my code will be safe. I'm not a pro-cryptographer, just a lowly pentester. Not sure what I'll do now.

IsThisObvious 13y ago
> I'm not a pro-cryptographer, just a lowly pentester. Not sure what I'll do now.f Release it with a big "WARNING - EXPERIMENTAL" at the top and don't claim it's a secure solution for end-users? That seems to be what the complaint is about, not that people are experimenting in crypto.