3 ms·

But why would anyone even bother trying to fix the situation? Any attempt to will just result in the entire crypto community community calling you "worthless" a

by zainny 13y ago

But why would anyone even bother trying to fix the situation? Any attempt to will just result in the entire crypto community community calling you "worthless" and "unqualified". This is the entire problem. Funnily enough, I imagine the original implementers of the major crypto libraries we use today and take for granted would probably equally be called "idiots" and "losers" if judged by today's internet crypto heroes. The crypto community is flat out toxic. You ain't gonna see progress from anywhere until the situation changes.

davidw 13y ago
I think you're being unfair by painting them all with the same brush. But there is definitely a 'tone' in that community that I find very off-putting. This thread was interesting - tptacek seems like a nice enough guy - he's very helpful here and certainly knowledgeable, and generally pleasant to interact with: https://news.ycombinator.com/item?id=5776111 https://news.ycombinator.com/item?id=5776111 I agree with you that the "don't do that" attitude seems a bit... binary. Who decides who gets to do what? At what point does it become 'ok' to do crypto stuff? What kind of crypto stuff? Putting together pieces like SSL and GPG? Writing crypto libraries? New crypto algorithms? I'm mostly a believer in leaving the latter to people who have demonstrable competence in the field, but lots of people need to put together pieces in some way and the "don't do that" attitude does not really solve that problem.
- tptacek 13y ago
  Don't let me off the hook; I am 1000% "that guy" when it comes to software security stuff. Also US law, sous vide cooking, C software development, the music of the Elephant 6 collective, tech entrepreneurship, and parenting.
- oinksoft 13y ago
  It's my perception that people seriously involved in mathematics, particularly sensitive things like crypto, must have a thick skin. It's a field that is all hard skills and no soft skills, and I'm not sure it could practically be any other way. The professional is either intensely correct or incorrect, and often provably so. Like in this case. I can call your ChicagoBoss application crap, say it is far from OTP design principle, baked with magic parse transforms, etc. and I'd be an asshole because it's a matter of design opinion, not provable fact. The author here has published a crack that absolutely proves that the CryptoCat guys were wrong, and that matters.
  - davidw 13y ago
    It's very easy to say someone is wrong, though, without calling them a shithead. Indeed, you could even go so far as to say that it fosters a more open, inviting atmosphere if you concentrate on what's right, and what's wrong, and let people have the freedom to be wrong without being labeled assholes, incompetents, and worse. This is why you don't find, in most scientific papers, descriptions of other scientists work as 'crap' or 'stupid', even if they do point out the most glaring of errors. It's left to the reader to assign the 'stupid' label. In this specific case, I agree that there's some justified anger at labeling something ready for public consumption that appears not to be. But I just get a sense of so many crypto/security discussions being a dick-waving contest.
- Ixiaus 13y ago
  You know, it's funny, because as a programmer and watching this interaction happen over the years (between programmers and people that are good at cryptography/security) I've come to this conclusion: It's down to the fact that developers are not engineers. In the sense that anyone can "sling" some code together and call it an application; but that isn't engineering. Cryptographers have a similar set of moral and ethical imperatives that medical doctors, civil engineers, or even aerospace engineers (may) have. If the guy down the street that's read a few books and built a few tree houses (or maybe even something more complex and impressive) goes to build a bridge intended to be used by anyone; any sane civil engineer would have every right to trash on him. I don't entirely understand the mushy "be nice to him, he's learning" attitude everyone has (that's what school and learning environments are for!!!) because it's precisely that personal attitude that has resulted in the loss of credit card data, sensitive passwords stored in big services, secrets that people would (literally) kill for, &c... This shit isn't a joke and I fully support any cryptographer being a hard-ass because they are the ones that put in the time to learn, practice, fuck up, and re-learn what it means to encrypt something. As programmers we don't even have a code of conduct, or ethical pact. Cryptographers have one but, they do, not because they all sat down and decided they should but because it's a natural consequence of what it is they are working on. As a cryptographer you cannot morally support an incompetent (and even a competent) programmer in rolling their own crypto; not because they are all assholes, but because they believe in privacy to a degree the rest of us don't.
DanBC 13y ago
Wait, if someone created documents to help people use PGP or GPG, and released those as beta versions, I believe they'd get mostly useful help and advice. I agree that they'd still get some toxic comments. This is a problem. As understand it the Math stack-exchange site had problems with toxic members. Perhaps it's a math thing?
- davidw 13y ago
  It's more than documents, it's that they wrote those programs with complex ways of interacting with them. To be fair, they have improved with time, but I don't want to let that get in the way of making my point. I'm going to dredge up my best Comic Book Guy to comment as an example: "The audacity these security guys have to release such critical software with such a poorly considered user interface is mind boggling, and makes it clear that they care not one whit for their users. Someone so incompetent in the field of user interaction should probably stay in their room playing with crayons. This software is full of stupid UI mistakes, and run by people who clearly know nothing about interacting with other human beings - our only meager consolation from this is that they will clearly never manage to reproduce". Now, I'm just kidding around, am extremely glad we have the software we do have, and am pretty shitty at making UI's myself, but that kind of discussion is really not pleasant at all to deal with.
- napoleond 13y ago
  I can personally verify this. Anecdotal, but still: for the past several months I've been working on an app that makes PGP/GPG easier to use for average people[0], and the crypto community has been astoundingly supportive (I was scared, at first). The difference is that my team isn't rolling our own crypto, and we've been adamant about that from the start. 0. http://parley.co http://parley.co

by zainny 13y ago

davidw 13y ago

I think you're being unfair by painting them all with the same brush. But there is definitely a 'tone' in that community that I find very off-putting. This thread was interesting - tptacek seems like a nice enough guy - he's very helpful here and certainly knowledgeable, and generally pleasant to interact with: https://news.ycombinator.com/item?id=5776111 https://news.ycombinator.com/item?id=5776111 I agree with you that the "don't do that" attitude seems a bit... binary. Who decides who gets to do what? At what point does it become 'ok' to do crypto stuff? What kind of crypto stuff? Putting together pieces like SSL and GPG? Writing crypto libraries? New crypto algorithms? I'm mostly a believer in leaving the latter to people who have demonstrable competence in the field, but lots of people need to put together pieces in some way and the "don't do that" attitude does not really solve that problem.

tptacek 13y ago
Don't let me off the hook; I am 1000% "that guy" when it comes to software security stuff. Also US law, sous vide cooking, C software development, the music of the Elephant 6 collective, tech entrepreneurship, and parenting.
oinksoft 13y ago
It's my perception that people seriously involved in mathematics, particularly sensitive things like crypto, must have a thick skin. It's a field that is all hard skills and no soft skills, and I'm not sure it could practically be any other way. The professional is either intensely correct or incorrect, and often provably so. Like in this case. I can call your ChicagoBoss application crap, say it is far from OTP design principle, baked with magic parse transforms, etc. and I'd be an asshole because it's a matter of design opinion, not provable fact. The author here has published a crack that absolutely proves that the CryptoCat guys were wrong, and that matters.
- davidw 13y ago
  It's very easy to say someone is wrong, though, without calling them a shithead. Indeed, you could even go so far as to say that it fosters a more open, inviting atmosphere if you concentrate on what's right, and what's wrong, and let people have the freedom to be wrong without being labeled assholes, incompetents, and worse. This is why you don't find, in most scientific papers, descriptions of other scientists work as 'crap' or 'stupid', even if they do point out the most glaring of errors. It's left to the reader to assign the 'stupid' label. In this specific case, I agree that there's some justified anger at labeling something ready for public consumption that appears not to be. But I just get a sense of so many crypto/security discussions being a dick-waving contest.
Ixiaus 13y ago
You know, it's funny, because as a programmer and watching this interaction happen over the years (between programmers and people that are good at cryptography/security) I've come to this conclusion: It's down to the fact that developers are not engineers. In the sense that anyone can "sling" some code together and call it an application; but that isn't engineering. Cryptographers have a similar set of moral and ethical imperatives that medical doctors, civil engineers, or even aerospace engineers (may) have. If the guy down the street that's read a few books and built a few tree houses (or maybe even something more complex and impressive) goes to build a bridge intended to be used by anyone; any sane civil engineer would have every right to trash on him. I don't entirely understand the mushy "be nice to him, he's learning" attitude everyone has (that's what school and learning environments are for!!!) because it's precisely that personal attitude that has resulted in the loss of credit card data, sensitive passwords stored in big services, secrets that people would (literally) kill for, &c... This shit isn't a joke and I fully support any cryptographer being a hard-ass because they are the ones that put in the time to learn, practice, fuck up, and re-learn what it means to encrypt something. As programmers we don't even have a code of conduct, or ethical pact. Cryptographers have one but, they do, not because they all sat down and decided they should but because it's a natural consequence of what it is they are working on. As a cryptographer you cannot morally support an incompetent (and even a competent) programmer in rolling their own crypto; not because they are all assholes, but because they believe in privacy to a degree the rest of us don't.

DanBC 13y ago

Wait, if someone created documents to help people use PGP or GPG, and released those as beta versions, I believe they'd get mostly useful help and advice. I agree that they'd still get some toxic comments. This is a problem. As understand it the Math stack-exchange site had problems with toxic members. Perhaps it's a math thing?

davidw 13y ago
It's more than documents, it's that they wrote those programs with complex ways of interacting with them. To be fair, they have improved with time, but I don't want to let that get in the way of making my point. I'm going to dredge up my best Comic Book Guy to comment as an example: "The audacity these security guys have to release such critical software with such a poorly considered user interface is mind boggling, and makes it clear that they care not one whit for their users. Someone so incompetent in the field of user interaction should probably stay in their room playing with crayons. This software is full of stupid UI mistakes, and run by people who clearly know nothing about interacting with other human beings - our only meager consolation from this is that they will clearly never manage to reproduce". Now, I'm just kidding around, am extremely glad we have the software we do have, and am pretty shitty at making UI's myself, but that kind of discussion is really not pleasant at all to deal with.
napoleond 13y ago
I can personally verify this. Anecdotal, but still: for the past several months I've been working on an app that makes PGP/GPG easier to use for average people[0], and the crypto community has been astoundingly supportive (I was scared, at first). The difference is that my team isn't rolling our own crypto, and we've been adamant about that from the start. 0. http://parley.co http://parley.co