4 ms·
I would agree, but for something as important as cryptography, I would prefer people error on the side of too cautious or repetitive if it means less people mak
by Shank 13y ago
I would agree, but for something as important as cryptography, I would prefer people error on the side of too cautious or repetitive if it means less people making the same mistake twice. It's the same reason why I don't mind repeated HN submissions if it's a good enough delay - the discussion was clearly relevant the first time, and new people have joined the community since then and deserve an equal chance to talk about the subject with new perspective.
- zalambar 13y agoCaution is a good attitude to have when working on critical code with non-obvious modes of failure. However I agree with davidw; this "dont' touch it" or "we're not smart enough" attitude is tiresome. Couldn't we instead admit that this is a difficult problem which requires some engineering rigor to solve well and talk about how we can address such problems like professionals instead of hiding from them?
- tptacek 13y agoMost people don't actually want to do their own surgery. Even if you put a scalpel in someone's hands, and gave them all the anesthesia, they still wouldn't be tempted to remove someone's appendix after reading an eHow article about it. The same isn't true of crypto. People know both intellectually and viscerally that they shouldn't be doing their own surgeries. But they only have an intellectual understanding that crypto is unsafe. A big part of that is because the harm caused by crypto mistakes are often an externality to the developer.
- arthuredelstein 13y agoThat's fine, but we have an emergency right now and there aren't enough surgeons to go around. We need more competent crypto engineers ASAP.
- tptacek 13y agoOk then, here's a scalpel, go to town: http://www.schneier.com/book-applied.html http://www.schneier.com/book-applied.html
- gizmo686 13y agoA bigger part of it is that bad crypto looks alot like good crypto.
- marcosdumay 13y agoIt doesn't only need engineering rigour. Good crypto needs engineering rigour, honest colective work, and time to mature.