4 ms·

Thanks for your hard work and for setting that up. Sounds like an awesome program. If I had more time right now, I'd love to check it out more. I think we're o

by 23david 13y ago

Thanks for your hard work and for setting that up. Sounds like an awesome program. If I had more time right now, I'd love to check it out more. I think we're on the same page here, but coming at it from different perspectives. I often have to find ways to secure as best as possible insecure systems that are already built. And I'm trying to find ways to incrementally improve systems over time so they get more and more secure. I can't wait to deploy code until its 100% secure, or the startups I've worked for would just find someone else to do the job who wouldn't be a 'blocker'.

tptacek 13y ago
I appreciate your appreciation, and note also that we're well compensated in other ways for doing that work. The challenges will be around for several more months. I'm just rebutting the idea --- which maybe you didn't mean --- that elitist infosec people were trying to set themselves up as gatekeepers. The opposite is true. Sean and I are working hard on getting as much of what we know about breaking cryptosystems into the challenges (set 7 is coming out probably next week, and I'm working on ECC stuff for set 8 now). We want the info out. But look at the numbers I just posted: 8100 people have started the challenges. Just 51 people have managed to finish. I like the challenges a lot, but candidly: on the scale of professional cryptographic research, it's pretty basic; being among the 0.5% of challenge finishers wouldn't qualify you to design cryptosystems.
bigiain 13y ago
"I can't wait to deploy code until its 100% secure, " That's fine if your working on a social network for cats, or another rage face Internet meme generator, but please don't use that excuse if you're storing my credit card details or health records (or writing an encrypted chat client you're promoting to political activists who's lives might literally depend on it).

by 23david 13y ago

tptacek 13y ago

I appreciate your appreciation, and note also that we're well compensated in other ways for doing that work. The challenges will be around for several more months. I'm just rebutting the idea --- which maybe you didn't mean --- that elitist infosec people were trying to set themselves up as gatekeepers. The opposite is true. Sean and I are working hard on getting as much of what we know about breaking cryptosystems into the challenges (set 7 is coming out probably next week, and I'm working on ECC stuff for set 8 now). We want the info out. But look at the numbers I just posted: 8100 people have started the challenges. Just 51 people have managed to finish. I like the challenges a lot, but candidly: on the scale of professional cryptographic research, it's pretty basic; being among the 0.5% of challenge finishers wouldn't qualify you to design cryptosystems.

bigiain 13y ago

"I can't wait to deploy code until its 100% secure, " That's fine if your working on a social network for cats, or another rage face Internet meme generator, but please don't use that excuse if you're storing my credit card details or health records (or writing an encrypted chat client you're promoting to political activists who's lives might literally depend on it).