3 ms·

My point wasn't the specificity of the argument, merely that you had misinterpreted the argument and gone after its originator misguidedly, to the conversation'

My point wasn't the specificity of the argument, merely that you had misinterpreted the argument and gone after its originator misguidedly, to the conversation's detriment, something you're continuing to do with me by accusing me of hindsight bias. Your résumé is well-known around here and you don't have to set the terms of the discussion about every security-related issue on Hacker News, particularly when it's this heavy-handed and you get recognition upvotes. All I'm saying.

tptacek 13y ago
I no longer have any idea what you're talking about. If you want to pose an argument about how TDD applies to building things like TLS stacks, I will read, consider, and respond. Debating TDD for TLS stacks isn't a waste of time, even if I do think the debate has a foregone conclusion. If you want to talk about me personally, I'm not interested.
- jsmthrowaway 13y ago
  Okay, small words: Him: Can't you test for this somehow? Even without TDD... You: TDD is bad because math and wall of text. Go read a book and realize why you can't, Web hacker. Me: You jumped on TDD unnecessarily, there. You: Now I'm going to redirect the argument to you! You're browbeating anybody that comments here, rather unnecessarily, almost as a display of expertise.
  - tptacek 13y ago
    I'll address the sliver of this comment that is actually relevant to the thread: the distinction between "testing" and "TDD" is not important to the point I'm making.
    - jsmthrowaway 13y ago
      Reading your original reply, I walk away with these four points from your four paragraphs, now with the knowledge that wherever you typed "TDD" you could mean "testing" as well. - Testing distributed cryptography is difficult. - Read a book. - You're a web developer and don't know the first thing about testing TLS stacks, clearly. - Testing does not improve systems security, as evidenced by Ruby on Rails: Rails uses testing and it's insecure. Seriously, re-read your comment. More than half of it is just unnecessary and dilutes what little point you've made into something unrecognizable in the snark.
      - sillysaurus3 13y ago
        Testing does not improve systems security, as evidenced by Ruby on Rails: Rails uses testing and it's insecure. This is an important and valuable point. He wasn't discouraging new ideas, but rather pointing out how hard it is to make new ideas practical in the security arena.
    - pg_is_a_butt 13y ago
      you're not making any point at all... you appear to be an idiot. if code can test a certificate, a certificate could trivially be created to test the code. "wah wah wah... so many different tests... it's too hard... wah wah wah" go suck a duck, lady. it's 2014. automated testing is a thing. it's dead simple. you're dumb.
- e12e 13y ago
  Well, lets assume gnutls had a test suite that tested for a few known-bad certs. Quite possibly the conniving bastard that tried his hardest to break tls by grinding out various inconceivable certs wasn't able to stumble on this particular case -- so the bug wouldn't have been found through TDD alone. Now that it is found, the cert could (trivially) go into the test suite, and (parts of) that test suite could be reused by anyone writing a TLS library from scratch. It's hard to see how that test suite couldn't help improve the reliability (and therefore "reduce the insecurity") of said new implementation (say a library with only support for a subset of tls1.2 -- without any support for fallback).

tptacek 13y ago

I no longer have any idea what you're talking about. If you want to pose an argument about how TDD applies to building things like TLS stacks, I will read, consider, and respond. Debating TDD for TLS stacks isn't a waste of time, even if I do think the debate has a foregone conclusion. If you want to talk about me personally, I'm not interested.

jsmthrowaway 13y ago
Okay, small words: Him: Can't you test for this somehow? Even without TDD... You: TDD is bad because math and wall of text. Go read a book and realize why you can't, Web hacker. Me: You jumped on TDD unnecessarily, there. You: Now I'm going to redirect the argument to you! You're browbeating anybody that comments here, rather unnecessarily, almost as a display of expertise.
- tptacek 13y ago
  I'll address the sliver of this comment that is actually relevant to the thread: the distinction between "testing" and "TDD" is not important to the point I'm making.
  - jsmthrowaway 13y ago
    Reading your original reply, I walk away with these four points from your four paragraphs, now with the knowledge that wherever you typed "TDD" you could mean "testing" as well. - Testing distributed cryptography is difficult. - Read a book. - You're a web developer and don't know the first thing about testing TLS stacks, clearly. - Testing does not improve systems security, as evidenced by Ruby on Rails: Rails uses testing and it's insecure. Seriously, re-read your comment. More than half of it is just unnecessary and dilutes what little point you've made into something unrecognizable in the snark.
    - sillysaurus3 13y ago
      Testing does not improve systems security, as evidenced by Ruby on Rails: Rails uses testing and it's insecure. This is an important and valuable point. He wasn't discouraging new ideas, but rather pointing out how hard it is to make new ideas practical in the security arena.
  - pg_is_a_butt 13y ago
    you're not making any point at all... you appear to be an idiot. if code can test a certificate, a certificate could trivially be created to test the code. "wah wah wah... so many different tests... it's too hard... wah wah wah" go suck a duck, lady. it's 2014. automated testing is a thing. it's dead simple. you're dumb.
e12e 13y ago
Well, lets assume gnutls had a test suite that tested for a few known-bad certs. Quite possibly the conniving bastard that tried his hardest to break tls by grinding out various inconceivable certs wasn't able to stumble on this particular case -- so the bug wouldn't have been found through TDD alone. Now that it is found, the cert could (trivially) go into the test suite, and (parts of) that test suite could be reused by anyone writing a TLS library from scratch. It's hard to see how that test suite couldn't help improve the reliability (and therefore "reduce the insecurity") of said new implementation (say a library with only support for a subset of tls1.2 -- without any support for fallback).