8 ms·
While reading your review, one of the main criticisms seems to be that the it's not made sufficiently clear that the code as written is insecure. In keeping wi
by archgoon 13y ago
While reading your review, one of the main criticisms seems to be that the it's not made sufficiently clear that the code as written is insecure.
In keeping with the philosophy of being hands on; would the book be improved if after introducing the code in the first section, have the reader implement an exploit for the same code?
- tptacek 13y agoI feel comfortable with the idea of writing a book showing people how to break badly-implemented crypto designs, so much so that Sean, Alex, and I are in fact writing that book; it'll be a "pay-what-you-want" directly to a preferred charity. If anyone can point us to someone who will take our money to expertly typeset a giant text file, that would be helpful. I do not feel remotely comfortable with the idea of writing a book containing prescriptions on how to design a cryptosystem. We're wary of doing that even for our clients, where we know all of the context and the threat model that the proposed system would face, and who will actually build it, and that we'll get paid to review the resulting implementation. I don't know how to solve that problem for strangers. Other people do. They are much better than I am. When Trevor and Moxie write the book on why they chose the TextSecure primitives that they chose, I'll be first in line to buy.
- angersock 13y agoAny chance of just releasing it as big .txt balls, MaTaSaNo_Crypto_2_of_7.txt , with glorious ascii art at the top? You know, for old times' sake?
- billpollock 13y agoI'd love to chat with you about your book.
- tptacek 13y agoThanks, but we're actively avoiding publishers.
- babawere 13y agoIs your book also based on golang crypto lib ?
- tptacek 13y agoNo.