7 ms·

I generally don't advocate complete rewrites, but it seems to be the best option in this scenario. Why is everyone so opposed to doing this? I don't mean that r

I generally don't advocate complete rewrites, but it seems to be the best option in this scenario. Why is everyone so opposed to doing this? I don't mean that rhetorically. I truly don't understand. I don't want to downplay the difficulty of such a project, but I regularly see brilliant developers here at HN and elsewhere scrambling to create something meaningful. Here's an excellent opportunity to build something that would have widespread use, with both cultural and political impact, yet there seems to be a lot of reluctance to actually take on such a project. Instead, we keep speculating about anonymous developers who have made it clear that they're done and want nothing to do with it anymore. We even have permission to use TrueCrypt for reference. Seems like an awesome opportunity for developers smart enough to do it.

na85 12y ago
Agree. Unfortunately it seems to me that people on this site would rather create yet another jsframework.js or Flappy Bird As A Service as opposed to something like NewCrypt. Pretty standard for the Hacker News crowd in my experience.
- tacotime 12y ago
  Oh my god, can you get me in the FBaaS beta?
- LaikaF 12y ago
  I think there is different level of difficulty between the two things you just described. And I'm pretty sure crypto is hard to work with and get right, and one mistake removes the purpose of software.
  - na85 12y ago
    Of course it's a different level of difficulty. People seem to overwhelmingly prefer to work on easy, shallow projects as opposed to hard, meaningful ones.
    - TheCapn 12y ago
      Its not like there's some standard or minimum level of competency required to create an account and comment here. I think many expect this to be an enlightened and learned crowd of commenters when most people here are likely still college age or younger. Heck, I created my account back when I was still studying in university.
      - na85 12y ago
        It is supposed to be a more enlightened crowd. If I wanted inane comments from only marginally-skilled people I'd read comments on reddit.
        Gigablah 12y ago
        This is the sort of comment that belongs on Reddit.
    - watwut 12y ago
      Contrary to what you think, writing crypto things is interestingly hard, not discouragingly or too difficult. Anyone can write one and most coders would enjoy it. The trouble is that if you are not already good in security, your creation will have too many security problems and holes to be useful for anybody who is not NSA.
    - deleted 12y ago
      [deleted]
- Alupis 12y ago
  > would rather create yet another jsframework.js or Flappy Bird As A Service Heyyyy... FBaaS was my next big thing!
- andrewljohnson 12y ago
  Such unwarranted and poisonous bitterness. The people who publish easy stuff are typically new developers/entrepreneurs, simply people with less practice. There aren't all that many amazing, experienced developers with deep toolkits and skills. Better to commend people for trying and critique their work for what it is, than bemoan the lack of depth. This sort of comment slings mud at the efforts of the young and inexperienced, when we should be trying to form a welcoming community that helps them grow. Our duty is to be supportive and help comb through the chafe to help find the diamond tech, content, and comments. That's the point of being here.
  - deleted 12y ago
    [deleted]
  - dang 12y ago
    I agree, but there's another factor besides inexperience: time constraint. Many people have day jobs. Any projects that they do for fun or interest have to fit into their spare time. There's a limit to how ambitious such projects can be, and we definitely don't want to exclude them. I think it's critical for HN to welcome a wide spectrum of original work. We want to see major technical achievements, of course. But we also want to see the minor one-offs. The bar for sharing your work on HN should be low. The relationship between major work and minor one-offs is mysterious. Things that start off playful and trivial can develop in unexpected ways. Or maybe a success at something trivial inspires someone to a more ambitious next effort. If we want to have a culture of people sharing things they've made—which we do—we need to accept that most won't seem very impressive. A good example is 2048. That game and its many variations weren't necessarily technically impressive. But the way in which a whole bunch of people riffed on each other's work for a few weeks—that was one of the most creative things ever to happen spontaneously on HN. If the game itself had been less trivial, I doubt that would have happened. The barrier to entry would have felt too high, so people without much time or experience wouldn't have gone for it. But because it was so simple, making one's own variation felt doable, and lots of people did.
- chc 12y ago
  Are you seriously criticizing everybody else for not doing something you have never done either? That is pretty bold. Just take whatever your excuse is and apply it to them. That's generally a more realistic way to simulate everybody's aggregate view of the world.
- tptacek 12y ago
  People write jsframework.js or Flappy As A Service because jsframework.js is --- face it --- easy, and Truecrypt is hard. A similar observation can be made about web-based encrypted chat systems versus encrypted block device drivers.
  - na85 12y ago
    I agree 100%.
noinsight 12y ago
All I want is a simple cross platform encryption program. Maybe something that is LUKS compatible so it works straight away on Linux and with a simple GUI for Windows that makes it as seamless as possible? (Sits in tray, autodetects when a container containing device is inserted and offers to mount it?) It's not hard (as such), yet no such program exists.
- stevechol 12y ago
  Try R10Cipher. It offers most of your requirements. www.r10cipher.com
- stevechol 12y ago
  Try R10Cipher. It offers most of your requirements. www.r10cipher.com
- stevechol 12y ago
  Try R10Cipher. It offers most of your requirements. www.r10cipher.com
- stevechol 12y ago
  Sorry for the multiples :-(
lnanek2 12y ago
I think a lot of developers would break at the point of native cross platform support. I like writing stuff people use, that's cool, but it's a huge pain to write for and test on platforms I'm not going to use like Windows and Linux. I'll do that if you pay me, sure, but not for fun. Maybe not even for the fame of having a more popular fun project.
- j45 12y ago
  Cross-platform would likely require Java as a base runtime, something that might not be appetizing for some developers. With that being said there's many brilliant polyglot developers with lots of experience and maybe it's a task for developers with more years than average under their belt as the project will take more effort than an MVP.
  - na85 12y ago
    Would you trust a full-disk encryption scheme running on top of a JVM? I sure wouldn't.
    - j45 12y ago
      Your point is valid :)
  - xenadu02 12y ago
    No, it wouldn't require Java (thankfully). The problem is the IO driver abstractions available on each platform are wildly different. Getting working filesystem driver code on Windows (7/8), Mac OS, and Linux is a non-trivial task that requires a lot of kernel mode hacking. If you are willing to live with the performance impact, at least initially, you could use FUSE for MacOS/Linux. I don't recall if the Windows UMDF (User Mode Driver Framework) supports file system drivers or not.
e40 12y ago
I think most of us think a complete rewrite would take a lot longer than picking up the current source code and continuing it.
jiggy2011 12y ago
They are frightened that tptacek might say mean things about their hashing algorithms.
- toomuchtodo 12y ago
  I'm not even in the security space and I'm sometimes afraid of tptacek's rebuttals to my comments.
- tptacek 12y ago
  Their hashing algorithms?
  - chimeracoder 12y ago
    Or their node.js implementation of DNSSEC!
    - tptacek 12y ago
      Contrary to popular belief I don't have a huge problem with Javascript. I'm just as likely to make fun of you for implementing DNSSEC in Haskell.
      - chimeracoder 12y ago
        I thought you did for Javascript for crypto purposes, though, (ie, a pure node.js implementation), not Javascript in general, right?
        tptacek 12y ago
        My problem is content-controlled Javascript (or "browser Javascript", although that term is less useful what with browser extension Javascript, which isn't content-controlled).
        napoleond 12y ago
        https://twitter.com/tqbf/status/474736429365338113 https://twitter.com/tqbf/status/474736429365338113
Havoc 12y ago
Seems reasonable. One thing I've learned from HN though is that brilliant and good at crypto are two very different things.

na85 12y ago

Agree. Unfortunately it seems to me that people on this site would rather create yet another jsframework.js or Flappy Bird As A Service as opposed to something like NewCrypt. Pretty standard for the Hacker News crowd in my experience.

tacotime 12y ago
Oh my god, can you get me in the FBaaS beta?
LaikaF 12y ago
I think there is different level of difficulty between the two things you just described. And I'm pretty sure crypto is hard to work with and get right, and one mistake removes the purpose of software.
- na85 12y ago
  Of course it's a different level of difficulty. People seem to overwhelmingly prefer to work on easy, shallow projects as opposed to hard, meaningful ones.
  - TheCapn 12y ago
    Its not like there's some standard or minimum level of competency required to create an account and comment here. I think many expect this to be an enlightened and learned crowd of commenters when most people here are likely still college age or younger. Heck, I created my account back when I was still studying in university.
    - na85 12y ago
      It is supposed to be a more enlightened crowd. If I wanted inane comments from only marginally-skilled people I'd read comments on reddit.
      - Gigablah 12y ago
        This is the sort of comment that belongs on Reddit.
  - watwut 12y ago
    Contrary to what you think, writing crypto things is interestingly hard, not discouragingly or too difficult. Anyone can write one and most coders would enjoy it. The trouble is that if you are not already good in security, your creation will have too many security problems and holes to be useful for anybody who is not NSA.
  - deleted 12y ago
    [deleted]
Alupis 12y ago
> would rather create yet another jsframework.js or Flappy Bird As A Service Heyyyy... FBaaS was my next big thing!
andrewljohnson 12y ago
Such unwarranted and poisonous bitterness. The people who publish easy stuff are typically new developers/entrepreneurs, simply people with less practice. There aren't all that many amazing, experienced developers with deep toolkits and skills. Better to commend people for trying and critique their work for what it is, than bemoan the lack of depth. This sort of comment slings mud at the efforts of the young and inexperienced, when we should be trying to form a welcoming community that helps them grow. Our duty is to be supportive and help comb through the chafe to help find the diamond tech, content, and comments. That's the point of being here.
- deleted 12y ago
  [deleted]
- dang 12y ago
  I agree, but there's another factor besides inexperience: time constraint. Many people have day jobs. Any projects that they do for fun or interest have to fit into their spare time. There's a limit to how ambitious such projects can be, and we definitely don't want to exclude them. I think it's critical for HN to welcome a wide spectrum of original work. We want to see major technical achievements, of course. But we also want to see the minor one-offs. The bar for sharing your work on HN should be low. The relationship between major work and minor one-offs is mysterious. Things that start off playful and trivial can develop in unexpected ways. Or maybe a success at something trivial inspires someone to a more ambitious next effort. If we want to have a culture of people sharing things they've made—which we do—we need to accept that most won't seem very impressive. A good example is 2048. That game and its many variations weren't necessarily technically impressive. But the way in which a whole bunch of people riffed on each other's work for a few weeks—that was one of the most creative things ever to happen spontaneously on HN. If the game itself had been less trivial, I doubt that would have happened. The barrier to entry would have felt too high, so people without much time or experience wouldn't have gone for it. But because it was so simple, making one's own variation felt doable, and lots of people did.
chc 12y ago
Are you seriously criticizing everybody else for not doing something you have never done either? That is pretty bold. Just take whatever your excuse is and apply it to them. That's generally a more realistic way to simulate everybody's aggregate view of the world.
tptacek 12y ago
People write jsframework.js or Flappy As A Service because jsframework.js is --- face it --- easy, and Truecrypt is hard. A similar observation can be made about web-based encrypted chat systems versus encrypted block device drivers.
- na85 12y ago
  I agree 100%.

noinsight 12y ago

All I want is a simple cross platform encryption program. Maybe something that is LUKS compatible so it works straight away on Linux and with a simple GUI for Windows that makes it as seamless as possible? (Sits in tray, autodetects when a container containing device is inserted and offers to mount it?) It's not hard (as such), yet no such program exists.

stevechol 12y ago
Try R10Cipher. It offers most of your requirements. www.r10cipher.com
stevechol 12y ago
Try R10Cipher. It offers most of your requirements. www.r10cipher.com
stevechol 12y ago
Try R10Cipher. It offers most of your requirements. www.r10cipher.com
stevechol 12y ago
Sorry for the multiples :-(

lnanek2 12y ago

I think a lot of developers would break at the point of native cross platform support. I like writing stuff people use, that's cool, but it's a huge pain to write for and test on platforms I'm not going to use like Windows and Linux. I'll do that if you pay me, sure, but not for fun. Maybe not even for the fame of having a more popular fun project.

j45 12y ago
Cross-platform would likely require Java as a base runtime, something that might not be appetizing for some developers. With that being said there's many brilliant polyglot developers with lots of experience and maybe it's a task for developers with more years than average under their belt as the project will take more effort than an MVP.
- na85 12y ago
  Would you trust a full-disk encryption scheme running on top of a JVM? I sure wouldn't.
  - j45 12y ago
    Your point is valid :)
- xenadu02 12y ago
  No, it wouldn't require Java (thankfully). The problem is the IO driver abstractions available on each platform are wildly different. Getting working filesystem driver code on Windows (7/8), Mac OS, and Linux is a non-trivial task that requires a lot of kernel mode hacking. If you are willing to live with the performance impact, at least initially, you could use FUSE for MacOS/Linux. I don't recall if the Windows UMDF (User Mode Driver Framework) supports file system drivers or not.

e40 12y ago

I think most of us think a complete rewrite would take a lot longer than picking up the current source code and continuing it.

jiggy2011 12y ago

They are frightened that tptacek might say mean things about their hashing algorithms.

toomuchtodo 12y ago
I'm not even in the security space and I'm sometimes afraid of tptacek's rebuttals to my comments.
tptacek 12y ago
Their hashing algorithms?
- chimeracoder 12y ago
  Or their node.js implementation of DNSSEC!
  - tptacek 12y ago
    Contrary to popular belief I don't have a huge problem with Javascript. I'm just as likely to make fun of you for implementing DNSSEC in Haskell.
    - chimeracoder 12y ago
      I thought you did for Javascript for crypto purposes, though, (ie, a pure node.js implementation), not Javascript in general, right?
      - tptacek 12y ago
        My problem is content-controlled Javascript (or "browser Javascript", although that term is less useful what with browser extension Javascript, which isn't content-controlled).
      - napoleond 12y ago
        https://twitter.com/tqbf/status/474736429365338113 https://twitter.com/tqbf/status/474736429365338113

Havoc 12y ago

Seems reasonable. One thing I've learned from HN though is that brilliant and good at crypto are two very different things.