4 ms·
I believe that's the point. What you do is make cool applications, and get people to use it. What he (they) do, is security. You wouldn't try and explain the mi
by skolor 17y ago
I believe that's the point. What you do is make cool applications, and get people to use it. What he (they) do, is security. You wouldn't try and explain the minutia of using ruby over django for web based applications that involve micro-blogging with SMS capabilities and micro-payments to a security researcher/expert. It may be within their grasp of understanding, but it is in no way worth the time to understand all of the requisite knowledge to understand all the underlying information.
Taking just the password hashing stuff. There are entire books on breaking passwords, and how to do it more efficiently. You're not going to go through the minutia of making sure your random number generator is seeded well, with a suitably random number, that your algorithm does not have any flaws, that... the list goes on, but its what needs to be done to make sure that the password is secure. You (as a developer) should not be doing that, just trying to learn about it would take far too much time to be worthwhile. Instead, do like he said in the post/talk, go find someone else who knows about it to do it for you.
- tptacek 17y agoThere are things, like crypto, where I think it's an actively bad thing for you to try to learn enough to implement them properly. I feel OK about pentesting apps that try to use well-understood crypto. I do not feel OK about implementing apps that try to use well-understood crypto. Crypto is radioactive. Other things, like user-controlled templating or DOM injection plugins, are so fraught with implementation errors that I think you're better off avoiding the features, or at least using well-known open source implementations. In no place do i want to argue that you should be paying to get this stuff done. The thesis behind everything we're talking about today is "here's what you do when you have no money to spend on this stuff --- and if you're a non-financial startup, you shouldn't be spending money on this stuff in any case".