3 ms·

Precisely this. "It's not hard to learn to use a crypto library" is not an interesting conversation, and so I actively tried to have a more interesting convers

Precisely this. "It's not hard to learn to use a crypto library" is not an interesting conversation, and so I actively tried to have a more interesting conversation about "it's actually pretty damn hard to implement crypto software". Since when is learning a single crypto library the end-all solution to writing good crypto software?

Nursie 12y ago
>> I actively tried to have a more interesting conversation about "it's actually pretty damn hard to implement crypto software". You might have said that! >> Since when is learning a single crypto library the end-all solution to writing good crypto software? It's not, but it's a start, a start which all of these stories that hit HN and get torn to pieces are missing. -- edit -- When I made my comment that you can learn to use existing things with minimal training I should have padded it out by telling you the reason I was saying that - learning to use well-understood crypto primitives, and (if you can) pre-provided crypto implementations is far from all you need to make secure software. But it's a start. "Hey, come and look at our neat new crypto, it's awesome!" is a big red flag, and it's a red flag with a subtext that reads: We don't know what we're doing. Software that does use good constructions and good implementations can still be done very badly, it's true. To go back to your first comment, you say there's this gap between the way crypto people work and the way developers develop - that may well be so, but in most of the messaging apps we see here on HN the developer hasn't really even attempted to bridge that gap. Think about it like cooking a meal - you're asking what it takes to become a top chef but in the case we're discussing they didn't even start their marinara sauce with tomatoes.

3 ms·

Precisely this. "It's not hard to learn to use a crypto library" is not an interesting conversation, and so I actively tried to have a more interesting convers

by diminoten 12y ago

Nursie 12y ago
>> I actively tried to have a more interesting conversation about "it's actually pretty damn hard to implement crypto software". You might have said that! >> Since when is learning a single crypto library the end-all solution to writing good crypto software? It's not, but it's a start, a start which all of these stories that hit HN and get torn to pieces are missing. -- edit -- When I made my comment that you can learn to use existing things with minimal training I should have padded it out by telling you the reason I was saying that - learning to use well-understood crypto primitives, and (if you can) pre-provided crypto implementations is far from all you need to make secure software. But it's a start. "Hey, come and look at our neat new crypto, it's awesome!" is a big red flag, and it's a red flag with a subtext that reads: We don't know what we're doing. Software that does use good constructions and good implementations can still be done very badly, it's true. To go back to your first comment, you say there's this gap between the way crypto people work and the way developers develop - that may well be so, but in most of the messaging apps we see here on HN the developer hasn't really even attempted to bridge that gap. Think about it like cooking a meal - you're asking what it takes to become a top chef but in the case we're discussing they didn't even start their marinara sauce with tomatoes.