2 ms·

Why must he? Why can't he build whatever he likes? Who are you to tell Joe what he can and can't do with regards to software development? This is the problem

Why must he? Why can't he build whatever he likes? Who are you to tell Joe what he can and can't do with regards to software development? This is the problem -- you and others are trying to perpetuate the idea that software must always be "complete" the moment it's put on GitHub. Why must Joe Developer adhere to your rigorous definition of what a software product is? Joe Developer should be free to tinker, and if he wants to tinker with crypto, crypto experts should let him. Currently they don't, and that's why we don't have any good crypto software.

Nursie 12y ago
>> Joe Developer should be free to tinker, and if he wants to tinker with crypto, crypto experts should let him. Currently they don't, and that's why we don't have any good crypto software. He can tinker. He can learn. He can do any of the many excellent free courses, tutorials and challenges on the net. He can implement attacks against toy problems, and real problems. And eventually, he can get deeper into implementing it. What he will absolutely and rightly be shot down for is making unverifiable claims about the security or what he's tinkering with, and try to profit from his claims. I'm sorry if you have a problem with that.
- diminoten 12y ago
  When did he make unverifiable claims? When did he profit from his claims? It's a nice straw man, but not what I suggested at all.
  - Nursie 12y ago
    >> When did he make unverifiable claims? When did he profit from his claims? When he launched an app that claimed to be the new safest thing ever, surely? Perhaps with an unbreakable One-Time-Pad. You know, the stuff we're commenting on here...
    - diminoten 12y ago
      > You know, the stuff we're commenting on here... Nope, not at all the stuff we're commenting on. We're commenting on the stuff that hasn't been written yet and probably won't be written at all because of your negative attitude.
      - Nursie 12y ago
        If it won't be written because people get shot down when they make outrageous claims about their security then I'm ok with that. Everyone should be. I'm not sure what it is you want here. Nobody's telling you not to use it. Nobody's telling you not to tinker. Everyone's encouraging you to learn, and giving you advice on the best way of doing that. You seem to want every bad, amateurish attempt at novel crypto, accompanied by self aggrandising copy, to be hailed as if it was awesome. It's not.
        diminoten 12y ago
        > If it won't be written because people get shot down when they make outrageous claims about their security then I'm ok with that. Everyone should be. Again, you strawman me. Where in my argument did I talk about making outrageous claims? I would very much appreciate it if you separated "make outrageous claims" from "develop open source security software".
        Nursie 12y ago
        >> Again, you strawman me. Where in my argument did I talk about making outrageous claims? You appear to be annoyed that folks write take-downs on software like the one linked to by the article. This is the outrageous claim. If you feel this is not what you're saying then fine, I'm not sure we actually have an argument. >> I would very much appreciate it if you separated "make outrageous claims" from "develop open source security software". There's no reason not to develop OSS security software. There's every reason to put up big warnings saying you can't vouch for its security. There's every reason to ask people who know what they're talking about to take a look, and to be humble when they point out flaws, and to rework it if that's the case. There's every reason to take some of the excellent free courses. But there's also no reason to go off-piste. Why develop this crazy new OTP scheme? There's existing crypto for exactly these use cases. Leave the devising and proving of new crypto constructs to the deeply-versed and the academics, who know how to prove this stuff (and disprove it). It's like saying "I can't write my OSS networking project because people keep telling me not to rewrite the TCP stack without learning about TCP first". Do you need to rewrite the stack? If so, if you want to do a good job then it's going to take a hell of a lot of knowledge and training. Why not use the OS API?

Nursie 12y ago

>> Joe Developer should be free to tinker, and if he wants to tinker with crypto, crypto experts should let him. Currently they don't, and that's why we don't have any good crypto software. He can tinker. He can learn. He can do any of the many excellent free courses, tutorials and challenges on the net. He can implement attacks against toy problems, and real problems. And eventually, he can get deeper into implementing it. What he will absolutely and rightly be shot down for is making unverifiable claims about the security or what he's tinkering with, and try to profit from his claims. I'm sorry if you have a problem with that.

diminoten 12y ago
When did he make unverifiable claims? When did he profit from his claims? It's a nice straw man, but not what I suggested at all.
- Nursie 12y ago
  >> When did he make unverifiable claims? When did he profit from his claims? When he launched an app that claimed to be the new safest thing ever, surely? Perhaps with an unbreakable One-Time-Pad. You know, the stuff we're commenting on here...
  - diminoten 12y ago
    > You know, the stuff we're commenting on here... Nope, not at all the stuff we're commenting on. We're commenting on the stuff that hasn't been written yet and probably won't be written at all because of your negative attitude.
    - Nursie 12y ago
      If it won't be written because people get shot down when they make outrageous claims about their security then I'm ok with that. Everyone should be. I'm not sure what it is you want here. Nobody's telling you not to use it. Nobody's telling you not to tinker. Everyone's encouraging you to learn, and giving you advice on the best way of doing that. You seem to want every bad, amateurish attempt at novel crypto, accompanied by self aggrandising copy, to be hailed as if it was awesome. It's not.
      - diminoten 12y ago
        > If it won't be written because people get shot down when they make outrageous claims about their security then I'm ok with that. Everyone should be. Again, you strawman me. Where in my argument did I talk about making outrageous claims? I would very much appreciate it if you separated "make outrageous claims" from "develop open source security software".
        Nursie 12y ago
        >> Again, you strawman me. Where in my argument did I talk about making outrageous claims? You appear to be annoyed that folks write take-downs on software like the one linked to by the article. This is the outrageous claim. If you feel this is not what you're saying then fine, I'm not sure we actually have an argument. >> I would very much appreciate it if you separated "make outrageous claims" from "develop open source security software". There's no reason not to develop OSS security software. There's every reason to put up big warnings saying you can't vouch for its security. There's every reason to ask people who know what they're talking about to take a look, and to be humble when they point out flaws, and to rework it if that's the case. There's every reason to take some of the excellent free courses. But there's also no reason to go off-piste. Why develop this crazy new OTP scheme? There's existing crypto for exactly these use cases. Leave the devising and proving of new crypto constructs to the deeply-versed and the academics, who know how to prove this stuff (and disprove it). It's like saying "I can't write my OSS networking project because people keep telling me not to rewrite the TCP stack without learning about TCP first". Do you need to rewrite the stack? If so, if you want to do a good job then it's going to take a hell of a lot of knowledge and training. Why not use the OS API?