4 ms·

> You know, the stuff we're commenting on here... Nope, not at all the stuff we're commenting on. We're commenting on the stuff that hasn't been written yet

> You know, the stuff we're commenting on here... Nope, not at all the stuff we're commenting on. We're commenting on the stuff that hasn't been written yet and probably won't be written at all because of your negative attitude.

Nursie 12y ago
If it won't be written because people get shot down when they make outrageous claims about their security then I'm ok with that. Everyone should be. I'm not sure what it is you want here. Nobody's telling you not to use it. Nobody's telling you not to tinker. Everyone's encouraging you to learn, and giving you advice on the best way of doing that. You seem to want every bad, amateurish attempt at novel crypto, accompanied by self aggrandising copy, to be hailed as if it was awesome. It's not.
- diminoten 12y ago
  > If it won't be written because people get shot down when they make outrageous claims about their security then I'm ok with that. Everyone should be. Again, you strawman me. Where in my argument did I talk about making outrageous claims? I would very much appreciate it if you separated "make outrageous claims" from "develop open source security software".
  - Nursie 12y ago
    >> Again, you strawman me. Where in my argument did I talk about making outrageous claims? You appear to be annoyed that folks write take-downs on software like the one linked to by the article. This is the outrageous claim. If you feel this is not what you're saying then fine, I'm not sure we actually have an argument. >> I would very much appreciate it if you separated "make outrageous claims" from "develop open source security software". There's no reason not to develop OSS security software. There's every reason to put up big warnings saying you can't vouch for its security. There's every reason to ask people who know what they're talking about to take a look, and to be humble when they point out flaws, and to rework it if that's the case. There's every reason to take some of the excellent free courses. But there's also no reason to go off-piste. Why develop this crazy new OTP scheme? There's existing crypto for exactly these use cases. Leave the devising and proving of new crypto constructs to the deeply-versed and the academics, who know how to prove this stuff (and disprove it). It's like saying "I can't write my OSS networking project because people keep telling me not to rewrite the TCP stack without learning about TCP first". Do you need to rewrite the stack? If so, if you want to do a good job then it's going to take a hell of a lot of knowledge and training. Why not use the OS API?
    - diminoten 12y ago
      Your need to be right has driven us so far afield from the original topic, I'm actually somewhat impressed. I don't know what you think I wrote, but no one here at any time suggested writing a new crypto scheme. It's 4 days later. I've made my point over and over again, and you understand it. You have even restated my point yourself, in your second paragraph. I'm done. You agreed with me, and everything else you're trying to talk about is just you begging to be validated. I can't feed this anymore, sorry.
  - Nursie 12y ago
    I think we probably still have a fundamental disconnect here. Can I ask you, when I say - "people writing software products generally shouldn't be creating novel cryptosystems" - what is it you hear? Do you hear someone saying "you shouldn't be writing software that uses encryption" ? Because that's not what I'm saying. A cryptosystem is something like what's going on here - we have messages secured by OTPs, generated using SecureRandom and exchanged over an encrypted channel using an AES key displayed on the screen for the other party to scan. So what I'm saying is "hey, why not use the industry standards for your crypto? Inventing cryptosystems is way hard and you probably got it wrong. You can still make your cool apps on top of it!"

Nursie 12y ago

If it won't be written because people get shot down when they make outrageous claims about their security then I'm ok with that. Everyone should be. I'm not sure what it is you want here. Nobody's telling you not to use it. Nobody's telling you not to tinker. Everyone's encouraging you to learn, and giving you advice on the best way of doing that. You seem to want every bad, amateurish attempt at novel crypto, accompanied by self aggrandising copy, to be hailed as if it was awesome. It's not.

diminoten 12y ago
> If it won't be written because people get shot down when they make outrageous claims about their security then I'm ok with that. Everyone should be. Again, you strawman me. Where in my argument did I talk about making outrageous claims? I would very much appreciate it if you separated "make outrageous claims" from "develop open source security software".
- Nursie 12y ago
  >> Again, you strawman me. Where in my argument did I talk about making outrageous claims? You appear to be annoyed that folks write take-downs on software like the one linked to by the article. This is the outrageous claim. If you feel this is not what you're saying then fine, I'm not sure we actually have an argument. >> I would very much appreciate it if you separated "make outrageous claims" from "develop open source security software". There's no reason not to develop OSS security software. There's every reason to put up big warnings saying you can't vouch for its security. There's every reason to ask people who know what they're talking about to take a look, and to be humble when they point out flaws, and to rework it if that's the case. There's every reason to take some of the excellent free courses. But there's also no reason to go off-piste. Why develop this crazy new OTP scheme? There's existing crypto for exactly these use cases. Leave the devising and proving of new crypto constructs to the deeply-versed and the academics, who know how to prove this stuff (and disprove it). It's like saying "I can't write my OSS networking project because people keep telling me not to rewrite the TCP stack without learning about TCP first". Do you need to rewrite the stack? If so, if you want to do a good job then it's going to take a hell of a lot of knowledge and training. Why not use the OS API?
  - diminoten 12y ago
    Your need to be right has driven us so far afield from the original topic, I'm actually somewhat impressed. I don't know what you think I wrote, but no one here at any time suggested writing a new crypto scheme. It's 4 days later. I've made my point over and over again, and you understand it. You have even restated my point yourself, in your second paragraph. I'm done. You agreed with me, and everything else you're trying to talk about is just you begging to be validated. I can't feed this anymore, sorry.
- Nursie 12y ago
  I think we probably still have a fundamental disconnect here. Can I ask you, when I say - "people writing software products generally shouldn't be creating novel cryptosystems" - what is it you hear? Do you hear someone saying "you shouldn't be writing software that uses encryption" ? Because that's not what I'm saying. A cryptosystem is something like what's going on here - we have messages secured by OTPs, generated using SecureRandom and exchanged over an encrypted channel using an AES key displayed on the screen for the other party to scan. So what I'm saying is "hey, why not use the industry standards for your crypto? Inventing cryptosystems is way hard and you probably got it wrong. You can still make your cool apps on top of it!"