Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram, a.k.a. “Stand back, we have Math PhDs”

unhandledexpression.com

Post reply on HN
Print view View original

11–20 of 56 posts

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#11

Post by fleitz »

igravious wrote: post #7

Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…

They did what pretty much everyone tells people not to do.

The fact that they hired experts to make rookie mistakes is just beyond belief.

It's like a pro painter who covers the walls in oil before putting a coat of latex on, then goes and tells the world he's discovered a way to make paint stick indefinitely to walls, then a week later the paint peels right off.

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#12

Post by MichaelGG »

igravious wrote: post #7

Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…

Because Telegram is acting careless, and ignoring actual criticism, while touting claims that do not appear to be true? It's close to lying and scamming users.

If Telegram was a messaging proposal, I'm sure the attitude would be a more straightforward one (with the same end result of "you're not ready to handle this yet"). Instead, it's billed as a definitely secure system.

Seriously, read the previous thread: https://news.ycombinator.com/item?id=6913456

Look at the threads regarding CryptoCat (which was quite broken, despite the author fighting folks off and people cheering him on), or that guy that insisted he had secure JavaScript crypto that wasn't ultimately as secure as the server.

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#13

Post by vacri »

igravious wrote: post #7

Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…

Elitism is found in all specialists, not just IT. I've seen it from doctors, mechanics, finance folks, dentists, police, even unskilled jobs like packaging dispatch staff.

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#14

Post by andrewflnr » 

  They could have made something like: the client generates a key pair,
  encrypts the public key with the server’s public key, sends it to the server
  with a nonce, and the server sends back the nonce encrypted with the
  client’s public key. Simple and easy.
Just out of curiosity, is it really that easy if you're using verified components? I would naively assume (and hope) so, but then everyone tells me that crypto is fraught with subtle ways to shoot your users in the feet, including if you misuse verified primitives. If yes, I'll continue making pie-in-the-sky plans using the magic of public-key cryptography. :)

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#15

Post by caprad »

igravious wrote: post #7

Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…

Did not pick this up as being smug, did pick it up as some guys stepping into a complicated field, and messing it up royally.

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#16

Post by igravious »

sheepz wrote: post #8
igravious wrote: post #7

Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…

This has nothing to do with smugness. If you market your product as a secure alternative, it better be secure.

I understand the importance of security. I do hope Telegram can get it right. I acknowledge it is probably not as secure as they claim right now. I still maintain the article author's attitude just rubs me up the wrong way because of the mood I'm in - the smugness (and I hope I'm not imagining it) is definitely a side issue but one I felt I had to get off my chest. I don't want to make a big issue of it and detract too much from the critique but I felt I had to say it even though HN may not be the bestest place in the world to voice such things. I hear you though.

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#17

Post by forgottenpass »

What's the business model? The app is free, I'm not going to install it but they claim to be ad free too.

Are they a charity designed to squirt cyphertext around the globe? Monitoring my behavior to monetize it? freemium?

This bit clears it up: PRIVACY: We take your privacy very seriously and will never give third parties access to your data!

Oh. So they're marketing an app under the banner of privacy, but architected to enable data collection from me. I can opt into having slightly less data collectable with additional encryption (of questionable quality) on top of their standard service. In an age where the greatest threats to privacy are corporate surveillance and the NSA's legal authority to collect data form businesses, they protect my privacy on exactly zero fronts.

Their messaging is either oblivious or underhanded: "We built Telegram to make messaging safe again so you can take back your right to privacy."

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#18

Post by igravious »

collinvandyck76 wrote: post #10
igravious wrote: post #7

Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…

In general, it's largely due to insecurity. I'm not saying that this is the case here, as I didn't pick up on it, but your comment definitely resonated with me, and this is something that bugs me more than I'd like on an ongoing basis. Over the last few years, I've been trying to become better at saying "I don't know", which can sometimes be really difficult in some tech circles.

I have never used Node.js

There, I said it.

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#19

Post by igravious »

nwh wrote: post #9
igravious wrote: post #7

Why so smug? I've seen this attitude in all types of IT heads (sys admins easily being the worst of the bunch) over the years. What is it about techies that they come over so smug when pointing out deficiencies in others? I still have the shame and anger provoking memory of two techies sniggering not-so-openly at me because I didn't know about name service switch in UNIX because guess what, I don't know everything. W…

The issue is that they claim their system is secure. Peoples lives can literally depend on encryption actually doing what it says on the tin; this software does not. It's the epitome of home grown encryption.

I hear you. Agreed. Surely every decent crypto system started off home-grown?

Re: Telegram, a.k.a. “Stand back, we have Math PhDs”

#20

Post by MichaelGG »

igravious wrote: post #16
sheepz wrote: post #8

Earlier quoted context omitted.

This has nothing to do with smugness. If you market your product as a secure alternative, it better be secure.

I understand the importance of security. I do hope Telegram can get it right. I acknowledge it is probably not as secure as they claim right now. I still maintain the article author's attitude just rubs me up the wrong way because of the mood I'm in - the smugness (and I hope I'm not imagining it) is definitely a side issue but one I felt I had to get off my chest. I don't want to make a big issue of it and detract t…

Given their attitude, it's unlikely they'll get it right. They'll keep telling people "that's not a real attack" and making up excuses. Then someone will publish a real attack, and they'll patch over it. Repeat.

The "smugness" is pointing out problems in their implementation, despite them going on about having "ACM champions" that took two years to design it, so it obviously must be perfect.

If someone pitched a database that simply mmap'd a file and then called it "fully transactional and safe", they'd get a lot of strong criticism.

Post reply on HN