Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tptacek's Review of "Practical Cryptography With Go"

gist.githubusercontent.com

Post reply on HN
Print view View original

121–130 of 255 posts

Re: Tptacek's Review of "Practical Cryptography With Go"

#121

Post by JunkDNA »

conformal wrote: post #88
jgrahamc wrote: post #42

I happen to know the author of this. This was a really tough thing for him to read, but he's taking it as constructive criticism. I would add to the people commentating here on HN: tptacek's review is tough; you do not need to lay into the author of this book any more.

DISCLAIMER: i know and have worked with kyle (the author). while the factual content of tptacek's review may be spot on, his overall tone is very negative and smacks of "only experts allowed" logic. while he could have easily helped improve kyle's book and shared these comments privately, he instead chose to lambast kyle publicly, which doesn't really help anybody: tptacek looks like a total jerk and kyle now has a l…

I'm sure the author is a nice guy. It is hard to put yourself out there like he has done. That said, when you put your name on something and put it in the public space, you have to be prepared for people to write these kinds of things. Furthermore, I think tptacek's blunt and at times snarky style is necessary to make his point. It is extremely hard to write clear critiques that don't sound harsh while at the same time clearly conveying the gravity of the situation. In short, tptacek can't afford the risk that softening his natural style means a major point will be missed. It's a bit like the old quote, "Sorry this letter is so long, I didn't have the time to make it short.". Politeness is a luxury one can't really afford when a book that has factual errors is already out there (and to be clear, I'm not qualified to assess whether this is true, I'm just speaking about the approach here). It is far better to write precisely what you're really thinking, than to couch it in all sorts equivocation and self-censorship.

Academic researchers get these kinds of critiques of their publications all the time. It's extremely useful to the whole academic process despite being infuriating and depressing. That said, most of those critiques happen before publication and in private. But as a book author, that's something one can control. If I were writing a book like this, my #1 worry would be that I was making claims or errors that would be held up on HN by folks like tptacek as evidence of my incompetence. I would therefore made it the highest priority to approach the most likely people to have an opinion to get them to review my draft ahead of publication. That's what people writing serious publications that have real world consequences do. Make no mistake: crypto is in this category. It's not like writing "The 4-hour Work Week", "Web Design for Programmers", or "JavaScript for Aspiring Ninjas".

Re: Tptacek's Review of "Practical Cryptography With Go"

#122

Post by StavrosK »

tptacek wrote: post #118
StavrosK wrote: post #116

Earlier quoted context omitted.

I don't know, I have problems with these things. I never know who's wrong, should the author not take it personally, or should the reviewer be tactful? I guess both. Why hurt someone when you can avoid it?

I have a personal problem with ASN.1, and with authenticate- then- obliviously- decrypt. I don't know the author of this book at all and reject the implication that the review had a personalized tone. Having said that: had I written the "review" as an actual "review", and not as an oversized HN comment that I had to make a Gist out of to get it onto the site, I would have written it more carefully.

I'm not saying the review was personal, it's pretty clear that you're only talking about the facts. It's just that there are phrases that have a lower "hurt-to-information" numerator with the same denominator.

Re: Tptacek's Review of "Practical Cryptography With Go"

#123

Post by tptacek »

raverbashing wrote: post #80

Those with glass ceilings shouldn't throw stones While criticism is good, the condescending way it is presented, as well as being overly critical are bad. Example: "Total undue reverence for NIST and FIPS standards; for instance, the book recommends PBKDF2 over bcrypt and scrypt (amusingly: the book actually recommends against scrypt, which is too new for it) because it's standardized." I know people love scrypt and…

This is silly. There is no advantage to using PBKDF2 other than to placate PHBs. PBKDF2 (as commonly implemented, with HMAC-SHA2) is faster than bcrypt and scrypt and particularly straightforward to implement in GPU crackers.

bcrypt is also approximately the same age as PBKDF2.

And, finally, standardization is a very poor substitute for security analysis. PKCS1v1.5 is also a standard. If you want to argue against bcrypt, you'll have to marshal actual arguments.

Re: Tptacek's Review of "Practical Cryptography With Go"

#124

Post by kbenson »

yukichan wrote: post #73
GuiA wrote: post #19

From tptacek's comment, it sounds like the author of the book may just be an inexperienced practitioner of cryptography who's only crime is to be too eager to spread what they've learned. Someone who picked up the basics from a few Wikipedia articles here, a few papers there, a couple open source projects here and there... they're smart, so they're not completely clueless about the field, but they just don't have the…

As bad as it may seem I've found that saying incorrect things results in more learning than staying quiet so I often say incorrect things but things I think are true. I'm embarrassed when I'm wrong but I always learn from it. I also ask "why?" a lot and "what is that?" if it makes sense to (or just Google it later). I learn this way. It helps solve ignorance. It doesn't make me a faster thinker which is something I m…

Writing a book to teach other people should not be considered first and foremost a way to learn a subject. You may learn when corrected, but at the expense of the readers that read the mistakes and did not see corrections. This is more important the more advanced or important the subject.

I would not write a book on structural engineering to learn the subject or become an expert. The stakes for the misinformation being spread are high.

Re: Tptacek's Review of "Practical Cryptography With Go"

#125

Post by raverbashing »

conformal wrote: post #88
jgrahamc wrote: post #42

I happen to know the author of this. This was a really tough thing for him to read, but he's taking it as constructive criticism. I would add to the people commentating here on HN: tptacek's review is tough; you do not need to lay into the author of this book any more.

DISCLAIMER: i know and have worked with kyle (the author). while the factual content of tptacek's review may be spot on, his overall tone is very negative and smacks of "only experts allowed" logic. while he could have easily helped improve kyle's book and shared these comments privately, he instead chose to lambast kyle publicly, which doesn't really help anybody: tptacek looks like a total jerk and kyle now has a l…

"this pervasive "experts only" attitude is a big part of why "secure" open source projects have hard times getting and keeping contributors. "

Exactly

Not to mention the need to have to filter through all the BS criticism. I've read people arguing that there was no issue in having the e in RSA (the public exponent) equals to 1. Really.

Re: Tptacek's Review of "Practical Cryptography With Go"

#126

Post by tptacek »

StavrosK wrote: post #115
philh wrote: post #102

Earlier quoted context omitted.

"I am not making this up" is a succinct way to say "this was a really stupid string for the book to contain". Tptacek could have chosen to say that differently, but it does add value as written. I have no idea what ASN.1 is; simply telling me that the book contains that string doesn't mean anything to me. Telling me that it was a stupid thing to say doesn't teach me about ASN.1 or crypto, but it does teach me about t…

Sure, but there's a difference between "this book is really bad, it contains errors and wrong advice, I would advise against it and avoid it" and "goddamn this is literally the stupidest book that has ever been written". They convey the same amount of information, but the author's feelings are not hurt equally.

This book doesn't come within an astronomical unit of being the worst book on cryptography I've read; _Applied Cryptography_ is far worse. Which is why I didn't write anything like "goddamn this is literally the stupidest book that has ever been written".

Re: Tptacek's Review of "Practical Cryptography With Go"

#127

Post by mikeash »

stcredzero wrote: post #96
stavros wrote: post #66

Earlier quoted context omitted.

You're being downvoted, but I agree that a greater amount of tact would have been warranted. Phrases like "I am not making this up", "argh!" and "huh?" add nothing to the review, but only serve to make it more personal, and I say this as a guy who also has very little tact.

There has been a cultural shift in recent years. None of tptacek's observations are adhominem. But there is now an expectation that one tone down the description of one's own reaction. I suspect this is often a conflict between the expectations of the children of helicopter parents and my generation. (1) Sorry, but I have a right to an emotional reaction to your content and a right to describe it, especially if the r…

You're spot on with the cultural shift.

To me, complaints about tone are for critiques that contain phrases like "fucking idiot" and "worthless waste of space" and other such direct insults or attacks.

If something legitimately makes you stop and stare with your mouth hanging open, it is OK to say "this statement made me stop and stare with my mouth hanging open." Phrases like "I am not making this up" are reasonable shortcuts to expressing that sentiment.

Could Mr. Ptacek's review have been worded more kindly? Of course. Do I care? Not at all. It was nice enough. It concentrated on technical flaws rather than personal attacks. It was informative and useful. The tone was just fine.

Re: Tptacek's Review of "Practical Cryptography With Go"

#128

Post by jvehent »

tptacek wrote: post #112

If I had written a book on implementing cryptography in Golang, I assure you that someone else would have reviewed it harshly too. It's simply a difficult subject to get right.

It's not specific to cryptography. There is a hierarchy in all fields:

1. Top researchers come up with algorithms and techniques

  - The research corpus reviews them
2. Top programmers implements these techniques

  - The programmers communities review them
3. Top engineers write books to explain these techniques

  - which everybody else relies on in their tools
1 knows more than 2 which knows more than 3. But each group needs the two others, and the rest of the worlds needs all of them. People who write books are rarely the same people who come up with cryptographic breakthrough. Instead, they are engineers, and they can use a bit of help to get things right.

Your review was harsh, because you know more. What, I think, was missing from it is a bit of "This is a great first step, let me help you make it better so we can move everybody else forward. Here are my comments."

Re: Tptacek's Review of "Practical Cryptography With Go"

#129

Post by StavrosK »

tptacek wrote: post #126
StavrosK wrote: post #115

Earlier quoted context omitted.

Sure, but there's a difference between "this book is really bad, it contains errors and wrong advice, I would advise against it and avoid it" and "goddamn this is literally the stupidest book that has ever been written". They convey the same amount of information, but the author's feelings are not hurt equally.

This book doesn't come within an astronomical unit of being the worst book on cryptography I've read; _Applied Cryptography_ is far worse. Which is why I didn't write anything like "goddamn this is literally the stupidest book that has ever been written".

Sorry, I have a habit of not clarifying enough. I'm not saying you said that, I'm just pointing out that one can say the same thing more innocuously if one is a bit more dry/factual.

Re: Tptacek's Review of "Practical Cryptography With Go"

#130

Post by sillysaurus3 »

tptacek wrote: post #112

If I had written a book on implementing cryptography in Golang, I assure you that someone else would have reviewed it harshly too. It's simply a difficult subject to get right.

If I had written a book on implementing cryptography

I've been throwing $20 bills at my monitor so that your book will start downloading, but it doesn't seem to be working.

But really, you should write one.

Post reply on HN