Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tptacek's Review of "Practical Cryptography With Go"

gist.githubusercontent.com

Post reply on HN
Print view View original

171–180 of 255 posts

Re: Tptacek's Review of "Practical Cryptography With Go"

#171

Post by tptacek »

yukichan wrote: post #73
GuiA wrote: post #19

From tptacek's comment, it sounds like the author of the book may just be an inexperienced practitioner of cryptography who's only crime is to be too eager to spread what they've learned. Someone who picked up the basics from a few Wikipedia articles here, a few papers there, a couple open source projects here and there... they're smart, so they're not completely clueless about the field, but they just don't have the…

As bad as it may seem I've found that saying incorrect things results in more learning than staying quiet so I often say incorrect things but things I think are true. I'm embarrassed when I'm wrong but I always learn from it. I also ask "why?" a lot and "what is that?" if it makes sense to (or just Google it later). I learn this way. It helps solve ignorance. It doesn't make me a faster thinker which is something I m…

I am exactly the same way.

Re: Tptacek's Review of "Practical Cryptography With Go"

#172

Post by stcredzero »

scott_s wrote: post #108
stcredzero wrote: post #96

Earlier quoted context omitted.

There has been a cultural shift in recent years. None of tptacek's observations are adhominem. But there is now an expectation that one tone down the description of one's own reaction. I suspect this is often a conflict between the expectations of the children of helicopter parents and my generation. (1) Sorry, but I have a right to an emotional reaction to your content and a right to describe it, especially if the r…

Regarding the shoes: making it clear to you that he did not mean any harm is a way of apologizing and defusing a potentially explosive situation. I hesitate to read too much into it. Regarding tptacek, I suspect that if he had sent this to the author, or posted it as a formal review, I suspect he would have toned down the description of his reactions. I'm not sure where this review came from, but my impression is tha…

making it clear to you that he did not mean any harm is a way of apologizing

A better way of apologizing is actually apologizing. The young man's reaction was more like exasperation that I should have been put out.

My impression is that the comment was/is a comment on social media. My comment was written in that context.

Re: Tptacek's Review of "Practical Cryptography With Go"

#173

Post by stcredzero »

smacktoward wrote: post #160
stcredzero wrote: post #96

Earlier quoted context omitted.

There has been a cultural shift in recent years. None of tptacek's observations are adhominem. But there is now an expectation that one tone down the description of one's own reaction. I suspect this is often a conflict between the expectations of the children of helicopter parents and my generation. (1) Sorry, but I have a right to an emotional reaction to your content and a right to describe it, especially if the r…

I would argue that it's not as simple as > I have a right to an emotional reaction to your content and a right to describe it, especially if the reaction is grounded in objective technical reality ... because while you have rights , being a person who participates in a civilized society means you also have responsibilities , and one of those responsibilities is to interact with people in ways that are appropriate to…

I never said what my tone was on the bus -- it was blunt and matter of fact. My observation was about the young man's reaction. I take exception to your post, as it suggests I said something I didn't.

Re: Tptacek's Review of "Practical Cryptography With Go"

#174

Post by notacoward »

leoc wrote: post #151
stcredzero wrote: post #96

Earlier quoted context omitted.

There has been a cultural shift in recent years. None of tptacek's observations are adhominem. But there is now an expectation that one tone down the description of one's own reaction. I suspect this is often a conflict between the expectations of the children of helicopter parents and my generation. (1) Sorry, but I have a right to an emotional reaction to your content and a right to describe it, especially if the r…

Amost all aggressive reactions are partly contrived and controlled, even if they're occasioned by genuine emotion in the actor. You can see this from the fact that you very rarely see someone give a strongly hostile or contemptuous emotional reaction to their boss or someone else whose reaction they fear. Somehow the guys who just have strong feelings, or just have to tell it like it is, manage to tell it in a much m…

Merely upvoting isn't enough. Online bullies are cowards at heart, and it's good to be reminded of that, so thanks.

Re: Tptacek's Review of "Practical Cryptography With Go"

#175

Post by CocaKoala »

bch wrote: post #154
mikeash wrote: post #120

Earlier quoted context omitted.

The point of responsible disclosure is that it limits the damage done to users of the system in question by reducing the window in which the flaw is known and the systems are unpatched. That doesn't apply for a book. Keeping the critique private for a week doesn't help the readers at all. In fact it harms them by keeping incorrect information in play and uncorrected for longer. Perhaps it softens the blow to the auth…

I agree with all your points. When I said treat this in a "responsible disclosure" method, I did really mean a grace period, for the authors sake[0]. Clearly the reasoning is not the same as a security issue, as you pointed out. I was trying to be a bit clever. My mistake. That all said, I still think we can treat each other better. Honest question: was it necessary to destroy it in such detail? Was it necessary for…

What do you mean, "was it necessary to destroy it in such detail"?

If tptacek hadn't destroyed it in such detail, his review would have consisted of saying "Hey, this book is pretty bad; it's got some very serious issues, and makes some pretty terrible or misleading recommendations. My suggestion: do not read it".

Would that be better? Or would you be complaining that "Well geeze, it's not helpful to say that the book isn't good; you have to go into some detail about what the problems are so that everybody can learn!"

The idea of asking for LESS DETAIL in a criticism of a topic is bizarre. How much detail would you prefer?

Re: Tptacek's Review of "Practical Cryptography With Go"

#176

Post by mikeash »

dragonwriter wrote: post #164
mikeash wrote: post #127

Earlier quoted context omitted.

You're spot on with the cultural shift. To me, complaints about tone are for critiques that contain phrases like "fucking idiot" and "worthless waste of space" and other such direct insults or attacks. If something legitimately makes you stop and stare with your mouth hanging open, it is OK to say "this statement made me stop and stare with my mouth hanging open." Phrases like "I am not making this up" are reasonable…

> If something legitimately makes you stop and stare with your mouth hanging open, it is OK to say "this statement made me stop and stare with my mouth hanging open." It's okay if you are writing a story about your personal reactions. It's irrelevant if you are writing a serious critique, which should be about the content, not about your emotional response to it (assuming it is a critique of an informative work -- ob…

Sure, it's irrelevant. It adds some color, but it's unnecessary. But who cares? The complaints are not "this writing could be tighter, it wastes words on unnecessary side notes." They are, "oh my god you're hurting this poor fellow's self esteem with your tone!"

It's ironic that these critiques of this review are much dumber than the review's critiques of the book, and implicitly hold a fairly off-the-cuff internet comment to far higher standards than a published book that purports to give important and useful advice about cryptography.

Could this review be better? Sure. But who cares?

Re: Tptacek's Review of "Practical Cryptography With Go"

#177

Post by diminoten »

tptacek wrote: post #146
conformal wrote: post #88

Earlier quoted context omitted.

DISCLAIMER: i know and have worked with kyle (the author). while the factual content of tptacek's review may be spot on, his overall tone is very negative and smacks of "only experts allowed" logic. while he could have easily helped improve kyle's book and shared these comments privately, he instead chose to lambast kyle publicly, which doesn't really help anybody: tptacek looks like a total jerk and kyle now has a l…

It's good to stick up for people. It's less good to be thin-skinned on someone else's behalf. Here, your attitude causes two problems. First, you know and apparently like Kyle Isom, and so I presume you're also ready to tell me that he's an adult and a professional. Professionals do one of three things with criticism: ignore it, rebut it, or learn from it. My assumption has been that Kyle is choosing options (1) and…

Ironically, you yourself are choosing more 4 than 2 in response to someone's criticism of your criticism.

Re: Tptacek's Review of "Practical Cryptography With Go"

#178

Post by tptacek »

diminoten wrote: post #177
tptacek wrote: post #146

Earlier quoted context omitted.

It's good to stick up for people. It's less good to be thin-skinned on someone else's behalf. Here, your attitude causes two problems. First, you know and apparently like Kyle Isom, and so I presume you're also ready to tell me that he's an adult and a professional. Professionals do one of three things with criticism: ignore it, rebut it, or learn from it. My assumption has been that Kyle is choosing options (1) and…

Ironically, you yourself are choosing more 4 than 2 in response to someone's criticism of your criticism.

I made 3 straightforward points in my comment. Do you disagree with any of them? If not, let's just agree to disagree.

Re: Tptacek's Review of "Practical Cryptography With Go"

#179

Post by billpollock »

tptacek wrote: post #157
archgoon wrote: post #147

Earlier quoted context omitted.

While reading your review, one of the main criticisms seems to be that the it's not made sufficiently clear that the code as written is insecure. In keeping with the philosophy of being hands on; would the book be improved if after introducing the code in the first section, have the reader implement an exploit for the same code?

I feel comfortable with the idea of writing a book showing people how to break badly-implemented crypto designs, so much so that Sean, Alex, and I are in fact writing that book; it'll be a "pay-what-you-want" directly to a preferred charity. If anyone can point us to someone who will take our money to expertly typeset a giant text file, that would be helpful. I do not feel remotely comfortable with the idea of writin…

I'd love to chat with you about your book.

Re: Tptacek's Review of "Practical Cryptography With Go"

#180

Post by stcredzero »

notacoward wrote: post #168
stcredzero wrote: post #96

Earlier quoted context omitted.

There has been a cultural shift in recent years. None of tptacek's observations are adhominem. But there is now an expectation that one tone down the description of one's own reaction. I suspect this is often a conflict between the expectations of the children of helicopter parents and my generation. (1) Sorry, but I have a right to an emotional reaction to your content and a right to describe it, especially if the r…

"I suspect this is often a conflict between the expectations of the children of helicopter parents and my generation." At 49, I see the exact opposite. Members of my generation tended to exhibit more tact and decorum. The urge to dress like a hobo, swear all the time, and flame everyone in sight is a classic overcompensation for years of helicopter parenting which forbade all of these things. "In some cases, it's hon…

In others, it's honesty used as a pretext for acting out.

Note I also make this observation.

Also note that I am specifically pointing out reactions to criticism. The other changes in decorum have been noted by previous generations since at least the 1800s. Waltzing was once a lascivious corrosive to society's morals.

Also: we are likely less than 4 years apart in age. I could do with more decorum, as I've been learning over the past 4 years.

Post reply on HN