Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tptacek's Review of "Practical Cryptography With Go"

gist.githubusercontent.com

Post reply on HN
Print view View original

101–110 of 255 posts

Re: Tptacek's Review of "Practical Cryptography With Go"

#101

Post by stcredzero »

rkangel wrote: post #91
jerf wrote: post #89

Earlier quoted context omitted.

The problem with regulation is that one must first establish who is capable of regulating correctly. There's no such thing as abstract regulation that simply exists. The entities that would most likely do the regulating already exist, but I'm unconvinced any of them would actually improve the situation. For instance, see http://blog.cr.yp.to/20140411-nist.html . What real group of people could really regulate cryptog…

I failed to express myself well. I'm not suggesting that all crypto is immediately regulated, that is completely infeasible. I'm just point out that regulation in general, over all domains, isn't inherently bad. There is actually some regulation in this space. FIPS compliance, PCI DSS etc.. It's just not as wide reaching as something like the FAA for aeroplanes.

The FAA, NTSB, and aerospace industry do an effective job of solving problems and taking concrete steps to prevent disasters from happening again. The industry is economically motivated to do so, and those in power want to fly safe, so things get done.

The programming field just keeps making the same old mistakes again and again. We're even economically motivated to keep things this way, because we get paid to fix things when they go wrong. Roads in Germany come with a warranty, so the contractors make sure to build them correctly. Roads in the US and Italy keep getting fixed, because that's how those companies get paid.

Re: Tptacek's Review of "Practical Cryptography With Go"

#102

Post by philh »

stavros wrote: post #66
jacquesm wrote: post #48

Earlier quoted context omitted.

I think the tone is what makes it tougher than it needs to be, not the factual content. Props to the author for just looking at the content and not at the way in which it was delivered. Props to Thomas for taking the time to review the book.

You're being downvoted, but I agree that a greater amount of tact would have been warranted. Phrases like "I am not making this up", "argh!" and "huh?" add nothing to the review, but only serve to make it more personal, and I say this as a guy who also has very little tact.

"I am not making this up" is a succinct way to say "this was a really stupid string for the book to contain".

Tptacek could have chosen to say that differently, but it does add value as written. I have no idea what ASN.1 is; simply telling me that the book contains that string doesn't mean anything to me. Telling me that it was a stupid thing to say doesn't teach me about ASN.1 or crypto, but it does teach me about the book.

Re: Tptacek's Review of "Practical Cryptography With Go"

#103

Post by duaneb »

MattRogish wrote: post #100
conformal wrote: post #88

Earlier quoted context omitted.

DISCLAIMER: i know and have worked with kyle (the author). while the factual content of tptacek's review may be spot on, his overall tone is very negative and smacks of "only experts allowed" logic. while he could have easily helped improve kyle's book and shared these comments privately, he instead chose to lambast kyle publicly, which doesn't really help anybody: tptacek looks like a total jerk and kyle now has a l…

The "experts only" attitude is because, well, as we've seen with HeartBleed, this is VerySeriousStuff. If the author instead put together a book on how a layperson could perform open-heart surgery, you're damn right that actual surgeons would jump all over it. There is some strange pervasive attitude/arrogance in tech that all it takes to be good at something is to be smart and give it a try. Why learn the theory/fun…

You know what else is hard? Writing a book on cryptography. It's all very well and good to point out problems, but there are probably more productive ways to teach people than simply point out what not to do.

Re: Tptacek's Review of "Practical Cryptography With Go"

#104

Post by bch »

ominous_prime wrote: post #97
conformal wrote: post #88

Earlier quoted context omitted.

DISCLAIMER: i know and have worked with kyle (the author). while the factual content of tptacek's review may be spot on, his overall tone is very negative and smacks of "only experts allowed" logic. while he could have easily helped improve kyle's book and shared these comments privately, he instead chose to lambast kyle publicly, which doesn't really help anybody: tptacek looks like a total jerk and kyle now has a l…

I understand where you're coming from, but the author is the one who put this out in public. Publishing a book like this sends a strong message of "I am an expert, take what is written here as fact". Maybe the tone could have been a little softer, but this should not have been done privately. The criticism of the work needs to be just as public as the work itself, so that people who might have been misled have a chan…

It could have been couched like responsible disclosure where The Author got a 1 week grace period and worked with tptacek on getting a responsible message out.

Re: Tptacek's Review of "Practical Cryptography With Go"

#105

Post by mikeash »

conformal wrote: post #88
jgrahamc wrote: post #42

I happen to know the author of this. This was a really tough thing for him to read, but he's taking it as constructive criticism. I would add to the people commentating here on HN: tptacek's review is tough; you do not need to lay into the author of this book any more.

DISCLAIMER: i know and have worked with kyle (the author). while the factual content of tptacek's review may be spot on, his overall tone is very negative and smacks of "only experts allowed" logic. while he could have easily helped improve kyle's book and shared these comments privately, he instead chose to lambast kyle publicly, which doesn't really help anybody: tptacek looks like a total jerk and kyle now has a l…

Publicly discussing the flaws of a technical book actually helps a lot of people. I don't understand how it could possibly be better to have kept these comments private. By making them public, there are people who would have taken this bad advice who now know that it's bad advice. That makes us all more secure.

I really truly cannot understand the critique of an "experts only" attitude when it comes to technical books that make important recommendations for building critical systems. By all means, non-experts should experiment and build and learn. But non-experts definitely should not be giving out large quantities of advice in an authoritative tone.

Re: Tptacek's Review of "Practical Cryptography With Go"

#106

Post by mathattack »

conformal wrote: post #88
jgrahamc wrote: post #42

I happen to know the author of this. This was a really tough thing for him to read, but he's taking it as constructive criticism. I would add to the people commentating here on HN: tptacek's review is tough; you do not need to lay into the author of this book any more.

DISCLAIMER: i know and have worked with kyle (the author). while the factual content of tptacek's review may be spot on, his overall tone is very negative and smacks of "only experts allowed" logic. while he could have easily helped improve kyle's book and shared these comments privately, he instead chose to lambast kyle publicly, which doesn't really help anybody: tptacek looks like a total jerk and kyle now has a l…

If you're writing a book on a serious topic like security, you are presenting yourself as an expert and need to be able to stand up to the criticism. It goes with the territory.

Re: Tptacek's Review of "Practical Cryptography With Go"

#107

Post by philh »

conformal wrote: post #88
jgrahamc wrote: post #42

I happen to know the author of this. This was a really tough thing for him to read, but he's taking it as constructive criticism. I would add to the people commentating here on HN: tptacek's review is tough; you do not need to lay into the author of this book any more.

DISCLAIMER: i know and have worked with kyle (the author). while the factual content of tptacek's review may be spot on, his overall tone is very negative and smacks of "only experts allowed" logic. while he could have easily helped improve kyle's book and shared these comments privately, he instead chose to lambast kyle publicly, which doesn't really help anybody: tptacek looks like a total jerk and kyle now has a l…

> he instead chose to lambast kyle publicly, which doesn't really help anybody

It helps people who might have read the book and learned to do things the wrong way.

We can model this as "Kyle has disseminated harmful material, and tptacek is trying to contain the damage". Kyle's feelings, intentions, and hard work aren't irrelevant; but they're not what we should be focusing on.

Re: Tptacek's Review of "Practical Cryptography With Go"

#108

Post by scott_s »

stcredzero wrote: post #96
stavros wrote: post #66

Earlier quoted context omitted.

You're being downvoted, but I agree that a greater amount of tact would have been warranted. Phrases like "I am not making this up", "argh!" and "huh?" add nothing to the review, but only serve to make it more personal, and I say this as a guy who also has very little tact.

There has been a cultural shift in recent years. None of tptacek's observations are adhominem. But there is now an expectation that one tone down the description of one's own reaction. I suspect this is often a conflict between the expectations of the children of helicopter parents and my generation. (1) Sorry, but I have a right to an emotional reaction to your content and a right to describe it, especially if the r…

Regarding the shoes: making it clear to you that he did not mean any harm is a way of apologizing and defusing a potentially explosive situation. I hesitate to read too much into it.

Regarding tptacek, I suspect that if he had sent this to the author, or posted it as a formal review, I suspect he would have toned down the description of his reactions. I'm not sure where this review came from, but my impression is that he did not think of it as a published review that the author would see. Certainly doing such would be advisable, as people are more receptive to criticism that way.

Perhaps I am wrong regarding how tptacek would have responded had he known the review would be, essentially, published. But I know I phrase things differently in such situations.

Re: Tptacek's Review of "Practical Cryptography With Go"

#109

Post by mikeash »

After I finished reading this review, I came to check out the HN comments knowing that the tone would be the subject of the top comments.

When did this community become more concerned with tone than correctness? The top of this thread is filled with people saying that the tone is bad, it's unproductive, it's unnecessary, etc. Yet nobody seems concerned about the published book filled with bad information that a lot of people are going to "learn" from. What gives?

Re: Tptacek's Review of "Practical Cryptography With Go"

#110

Post by scott_s »

duaneb wrote: post #103
MattRogish wrote: post #100

Earlier quoted context omitted.

The "experts only" attitude is because, well, as we've seen with HeartBleed, this is VerySeriousStuff. If the author instead put together a book on how a layperson could perform open-heart surgery, you're damn right that actual surgeons would jump all over it. There is some strange pervasive attitude/arrogance in tech that all it takes to be good at something is to be smart and give it a try. Why learn the theory/fun…

You know what else is hard? Writing a book on cryptography. It's all very well and good to point out problems, but there are probably more productive ways to teach people than simply point out what not to do.

When you are writing about a difficult subject, you should invite reviews from experts to vet your work.
Post reply on HN