Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tptacek's Review of "Practical Cryptography With Go"

gist.githubusercontent.com

Post reply on HN
Print view View original

201–210 of 255 posts

Re: Tptacek's Review of "Practical Cryptography With Go"

#201

Post by tptacek »

diminoten wrote: post #197
tptacek wrote: post #178

Earlier quoted context omitted.

I made 3 straightforward points in my comment. Do you disagree with any of them? If not, let's just agree to disagree.

I disagree with your condemnation of a behavior while exhibiting said behavior. It shows that you're okay with drama so long as it's you creating it, but you're not okay with a dramatic response to your own drama-creating. The accusation of elitism on your part is not a new one, I don't think, to you - I found myself levying the same accusation when you decided to single out the CryptoCat project as a distinctly "bad…

I think Cryptocat illustrates and affirms the points I'm making about amateur cryptography, and doesn't rebut them.

Re: Tptacek's Review of "Practical Cryptography With Go"

#202

Post by simik »

tptacek wrote: post #161
angersock wrote: post #158

Earlier quoted context omitted.

Any chance of just releasing it as big .txt balls, MaTaSaNo_Crypto_2_of_7.txt , with glorious ascii art at the top? You know, for old times' sake?

We have a different funny plan for releasing it. :)

Deface different websites with chapters of the book? Each chapter being about a defect in crypto implementation that allowed you to deface that particular website.

Re: Tptacek's Review of "Practical Cryptography With Go"

#203

Post by 0xdeadbeefbabe »

Varcht wrote: post #194
jvehent wrote: post #128

Earlier quoted context omitted.

It's not specific to cryptography. There is a hierarchy in all fields: 1. Top researchers come up with algorithms and techniques - The research corpus reviews them 2. Top programmers implements these techniques - The programmers communities review them 3. Top engineers write books to explain these techniques - which everybody else relies on in their tools 1 knows more than 2 which knows more than 3. But each group ne…

How can publishing a book purporting to be the way to do security be considered a first step? A first step would be to get some feed back from experts prior to publishing. This is the real world where this information is critical to our future, not something to be taken lightly. On a human level I have some sympathy for the writer but professionally I think Tptacek's response is completely acceptable and am glad I re…

A short time ago in the information critical real world someone was quietly exploiting the bug that would become CVE-2014-0160 (heartbleed). Today your iphone uses really bad software [0]. Today it is easy to be a critic. As for Tp*'s professionalism, can you figure out if he wants the world to improve or stay the same?

[0] http://www.osnews.com/story/27416/The_second_operating_syste...

Re: Tptacek's Review of "Practical Cryptography With Go"

#204

Post by austinz »

logicallee wrote: post #99
rkangel wrote: post #43

Earlier quoted context omitted.

> I see the implementation of cryptosystems as an engineering endeavor little different than designing, for example, > a commercial airplane, a bridge, or a radiation therapy machine. Couldn't agree more. The problem is that for any bridge that gets used, every structural engineer signing off is going to have been educated and experienced to the extent that they are Chartered (or equivalent), the plans for the bridge…

> I see the implementation of cryptosystems as an engineering endeavor little different than designing, for example, a commercial airplane, a bridge, or a radiation therapy machine. I disagree with you completely and absolutely. Your bridge in Boston isn't going to collapse the moment a researcher sitting in his bathtub in Tel Aviv has a eureka moment. But if that eureka moment results in a preimage collision in a se…

While it is true that fundamental weaknesses in cryptographic theory may be discovered at any time, the implementation of cryptosystems is, I would assert, still very much like engineering. Broken theory is distinct from broken implementation, although broken theory does end up breaking implementations as well.

Maybe some mathematician will prove AES is broken tomorrow. In terms of the analogy, I don't care. The most qualified, fastidious engineer building the most correct implementation of AES is going to have an insecure system on their hands at the end of the day if that's true, and there is nothing we can do about that on the implementation side.

This is distinct from some programmer reading "Learn Crypto in 24 Hours", building a bad implementation of an otherwise secure cryptosystem due to inexperience or carelessness, and then screwing people over because that bad cryptosystem goes into production code.

Re: Tptacek's Review of "Practical Cryptography With Go"

#205

Post by swordswinger12 »

sillysaurus3 wrote: post #185
tptacek wrote: post #149

Earlier quoted context omitted.

The JCA provides primitives, not whole designs. Primitives are rarely broken; even PHP mcrypt manages to successfully provide low-level crypto primitives. Most of the things that go wrong in cryptography happen at the points where two primitives join to form a more elaborate construction. The JCA isn't much help there. If you have the option to use NaCl, use NaCl. A Java-specific alternative to NaCl is Keyczar.

Speaking of Java crypto, I have a question. Is it possible a garbage collector might be dangerous to crypto code? I've seen it mentioned on HN that maybe we should be worried about implementing crypto code in a language with a non-deterministic GC, but sadly I can't find those comments right now. TextSecure's crypto is implemented in Java, which is of course garbage collected. Some cursory Googling suggests that Java…

Typed a whole long comment about the relevant section of Cryptography Engineering, but it seems you already read it :) I'd also be interested in an in-depth study of GC's effect on secret material.

Re: Tptacek's Review of "Practical Cryptography With Go"

#206

Post by awj »

duaneb wrote: post #148
scott_s wrote: post #110

Earlier quoted context omitted.

When you are writing about a difficult subject, you should invite reviews from experts to vet your work.

I'm not disagreeing. I'm just pointing out that a critic is much less useful than an author.

I'll take one responsible author with one harsh-but-knowledgeable critic over a hundred would-be authors without the ability to sift useful content from polemic criticism.

Re: Tptacek's Review of "Practical Cryptography With Go"

#207

Post by diminoten »

tptacek wrote: post #201
diminoten wrote: post #197

Earlier quoted context omitted.

I disagree with your condemnation of a behavior while exhibiting said behavior. It shows that you're okay with drama so long as it's you creating it, but you're not okay with a dramatic response to your own drama-creating. The accusation of elitism on your part is not a new one, I don't think, to you - I found myself levying the same accusation when you decided to single out the CryptoCat project as a distinctly "bad…

I think Cryptocat illustrates and affirms the points I'm making about amateur cryptography, and doesn't rebut them.

Yes, because amateur projects generally undergo third party security reviews.

Re: Tptacek's Review of "Practical Cryptography With Go"

#208

Post by duaneb »

awj wrote: post #206
duaneb wrote: post #148

Earlier quoted context omitted.

I'm not disagreeing. I'm just pointing out that a critic is much less useful than an author.

I'll take one responsible author with one harsh-but-knowledgeable critic over a hundred would-be authors without the ability to sift useful content from polemic criticism.

Well, I'll take the one responsible author now. Who are they?

Re: Tptacek's Review of "Practical Cryptography With Go"

#209

Post by mpyne »

stavros wrote: post #66
jacquesm wrote: post #48

Earlier quoted context omitted.

I think the tone is what makes it tougher than it needs to be, not the factual content. Props to the author for just looking at the content and not at the way in which it was delivered. Props to Thomas for taking the time to review the book.

You're being downvoted, but I agree that a greater amount of tact would have been warranted. Phrases like "I am not making this up", "argh!" and "huh?" add nothing to the review, but only serve to make it more personal, and I say this as a guy who also has very little tact.

Your comment actually made me read the review since it seemed really bad... but after reading it I'm just not seeing the problem.

The "I am not making this up" thing came in the context of recommending ASN.1 for instance. If that were a chess match commentary, this is where the scorekeeper would have put a "??" after the move to note the shock.

And note what tptacek's comment was not: It wasn't a bunch of personal attacks, or swearing. Some of the commentary was "more than professional", to be sure, but that's exactly the kind of commentary you should hope to get in highly-demanding, highly-selective fields.

You want to know what a perfect book review would look like in the Navy's nuclear propulsion program? It would be this: "No deficiencies noted."

Re: Tptacek's Review of "Practical Cryptography With Go"

#210

Post by tptacek »

diminoten wrote: post #207
tptacek wrote: post #201

Earlier quoted context omitted.

I think Cryptocat illustrates and affirms the points I'm making about amateur cryptography, and doesn't rebut them.

Yes, because amateur projects generally undergo third party security reviews.

I disagree, but I'm also not interested in discussing Cryptocat on this thread, and I don't think you'd be doing Kyle Isom any favors by pushing the comparison further.
Post reply on HN