Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security is Mathematics

daemonology.net

Post reply on HN
Print view View original

41–49 of 49 posts

Re: Security is Mathematics

#41

Post by eru »

leif wrote: post #27
tptacek wrote: post #19

The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians! * Mark Dowd * John McDonald * Alex Sotirov * Dino Dai Zovi * Charlie Miller * Michal Zalewski * Aaron Portnoy * Dave Aitel * David Litchfield * Barnaby Jack This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with ex…

Whether they have "Mathematics" on their diploma is immaterial; I'd bet good money that most of these guys took some real serious math classes in school.

I presume you mean at university? There are no serious math classes at school.

Re: Security is Mathematics

#42

Post by eru »

shoo wrote: post #33
Someone wrote: post #29

Earlier quoted context omitted.

You can see that computer science is an applied science. A mathematics professor would have given a proof that such an algorithm exists or, more likely, that algorithms exist for solving several more general problems, and left it at that.

And unless you were especially lucky, the existence proof would be non-constructive.

I still hope, that somebody finds a non-constructive proof for P=NP.

Re: Security is Mathematics

#43

Post by eru »

leif wrote: post #26

Forget security, programming is mathematics. If you program, you should be doing this whether you're writing security code or not. Nothing saves me more keystrokes or debugging time than proving things about my algorithm before I code it, and I know this comes from math because my CS-only friends can't do it . I don't care if you want to go in to algorithm theory or get a software job at a bank, if you're a CS major,…

You can even prove that. It's called the Curry–Howard isomorphism (http://en.wikipedia.org/wiki/Curry%E2%80%93Howard_isomorphis...). Guess who has a the highest bid on ads for `curry howard isomorphism' on Google?

Re: Security is Mathematics

#44

Post by eru »

mdwrigh2 wrote: post #17
kenjackson wrote: post #2

This article is correct, except it omits one important point... writing programs is harder than writing a proof. Especially security code. With sufficiently complex proofs it is often hard to find holes in the proof, but with security code (and code in general) there are ways to attack it, that just isn't doable with standard math proofs. There's no notion of "fuzzing" with proofs. But in any case, the gist of the ar…

I'd argue there is a certain notion of fuzzing with proofs. Say I have a proof claiming that a certain function is monotonic. Fuzzing, in this case, is throwing a bunch of numbers at the function and checking to see if it's actually monotonic with regards to your inputs. Obviously not all math proofs are regarding functions and definable numbers, but there's a similar concept of fuzzing for each different proof type…

There are some domains, like Geometry, where trying enough random numbers is actually good enough for a certain kind of proof.

Re: Security is Mathematics

#45

Post by leif »

eru wrote: post #41
leif wrote: post #27

Earlier quoted context omitted.

Whether they have "Mathematics" on their diploma is immaterial; I'd bet good money that most of these guys took some real serious math classes in school.

I presume you mean at university? There are no serious math classes at school.

a university is a school, why are you trolling

Re: Security is Mathematics

#46

Post by basugasubaku »

tptacek wrote: post #19

The best security researchers in the world are almost uniformly not trained in mathematics. Here's a short list of top-tier researchers. Spot the mathematicians! * Mark Dowd * John McDonald * Alex Sotirov * Dino Dai Zovi * Charlie Miller * Michal Zalewski * Aaron Portnoy * Dave Aitel * David Litchfield * Barnaby Jack This doesn't invalidate the blog post, but I will go on to suggest that quite a lot of people with ex…

How about Dan Boneh and David Brumley? They are security researchers with strong backgrounds in mathematics.

Re: Security is Mathematics

#47

Post by chwahoo »

cperciva wrote: post #38
danielparks wrote: post #36

Earlier quoted context omitted.

Obviously I can’t speak for Colin Percival, but I think that the point of the article is quite a bit simpler: I read this as saying that the mindset required to write proofs is similar to the mindset required to write secure software. The proof mindset is useful for considering “all the real-world ways that things could go wrong.” I think the paragraphs about Knuth’s famous quote just muddy the water.

the mindset required to write proofs is similar to the mindset required to write secure software Bingo.

My point wasn't intended to be as low-level as it came across. Perhaps a more clear restatement is that I suspect that the attention to detail that I associate with the "proof mindset" isn't quite the same thing as the "twisted mind" that Bruce Schneier talks about; so I'm not convinced mathematicians are more likely to have that skill.

Re: Security is Mathematics

#48

Post by socksy »

leif wrote: post #45
eru wrote: post #41

Earlier quoted context omitted.

I presume you mean at university? There are no serious math classes at school.

a university is a school, why are you trolling

It might have been a genuine mistake - University and school are not really interchangeable terms here in the UK.

Re: Security is Mathematics

#49

Post by eru »

socksy wrote: post #48
leif wrote: post #45

Earlier quoted context omitted.

a university is a school, why are you trolling

It might have been a genuine mistake - University and school are not really interchangeable terms here in the UK.

Indeed. Though I should probably have been more generous with my input. (And growing up in Germany, a school is something completely different from a university there.)
Post reply on HN