The author could spend less time bashing the original article and a little bit more explaining how to do things right.
This:
Suggestion to use the encryption key as the IV
is a second sub-heading while the words "initialization vector" don't appear until much later. Initialization vector is pretty obvious, "IV" isn't.
Also the author spends time complaining that the original article misunderstands the use of initialization vector while providing no explanation of how it should be used.
After reading the post I haven't learned anything useful other than that the original article was bad.
I agree that the article could do far more to explain what's good, both in content (talking about why these things are bad) and in style (defining all terms immediately).
But holy shit, the MSDN article is bad. It's so hideously bad that I think there's nontrivial social value in bashing it extensively to discourage people from writing docs like this without getting them sanity-checked.
In short, I think this article is largely useless to people reading guides and trying to avoid the pitfalls of the original source, but is aimed at people writing crypto guides who have no business doing so.
Explaining to you how to do it the right way is not an obligation of anyone that says X article is wrong?
"This article on global warming could spend less time bashing governments for inaction and more time talking about how I can reduce my emissions."
"This bad restaurant review could spend less time bashing the chef's food and more time telling me where the good restaurants are."
Similarly maybe the author didn't explain what "IV" means because their audience understands that term.
"This article in CACM uses 'NVRAM' in the heading, while the words "non-volatile" don't appear until much later. Non-volatile is pretty obvious, 'NVRAM' isn't."
Explaining to you how to do it the right way is not an obligation of anyone that says X article is wrong?
I wouldn't expect an explanation, I wouldn't say the author is obliged to that kind of effort.
I did sort of expect a link to an explanation, though.
At this writing, other comments in this very HN thread claim there are many intro-level explanations of IVs out there to choose from. They don't link to them either.
Hypertext is what makes the web special, you know? The article would be more useful with a link. Think of this: even this discussion, here on HN, would have been more fruitful if the author had included a link to some explanation.
Similarly maybe the author didn't explain what "IV" means because their audience understands that term.
I have actually shipped a couple of products that made use of encryption packages, and I've never heard of an IV. Maybe the encryption advice I followed was terrible; maybe the instructions were terrible; maybe the packages were terrible. Maybe I'm an idiot suited only to the digging of ditches.
The blog post also would have been more useful if it had been a full crypto textbook rather than a single post.
One can always say, "X would have been more useful if it had included Y (or at least a link to Y)". This sort of criticism is not useful, particularly of informal writing that someone posted to a personal blog.
While we're talking about awesome things about the web, use Google or Wikipedia. You don't need to be spoonfed a link, so why are you asking to be?
I was in the audience, and if I ever knew how one should use an IV, I forgot. The article would have been more valuable to me if it gave a summary of what IVs are instead of what they aren't.
What makes you think were the author's intended audience, exactly? It sounds like the author intended their article for people who know what an IV is. You don't, and, while there's no shame in that, it does seem to indicate that you're not in the audience.
This is like me complaining that I can't understand Terry Tao's blog when it's posted to HN. It's not written for me.
You were probably not the intended audience then. It seems to me that this is intended for people who have some form of knowledge about cryptography already.
In any case, there are many articles about IVs and how to use them already so I do not see the point of explaining what an IV is yet again in that article.
Comments
The author could spend less time bashing the original article and a little bit more explaining how to do things right.
This:
is a second sub-heading while the words "initialization vector" don't appear until much later. Initialization vector is pretty obvious, "IV" isn't.
Also the author spends time complaining that the original article misunderstands the use of initialization vector while providing no explanation of how it should be used.
After reading the post I haven't learned anything useful other than that the original article was bad.
I... sort of have mixed feelings on this.
I agree that the article could do far more to explain what's good, both in content (talking about why these things are bad) and in style (defining all terms immediately).
But holy shit, the MSDN article is bad. It's so hideously bad that I think there's nontrivial social value in bashing it extensively to discourage people from writing docs like this without getting them sanity-checked.
In short, I think this article is largely useless to people reading guides and trying to avoid the pitfalls of the original source, but is aimed at people writing crypto guides who have no business doing so.
Explaining to you how to do it the right way is not an obligation of anyone that says X article is wrong?
"This article on global warming could spend less time bashing governments for inaction and more time talking about how I can reduce my emissions."
"This bad restaurant review could spend less time bashing the chef's food and more time telling me where the good restaurants are."
Similarly maybe the author didn't explain what "IV" means because their audience understands that term.
"This article in CACM uses 'NVRAM' in the heading, while the words "non-volatile" don't appear until much later. Non-volatile is pretty obvious, 'NVRAM' isn't."
Explaining to you how to do it the right way is not an obligation of anyone that says X article is wrong?
I wouldn't expect an explanation, I wouldn't say the author is obliged to that kind of effort.
I did sort of expect a link to an explanation, though.
At this writing, other comments in this very HN thread claim there are many intro-level explanations of IVs out there to choose from. They don't link to them either.
Hypertext is what makes the web special, you know? The article would be more useful with a link. Think of this: even this discussion, here on HN, would have been more fruitful if the author had included a link to some explanation.
Similarly maybe the author didn't explain what "IV" means because their audience understands that term.
I have actually shipped a couple of products that made use of encryption packages, and I've never heard of an IV. Maybe the encryption advice I followed was terrible; maybe the instructions were terrible; maybe the packages were terrible. Maybe I'm an idiot suited only to the digging of ditches.
The blog post also would have been more useful if it had been a full crypto textbook rather than a single post.
One can always say, "X would have been more useful if it had included Y (or at least a link to Y)". This sort of criticism is not useful, particularly of informal writing that someone posted to a personal blog.
While we're talking about awesome things about the web, use Google or Wikipedia. You don't need to be spoonfed a link, so why are you asking to be?
I was in the audience, and if I ever knew how one should use an IV, I forgot. The article would have been more valuable to me if it gave a summary of what IVs are instead of what they aren't.
What makes you think were the author's intended audience, exactly? It sounds like the author intended their article for people who know what an IV is. You don't, and, while there's no shame in that, it does seem to indicate that you're not in the audience.
This is like me complaining that I can't understand Terry Tao's blog when it's posted to HN. It's not written for me.
You were probably not the intended audience then. It seems to me that this is intended for people who have some form of knowledge about cryptography already.
In any case, there are many articles about IVs and how to use them already so I do not see the point of explaining what an IV is yet again in that article.