I think it's important to not confuse "dogma" with "development best practices," a lack of which is one of the problems that is hurting software development. People go off and do their own versions of password hashing because they don't know what's the best practice or think they'r e being safe.
Is it important that you know why brcypyt is a best practice? Yes. I understand that it (tunably) is slow and uses a random salt, which I also know is a best practice for hashing passwords. Is doing repetitive sha1s going to work well enough? Probably, but I don't know enough about cryptography to know fo sure. So when smart people say, "use bcrypt," I do just that.
Programming is too big of a topic for everyone to understand everything about what they're using. We have to trust others.
IMHO, the thing that bothered me about the whole exchange was that it could have been avoided with a little bit of common courtesy. Instead it turned into a "oh let's go roll that pull request".
I picked up pretty early on that antirez wanted to know the "why" first since one of his stated goals was keeping deps to a minimum. What could have been a nice productive discussion about crypto standards was fucked up by ego, asshattery and language barriers.
Oh and github pull requests are TOTALLY the appropriate place to have those kinds of discussions =/
Oh totally agree. I saw on person who commented on Salvatore's blog that said, "I just lost all respect for you and your project (Redis)." That seems like a rather large knee-jerk reaction.
Comments
I think it's important to not confuse "dogma" with "development best practices," a lack of which is one of the problems that is hurting software development. People go off and do their own versions of password hashing because they don't know what's the best practice or think they'r e being safe.
Is it important that you know why brcypyt is a best practice? Yes. I understand that it (tunably) is slow and uses a random salt, which I also know is a best practice for hashing passwords. Is doing repetitive sha1s going to work well enough? Probably, but I don't know enough about cryptography to know fo sure. So when smart people say, "use bcrypt," I do just that.
Programming is too big of a topic for everyone to understand everything about what they're using. We have to trust others.
IMHO, the thing that bothered me about the whole exchange was that it could have been avoided with a little bit of common courtesy. Instead it turned into a "oh let's go roll that pull request".
I picked up pretty early on that antirez wanted to know the "why" first since one of his stated goals was keeping deps to a minimum. What could have been a nice productive discussion about crypto standards was fucked up by ego, asshattery and language barriers.
Oh and github pull requests are TOTALLY the appropriate place to have those kinds of discussions =/
Absolutely. Coda Hale's "fuck tact" statement does a neat job of ignoring that "fuck tact" leads to stupid arguments like this.
Oh totally agree. I saw on person who commented on Salvatore's blog that said, "I just lost all respect for you and your project (Redis)." That seems like a rather large knee-jerk reaction.