Edit: another thought, looking at the incentives involved:
* If you, as a security guy, spend your time breaking stuff, you win some points for that if you score a 'hit'. If you don't, well no one is really paying attention. Pretty much all systems - even those written by really bright guys like cperciva - have flaws, so if you look enough, you'll probably find some.
* If you write your own system, you attract the attention of all the people out to break it. And eventually they probably will find some problem and write Comic Book Guy style posts about how the system is badly flawed. And your reputation will suffer.
Ironically, tptacek spends a large amount of time criticizing crypto, but a lot of the time it's useful criticism (i.e. actually provides some kind of a solution.)
I have nothing against criticism. If there's a flaw in something, let's talk about it. But I don't care for "I know how to do it better," and nothing more.
tptacek's comments are usually interesting and insightful, and he seems like a good person who does his best to interact in meaningful ways here, rather than simply channeling the Comic Book Guy as is the custom in crypto dick waving forums.
Comments
I thought tptacek's response to my question here was interesting, WRT crypto dick waving:
https://news.ycombinator.com/item?id=5776111
Edit: another thought, looking at the incentives involved:
* If you, as a security guy, spend your time breaking stuff, you win some points for that if you score a 'hit'. If you don't, well no one is really paying attention. Pretty much all systems - even those written by really bright guys like cperciva - have flaws, so if you look enough, you'll probably find some.
* If you write your own system, you attract the attention of all the people out to break it. And eventually they probably will find some problem and write Comic Book Guy style posts about how the system is badly flawed. And your reputation will suffer.
Ironically, tptacek spends a large amount of time criticizing crypto, but a lot of the time it's useful criticism (i.e. actually provides some kind of a solution.)
I have nothing against criticism. If there's a flaw in something, let's talk about it. But I don't care for "I know how to do it better," and nothing more.
tptacek's comments are usually interesting and insightful, and he seems like a good person who does his best to interact in meaningful ways here, rather than simply channeling the Comic Book Guy as is the custom in crypto dick waving forums.