No, it doesn’t matter if a cryptography blog has cartoons on it.
No, it’s off topic to rehash this meta discussion. Again. You can click the domain to find it on several earlier posts.
No, it’s not appropriate to flame the author because their blog has cartoons. This has been the final straw in at least one ban so far.
No, it’s not appropriate to flag the story for mod attention because it feels like you get to punish cartoons. Reread the previous point and consider whether you want mod attention. You can click ‘hide’ below the title if you want to not see the story or any comments to it.
I feel this and I agree with you. However, I have flagged this as spam because this person keeps posting their own blog over and over. Maybe that’s not how that flag is intended to be used? I’m open to criticism about that. In any case I wanted to be clear about my motives for flagging this since it seems like there’s some other thing going on that I didn’t know about until reading this.
It’s well written work, yes it’s posted regularly, but that doesn’t make it blog spam. The submissions tend to see engagement, so I think there’s some level of consensus there amongst the community.
there’s a previous thread somewhere discussing if self-posting should be permitted or not, there’s definitely arguments for both sides. some users routinely post their own site and it’s just really uninteresting stuff (including this post), but I don’t think that’s spam— it’s just content I’m not interested in personally.
Also, there’s a user script for hiding posts from a domain/user/whatever. someone linked it to me in a previous thread but the story was nuked.
Yeah, this is more in line with what my opinion is. I’m not arguing whether or not it’s well written and it’s certainly on topic for this site. I’m not trying to come in here to argue with folks. I flag something as spam if someone keeps posting “self-promotion” things like this. That still seems like spam to me but I’m fine being told I’m wrong as it’s clear what the consensus is. I won’t reply to each person that replied but I appreciate them all the same.
Yes, I see 4 out of your 15 posts aren’t something you authored. One of which comes after this thread started. Either way, my opinions aren’t personal attacks or facts… they’re just opinions. I mean you no disrespect.
If it’s on-topic then it’s on-topic, and does it really matter who submitted it? In general I prefer it when authors submit their own stuff, because if I have some comment or criticism I can write “I don’t agree with you there”, “I think you are mistaken”, “I think this is unclear”, etc. and can then have a conversation with the author themselves, instead of “I don’t agree with the author”.
I’ve already commented on the /r/crypto submission, but just wanted to make sure I also mention here: these are absolutely great points that any crypto library should, at least, take into consideration.
We have all seen how some critical piece of software can be tied down to a pre-compiled binary or some old cryptography. Just look how difficult it has been to address the RSA PKCSv1.5 padding issue in TLS or even the middleware boxes that broke with the previous draft that we all love and hate.
There are options of course, but in my experience it is surprisingly hard to ask customers to update because they might not even have the code or staff or contract anymore. It takes huge amounts of efforts to keep security patching old libraries and maintain many releases.
If I worked for a 3-letter agency that wanted backdoors in encryption, I would steer libraries towards fragile APIs. Why break cryptography when you can just drop in a mailing list and ask to support alg:"none"?
The less choices a user has to make to get their code working correctly, the less they’ll make their application subtly insecure by sheer accident.
In this paragraph I believe you might have preferred to write “insecure by making a subtle mistake” or something rather than “subtly insecure”? Just to clearly delineate that it’s the mistake which is subtle, not necessarily the consequences. (e.g. AIUI some cryptosystems become trivial to break if I ever misuse a nonce?)
Ok, honest question. Except for the fixed testkey/testiv, is there something wrong with this ChaCha encoder/decoder from LibreSSL/libcrypto an it’s usage.
Apparently I need to remind people that:
I feel this and I agree with you. However, I have flagged this as spam because this person keeps posting their own blog over and over. Maybe that’s not how that flag is intended to be used? I’m open to criticism about that. In any case I wanted to be clear about my motives for flagging this since it seems like there’s some other thing going on that I didn’t know about until reading this.
A qualitatively good article every two weeks is hardly spam in my opinion.
Spam is low effort, low quality, high volume. This is none of those things.
It’s well written work, yes it’s posted regularly, but that doesn’t make it blog spam. The submissions tend to see engagement, so I think there’s some level of consensus there amongst the community.
there’s a previous thread somewhere discussing if self-posting should be permitted or not, there’s definitely arguments for both sides. some users routinely post their own site and it’s just really uninteresting stuff (including this post), but I don’t think that’s spam— it’s just content I’m not interested in personally.
Also, there’s a user script for hiding posts from a domain/user/whatever. someone linked it to me in a previous thread but the story was nuked.
Here’s the Greasemonkey script for blocking domains, stories, or users.
Yeah, this is more in line with what my opinion is. I’m not arguing whether or not it’s well written and it’s certainly on topic for this site. I’m not trying to come in here to argue with folks. I flag something as spam if someone keeps posting “self-promotion” things like this. That still seems like spam to me but I’m fine being told I’m wrong as it’s clear what the consensus is. I won’t reply to each person that replied but I appreciate them all the same.
If it helps to add context, I do submit things other than what I’ve written, if I believe they belong on this site. :)
Yes, I see 4 out of your 15 posts aren’t something you authored. One of which comes after this thread started. Either way, my opinions aren’t personal attacks or facts… they’re just opinions. I mean you no disrespect.
If it’s on-topic then it’s on-topic, and does it really matter who submitted it? In general I prefer it when authors submit their own stuff, because if I have some comment or criticism I can write “I don’t agree with you there”, “I think you are mistaken”, “I think this is unclear”, etc. and can then have a conversation with the author themselves, instead of “I don’t agree with the author”.
Obviously, I think it matters or I wouldn’t have flagged it. Seems we prefer different things.
If you don’t personally like it, even though it’s on topic and there’s nothing wrong with it, use the hide feature.
I’ve already commented on the /r/crypto submission, but just wanted to make sure I also mention here: these are absolutely great points that any crypto library should, at least, take into consideration.
The fun thing about cryptography is that eventually your cutting edge API will be full of bad options lest you break compatibility.
Is breaking compatibility really that bad in this case though? IMO, absolutely not.
We have all seen how some critical piece of software can be tied down to a pre-compiled binary or some old cryptography. Just look how difficult it has been to address the RSA PKCSv1.5 padding issue in TLS or even the middleware boxes that broke with the previous draft that we all love and hate.
There are options of course, but in my experience it is surprisingly hard to ask customers to update because they might not even have the code or staff or contract anymore. It takes huge amounts of efforts to keep security patching old libraries and maintain many releases.
Even when the answer is “append code to binary, throw in a jump from the old code to the new code”, that require extensive testing.
If I worked for a 3-letter agency that wanted backdoors in encryption, I would steer libraries towards fragile APIs. Why break cryptography when you can just drop in a mailing list and ask to support
alg:"none"?Very nice, thank you for posting. ❤️
One very small thing:
In this paragraph I believe you might have preferred to write “insecure by making a subtle mistake” or something rather than “subtly insecure”? Just to clearly delineate that it’s the mistake which is subtle, not necessarily the consequences. (e.g. AIUI some cryptosystems become trivial to break if I ever misuse a nonce?)
The Most Dangerous Code in the World has some other examples of TLS security vulnerabilities caused by poorly designed APIs.
Ok, honest question. Except for the fixed testkey/testiv, is there something wrong with this ChaCha encoder/decoder from LibreSSL/libcrypto an it’s usage.