I think the time to bring up erroneous posts, is in the thread in which they occur. And as long as we are talking "substantive," how about citing tptacek's incorrect posts instead making vague references?
Even the dumbest of us know tptacek is not infallible, though I do hope cperciva and tptacek revisit this thread.
> I think the time to bring up erroneous posts, is in the thread in which they occur. And as long as we are talking "substantive," how about citing tptacek's incorrect posts instead making vague references?
I did bring them up in the threads they occurred in. Not wanting to reopen those old discussions is precisely why I didn't talk about specific examples or give links.
No-one is trustworthy enough to outsource the whole industry's security to - not tptacek, not djb, not AWS, and certainly not me. I think the key is to take not just the recipe but also the rationale. Someone who tells you "Don’t use RSA." might as well be working for the NSA. Someone who tells you "RSA has too many knobs. In modern curve systems, like Curve25519, everything is pre-set for security." is at least making a coherent argument that others can criticize - they might still be wrong, but the fact that they're being substantive is a positive step.