News for hackers. Stuff that matters.
Re:The Secure Programmer's Pledge by ori_b on Monday July 16, 2012 @05:39PM (#4252833)
> This abets a hugely widespread misunderstanding about the security of crypto. You could in fact invent your own block cipher core, and if you dropped it into Keyczar or cryptlib's high level library be more secure than people using AES-256 directly via OpenSSL.

No.

Someone who knew their way around cryptography algorithms could do that. I can't. This is good advice for someone who isn't a security expert. (Edit: With my level of crypto knowledge, I don't even know how to evaluate whether your claim bears any relationship to reality.)

(Yes. I would like to remedy that. I'm working on it, slowly.)

Re:The Secure Programmer's Pledge by tptacek on Monday July 16, 2012 @05:44PM (#4252856)
Are you sure you're right about that? Because I think you're wrong. I think you could spend 15 minutes on Wikipedia, write your own block cipher core, and if you used Keyczar as the protocol implementation, you'd be better off than if you had used AES directly.

Your AES code, I am implying, would be so bad that you'd be better off not having used it at all.

Re:The Secure Programmer's Pledge by ircmaxell on Monday July 16, 2012 @08:10PM (#4253406)
That's fair. However I'd argue that someone implementing their own algorithm would not use a library like keyczar. They would just write their own.

So while it's possible to write your own and be secure, IMHO it'd be better to stick to vetted algorithms and libraries... I think it's just that - all other things being equal - the public algorithm is more likely to be more secure...