Re:The Conflict at the Heart of Open Source
by gpcz on Wednesday May 07, 2014 @11:19AM
(#7710632)
I got the same vibe from the chorus of "never roll your own crypto" rhetoric I heard on the Internet -- that I shouldn't even bother looking into OpenSSL's code unless I went to the Shaolin Temple of Crypto and trained under Master Schneier for 10 years. Just because the intent of the message was one thing doesn't mean that it won't be interpreted in a completely different way by the intended audience.
[ Parent
| on HN ]
Re:The Conflict at the Heart of Open Source
by dublinben on Wednesday May 07, 2014 @11:51AM
(#7710830)
Looking at OpenSSL source code and fixing a bug are pretty much the exact opposite of "rolling your own crypto."
The impression I got from "don't roll your own crypto" (especially after the Debian key bug thing) was that crypto code was so nuanced and complicated that even if you thought something was a bug, you were likely to be horribly wrong for really complex reasons outside the realm of understanding of anyone who wasn't an expert, and everyone would laugh at you for even bringing it up.
After an entire webpage was created to ridicule the Debian developers for how stupid they were when they changed something in OpenSSL's code in their distro's version (complete with references to Dilbert strips about faulty random number generators), I just assumed that I shouldn't even bother trying to look at OpenSSL's code (and especially not try to send patches or ask questions on their mailing list) unless I was willing to make a lifestyle out of it, lest I get ridiculed in the same way (but probably not at Debian's magnitude). I wasn't willing to make a lifestyle out of it.
Re:The Conflict at the Heart of Open Source
by dasil003 on Wednesday May 07, 2014 @12:51PM
(#7711235)
Obviously a lot of security people and cryptographers develop a holier-than-thou attitude, no doubt from spending their lives scrutinizing things that people continuously get wrong and for which failure is catastrophic.
That attitude, off-putting though it may be, shouldn't cause us to read too much into what they say.