Hacker News Reader

Comment by cup-of-tea | Hacker News Reader

If they can't understand hashing then there's no hope of teaching them security so why even bother?

No, if they can’t understand hashing, then you’ve failed as a teacher.

What Rich has done amazingly well here is use the correct term, but then made the “magic” analogy that allows the concept to be more easily understood by people not within engineering. Think sales, marketing, HR, biz dev, etc.

For those who are interested, they can look up more about hashing afterwards. But for everyone, the concept of how hashes are used was taught with high retention rates.

How is it even a good analogy? Hashing literally means chopping something up and making a mess. Heard of a hash brown? Hash is a dictionary word coming from French. You chop something up into a mess that you can't reassemble, but you get the same mess each time. The word magic needs to stay the hell away from computers.

I'm all for the power of analogy, but I agree with others here that "magic" is a pretty lame choice of words. Anything you don't understand can be described as magic, it's a meaningless analogy that doesn't have any more explanatory power than the word hash does to people who don't know it. The presentation was good, but I bet it would have had similar impact if the word hash had just been used throughout.

I think there's some value for swapping out one semantically opaque word that seems intimidating/"engineer-y" for another equally semantically opaque word that instead connotes "hey, I'm on your side in helping you understand this".

Ie, the value isn't in the word choice itself, but rather in signalling that you empathize with your audience's discomfort.

Not everyone thinks like an engineer. I thought the approach was very appropriate.

This is the security culture infosec has been trying to get everyone to do.

Reply on news.ycombinator.com