Hacker News Reader

Comment by breakfastduck | Hacker News Reader

Go fix it then. That's the point of the project.

Or are you just throwing out comments without even looking at it?

Not them, but this is the one place where that attitude seems reasonable: I am not a crypto expert, and therefore can't audit their crypto code, and the refrain is "don't roll your own crypto (unless you really know what you're doing)", so unless one of the devs is a crypto expert then it is 100% reasonable to both be rather worried that they're rolling their own and also unable to do anything about it.

Serenity is not really designed for everyday use, but more for enjoyment and as a learning experience for the developers. It's not really reasonable to be worried about it from that point of view, as of course it's not professional crypto, it's written by someone who wanted to learn more about it, and figure out how it'd work in a modern system.

Its pretty sad that you're concerned about how a hobby project is handling crypto enough to complain on a forum but not enough to contribute to the project.

I fix the software I use. Random commenters are not entitled my time and attention. I've learned to avoid rolling out my own crypto and suggest others learn it too. One shouldn't be proud of reinventing the wheel unless it's significantly better wheel.

So, is it?

edit: they use libtls, so I guess they aren't "free" from third party code after all.

That is not the libtls you are thinking of. That is a homemade library.

Serenity’s LibTLS is Serenity-specific code.

What kind of attitude is that? Why shouldn't someone be proud of themselves, when they manage to implement a crypto library? It's not like they're asking you or anyone else to use it with sensitive data and they're not pretending it's secure or on par with others.

The whole OS is a learning process for almost everyone involved and they have every right to feel proud of every little step they take. Like do you think the best in class crypto libraries out there just popped into existence or their authors wrote the perfect code on their first try? All of them were inferior wheels at one point, and all of them made mistakes and learned from them.

It's impressive how hard you're missing the point of the project.

Reply on news.ycombinator.com