Hacker News Reader

Comment by throwoutway | Hacker News Reader

Most CISSPs I interview can’t tell me the difference between the two most common types of encryption

Presumably, you mean symmetric and asymmetric? I could think of this a few ways. Granted some of the others are more than 2.

Yes. And the embarrassing part is it’s part of the study guides and covered by the certification.

saw a CISSP who didn't know the difference between a SHA256 checksum and SHA1 or even how to hash a file using openssl

I would expect that. But the lack of knowing the definitions is embarrassing

Does anyone have a tutorial on using the openssl cli? It seems to barf on some inputs if it's not exactly perfect or you miss a step in the stack overflow answer.

Honestly I would expect some to be more familiar with the hashXsum tools.

I'm relatively deep in this stuff. If you asked my how to use the openssl CLI for anything other than X.509 and s_client I would fail your interview.

Yeah openssl CLI is so incomprehensible. And some parameters have to be configured using .conf files, ewww. The C API is hardly any better.

When I read the RFCs behind the stuff to write what I needed in Rust, suddenly it dawned on me: wow this stuff isn't nearly as complicated and horrible as openssl's interface makes it seem like.

I didn't expect the knowledge of the cli to do it immediately, this person didn't even know they could do it. "openssl dgst -sha256 filename". An answer that they'd need to check the man page would've been sufficient...

Would you have accepted a python solution? I typically don't do this type of stuff using raw openssl on the rare occasion I need it.

I would have accepted even the person knowing and confirming they were aware SHA1 is obsolete

Reply on news.ycombinator.com