5 ms·

Like what, in the HN context?

tptacek 16y ago
Declining quality of comments? Creeping influence of politics? SSL is a giant waste of time for Hacker News, modulo the fact that people might be crazy enough to use a shared password here.
- requinot59 16y ago
  > Declining quality of comments? Creeping influence of politics? It's a fallacious argument in my book. Like comparing apples and oranges. Say I run a bakery. What I care the most about is the quality of my bread. So much, I spend all my time working on that and only that. So much, I didn't ever bother to have a lock at the door. But it's not even a big deal if someone comes in and poisons one of the bread, as long as the overall quality is increasing! > SSL is a giant waste of time for Hacker News Yes, if by "giant" you mean that it takes like 2 hours to set-up, and a small payload for each negociation. But concerning the payload, Arc is not especially fast, so there is room for improvements there to compensate, if needed. > modulo the fact that people might be crazy enough to use a shared password here. Not the point, the point is HTTP sniffing. And anyway, people could use a shared password, making it easier for them (don't overestimate human memory), if HN used (HTTPS and) a "real" password encryption scheme (bcrypt or the like). Why put the burden on the user when you can put it on the computer?
  - tptacek 16y ago
    No, that is an extremely bad idea. Even if they use bcrypt. Bcrypt exists to protect the site owner from calamity, like, "thousands of user passwords posted to Rapidshare". It does very little to protect individual users against the attacker who busts into your server; whether you use bcrypt or not, they still get the contents of every input type=PASSWORD that hits the site.
- statictype 16y ago
  SSL is a giant waste of time for Hacker News, Waste of time in what sense? The time it takes to set up SSL?
  - tptacek 16y ago
    Yep. If this was a real product, this would clearly not be my advice. But it's not. It's just HN. The worst case to an attack here is not all that bad. There's some goofy YC stuff that happens through this site. If asked, my advice regarding security and YC would not be "make HN more secure so the YC stuff is safer". It would be "get the YC stuff the hell off HN."
    - Mz 16y ago
      <really, really dumb question> Hi Thomas, I have checked your profile because I am confused by this whole conversation (I mean the social dynamic of it where you are mostly being downvoted into oblivion -- I have no hope of following the technical points). I can't find the info I want. For the unwashed masses (like myself), can you clarify: Aren't you some kind of security professional? </really really dumb question> Thanks in advance.
      - JoachimSchipper 16y ago
        Yes, tptacek runs a security consultancy. Why are you surprised? He's not wrong that the worst-case scenario isn't that bad, and he's a lot more "practical", for want of a better word, than either e.g. cperciva or me. (cperciva picks his serverside crypto algorithms for side-attack-resilience; tptacek points out that not having buffer overflows is asking too much of most software.) This is not to say that I agree with him - the worst-case scenario isn't that bad, but setting up SSL is easy and the right thing - but he's not babbling nonsense or anything.
        tptacek 16y ago
        For what it's worth, I cofounded it, and I'm a principal, but Dave Goldsmith runs it. Working with me is a hazard of joining us, but working for me isn't, so much.

Declining quality of comments? Creeping influence of politics? SSL is a giant waste of time for Hacker News, modulo the fact that people might be crazy enough to use a shared password here.

requinot59 16y ago
> Declining quality of comments? Creeping influence of politics? It's a fallacious argument in my book. Like comparing apples and oranges. Say I run a bakery. What I care the most about is the quality of my bread. So much, I spend all my time working on that and only that. So much, I didn't ever bother to have a lock at the door. But it's not even a big deal if someone comes in and poisons one of the bread, as long as the overall quality is increasing! > SSL is a giant waste of time for Hacker News Yes, if by "giant" you mean that it takes like 2 hours to set-up, and a small payload for each negociation. But concerning the payload, Arc is not especially fast, so there is room for improvements there to compensate, if needed. > modulo the fact that people might be crazy enough to use a shared password here. Not the point, the point is HTTP sniffing. And anyway, people could use a shared password, making it easier for them (don't overestimate human memory), if HN used (HTTPS and) a "real" password encryption scheme (bcrypt or the like). Why put the burden on the user when you can put it on the computer?
- tptacek 16y ago
  No, that is an extremely bad idea. Even if they use bcrypt. Bcrypt exists to protect the site owner from calamity, like, "thousands of user passwords posted to Rapidshare". It does very little to protect individual users against the attacker who busts into your server; whether you use bcrypt or not, they still get the contents of every input type=PASSWORD that hits the site.
statictype 16y ago
SSL is a giant waste of time for Hacker News, Waste of time in what sense? The time it takes to set up SSL?
- tptacek 16y ago
  Yep. If this was a real product, this would clearly not be my advice. But it's not. It's just HN. The worst case to an attack here is not all that bad. There's some goofy YC stuff that happens through this site. If asked, my advice regarding security and YC would not be "make HN more secure so the YC stuff is safer". It would be "get the YC stuff the hell off HN."
  - Mz 16y ago
    <really, really dumb question> Hi Thomas, I have checked your profile because I am confused by this whole conversation (I mean the social dynamic of it where you are mostly being downvoted into oblivion -- I have no hope of following the technical points). I can't find the info I want. For the unwashed masses (like myself), can you clarify: Aren't you some kind of security professional? </really really dumb question> Thanks in advance.
    - JoachimSchipper 16y ago
      Yes, tptacek runs a security consultancy. Why are you surprised? He's not wrong that the worst-case scenario isn't that bad, and he's a lot more "practical", for want of a better word, than either e.g. cperciva or me. (cperciva picks his serverside crypto algorithms for side-attack-resilience; tptacek points out that not having buffer overflows is asking too much of most software.) This is not to say that I agree with him - the worst-case scenario isn't that bad, but setting up SSL is easy and the right thing - but he's not babbling nonsense or anything.
      - tptacek 16y ago
        For what it's worth, I cofounded it, and I'm a principal, but Dave Goldsmith runs it. Working with me is a hazard of joining us, but working for me isn't, so much.