Hacker News Reader

Comment by tialaramex | Hacker News Reader

>How are people supposed to learn (from mistakes) if they don't roll their own crypto?

The right answer to this question, and not just on cryptography is: Stop it. There are billions of humans. They're already making plenty of mistakes, learn from those. Don't just make more and imagine that helps somehow.

If you feel the need to "learn from mistakes" you can find a healthy supply of detailed reports about mistakes other people already made and learn from them.

Most often what people actually mean is "I'm pretty sure I am uniquely brilliant and won't make mistakes" and I think the healthiest response is probably to laugh until you cry.

View on HN

I watch a lot of cooking shows. America's Test Kitchen, Cook's Country, Good Eats, Milk Street, I watch Bon Apetite's YouTube channel, I read dozens cookbooks, all sorts of things.

Not a single one of them is a substitute for standing there in the kitchen and cooking. They help, they help a lot, but eventually you have to get hands on with something to actually gain experience with it.

Now, do you want someone to learn from their (incredibly common) mistakes on your production crypto system? No. Very Much No. But people learning from working on side projects and prototypes and whatnot? That's great, so long as they have a way to get feedback on what they're doing wrong.

But the thing is, there's no way to get feedback on what they're doing wrong.

If you make bad crypto in your prototype, then to you and most everyone else it will look just fine, so you'll get no feedback on misleading feedback. You won't get the chance to learn from your mistakes because you won't know what was a mistake.

You'll get realistic feedback only if someone skilled spends nontrivial time to analyze your solution (likely more time than it would take them to just implement a known good solution) - which will happen only if you hire them for an in-depth audit, or if you launch a production system where breaking your crypto will have a big enough impact to motivate someone to break it.

Every time I read comments like this, I'm left wondering the author thinks of the people who are actually doing the work in question - here it's crypto, in other cases it's new operating systems or game engines or programming languages or what have you.

This is what I think: those people are not some non-human species beyond the comprehension of mere mortals, nor did they crawl into the world already knowing everything in their fields.

We need more people experimenting and learning outside the boundaries of staid, safe product development, not less.

People actually doing good work get to make new and interesting mistakes. They hope not to of course, but that's just how it goes.

But what you and so many people want is permission to go on "experimenting and learning" by making the same mistakes the previous cohort of people "experimenting and learning" made, and those before them, and so on ad infinitum. That's futile. Stop it.

Since the horizon of your imagination seems to be computer software let me expand a little bit with an example from a quite different discipline which is entirely illustrative of my point.

Some years ago, an elderly couple were struck and seriously injured (one of them died I think) by a speeding tram. The accident investigation report found as you would expect a long list of causes, but one of them is particularly relevant to us here.

On the _mainline railways_ subject to oversight from the same authorities and investigations by the same team, it had for many years been the practice to require Compliance as a psychological trait of drivers. Compliant people are inclined to obey rules, all else being equal. If you tell a Compliant person that the speed limit is 45mph they will tend to go no faster than 45mph whereas people who are less compliant might ask "Why?" or just decide it seems safe to do 55mph instead since what could go wrong?

The driver of the tram was not tested for Compliance, his employers hadn't picked up on this requirement, and their drivers hadn't ever killed anybody by speeding before. Sure enough during the accident he was driving the tram faster than the maximum speed shown and was unable to stop it striking the elderly victims.

You don't need to make your own mistakes to learn from other people's. Stop it.

I thought I was making a rather obvious point, so here it is in plainer terms: you can't keep up a sufficient flow of new people in a field (especially a niche one) if everybody's response to "How do I start doing this?" is "No no no, this is only for a chosen few grandfathered-in greybeards and the rest of us are too stupid to even try". There's absolutely nothing wrong with people trying their hand at difficult things, even if the only thing it produces is first-hand experience/appreciation of how difficult they are. Black boxes and low bus factors don't aid progress, they hinder it.

Additionally, it's astonishingly not unheard of for people to, well, research the experiments and studies of those before them before trying their hand at their own; if you start all your own experiments by jumping headfirst in total ignorance, perhaps consider slowing down a little?

Then again you've chosen to go on a rant about speeding trams and fatalities when the literal third sentence in the linked article is "don't use [your crypto] in production until it's vetted by professionals".

"No no no, this is only for a chosen few grandfathered-in greybeards and the rest of us are too stupid to even try".

This isn't even a straw man version of what I wrote. You should make your own thread to argue with this imaginary claim if that's what you want to do. Or better maybe start a Twitter thread about it.

As a reminder, here's that quote from the article, attributed to a co-worker but illustrative of a pretty common trope:

> How are people supposed to learn (from mistakes) if they don't roll their own crypto?

How are they supposed to learn? From other people's mistakes. There is no need to make those mistakes again yourself. Stop it.

There is actually a standard way for new people to get into crypto. However, it is emphatically not to write your own crypto and let others evaluate it. Everyone can make a crypto system they themselves cannot break. That says very little about the system's security, unless you're actually goods at breaking crypto.

That is why you begin learning crypto by breaking other people's crypto. Once you understand some of the pitfalls, your designs are far less likely to incorporate the same pitfalls.

> There is actually a standard way for new people to get into crypto...That is why you begin learning crypto by breaking other people's crypto.

And that is actual, useful advice for someone who is looking to get into crypto, not the equivalent of spraying an errant dog with a water bottle. Hence, like I said, studying and learning from others' experiments first.

To bring up game engine or OS dev again for instance, the answer to "I want to build my own game engine/OS" isn't "don't do that, you'll get it wrong", because people in those fields have actually put in the effort to create and document amateur-friendly resources targeted at various levels. And it's not like using your own OS or game engine in production is necessarily less dangerous than you using your own crypto in it, but again people in those fields somehow seem capable at grasping that people can [want to do] things without it even remotely being about a production service or product.

It's somewhat unfortunate, but people almost always get crypto wrong.

Anyone can, of course, experiment. Just don't take the results personally.

Is that how you learned to walk? You observed other kids failing and falling constantly? Adults not falling? And you watched them until you got it and then you got up and have been walking flawlessly ever since?

Or were you thinking that you are uniquely brilliant, just tried it yourself for a while, falling and getting up, with an encouraging pat on the back by your parents every time you did, until you had figured it out?

You have correctly observed that children learning to walk is a frustrating process of trial and error. But weirdly, you seem to think this is an admirable property to be imitated.

How many say aeroplanes do you think the average airline pilot crashes during training? A few dozen? Maybe only a handful of big jets with passengers on them because presumably you'd practice stuff like "Not smashing an airliner full of people into a mountain" last?

No. We don't learn to fly aeroplanes this way because it'd be stupid. Aeroplane pilots learn from other people's mistakes instead. Even when they have an accident and they personally learn from that, every effort is made to also teach other pilots who didn't have the accident the same lessons. A guy will stand up and lecture other pilots about the time he did an Impossible Turn† and his point won't be "I'm fucking amazing" or "You should go do this and get yourself killed" but "Here's what I did wrong. Learn from my mistake don't make your own".

†Despite its name the Impossible Turn isn't actually impossible, it's just probably a bad idea and you almost certainly already did at least two things wrong if you're attempting it. It's an attempt to return to your takeoff runway by doing a 180° turn after engine failure in climb out. It probably won't work because you will consume too much of your residual energy. But sometimes people get lucky.

I believe that airline pilots also fly in simulators a fair amount, and that this gives them the opportunity to test their skills in a safe environment where failure is not penalised to the same degree.

I don't really know that much about flying planes or learning to fly them, but I'm pretty sure that learning to fly planes involves lots of hands-on trial and error, mostly in small planes with an instructor next to them with another set of controls, and in simulators, in addition to reading about and listening to lectures on the theory of flight and past mistakes that have been made. They're still learning by doing, just in a structured environment where their mistakes don't actually lead to real disasters.

I don't think anybody would want to fly on a big passenger jet piloted by somebody who had never actually touched flight controls, just read books and listened to talks.

Reply on news.ycombinator.com