Hacker News Reader

Comment by MSFT_Edging | Hacker News Reader

I once interviewed an intern candidate who bragged about getting into an argument with Bram on the mailing lists over a possible vulnerability. Bram insisted it was not important, and this young gun insisted it was.

We didn't hire the guy. It's interesting seeing these memorials for Bram, from what people say he was the polar opposite of this kid in a good way.

View on HN

Was this kid arguing about the automatic encrypt/decrypt file capability and Bram's unwillingness to use a cryptographically secure algorithm? It was a long, long thread that got heated.

I was with Bram though! It was never meant to be secure in a cryptographic sense...

"Never meant to be cryptographically secure" should never go together with "encrypt/decrypt file capability".

This can even mean someone's loss of life in the right (meaning wrong) regime, or property (e.g. storing bitcoin info there).

It's like advertising a "self-driving technology" when your car needs human supervision to not crash and kill you or someone you fall into.

I am not sure it's so black and white with encryption. It depends on your threat model. Keeping it secure from an angry ex-girlfriend is one thing, but keeping it secure from a three letter agency is another.

The mistake you are referring to is someone that assumes "encrypted" means three letter agency safe, which is a pretty terrible way to leverage encryption. In that case, it's exactly like hopping in a Tesla and assuming auto pilot will take you home without your supervision.

>The mistake you are referring to is someone that assumes "encrypted" means three letter agency safe, which is a pretty terrible way to leverage encryption.

That's not a mistake, that's table stakes. People reading that X offers "encryption", should assume its cryptographically safe to the standards of the day, and be given that.

Not just some "safe from your spouse, ...maybe..." glorified rot13.

Else, just don't offer it. It's not Vim's place to offer "file encryption" anyway, especially if they can't keep that promise. It's fine not to offer it.

And it doesn't have to be a "three letter agency" that's the threat. The "angry ex-girlfriend" could might as well be a programmer. Or have a script-kiddie nephew. Or know a person or two who can use off-the-shelf tools to decrypt it. And the file might have things like a person's bank account passwords.

the three letter agencys built modern encryption with explicit loopholes. [0] They probably made bitcoin too.

Thus, the GF V. FBI scenario. Just because you "encrypt" something doesn't make it '100% Safe'. Such as someone keylogging you for your onepass pass.

[0] https://www.washingtonpost.com/graphics/2020/world/national-...

This would make sense if only it wasn't faster to run AES_GCM or some other AEAD, than whatever they did there.

That sounds really familiar tbh. Basically the argument was "this is insecure" vs "Yeah, its supposed to be like that".

at least they cared enough to stick to their guns i guess

Indeed, not 100% clear but it felt like GP was criticizing the kid.

The kid enters a security related conversation and Bram not only listens but engages in the conversation. Seems like you missed on a great hire.

Bram listened to and engaged in most conversations, I think. He was very approachable.

The young guy was fairly skilled at technical stuff, but his story about arguing with Bram was an insight into his interpersonal skills. It wasn't what lost him the spot though. I personally liked him but he didn't really perform on the nuts and bolts challenges we present to candidates.

They're not particularly difficult challenges, just things to see how a candidate approaches a problem. I don't remember what exactly was disconcerting about his approach but I feel like he took a lot of short cuts via google searching and didn't exactly understand what he was doing. This was years ago back when we did in-person interviews though, so my memory isn't 100% on it.

We have a lot of extremely intelligent people with small egos at my company and cockyness like that doesn't really fit super well with our group.

The article talks about modesty and meeting in the middle, but I get the impression that the younger dev didn’t want to budge or understand the other point being made by Bram.

I haven't followed that but that is having an opinion. Sometimes you can only agree on disagreeing.

Reply on news.ycombinator.com