Hacker News Reader

Comment by bollockitis | Hacker News Reader

I generally don't advocate complete rewrites, but it seems to be the best option in this scenario. Why is everyone so opposed to doing this? I don't mean that rhetorically. I truly don't understand. I don't want to downplay the difficulty of such a project, but I regularly see brilliant developers here at HN and elsewhere scrambling to create something meaningful. Here's an excellent opportunity to build something that would have widespread use, with both cultural and political impact, yet there seems to be a lot of reluctance to actually take on such a project. Instead, we keep speculating about anonymous developers who have made it clear that they're done and want nothing to do with it anymore. We even have permission to use TrueCrypt for reference. Seems like an awesome opportunity for developers smart enough to do it.

View on HN

I think a lot of developers would break at the point of native cross platform support. I like writing stuff people use, that's cool, but it's a huge pain to write for and test on platforms I'm not going to use like Windows and Linux. I'll do that if you pay me, sure, but not for fun. Maybe not even for the fame of having a more popular fun project.

Cross-platform would likely require Java as a base runtime, something that might not be appetizing for some developers.

With that being said there's many brilliant polyglot developers with lots of experience and maybe it's a task for developers with more years than average under their belt as the project will take more effort than an MVP.

Would you trust a full-disk encryption scheme running on top of a JVM? I sure wouldn't.

Your point is valid :)

No, it wouldn't require Java (thankfully).

The problem is the IO driver abstractions available on each platform are wildly different. Getting working filesystem driver code on Windows (7/8), Mac OS, and Linux is a non-trivial task that requires a lot of kernel mode hacking.

If you are willing to live with the performance impact, at least initially, you could use FUSE for MacOS/Linux. I don't recall if the Windows UMDF (User Mode Driver Framework) supports file system drivers or not.

All I want is a simple cross platform encryption program.

Maybe something that is LUKS compatible so it works straight away on Linux and with a simple GUI for Windows that makes it as seamless as possible? (Sits in tray, autodetects when a container containing device is inserted and offers to mount it?)

It's not hard (as such), yet no such program exists.

Try R10Cipher. It offers most of your requirements. www.r10cipher.com

Sorry for the multiples :-(

They are frightened that tptacek might say mean things about their hashing algorithms.

I'm not even in the security space and I'm sometimes afraid of tptacek's rebuttals to my comments.

Their hashing algorithms?

Or their node.js implementation of DNSSEC!

Contrary to popular belief I don't have a huge problem with Javascript. I'm just as likely to make fun of you for implementing DNSSEC in Haskell.

I thought you did for Javascript for crypto purposes, though, (ie, a pure node.js implementation), not Javascript in general, right?

My problem is content-controlled Javascript (or "browser Javascript", although that term is less useful what with browser extension Javascript, which isn't content-controlled).

https://twitter.com/tqbf/status/474736429365338113

I think most of us think a complete rewrite would take a lot longer than picking up the current source code and continuing it.

Seems reasonable. One thing I've learned from HN though is that brilliant and good at crypto are two very different things.

Agree. Unfortunately it seems to me that people on this site would rather create yet another jsframework.js or Flappy Bird As A Service as opposed to something like NewCrypt.

Pretty standard for the Hacker News crowd in my experience.

Oh my god, can you get me in the FBaaS beta?

I think there is different level of difficulty between the two things you just described.

And I'm pretty sure crypto is hard to work with and get right, and one mistake removes the purpose of software.

Of course it's a different level of difficulty. People seem to overwhelmingly prefer to work on easy, shallow projects as opposed to hard, meaningful ones.

Its not like there's some standard or minimum level of competency required to create an account and comment here. I think many expect this to be an enlightened and learned crowd of commenters when most people here are likely still college age or younger. Heck, I created my account back when I was still studying in university.

It is supposed to be a more enlightened crowd. If I wanted inane comments from only marginally-skilled people I'd read comments on reddit.

This is the sort of comment that belongs on Reddit.

Contrary to what you think, writing crypto things is interestingly hard, not discouragingly or too difficult. Anyone can write one and most coders would enjoy it. The trouble is that if you are not already good in security, your creation will have too many security problems and holes to be useful for anybody who is not NSA.

Such unwarranted and poisonous bitterness.

The people who publish easy stuff are typically new developers/entrepreneurs, simply people with less practice. There aren't all that many amazing, experienced developers with deep toolkits and skills. Better to commend people for trying and critique their work for what it is, than bemoan the lack of depth.

This sort of comment slings mud at the efforts of the young and inexperienced, when we should be trying to form a welcoming community that helps them grow. Our duty is to be supportive and help comb through the chafe to help find the diamond tech, content, and comments. That's the point of being here.

I agree, but there's another factor besides inexperience: time constraint. Many people have day jobs. Any projects that they do for fun or interest have to fit into their spare time. There's a limit to how ambitious such projects can be, and we definitely don't want to exclude them.

I think it's critical for HN to welcome a wide spectrum of original work. We want to see major technical achievements, of course. But we also want to see the minor one-offs. The bar for sharing your work on HN should be low.

The relationship between major work and minor one-offs is mysterious. Things that start off playful and trivial can develop in unexpected ways. Or maybe a success at something trivial inspires someone to a more ambitious next effort. If we want to have a culture of people sharing things they've made—which we do—we need to accept that most won't seem very impressive.

A good example is 2048. That game and its many variations weren't necessarily technically impressive. But the way in which a whole bunch of people riffed on each other's work for a few weeks—that was one of the most creative things ever to happen spontaneously on HN. If the game itself had been less trivial, I doubt that would have happened. The barrier to entry would have felt too high, so people without much time or experience wouldn't have gone for it. But because it was so simple, making one's own variation felt doable, and lots of people did.

> would rather create yet another jsframework.js or Flappy Bird As A Service

Heyyyy... FBaaS was my next big thing!

Are you seriously criticizing everybody else for not doing something you have never done either? That is pretty bold. Just take whatever your excuse is and apply it to them. That's generally a more realistic way to simulate everybody's aggregate view of the world.

People write jsframework.js or Flappy As A Service because jsframework.js is --- face it --- easy, and Truecrypt is hard.

A similar observation can be made about web-based encrypted chat systems versus encrypted block device drivers.

I agree 100%.

Reply on news.ycombinator.com