So by that logic, if a tv station chooses to broadcast content that propagates racist misinformation and calls for violence, but the station only does it because that's what they algorithmically determine gives them the most viewership, that it's fine?
Agreed. In my case, daydreams regardless, I'm not expecting to build a multi-billion $ exit. It's more about building something useful for people, that I can control the direction of, and guide to some kind of "success".
Success here can be a nice side-income, but also just making a solid, valuable tool for customers.
I just watched this last night. A lot of the content will already be well known to the HN audience. There was one big light-bulb moment for me. One of the speakers was clarifying the "If you're not paying then you are the product" idea.
He refined it to, (rough quote), "Changes to your behavior and actions are the product"
That distinction made the insidiousness much more clear than the former statement.
Distance learning is manageable for my kids as they're a little older and I can work from home. But families with younger kids where both parents have to go out to work and can't possibly afford childcare are getting hammered.
As always, the poor get the worse of the effects, and children are really compounding that right now.
The weaknesses resulting from this wouldn't be discoverable with a test like corrupting the password from the first example. If the developer wasn't aware that IV reuse introduced that weakness then they would be using strong primitives but in a way that dramatically undermines the actual encryption.
Not to put words in your mouth, but I assume your answer would be to say that this would be a matter of correctness. If yes, then where I'm coming from is that the majority of devs don't have the skillset to be correct and sometimes wouldn't dive deep enough to discover these kinds of pitfalls.
That's a dangerous statement on it's own. Making proper use of primitives is not at all a simple concept. Developers can absolutely undermine their systems with poor choices/mistakes.
Self promotion:
I wrote a blog up on a very high level screw up with type conversions to show just the very surface of how to screw up using solid crypto primitives. Time allowing I want to do more entries on topics within the crypto realm itself. IV reuse, etc.
You're not alone. This has always felt scammy. It's a little more gray-area than some of the traditional vapor-ware which was more about driving competition out of business by large players, but still something I try to avoid.
I don't see PBKDF2 as a full footgun, but maybe as the minimally still-acceptable method. When I was building my system for E2E messaging (pritact.com) I started out with PBKDF2 but kept mentally revisiting the iteration count before biting the bullet and switching to Argon2.