Hacker News new | past | comments | ask | show | jobs | submit login

Even if it is illustrative, you should aim to give a good example.

Now, you could make this a good example by continuing, in lesson 2, to show weaknesses with this approach.

For an analogous case, read Knuth. In 'the art of computer programming', chapter ?2? on random numbers, he gives a convoluted random number generator that, in an abstract sense, is not unlike your one-way function, then shows how bad it is, and makes the case that you shouldn't let ordinary programmers design (or even tweak) these algorithms for you.




Knuth's point is that the random number generator that he came up with isn't good and so people shouldn't write such functions themselves. This is different from my blog post which is trying to explain to people what a one way function is without resorting to mathematics.

I do agree that a follow up could be written (e.g. Bob could compute a 'rainbow table' of the dictionary for the next time Alice uses the same trick; and the Alice could introduce some salt; Alice could introduce multiple rounds as well with a 'work factor' to make Bob's life harder).


It was pretty much the perfect explanation for me.

If you're trying to non-mathematically explain a mathematical process, I think, more often than not, you're going to end up with an incomplete example. If you try, I'd wager that you'd probably end up with something fairly long and possibly convoluted.

Which isn't to say that more blog posts about the topic would be wasted. I think the posts so far are great ideas for expansion. I just think it accomplished what it wanted to accomplish.

Hopefully the blog post won't spur too many novice developers into writing home-grown password hashing functions based on the outlined technique.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: