K
Kivikakk
kivikakk.ee · Personal blog · on HN since 2013
Kivikakk is a programmer's personal blog on cryptography, Erlang, C++, Python and small projects such as Contrigraph.
What HN saysHN commenters link it for the post on breaking homegrown crypto, which they use in security debates, and for the Contrigraph GitHub t-shirt recreation.
15HN people shared it
4linked it in comments
20stories submitted
356story points
2 years agolast shared
2013people per year2026
Most-shared posts
- 1Breaking homegrown crypto9 people · 317 points · first shared 2016 · 18 comments on HN
- 2Erlang is slow: and other rubbish2 people · 15 points · first shared 2013 · 2 comments on HN
- 3Being sorta useful in vim2 people · 3 points · first shared 2014 · discussion on HN
- 4Contrigraph2 people · first shared 2013
- 5Snapchat: not for state secrets1 people · 11 points · first shared 2013 · discussion on HN
- 6Python Still Surprises1 people · 3 points · first shared 2024 · 1 comments on HN
- 7Inefficiencies: using C++ and the Sapir–Whorf hypothesis1 people · 2 points · first shared 2013 · discussion on HN
- 8DTB Parser Implementing Notes1 people · 1 points · first shared 2021 · discussion on HN
- 9Escapology: How, when and why to encode and escape1 people · 1 points · first shared 2021 · discussion on HN
- 10Inkplate Done Quick1 people · 1 points · first shared 2021 · discussion on HN
- 11Chisel and C++, Together at Last1 people · 1 points · first shared 2024 · discussion on HN
- 12Escapology: how, when and why to encode and escape1 people · 1 points · first shared 2013 · discussion on HN
What HN people wrote when they linked it
CiPHPerCoder · 2017-03-19
> Look, you can't put up a blog post titled "How We Engineered CMS Airship to Be Simply Secure" and say that when asked "well, how did you actually engineer it to be secure?". In your post you talk about problems all solved by a framework, and apparently you haven't even evaluated what is out there already and rushed headfirst into building it all yourself.
I've looked at Laravel, about two years ago. http://seclists.org/fulldisclosure/2015/Apr/57
I haven't looked deeper at what it's done since then, since nobody is paying me to do so. I wasn't impressed then, and instead of waiting for them to get around to doing things right (while figuring out how to preserve backward compatibility), I started from zero.
You don't have to like that decision, but that's the decision I made.
> Again, using a framework makes your code way easier to review and a lot smaller to boot.
Sure, use a framework.
And then this happens: https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.…
I designed my own because, unfortunately, most of the PHP community either doesn't prioritize security enough to be trustworthy, or is simply in over their heads.
We use third party libraries (Twig for templates, HTML Purifier for allowing some HTML but avoiding XSS vulnerabilities) because they're well-studied and trustworthy libraries.
However, I do not trust most other PHP developers to do anything security-critical correctly. And thus, I will not design something meant to be secure…
voltagex_ · 2016-03-13
There has to be a middle ground between saying "security is simple" and "the sky is falling".
I think stating things like "don't trust user input" risks things like https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.… happening.
Security is hard, programming is hard, we should all get better at both.
bentoner · 2013-09-26
This one's based on the Github tshirt: https://github.com/contrigraph
See http://kivikakk.ee/2013/05/07/contrigraph.html
kivikakk · 2013-05-21
At this point I'll point out my recreation of the GitHub t-shirt: https://github.com/contrigraph
And the write-up: http://kivikakk.ee/2013/05/07/contrigraph.html