@marshray @ioerror @kaepora Drama

 _____
|  __ \
| |__) |___  ___ __ _ _ __
|  _  // _ \/ __/ _` | '_ \
| | \ \  __/ (_| (_| | |_) |
|_|  \_\___|\___\__,_| .__/
                     | |
                     |_|
Today I had a Twitter conversation went something like this. I'm copying the conversation here for convenience, and in case someone gets upset and decides to DELETE FUCKING EVERYTHING, I'll still have a copy :)

@RiptideTempora -> @marshray
> Is there an enumerated list of the issues that Cryptocat's crypto has?
@marshray -> @RiptideTempora
> No. Because I bet @kaepora can't remember all the bugs @ioerror and I have told him about.
@RiptideTempora -> @marshray
> Why don't you guys work on a list of issues you'd like fixed then?
> That way even if @kaepora becomes stubborn everyone else can learn from it.
> Otherwise, what are you really accomplishing? Giving @ED_Updates fresh content?
@marshray -> @DefuseSec
> Because even if @kaepora fixes the last bug *I* can exploit he will not have done it with secure engineering
@DefuseSec -> @marshray
> This is the most intelligent and correct tweet I have seen in this whole 'debate'.
@RiptideTempora -> @marshray
> Then make recommendations to improve the design. Make it a community effort. Get more criticism in the equation.
@marshray -> @RiptideTempora
> Secure engineering is a principle greater than myself, or @ioerror, or @kaepora.
@RiptideTempora -> @RiptideTempora
> See previous tweet. That sounds an awful lot like a recommendation to me. Write it down. That's list material!
@marshray -> @DefuseSec
> Now it is revealed that my trolling has not been mere trolling, but *compassion*.
@RiptideTempora -> @RiptideTempora
> The road to hell is paved with good intentions. How about actually helping make things better?
@marshray -> @RiptideTempora
> Alternatively, I may be just a sanctimonious bastard. This is for users to judge.
@RiptideTempora -> @marshray
> If @kaepora doesn't understand secure engineering, how about teaching people how to do it right? Including him
@DefuseSec to @RiptideTempora ->
> This is even more intelligent. :) We're headed in the right direction now...
@RiptideTempora -> @marshray
> Compassion without action is a spectator sport. If not for @kaepora then for other developers eyeing crypto
@marshray -> @RiptideTempora
> There are too many eager and willing to learn secure engineering to waste time on the likes of @kaepora
@RiptideTempora -> @marshray
> Ok, you just validated Nadim's claims that you're personally attacking him rather than helping.
> You don't give a shit about security at all, you only care about feeling right.
@marshray -> @RiptideTempora
> You haven't tried to give him advice.
@RiptideTempora -> @marshray
> Let me spell it out for you why my idea was good and why refusing to do it makes you a fool. One sec.

Which brings you to the present moment. Hooray! Now put your thinking caps on, folks, because it's time for some...
    ________                          __                      __                _
   / ____/ /__  ____ ___  ___  ____  / /_____ ________  __   / /   ____  ____ _(_)____
  / __/ / / _ \/ __ `__ \/ _ \/ __ \/ __/ __ `/ ___/ / / /  / /   / __ \/ __ `/ / ___/
 / /___/ /  __/ / / / / /  __/ / / / /_/ /_/ / /  / /_/ /  / /___/ /_/ / /_/ / / /__
/_____/_/\___/_/ /_/ /_/\___/_/ /_/\__/\__,_/_/   \__, /  /_____/\____/\__, /_/\___/
                                                 /____/               /____/
              "The kind of stuff a fifth grader should grasp with mimimal difficutly."

So here's my argument: Instead of bitching that Nadim Kobeissi (@kaepora) didn't design his
free and open source crypto software the way you (@marshray, @ioerror, Ian Goldberg, et al.)
envisioned, I propose you get together and write a 95 Theses style essay on everything and
anything wrong with Cryptocat or @kaepora's attitude: Covering the crypto, the architecture,
the programming language, the security of browser extensions, his mindset, his approach,
his logic, his personality, superfluous features that need to be axed, essential features
that are missing. Everything. In one document. And release it publicly.

There are many reasons why this is a more advantageous approach than saying stupid things
like "There are too many eager and willing to learn secure engineering to waste time on the
likes of @kaepora" (It's no wonder he feels like he's being attacked):

1. It will give him an idea on what to improve so he can improve the product. Pretty damn
   obvious, I'd say. That's why this is reason #1. You can't condemn someone without giving
   them a chance.

2. A lot of developers look at Cryptocat as a starting point for building their own crypto
   apps. Personally, I learned how public key cryptography works from his specification.
   (My classes still haven't covered this yet :( )

   So let's say you follow my suggestion, and Nadim is as bad as you seem to think, and he
   just scoffs and ignores the whole thing. Then Nadim and Cryptocat are both a lost cause,
   but the more people your criticisms of him and his work reach, the more aspiring crpyto
   developers will know not to do the same thing he did or make the same mistakes, thus
   improving the security of more than just Cryptocat and reaching out to the many folk who
   are "eager and willing to learn secure engineering".

So let's do a game theory/prisoner's dilemma type analysis of the possibilities. In this
thought experiment, your actions dictate the row and @kaepora's personality dictates the
column:
     _____ _____
    [  A  |  B  ] <- Row 1: You compile your criticisms and publish them
    -------------
    [__C__|__D__] <- Row 2: You don't
       ^     ^---- Column 2: @kaepora is an asshole
       \---------- Column 1: @kaepora isn't an asshole

In condition A (row 1, column 1), you publish your criticisms and @kaepora goes over them,
learns how to improve Cryptocat and maybe learns to better himself in the process. WIN-WIN

In Condition B (row 1, column 2), you publish your criticisms and @kaepora says "WONTFIX", but developers
like myself will go, "Oh, so that's what Cryptocat does wrong. With this knowledge, I can
do it better." Then we will do so and there will be a better product on the market (for
free, if I'm behind it) and everyone who isn't @kaepora or Cryptocat wins.

Condition C (row 2, column 1) is where I suspect we are right now. Instead of doing
something productive, you just belittle @kaepora because you're butthurt over past
experiences with him or something. Get over it, and while you're at it, get over
yourself. LOSE-LOSE

Condition D (row 2, column 2) is where you seem to suspect we are right now, in which
case, no advantage is gained by persisting in being a narcissistic dipshit about this
whole situation.

Any logical person should see why I call you a fool for staying in Row 2.

TL;DR - Put up or shut up. Crypto isn't about being nice, crypto is about designing
secure systems that work. So I'm not being nice.