15

Proposal: Cryptography, CS Theory, IT Security

I am failing to understand the scope of this proposal. The comments like these:

Since this site was not merged with the security.stackexchange.com one, and that one does cover applied cryptography, as in developers using encryption and building cryptosystems, I would say this should be more in the direction of research / theoretical / conceptual / algorithmical / mathy parts of crypto.

implementation fits SO; applications fit security site.

implementation should be on ITsec; and applications on SU

seem to imply that the scope of the proposal research/theoretical parts of Crypto which is part of theoretical computer science and therefore covered by the scope of cstheory. All of the listed on-topic questions seem to be on-topic for cstheory.

So I think this proposal should be closed, (or alternatively, exclude theoretical crypto questions and then merged into ITSec site, where around half of the questions are tagged with cryptography, encryption, authentication).

1

4 Answers 4

Reset to default
16

I disagree for the following reasons:

  1. I think Cryptography as a subject covers a wide range of disciplines. An explanation of RSA is impossible without understanding Number Theory. The basis for AES is rooted in Abstract Algebra (Finite Fields specifically), questions on which are if anywhere more appropriate to math.se and mathoverflow. I think however that there are additional points to be made on such subjects in the context of a cryptographic environment which in the context of other domains might be seen as unnecessary.
  2. There is some pretext for duplicate subset proposals. All of these sites: https://askubuntu.com/, https://unix.stackexchange.com/, https://dba.stackexchange.com/, http://serverfault.com, http://superuser.com technically share common ground, they just have different focus.
  3. From @AviD's comment, "I would say this should be more in the direction of research / theoretical / conceptual / algorithmical / mathy parts of crypto". I don't take that to mean solely research level questions - I take it to mean the full spectrum from research level to basic questions (but well asked ones, of course) are on-topic. From the CSTheory FAQ these kind of questions are considered too basic there.
  4. I think rather than taking a pre-emptive action against a potential community, we should allow the site a chance to stand or fall on its own merits. It may well be that this community does not achieve critical mass in any case. After all commitment is not necessarily a measure of quality participation.

I suggest hanging fire here. There is a fairly large overlap between the two communities and that could be seen in a negative light (removing potential questions from CSTheory) but it could also be positive. I expect CSTheory, Math, ITSec and StackOverflow would be the obvious migration routes for questions and I imagine there'll be a subset of the userbase who are members of all three.

16
  • 5
    In short: I am a moderator on cstheory and I am obviously concerned about a proposal whose scope seems to be completely covered by the scope of cstheory. It will drain users and questions from cstheory. Crypto is the sixth highly used area tag on cstheory. Based on what is written in Jeff's blog post and the practice of area51 I think this proposal whose scope seems to be theoretical crypto should be closed.
    – Kaveh
    Commented Apr 25, 2011 at 14:19
  • 2
    Regarding 1: I think you don't have the correct idea about what theoretical computer science is. Many theoretical computer scientists are affiliated with math departments. Regarding 2, I refer you to Jeff's blog post. I want to see the kind of on-topic questions for this proposal that are not already covered by the existing sites like cstheory.
    – Kaveh
    Commented Apr 25, 2011 at 14:30
  • 1
    Regarding 3, that is your interpretation of the comment, I interpreted it differently. Even if that is what is meant, non-research level theoretical CS questions are already in the scope of Math.SE. Regarding 4, I think after having the security.SE as a separate site, there is no point in having a separate crypto.SE proposal to cover theoretical crypto. Practical crypto questions are already excluded from this proposal according to comments so the argument that crypto needs to be in one place is already defeated.
    – Kaveh
    Commented Apr 25, 2011 at 14:34
  • 2
    @kaveh I realise there is some concern about losing users. However, my concern is the non-inclusive nature and lack of clarity as to where crypto questions belong your solution (research level to CSTheory, non-research level to wherever else) provides. Clearly, a question on the internals of AES is non-research, since it's already been done, yet it's quite a specialised form of Maths. I recognise you're trying to provide a high quality site via the research-only filter, but it shuts out people who want to learn, which I can't support.
    – user15097
    Commented Apr 25, 2011 at 14:38
  • (I think AviD is one of the moderat of security.SE and has excluded the practical questions from this proposal because they fall in the scope of security.SE which is in beta right now). I think one can use the same argument to exclude theoretical crypto questions from the scope of this proposal since they are already covered.
    – Kaveh
    Commented Apr 25, 2011 at 14:38
  • SE admins have told us that they would like cstheory to extend its scope, I think having another theoretical crypto site (which is already in cstheory's scope) is in the opposite direction. (sorry, I was fixing typos in my comments.)
    – Kaveh
    Commented Apr 25, 2011 at 14:40
  • @Ninefingers, I think you have a misconception about what is considered research-level. I would suggest having a look at the questions that we have in our crypto tag. (But even if that was the case, it is not a good argument since several general level CS proposals has been closed because of overlapping as you can see by checking the area51 discussion posts.)
    – Kaveh
    Commented Apr 25, 2011 at 14:49
  • 2
    @Kaveh They're all good quality, but they're all definitely research domain crypto questions. I am for this proposal because I think it would allow for questions like What is the difference between various block cipher modes of operation?. I see this as a wholly valid question on the subject of cryptography. It is quite possible to give a high quality answer to such a question even if the content can be found from wikipedia. If you are saying I'd be able to ask such questions without being downvoted/closed then I'll consider supporting the closure.
    – user15097
    Commented Apr 25, 2011 at 14:52
  • (ps: I don't want this discussion to diverge by discussing other remotely related issues like whether our decision to restrict the scope to research-level was right or not, that is a separate issue and the decision has been made and we understand that several people have different opinion about that, but I would like to point out that non-research level questions are not shut out, non-research level theoretical CS questions can be posted on Math.SE.)
    – Kaveh
    Commented Apr 25, 2011 at 14:56
  • I cannot promise that, I am just one user! And in general we expect users to try to answer their question first by themselves (and that includes reading WP), and if they try and cannot (like after reading WP article they still have questions), then I don't think their question would be treated badly if they explain what have tried and found by themselves in their post. Btw, I think that is also kind of a practical question which can be posted to security.SE. Note that cryptography tag is also their second highly used tag.
    – Kaveh
    Commented Apr 25, 2011 at 15:04
  • 1
    @kaveh Just to be clear I don't want to diverge the discussion either. The CSTheory community clearly made that decision and that's fair enough. However, I'd like to have and am trying to support a crypto community where that restriction does not exist. I realise we therefore have conflicting interests, so I guess we're unlikely to come to a resolution here. As I say, this proposal may never reach beta and even if it does it may never become a fully fledged site. For the reasons I've outlined, I'm for giving it the chance to succeed or fail.
    – user15097
    Commented Apr 25, 2011 at 15:06
  • 2
    @Kaveh Honestly, I've no idea r.e. the removal of practical crypto. I'd guess it was to avoid the obvious Stackoverflow ambiguity. Like many proposals, I suspect the actual tone and content of the site will be set in beta, not what's written here. And yes, we do, that's why I'm here - I think it does stand on its own. But at the end of the day, if it dies, or if Jeff closes it, that's also fine by me - If it doesn't survive on it's own, fair enough. If Jeff closes it, the reasons for closing you've suggested are well argued points, even if I don't agree with them :D
    – user15097
    Commented Apr 25, 2011 at 15:33
  • 1
    I understand your position. People partition topics differently and obviously those partitions are more or less subjective. You would like to have all crypto in one place. But I still believe that this proposal should be closed (since its scope is already covered and it will hurt existing sites). :)
    – Kaveh
    Commented Apr 25, 2011 at 15:45
  • 4
    I was really looking forward to this site, and I would greatly prefer to see Cryptography all in one place instead of spread around multiple sites, but I think @Kaveh makes some compelling arguments. There are probably too few open questions in cryptography that are not covered by CS Theory to warrant a separate site specifically for crypto research. It's just too bad that a more broadly defined cryptography site didn't make it to Beta before IT Security.
    – Bill the Lizard
    Commented Apr 25, 2011 at 17:48
  • 2
    I am happy to see Stack Exchange mirror conferences. Yes you can send your theoretic crypto papers to STOC/FOCS/TCC, your applied crypto papers to Oakland/CCS/Usenix Security, and your implementation papers off to FSE/CHES. That does not preclude having Crypto/Eurocrypt/PKC/FC/RSA-CT/etc/etc.
    – PulpSpy
    Commented Jul 12, 2011 at 14:24
4

I don't see the point of a cryptography site if it doesn't encompass all aspects of cryptography. The questions deemed on-topic look like they are currently accepted on Math, with perhaps a hint of CSTheory. If that's really the desired scope, the existing sites are fine.

I could see the point of a site that unites all aspects of cryptography, including the math and protocols (currently more Security or CSTheory or Computer Science Stack Overflow material) and implementation (currently Stack Overflow material) and usage (currently Security material).

4

Most of the discussion has implicitly centered around where someone goes to ask a question, and the argument is that there are a spectrum of places to ask cryptography-related questions depending on exactly what the nature of the question is. (I happen to think there is a lot that falls through the cracks but that is for another time. And I do participate at both IT Security and CS Theory.)

The flipside needs to be considered. Where are experts going to congregate to answer questions? One of the amazing things about CSTheory is the active participation by distinguished researchers and academics in theory of computing.

Unfortunately, without a crypto stack-exchange, it is unlikely we'll ever see distinguished cryptographers participate unless if they wholly specialize in an aspect of cryptography covered by a competing site (i.e., they do theoretic cryptography or software implementations).

If I pitched stack exchange to a cryptographer or gave a promotional rump session pitch, what would I say? "You might be interested in the community of questions and answers concerning cryptography and your participation would be very helpful. It is pretty easy to participate: just check CS Theory and then head over to IT Security, take a peak at SO, and definitely check Math." That's obviously not great for attracting experts with limited time.

Yes, you may be able to ask crypto related questions elsewhere: the question is, can you have them answered?

6
  • PS This is only to argue that the proposal should not be closed. I agree the scope of the proposal is be revisited (and made as wide as possible).
    – PulpSpy
    Commented Jul 12, 2011 at 14:26
  • 1
    tag-lists are exactly for that purpose. Just create a tag-list for crypto questions.
    – Kaveh
    Commented Jul 12, 2011 at 14:49
  • That is fine if you see stack exchange as just a list of questions. I liken it to a community: users build their corner of SE, gain reputation, chat with other users in their area, etc. I think these aspects are influential in attracting and engaging the top researchers in a given field as much as the questions themselves. It doesn't work quite the same when you are split between four sites. Anyways, it is decided now.
    – PulpSpy
    Commented Jul 14, 2011 at 18:29
  • I have already answered the points you bring up in the comments below Ninefingers's answer. It is still not clear to me what is the scope and does it contain practical crypto questions on the security.SE site. The site is only in beta, it is too early to say whether it will stand along side the other sites or will drain activity from cstheory and security.SE and split the questions between them, I am not holding my breadth but there is still the possibility of merging it with security.SE if things don't go well, arguing at this point is pointless, we have to wait and see how things work out.
    – Kaveh
    Commented Jul 14, 2011 at 18:42
  • "IT" security covers cryptography that has been standardized enough to be used in the IT industry. CS Theory should only cover theoretic cryptography, the likes of what is covered in the TCC CFP. Crypto will cover the majority of the remaining crypto research that is not theoretic/foundational and not standardized/deployed.
    – PulpSpy
    Commented Jul 14, 2011 at 18:52
  • That may work, as I said, we will see how things develop. :)
    – Kaveh
    Commented Jul 14, 2011 at 18:54
1

IT security's description states :

"Beta Q&A site for security professionals to discuss vulnerabilities like XSS, buffer overflows, SQL injection, CSRF, clickjacking, as well as system and network security. Discussions related to OWASP projects, tools, papers, and other materials are encouraged".

I am pretty sure Cryptography does not overlap XSS,Buffer overflows , SQL injection etc.

Cypto has a lot of theory which cant be talked about in IT security or SO . eg Any question on the Enigma machine would not fit both SO and IT Security.

3
  • Don't see why a question about the Enigma machine can not be posted on ITSec. And research-level theoretical crypto questions are covered by cstheory.SE as I explained above and non-research level theoretical crypto questions are covered by Math.SE.
    – Kaveh
    Commented Jun 3, 2011 at 12:51
  • 2
    The actual scope of IT Security has broadened quite a bit since the time the description was written. Some aspects of cryptography fare quite well there.
    – Gilles 'SO- stop being evil'
    Commented Jun 5, 2011 at 12:16
  • 2
    I agree - the scope broadened long ago to include crypto, and this is on the faq: IT Security - Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities. Topics include, but are not limited to: web app hardening network security phishing risk management policies penetration testing security tools using cryptography.
    – nealmcb
    Commented Jul 12, 2011 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .