Osmosing

I was three topics deep in explaining something we are doing for a client, security-oriented stuff, when my colleague asked "how did you learn all this stuff?". The nest of topics was essentially Digital Signatures -> Public/Private keys -> Certificate Authorities. All the same general area. For this work we can't just breeze past how that all works, we're not trying to set up convenient SSH or git repo access. We are using cryptographic tools to ensure security-properties.

How to answer that? I think I learned some theory by reading Simon Singh's - The Code Book. I learned a lot about TLS and CAs during the bad old days of SSL/HTTPS when customers for our web agency were quite keen to have a green lock on their site. $50 per year, thank you. For the cheap ones. And setting it up right in Apache and Nginx was super fiddly the first times I did it. I got used to it. But even the process of ordering was, while well documented, quite raw and I got exposed to a lot of the components.

You learned about CAs the moment you tried to get HTTPS on something you made back then. Now you learn about LetsEncrypt if your hosting solution doesn't just solve it for you.

I can't imagine it being easier to learn by tinkering now. You are probably tinkering with Docker more than you are tinkering with the software itself. You are rarely tinkering with a live server where you can change config, restart the service and see if it worked. It just has to be harder to learn this stuff now. Which somewhat means the abstractions have improved and not as many need to wrangle the primitive parts of it. But this will also mean limited know-how in the future. Hopefully one still gets properly exposed to it with time.

Personally I'm having a good time fiddling with this stuff at levels I haven't before. And I'm sometimes surprised how well my old understanding holds up.

What are things you know that you barely know how you know? What are things you've seen peers know that you wonder how they learned? You can reach me on the Fediverse where I'm @lawik@fosstodon.org or by responding to this email to lars@underjord.io.

Thanks for reading. I appreciate it.