You are dangerously bad at cryptography
His insight that crypto is hard because you don't get feedback when you mess up is good.  It made me wonder what other domains are like that -- domains where correctness seems within reach, yet there are subtle aspects that are hard to state.  Some that come to mind:<p>* Concurrency.  It's easy to introduce race conditions, livelocks, or deadlocks without even knowing.  They are often difficult to observe or reproduce, and it takes a lot of hard-won experience to become sufficiently critical of your own incompetence.  On the other hand, the tools are improving here (helgrind, relacy, threadsanitizer).<p>* Exception-safety.  I don't mean in the weak sense of "won't leak resources" but in the stronger sense of leaving the system in a consistent state after an exception.  Again, it's difficult to analyze or induce all the different code paths that might occur, and difficult or expensive (depending on your starting point) to roll back your mutations.  Again, there are tools that help with this, like STM or cheap persistent data structures (so you can do a bunch of mutation that is only committed atomically at the end).<p>Are there others?  Can the progress in these domains shed light on how to make crypto safer?