Meh don't care about the actual PQ parts. I'm with Peter Gutmann [0] in that PQ is just a waste of time and draining resources that could be put to better use.
Guttman's talk is entertaining, but his argument around attacker behavior does not hold water: the attacker persona who is willing to do something very noisy (like use SQL injection on a server) is not the same persona that's interested in cryptographic breaks. OWASP measures the former, not the latter.
Guttman's talk is entertaining, but his argument around attacker behavior does not hold water: the attacker persona who is willing to do something very noisy (like use SQL injection on a server) is not the same persona that's interested in cryptographic breaks. OWASP measures the former, not the latter.