Sorry, this tweet is nonsense. The implementation is in assembly because people complain about crypto performance and to avoid side channels. Code was written by competent people who should implement crypto. Language is not "safe", it's safe against some mistakes, not logic bugs.https://twitter.com/marcan42/status/946252676781748224 …
-
I don’t have data to back it up, but I think there were more bugs discovered in OpenSSL than in the Go crypto library that reimplemented everything.
Does the Go code implement all the junk that OpenSSL does, are those bugs mostly in low-level crypto primitive code or in high-level protocols and formats, and are the same number of people *looking* for bugs in both of those? Lots of questions before you can make that assertion.
-
-
I believe the Go crypto libraries started out to be just enough to implement TLS, but obviously they've grown since then. You'd need to ask
@agl__ for the complete history.Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.