Here is the thought experiment to do: is it currently easier -- seriously, think it over -- to adopt an abandoned dep and ship an exploit as a minor rev; or is it easier to get a job as a junior programmer at microsoft and smuggle an exploit past your senior engineer reviewer?
-
-
This Tweet is unavailable.
-
Crypto is no less dangerous to rewrite if it’s 20 lines or 200.
- 9 more replies
-
-
-
Libsodium is 56 kloc and 6 years of work by experts (plus a previous 5 years by academics developing its upstream). People who use it track its maintenance status relatively carefully (and often vendor it).
-
I wasn’t aware that libsodium had gotten so big, but whatever, that example isn’t central to my point. Crypto code is hard to get right, regardless of how many lines it is.
- 1 more reply
New conversation -
-
-
"Small" is ill-defined, obviously constant-time-execution crypto algorithms can be small in compiled size but big in value and opportunity cost to substitute. The larger point stands.
-
This Tweet is unavailable.
- 3 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.