News for hackers. Stuff that matters.

A comment on Open-source crypto is no better than closed-source crypto. Parent comment

Re:Open-source crypto is no better than closed-source crypto by watwut on Thursday October 04, 2018 @03:55PM (#18143135)
Real world open crypto libraries have sometimes really atrocious code. Openssl being notorious.

Open source is way to go imo, but the automatic assumption that it is good or someone reviewed it is wrong.

[ Parent | on HN ]
Re:Open-source crypto is no better than closed-source crypto by umvi on Thursday October 04, 2018 @04:31PM (#18143392)
> or someone reviewed it

Sometimes I wonder if everyone assumes everyone else has reviewed it, therefore nobody has reviewed it

[ Parent | on HN ]
Re:Open-source crypto is no better than closed-source crypto by watwut on Friday October 05, 2018 @12:59AM (#18145844)
It is awful lot of hard work and requires a lot of special knowledge not that many have. Plus it is guaranteed political fight afterwards.

Average programmer don't know what to look for and can't do it over wekend.

[ Parent | on HN ]
Re:Open-source crypto is no better than closed-source crypto by nickpsecurity on Thursday October 04, 2018 @05:10PM (#18143702)
I covered this in an essay about security of various models of source sharing. It came down to talent and methods of developers and reviewers being what determines trustworthiness of a specific project/product. Although my stuff is text (old school), roryokane on Lobste.rs kindly made a better-formated, HTML version here:

https://gist.github.com/roryokane/d02addfa9329c579f15daef5b4...

EDIT: This also answers another commenter's question about when I'd trust closed-source software. Essentially if I trust the developer and/or reviewer. Then, I have to know I'm using the same thing. So, they have to publish signed hashes and so on of either the binary or source.

[ Parent | on HN ]