News for hackers. Stuff that matters.
Re:Passage: A fork of password-store that uses age instead o... by johnisgood on Friday December 17, 2021 @07:25PM (#29600064)
> Age is written in Go (there's also Rage, written in Rust), whereas GnuPG is a big old ball of C, so if there are parser bugs, GnuPG is bad news and Go/Rust are likely hopefully sound.

Well, on "written in Go" part, I remember looking at the crypto code 2-3 years ago (??), and it was full of unnecessary copies. You know the practice of using explicit_bzero, avoiding copying, and so forth? In this case neither I remember was being the followed practice (it uses GC anyways), in fact, I remember copying like no tomorrow. Correct me if I am wrong though. Regardless, languages with GC are usually a no-no. There is a chapter on it in "Cryptography Engineering: Design Principles and Practical Applications by by Bruce Schneier, Niels Ferguson, and Tadayoshi Kohno", the name of the chapter is: "Implementation Issues". It mentions Java (as not being a good language for crypto due to GC), and I think C as well.

In any case, it has been a while, and I am currently tired. Feel free to correct me, of course.

Re:Passage: A fork of password-store that uses age instead o... by wglb on Friday December 17, 2021 @10:22PM (#29601283)
Knowing who the author is and knowing what he knows and what projects he has completed I would expect that he is quite familiar with this citation and the body of literature surrounding it.