Re:Passage: A fork of password-store that uses age instead o...
by wglb on Friday December 17, 2021 @10:22PM
(#29601283)
Knowing who the author is and knowing what he knows and what projects he has completed I would expect that he is quite familiar with this citation and the body of literature surrounding it.
Well, on "written in Go" part, I remember looking at the crypto code 2-3 years ago (??), and it was full of unnecessary copies. You know the practice of using explicit_bzero, avoiding copying, and so forth? In this case neither I remember was being the followed practice (it uses GC anyways), in fact, I remember copying like no tomorrow. Correct me if I am wrong though. Regardless, languages with GC are usually a no-no. There is a chapter on it in "Cryptography Engineering: Design Principles and Practical Applications by by Bruce Schneier, Niels Ferguson, and Tadayoshi Kohno", the name of the chapter is: "Implementation Issues". It mentions Java (as not being a good language for crypto due to GC), and I think C as well.
In any case, it has been a while, and I am currently tired. Feel free to correct me, of course.