> could be a state actor trying to lay the foundation for future backdoors
idk if presence of “names” are a good signal to indicate otherwise either
If xz contributors were anonymous, we would need to throw out the whole thing
Minibone is an initial attempt to address this challenge in the single-user setting (that allows a concise and easily auditable implementation).
This is all part of our broader work that you can read about here: https://backbone.dev/company
After the xz debacle, knowing who wrote which commits became important
It's also not immediately obvious to me where the company is registered or info about the people behind the company.
For a security focused company these are all things I would expect to be rock-solid and as transparent as possible for the initial due-diligence when evaluating services like this.
This is slightly insane. How can they release something as Apache License if they aren't even giving out the name of the developers? Exactly WHO is licensing this source code?
There are many open source crypto libraries and it's probably not the wisest to use one authored by anonymous developers
The committers appear to be "Backbone Authors". The organizations membership is not visible.
With something like this, trust is vital. I need to be able to trust the code now and into the future. For trust, transparency is key. And this project has zero transparency.
For all I know, this could be a state actor trying to lay the foundation for future backdoors.