19 ms·

To be equally candid: I didn't think you would want the $1000, but I thought you might enjoy the challenge. Similarly, I think the people who are most likely t

To be equally candid: I didn't think you would want the $1000, but I thought you might enjoy the challenge. Similarly, I think the people who are most likely to win this are going to be more interested by the puzzle than by the money. The $1000 is there mainly as linkbait to increase the odds that the right people hear about this. But if there was anyone whose code I would bet on, your name at the top of the list anyways! Well, we've already established that the code was wrong...

e12e 11y ago
> Well, we've already established that the code was wrong... Hah, it's been a while since I read: http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-security-bug.html http://www.daemonology.net/blog/2011-01-18-tarsnap-critical-... Makes me feel a little less bad for the Debian issue with (way!) too low entropy in key-generation. Refactoring code using crypto dangerous :-/ Have you considered creating a 2.0 on top of NaCL? I could see that it would probably not be a good idea to actually throw out all the existing tarsnap-code etc -- I generally just mean if you'd want to move to a simple, yet "batteries-included"/shrink-wrapped crypto library?
- cperciva 11y ago
  That's part of why I have code in libcperciva which is shared with other projects -- the new AESNI code in tarsnap was all tested via its inclusion in spiped and scrypt before it came into this tarsnap release.