2 ms·
This is good. However, I mentioned downgrade attacks as an example of the kind of bug Rust can't solve. Most likely new TLS stacks will not be prone to downgrad
by Manishearth 10y ago
This is good. However, I mentioned downgrade attacks as an example of the kind of bug Rust can't solve. Most likely new TLS stacks will not be prone to downgrade attacks. They might be prone to other logic errors. So will established TLS stacks, but those are more battle tested. The rust ones will be too, but eventually, not now.
It's a tradeoff.
- briansmith 10y agoOut of curiousity, what sort of evidence of safety is the Servo team using to evaluate crypto libraries? I'd love to see the criteria.
- Manishearth 10y agoI'm not aware of the details.
- larsberg 10y agoAs we mentioned in the recent Security meetings notes (https://github.com/servo/servo/wiki/London-Security https://github.com/servo/servo/wiki/London-Security ), there will be a blog post on blog.servo.org in the coming weeks from the folks on the team who are making these decisions.