4 ms·
The fact that you have a PhD in cryptography doesn't necessarily mean you know how to write secure code. Especially C code. Lot of people hated OpenSSL quality
by d33 10y ago
The fact that you have a PhD in cryptography doesn't necessarily mean you know how to write secure code. Especially C code. Lot of people hated OpenSSL quality long before Heartbleed, but it took that vuln for people to actually realize how bad it is. I can imagine a good, secure SSL library being written by somebody without a PhD, in a safer language.
- hellofunk 10y ago> Especially C code Isn't WhatsApp an Erlang app?
- tim333 10y agoWhatsApp uses Erlang and various other languages. I doubt the encryption code is in Erlang. Erlang can call C code.
- pgt 10y agoThe socket layer at OS-level is written in C and Erlang probably uses an SSL library written in C. Turtles all the way down!
- rakoo 10y agoWhatsapp is both a server and a client. The server might be written in Erlang, but the client (where all the end-to-end encryption happens) is written in whatever the device can run.
- fnj 10y agoThe device runs machine code. Client code can be written in any language which can be either compiled or interpreted to machine code.
- SAI_Peregrinus 10y agoAndroid devices run Java, with an option for machine code for some functionality.
- sverige 10y agoI'm not sure that security is fully correlated with the degrees held by developers. It seems to have more to do with their motives. WhatsApp is owned by Facebook, which is wholly motivated by profit and the aggrandizement of Zuckerberg, not by providing secure code. What's most interesting to me is that for all the people who complain that C is insecure, I don't see any great, proven open source crypto implementations written in the "secure" languages. As an aside to your aside, LibreSSL is certainly more secure than OpenSSL, and it is written in C. Theo de Raadt doesn't have a PhD (though obviously he's not the only one hacking on LibreSSL).
- weavie 10y agoThere are plenty of crypto implementations out there. What do you mean by proven?