5 ms·

This is interesting, but shows some of the problems with the word "secure" The app. promises to be more secure than OpenSSH and provides a number of reasons wh

This is interesting, but shows some of the problems with the word "secure" The app. promises to be more secure than OpenSSH and provides a number of reasons why it thinks it will be. However the site is entirely anonymous, so you have no idea who wrote this tool and what their affiliations or background are. So either you audit the code to get some assurance, or you trust the author(s) without any evidence. Also the lack of any form of signed binaries would make me a little nervous from a security focused tool. You're then not only trusting the author(s) but their web hosting providers as anyone with access to that webserver can change the binary without it being obvious that they have.

tmikaeld 8y ago
...and 10 lines of css would be nice.
- code_duck 8y ago
  Coming from years of open source software, I trust this sort of presentation more.
  - nickik 8y ago
    Actually I think this just smells of low effort. As a comparative: https://www.wireguard.com/ https://www.wireguard.com/ That how a serious open source project looks like.
- lucb1e 8y ago
  I really like the site as it currently is. I've been considering converting my own website, which has CSS but I've still gotten readability complaints about (usually I'm the one complaining), to such a plain format.
- tzahola 8y ago
  Feel free to change your browser's default stylesheet if you're not satisfied with it.
code_duck 8y ago
I'd consider it primarily a source release. Since source is available, of course you should audit it, or at least glance over it before compiling.
- raesene9 8y ago
  If the goal was a source release they probably should have posted source + compilation instructions, rather than recommending curl + chmod :)
  - nailer 8y ago
    they did, right underneath.
- nebulous1 8y ago
  > Since source is available, of course you should audit it, or at least glance over it before compiling. Really? I don't think everybody auditing the source of the apps we use is at all realistic, and I don't think glancing at the source is worthwhile. Barring an organized audit, I think confidence in an open source tools like this just comes with popularity, rightly or wrongly.
  - code_duck 8y ago
    I think it's reasonable to wait for the community to audit it, and to trust that. Popularity tends to include a certain amount of vetting by people who do have time, resources or knowledge.
    - raesene9 8y ago
      That could happen, but if it did it would very much be the exception rather than the rule :) Heartbleed and shellshock (and others of course but those two have memorable names) very much laid the general case of "many eyes make all bugs shallow" to rest. The unfortunately truth is that a tiny percentage of source code gets reviewed by a competent reviewer. In this case my feeling is that it being crypto+rust the chances are even smaller than usual..
clpwn 8y ago
In general, I think it's very important that early-stage security tools make it clear in their copy that the codebase is young, not well audited, and therefore not yet fit for serious usage. It's super fun to play with cryptography, but giving a false confidence to users who may seriously rely on it is what can lead to major problems.
- clan 8y ago
  Talking about false confidence is spreading FUD to me. Quote from the page: > Does Oxy have... > Years of testing and battle hardening? No, it's super green. But hey, if you try it you'll help make it less green! Maybe not at the top of the page. But at the very least in the relevant section. I find the page absolutely clear and to the point. Yes - it would be nice with code signing. Being slightly less anonymous might also be better to gain traction. But overall I think it is an impressive start to a rather ambitious goal.
akx 8y ago
Re anonymity, the commits at https://github.com/oxy-secure/oxy https://github.com/oxy-secure/oxy are by @jennamagius, who seems to be https://twitter.com/jennamagius https://twitter.com/jennamagius / https://octodon.social/@jennamagius https://octodon.social/@jennamagius . Still (probably) pseudonymous, but at least not anonymous.

tmikaeld 8y ago

...and 10 lines of css would be nice.

code_duck 8y ago
Coming from years of open source software, I trust this sort of presentation more.
- nickik 8y ago
  Actually I think this just smells of low effort. As a comparative: https://www.wireguard.com/ https://www.wireguard.com/ That how a serious open source project looks like.
lucb1e 8y ago
I really like the site as it currently is. I've been considering converting my own website, which has CSS but I've still gotten readability complaints about (usually I'm the one complaining), to such a plain format.
tzahola 8y ago
Feel free to change your browser's default stylesheet if you're not satisfied with it.

code_duck 8y ago

I'd consider it primarily a source release. Since source is available, of course you should audit it, or at least glance over it before compiling.

raesene9 8y ago
If the goal was a source release they probably should have posted source + compilation instructions, rather than recommending curl + chmod :)
- nailer 8y ago
  they did, right underneath.
nebulous1 8y ago
> Since source is available, of course you should audit it, or at least glance over it before compiling. Really? I don't think everybody auditing the source of the apps we use is at all realistic, and I don't think glancing at the source is worthwhile. Barring an organized audit, I think confidence in an open source tools like this just comes with popularity, rightly or wrongly.
- code_duck 8y ago
  I think it's reasonable to wait for the community to audit it, and to trust that. Popularity tends to include a certain amount of vetting by people who do have time, resources or knowledge.
  - raesene9 8y ago
    That could happen, but if it did it would very much be the exception rather than the rule :) Heartbleed and shellshock (and others of course but those two have memorable names) very much laid the general case of "many eyes make all bugs shallow" to rest. The unfortunately truth is that a tiny percentage of source code gets reviewed by a competent reviewer. In this case my feeling is that it being crypto+rust the chances are even smaller than usual..

clpwn 8y ago

In general, I think it's very important that early-stage security tools make it clear in their copy that the codebase is young, not well audited, and therefore not yet fit for serious usage. It's super fun to play with cryptography, but giving a false confidence to users who may seriously rely on it is what can lead to major problems.

clan 8y ago
Talking about false confidence is spreading FUD to me. Quote from the page: > Does Oxy have... > Years of testing and battle hardening? No, it's super green. But hey, if you try it you'll help make it less green! Maybe not at the top of the page. But at the very least in the relevant section. I find the page absolutely clear and to the point. Yes - it would be nice with code signing. Being slightly less anonymous might also be better to gain traction. But overall I think it is an impressive start to a rather ambitious goal.

akx 8y ago

Re anonymity, the commits at https://github.com/oxy-secure/oxy https://github.com/oxy-secure/oxy are by @jennamagius, who seems to be https://twitter.com/jennamagius https://twitter.com/jennamagius / https://octodon.social/@jennamagius https://octodon.social/@jennamagius . Still (probably) pseudonymous, but at least not anonymous.