3 ms·
> Since source is available, of course you should audit it, or at least glance over it before compiling. Really? I don't think everybody auditing the source o
by nebulous1 8y ago
> Since source is available, of course you should audit it, or at least glance over it before compiling.
Really? I don't think everybody auditing the source of the apps we use is at all realistic, and I don't think glancing at the source is worthwhile.
Barring an organized audit, I think confidence in an open source tools like this just comes with popularity, rightly or wrongly.
- code_duck 8y agoI think it's reasonable to wait for the community to audit it, and to trust that. Popularity tends to include a certain amount of vetting by people who do have time, resources or knowledge.
- raesene9 8y agoThat could happen, but if it did it would very much be the exception rather than the rule :) Heartbleed and shellshock (and others of course but those two have memorable names) very much laid the general case of "many eyes make all bugs shallow" to rest. The unfortunately truth is that a tiny percentage of source code gets reviewed by a competent reviewer. In this case my feeling is that it being crypto+rust the chances are even smaller than usual..
- floatboth 8y ago> crypto+rust Well, security_protocol+rust. The actual crypto comes from https://github.com/briansmith/ring https://github.com/briansmith/ring which just calls hand-written assembly crypto code copied from BoringSSL.
- paulie_a 8y agoThat worked really well for openssl