4 ms·

This question reduces to "Why trust Tarsnap?" Colin is a renowned security expert and it's known how he handles vulnerabilities: http://www.daemonology.net/blo

• TheDong 8y ago
  Why can't I trust credibility and tools? I do trust tarsnap, but if Colin wrote tarsnap in safe rust, I'd trust it even more. Similarly, I can trust a library or program is less likely to exhibit crashes and memory issues if it's written in rust, and that allows the developers to be less renowned security experts while still producing usable code. Your argument that C programs can be trusted to be memory safe and contain minimal bugs IFF they're written by experts doesn't prove the point that language's are meaningless for gaining trust. I trust a combination of credibility and tools. If someone tells me they ran a fuzzer over their http server, I'll trust it more than if they say they didn't. That's not credibility, that's tools. Both credibility and tools have their place. This isn't some black and white issue like you're portraying it.
• lifthrasiir 8y ago
  > Also, Tarsnap has had a long-standing bug bounty program, which is another reason to trust it. This is not necessarily a reason to trust Tarsnap. It is just an (rather weak) indication of the security-oriented process and nothing more. Probably you would want to say security track records (inferred from the bug bounty program), which would be a good reason to trust it.