3 ms·

I can easily write closed source crypto that will be absolute garbage. I can also write open source crypto that will be total shit. With enough seller skills I

I can easily write closed source crypto that will be absolute garbage. I can also write open source crypto that will be total shit. With enough seller skills I could convince some people to use the closed source crypto, I guess with open source crypto I would be called out quicker.

watwut 8y ago
Real world open crypto libraries have sometimes really atrocious code. Openssl being notorious. Open source is way to go imo, but the automatic assumption that it is good or someone reviewed it is wrong.
- umvi 8y ago
  > or someone reviewed it Sometimes I wonder if everyone assumes everyone else has reviewed it, therefore nobody has reviewed it
  - watwut 8y ago
    It is awful lot of hard work and requires a lot of special knowledge not that many have. Plus it is guaranteed political fight afterwards. Average programmer don't know what to look for and can't do it over wekend.
- nickpsecurity 8y ago
  I covered this in an essay about security of various models of source sharing. It came down to talent and methods of developers and reviewers being what determines trustworthiness of a specific project/product. Although my stuff is text (old school), roryokane on Lobste.rs kindly made a better-formated, HTML version here: https://gist.github.com/roryokane/d02addfa9329c579f15daef5b4ebae2f https://gist.github.com/roryokane/d02addfa9329c579f15daef5b4... EDIT: This also answers another commenter's question about when I'd trust closed-source software. Essentially if I trust the developer and/or reviewer. Then, I have to know I'm using the same thing. So, they have to publish signed hashes and so on of either the binary or source.
mahemm 8y ago
A counterpoint to this is the billion dollar success of cryptocurrencies such as IOTA and Verge that are fundamentally broken from a cryptographic point of view.
- r32a_ 8y ago
  But they have been called out many times
  - anonytrary 8y ago
    But dumb money is dumb. Masses of people are seduced by marketing and internet forums.

watwut 8y ago

Real world open crypto libraries have sometimes really atrocious code. Openssl being notorious. Open source is way to go imo, but the automatic assumption that it is good or someone reviewed it is wrong.

umvi 8y ago
> or someone reviewed it Sometimes I wonder if everyone assumes everyone else has reviewed it, therefore nobody has reviewed it
- watwut 8y ago
  It is awful lot of hard work and requires a lot of special knowledge not that many have. Plus it is guaranteed political fight afterwards. Average programmer don't know what to look for and can't do it over wekend.
nickpsecurity 8y ago
I covered this in an essay about security of various models of source sharing. It came down to talent and methods of developers and reviewers being what determines trustworthiness of a specific project/product. Although my stuff is text (old school), roryokane on Lobste.rs kindly made a better-formated, HTML version here: https://gist.github.com/roryokane/d02addfa9329c579f15daef5b4ebae2f https://gist.github.com/roryokane/d02addfa9329c579f15daef5b4... EDIT: This also answers another commenter's question about when I'd trust closed-source software. Essentially if I trust the developer and/or reviewer. Then, I have to know I'm using the same thing. So, they have to publish signed hashes and so on of either the binary or source.

mahemm 8y ago

A counterpoint to this is the billion dollar success of cryptocurrencies such as IOTA and Verge that are fundamentally broken from a cryptographic point of view.

r32a_ 8y ago
But they have been called out many times
- anonytrary 8y ago
  But dumb money is dumb. Masses of people are seduced by marketing and internet forums.