4 ms·

Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and

Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". While it's drying up and disappearing, is it going to take with it things like rbnacl which both use it transitively, package it for their environments, and also have some pretty great documentation on how it works? Is it going to take with it the public definitions of Curve25519 and XSalsa20+Poly1305? Are we going to get all neuralyzed and just...lose it? Look, I'm no security wonk. I have some interest in it, but that's it. And even I realize that libsodium as a thing you can use if you need to will probably outlive both you and I. Also, FWIW, it took me literally one Google search to find a bzip decompressor. I did have to read a page first, though.

throwaway415415 8y ago
Did Tink rely on NaCl or libsodium?
- eropple 8y ago
  http://google.github.io/tink/javadoc/tink/1.0.0/com/google/crypto/tink/subtle/NaClCryptoBox.html http://google.github.io/tink/javadoc/tink/1.0.0/com/google/c... Tink implements it, though it does not rely on it.
agumonkey 8y ago
Google is not necessarily forever
- e12e 8y ago
  Memento Alta Vista
- eropple 8y ago
  Yeah, and neither are any of us. The idea that we're just going to lose incredibly central open-source projects in five years--or, frankly, fifty--is bonkers and your objection is to the color of the bikeshed.
jwr 8y ago
> Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". I didn't write about libsodium. I wrote about tools I can actually use to access my data — while writing my own utilities to decode my stuff is fun, it is not necessarily how I choose to spend my time. And the fact that something was written by HN celebrities doesn't change much — being revered in HN circles is not necessarily indicative of real-life performance and certainly not of software longevity :-)
- eropple 8y ago
  > I didn't write about libsodium You wrote about NaCl and "those fancy 'nacl/box' thingies?", of which libsodium is an implementation; if it's still around, "nacl/box thingies" aren't a problem. Further, libsodium is not by "HN celebrities". This is the modern standard recommended by every single crypto/security professional I know. Please don't externalize this junk onto other people who may be impressionable.

throwaway415415 8y ago

Did Tink rely on NaCl or libsodium?

eropple 8y ago
http://google.github.io/tink/javadoc/tink/1.0.0/com/google/crypto/tink/subtle/NaClCryptoBox.html http://google.github.io/tink/javadoc/tink/1.0.0/com/google/c... Tink implements it, though it does not rely on it.

agumonkey 8y ago

Google is not necessarily forever

e12e 8y ago
Memento Alta Vista
eropple 8y ago
Yeah, and neither are any of us. The idea that we're just going to lose incredibly central open-source projects in five years--or, frankly, fifty--is bonkers and your objection is to the color of the bikeshed.

jwr 8y ago

> Hm. So you think that libsodium is going to dry up and disappear from the internet in "5 years' time"? Bear in mind that its first GitHub import was in 2013 and that it is used, and supported, by lil' guys like...uh...lemme look at this..."Google". I didn't write about libsodium. I wrote about tools I can actually use to access my data — while writing my own utilities to decode my stuff is fun, it is not necessarily how I choose to spend my time. And the fact that something was written by HN celebrities doesn't change much — being revered in HN circles is not necessarily indicative of real-life performance and certainly not of software longevity :-)

eropple 8y ago
> I didn't write about libsodium You wrote about NaCl and "those fancy 'nacl/box' thingies?", of which libsodium is an implementation; if it's still around, "nacl/box thingies" aren't a problem. Further, libsodium is not by "HN celebrities". This is the modern standard recommended by every single crypto/security professional I know. Please don't externalize this junk onto other people who may be impressionable.