3 ms·
Just trusting a name and not the product has led to some bad outcomes before.
by drenvuk 7y ago
Just trusting a name and not the product has led to some bad outcomes before.
- bluejekyll 7y agoHaving worked with Brian while integrating ring into Trust-DNS, I concur with the assessment from pcwalton. But, yes, the name isn’t the only thing, but the discourse on the development of ring through the issue discussion on Github is high quality and very conservative in what is accepted. The library is high quality and has decent test coverage, with a diligent review process. All of that stems from Brian’s effort in maintaining an amazing project.
- tptacek 7y agoCan you provide an example of a name trusted among cryptographers, a specific library, and a bad outcome? I agree with Patrick Walton: Brian Smith is an extremely credible engineer in this particular domain. I would venture, tentatively, the hypothesis that the exact opposite thing is true, and that trusting well-established subject matter experts has been a pretty good strategy in cryptographic security. There's a reason everyone uses Sodium/Nacl.
- tedunangst 7y agoI think the subject is somewhat ambiguous because for many users, they are more likely to recognize library author names than cryptographers. And imagine those authors are cryptographers in their own right.
- drenvuk 7y agoNot a single one.