3 ms·
(regarding qmail) It was a security bug back in 2005. It stopped being a security bug when DJB mentioned on the official page about the memory limits. Regardin
by dependenttypes 6y ago
(regarding qmail) It was a security bug back in 2005. It stopped being a security bug when DJB mentioned on the official page about the memory limits.
Regarding the salsa20 implementation: I just mentioned in my previous message why this was not a bug and the only reason that people were upset over it was due to Filo's incompetence.
As for evidence of DJB dealing straightforwardly with security reports: https://news.ycombinator.com/item?id=23250748 https://news.ycombinator.com/item?id=23250748
I think that https://old.reddit.com/r/crypto/comments/72w42c/statement_regarding_cryptanalysis_of_22_12_rounds/dnlv59e/ https://old.reddit.com/r/crypto/comments/72w42c/statement_re... would be a better example of DJB not properly handling security reports.
- dullgiulio 6y agosalsa20 was added in 2012, the warning file was added into the repository in 2016 the earliest (it is not clear when--which is vary bad for security and also shows the move was not advertised.) Incompetence is a strong word on the wrong target...
- dependenttypes 6y ago> the warning file was added into the repository in 2016 the earliest There is no official public repository. It gets released in tarballs. This does indeed make him seem slightly less incompetent though. > which is vary bad for security It is a framework for benchmarking cryptographic algorithms.