4 ms·

It's now vetted by CryptoCat's author so it must be good.

by brohee 6y ago

dathinab 6y ago
At least if you somewhat trust the reviewer we now know that it has no glaring problems and seems to be well designed. Which is important because without any external reviews how would we know if it wasn't written by some people with "dangerous" skill levels being high enough to look good for someone having no idea about TLS but to low to actually get it right. I do have seen some open source projects over the years where that was the case and the authors where not open for any form of critique, which lead to situations where you seemed to get a high quality well maintained library but you got a somewhat high quality well maintained library with hidden extremely dangerous bugs the authors have no intention of fixing and closing all issues about them... Nice to hear that Rustls is not such a bad apple but a most likely good pice of work.
- viraptor 6y ago
  > At least if you somewhat trust the reviewer we now know that it has no glaring problems and seems to be well designed. I believe OP was making fun of the review. Cryptocat was full of questionable choices (https://tobtu.com/decryptocat.php https://tobtu.com/decryptocat.php) as well as widely disputed security claims.
  - brohee 6y ago
    Exactly, Nadim Kobeissi's name is the last one I expected to see on a crypto audit that someone would pay for. Internet never completely forgets, but in practice a little with your head down and your past sins wash out.
    - Harvesterify 6y ago
      He went a really long way since 2013 and his debuts with CryptoCat : he got a PhD in one of the top European crypto research team, on formal verification of crypto implementations. I would confidently guess that's way more legitimate that any opinion you could formulate against this audit, based on ad hominem attacks.
      - brohee 6y ago
        He completely rewrote CryptoCat in 2016 and that still wasn't good, the security page was at https://web.archive.org/web/20160407125207/https://crypto.cat/security.html https://web.archive.org/web/20160407125207/https://crypto.ca... and there were still pretty bad issues, notably the file sharing disclosing the exact size of the file shared, despite him stating "Cryptocat makes the following assumptions: Untrusted network: We assume that an attacker controls the network and so can intercept, tamper with and inject network messages.". This was not "ECDH completely broken" bad, by far, but still far from good. I guess that was still before obtaining his PhD. And about not liking the guy, I'll admit reading https://www.courtlistener.com/docket/14868600/todd-v-reichwein/ https://www.courtlistener.com/docket/14868600/todd-v-reichwe... biased me...
- brohee 6y ago
  The point is that I absolutely don't trust one of them, but I guess the reference was too obscure for most.

It's now vetted by CryptoCat's author so it must be good.

by brohee 6y ago

It's now vetted by CryptoCat's author so it must be good.

At least if you somewhat trust the reviewer we now know that it has no glaring problems and seems to be well designed. Which is important because without any external reviews how would we know if it wasn't written by some people with "dangerous" skill levels being high enough to look good for someone having no idea about TLS but to low to actually get it right. I do have seen some open source projects over the years where that was the case and the authors where not open for any form of critique, which lead to situations where you seemed to get a high quality well maintained library but you got a somewhat high quality well maintained library with hidden extremely dangerous bugs the authors have no intention of fixing and closing all issues about them... Nice to hear that Rustls is not such a bad apple but a most likely good pice of work.

viraptor 6y ago
> At least if you somewhat trust the reviewer we now know that it has no glaring problems and seems to be well designed. I believe OP was making fun of the review. Cryptocat was full of questionable choices (https://tobtu.com/decryptocat.php https://tobtu.com/decryptocat.php) as well as widely disputed security claims.
- brohee 6y ago
  Exactly, Nadim Kobeissi's name is the last one I expected to see on a crypto audit that someone would pay for. Internet never completely forgets, but in practice a little with your head down and your past sins wash out.
  - Harvesterify 6y ago
    He went a really long way since 2013 and his debuts with CryptoCat : he got a PhD in one of the top European crypto research team, on formal verification of crypto implementations. I would confidently guess that's way more legitimate that any opinion you could formulate against this audit, based on ad hominem attacks.
    - brohee 6y ago
      He completely rewrote CryptoCat in 2016 and that still wasn't good, the security page was at https://web.archive.org/web/20160407125207/https://crypto.cat/security.html https://web.archive.org/web/20160407125207/https://crypto.ca... and there were still pretty bad issues, notably the file sharing disclosing the exact size of the file shared, despite him stating "Cryptocat makes the following assumptions: Untrusted network: We assume that an attacker controls the network and so can intercept, tamper with and inject network messages.". This was not "ECDH completely broken" bad, by far, but still far from good. I guess that was still before obtaining his PhD. And about not liking the guy, I'll admit reading https://www.courtlistener.com/docket/14868600/todd-v-reichwein/ https://www.courtlistener.com/docket/14868600/todd-v-reichwe... biased me...
brohee 6y ago
The point is that I absolutely don't trust one of them, but I guess the reference was too obscure for most.