3 ms·
This looks pretty cool, but to be perfectly honest. At the moment I'd be quite weary to use this. And the reason is that I have no idea who you are and if you c
by lawl 6y ago
This looks pretty cool, but to be perfectly honest. At the moment I'd be quite weary to use this. And the reason is that I have no idea who you are and if you can write crypto code. Please don't take this as an offence, i'm sure you do, but I have no way of verifying this.
So my heuristic so far has basically been "is this from someone who's known to know their shit", e.g. djb and/or "has this been audited by someone/some company that's known to know their shit".
In general though, an end2end encrypted open source firebase-like stack does sound pretty awesome though. But you'd need to publish at least one external audit of the crypto for me to consider using it.
Anyways, I have it bookmarked and wish you success!
- tasn 6y agoThanks for the feedback, and these are all fair concerns. Some points that would hopefully alleviate some of them: 1. We have been running EteSync for >3.5 years and have been in the space for much longer, so I'm not just some rando, though yes, I'm definitely not djb. :) 2. We use libsodium for everything so the harder crypto parts are audited and battle-tested. 3. We are going to formally verify the protocol. 4. We have been been awarded a grant by NLnet's PET fund and as part of that we will get a mini security audit. Though to be honest, I think the formal verification is a much more serious assurance. With that being said, I'm not trying to convince you. I think it's a very important point that we are working on addressing.