3 ms·
In a sense it is good when people actually check opensource software for security vulnerabilities, and these get fixed, no? There would only be reason of concer
by tobias2014 5y ago
In a sense it is good when people actually check opensource software for security vulnerabilities, and these get fixed, no? There would only be reason of concern if a project shows overall continued sloppiness, but I'm not aware of that for croc. Correct me if I'm wrong.
- exadeci 5y agoThey seem to be sloppy: >The only thing I know about croc is that they misread a SPAKE2 description and it was very broken (https://github.com/schollz/pake/commit/04729caa1862a96ce3aef043c315d87ab92c360f#diff-3392294668649ee2b185383421a6b8e31ad9bac0662f6cf39629345ca064e65aL121-R125 https://github.com/schollz/pake/commit/04729caa1862a96ce3aef...) while also not knowing how long private keys should be