> Age is written in Go (there's also Rage, written in Rust), whereas GnuPG is a big old ball of C, so if there are parser bugs, GnuPG is bad news and Go/Rust ar

> Age is written in Go (there's also Rage, written in Rust), whereas GnuPG is a big old ball of C, so if there are parser bugs, GnuPG is bad news and Go/Rust are likely hopefully sound. Well, on "written in Go" part, I remember looking at the crypto code 2-3 years ago (??), and it was full of unnecessary copies. You know the practice of using explicit_bzero, avoiding copying, and so forth? In this case neither I remember was being the followed practice (it uses GC anyways), in fact, I remember copying like no tomorrow. Correct me if I am wrong though. Regardless, languages with GC are usually a no-no. There is a chapter on it in "Cryptography Engineering: Design Principles and Practical Applications by by Bruce Schneier, Niels Ferguson, and Tadayoshi Kohno", the name of the chapter is: "Implementation Issues". It mentions Java (as not being a good language for crypto due to GC), and I think C as well. In any case, it has been a while, and I am currently tired. Feel free to correct me, of course.