3 ms·
You advise to "fork it", but immediately after that you add the notorious "do not write your own" meme. Can you see the inconsistency of the messages? Part of
by gambler 14y ago
You advise to "fork it", but immediately after that you add the notorious "do not write your own" meme. Can you see the inconsistency of the messages?
Part of security is being up-to-date in regards to things like hashes. If authors don't update their own libraries and you need to tweak them manually, how is it different from "writing your own"?
- ebiester 14y agoI always thought the advice against "writing your own" spoke of the algorithm itself, not a library around the algorithm.
- Locke1689 14y agoNope. Google Keyczar: standard algorithms; still screwed up. You should always use the highest level interface available.
- Luit 14y agoI agree I'm a bit inconsistent, but the library is well written, and exchanging the hashing function is a trivial task. That's not really quite "writing your own". I just mean to discourage people who aren't 100% sure they know what they're doing. I strongly agree with Armin: HMAC-SHA1 (note, the combo, it's not just the latter) is still good security for most applications you'd consider this library for.