2 ms·
If you’re not aggressively vetting the crypto libraries you’re using, you’re more or less exposing yourself to the same probability of risk as rolling your own
by deadbabe 1y ago
If you’re not aggressively vetting the crypto libraries you’re using, you’re more or less exposing yourself to the same probability of risk as rolling your own crypto.
- immibis 1y agoIf you're picking some random blob of code from Github, then yes. If you're picking OpenSSL or Bouncy Castle, then no. Despite Heartbleed.
- mrngm 1y agoI'll pick my battles, it's part risk appetite and part expected attacker model. It also depends on what I'm trying to protect. If it's in a standard library of an open source programming language, I'm less inclined to fully check the implementation.