4 ms·
"This is not a security issue" and "we can improve things here" are entirely compatible. Also doesn't seem like a Google project?
by arp242 1y ago
"This is not a security issue" and "we can improve things here" are entirely compatible.
Also doesn't seem like a Google project?
- perbu 1y agoIt isn't. Filippo is a x-googler that used to work on Go crypto for Google, so assumptions are easy to make. The project seems to be sponsored by Let's Encrypt, fwiw.
- deleted 1y ago[deleted]
- arp242 1y agoI have some projects "used by Google" as a dependency. Can I now expect someone posting three threads here in a day using deceitful title if I'm not nice enough to you? Will my words now be misrepresented as "Google said [..]"? You lied to whip up outrage so you can piss an open source maintainer in the face, seemingly just to get revenge? Well done. Good job. 10/10 contributing.
- Eikon 1y agoThis is not a strong take, the "fix" doesn't completely fixes the vulnerability. Passwords or private keys are not the same as a user-provided crypto-seed without checksums. This is supposed to be critical PKI software. It's about corruption and bit rot, not about seed length. This is a project of a ex-google employee, used in chromium, that google publicly endorses; that's definitely akin to a "google project".
- eddythompson80 1y ago> akin to a "google project". LOL, ok.
- eran- 1y agoExactly, the two statements aren’t contradictory. The fix was super simple, and Filippo (whom I don’t know personally) just went ahead and did it. Also, bringing up Project Zero’s 30-day disclosure policy while complaining about someone sharing what they thought was a vulnerability report for visibility feels off. If it’s not a security issue, then there’s no reason it needs to be kept quiet. Grow up. Let’s not turn harmless fixes into drama.