4 ms·
What makes you think they haven't benchmarked? Here's one fun example from following development on Zulip: advapi.dll loads bcrypt.dll, which loads bcryptprimi
by nvme0n1p1 8mo ago
What makes you think they haven't benchmarked?
Here's one fun example from following development on Zulip: advapi.dll loads bcrypt.dll, which loads bcryptprimitives.dll. bcryptprimitives.dll runs an internal test suite every time it's loaded into any process. So if you can avoid loading advapi.dll, your process will start faster.
- delta_p_delta_x 8mo agoIs there a source for this? My Google- and GitHub-fu turns up nothing.
- lelanthran 8mo agoHe might be talking about cipher test that respected cryptography libs do on initialisation to verify integrity. Skipping those seem like a really bad idea.
- josephcsible 8mo ago> Skipping those seem like a really bad idea. Why? Is there any realistic scenario where your cryptography libs worked correctly yesterday but the exact same ones will be buggy today? What would be wrong with them just running once per build instead?
- nvme0n1p1 8mo agoJoin their Zulip and search for bcryptprimitives. That's where I got my info.
- lelanthran 8mo agoAre you talking about the cipher tests that are run when any cipher library is loaded? There's a reason they do that and it's not for shits and giggles. You could find yourself with broken ciphers and not know it. Skipping the cipher (or hash - not sure now) tests seem like a good way to get exploited.
- nvme0n1p1 8mo agoZig doesn't run any code from the dll that never gets loaded, of course. Why run tests for code that is never called? If another part of your app does load the dll, the tests will still run.
- josephcsible 8mo ago> Skipping the cipher (or hash - not sure now) tests seem like a good way to get exploited. Can you explain how? That doesn't seem plausible.