2 ms·
This isn't an article naming-and-shaming; it's an information dump so people can sort through it and find the right people to actually name-and-shame.
by DerpDerpDerp 13y ago
This isn't an article naming-and-shaming; it's an information dump so people can sort through it and find the right people to actually name-and-shame.
- ballard 13y agoThis lists which companies have certified implementations, not which products relies on which CSPRNG/s by default. I think there are already internal code audits underway by some of the listed entities, if not, it would be wise to get started real quick before customer anger arrives. If this is not a clear impetus for open source, eg, publicly audit-able code >>> trade secrets, I think we should keep blindly accepting black box solutions, from chip to app. No funny business ever happens without transparency.