4 ms·
Over 300.000 LoC: ~/tmp/openssl-1.0.1g $ find . -name "*.c" | xargs wc -l | tail -n1 349834 total This is too much by at least one order of magnitu
by hf 13y ago
Over 300.000 LoC:
~/tmp/openssl-1.0.1g $ find . -name "*.c" | xargs wc -l | tail -n1
349834 total
This is too much by at least one order of magnitude.
What's the going price for a crypto-level code review
(I'm not even saying audit) these days?
Is all this code necessary for state-of-the art encryption or
isn't it rather backwards compatibility baggage?
If the latter: how much could be gained by splitting the project
into '-current' and '-not'?
- eliteraspberrie 13y agoThe cost of a cryptography code review is about $5-10k per week.
- hf 13y agoThanks! So how does this work: Say I have this project and I want it audited -- would you (or the company/person that you had in mind) give me an estimate like "I'd need 3 weeks for 25, 5 weeks for 50 or 10 weeks for 95% coverage" or do you simply analyse away for a week (or whatever time I'm willing to pay you) and try to find something?
- eliteraspberrie 13y agoI don't have personal experience with it, but apparently these things are booked months in advance, on a contract basis. The engineer doing the audit spends an agreed number of weeks finding as many problems as they can, and hand you a report at the end.
- hf 13y agoThanks!
- dirtyaura 13y agoThat cheap? A freelance web/Mobile developer can charge over $5K per week, I find it hard to believe that you could get quality security code review for that price