3 ms·

Last time when Telegram appeared on HN it was strongly criticized for coding encryption from scratch instead of using something well-known and checked library.

• dlisboa 12y ago
  > Now with all that story with Heartbleed bug it looks like this idea was not so bad. To make that claim you're assuming their implementation has fewer exploitable holes than OpenSSL or some other well-known and checked library. I don't put that much faith on them.
• michh 12y ago
  I disagree, who says there isn't a bug with Heartbleed-like severity in their crypto? You could flip your argument around and say the fact it took so long for Heartbleed to have been discovered means even OpenSSL didn't have enough people checking it. Which it probably didn't. And Telegram has even less people combing through its source than OpenSSL did pre-Heartbleed. The only valid reason I can think of is a small and obscure proprietary crypto algorithm and implementation isn't worth the bad guys/agencies' time for finding the inevitable bugs. But Telegram has gained more than enough popularity for that ship to have sailed months ago.