Hell Is Overconfident Developers Writing Encryption Code Overconfident developers that choose to write their own cryptography code have plagued the information security industry since before it was even an industry. This in and of itself isn't inherently a bad thing, despite the infosec truisms… - ThreadSky

soatok.bsky.social • 23 days ago

Hell Is Overconfident Developers Writing Encryption Code

Overconfident developers that choose to write their own cryptography code have plagued the information security industry since before it was even an industry. This in and of itself isn't inherently a bad thing, despite the infosec truisms…

Comments

gblackmuzzle.bsky.social•23 days ago

i tried to read it and i only get a faint idea as a silly dog.

but i am really happy how hard you are working to keep the community informed.

thank you!

xershadowtail.bsky.social•23 days ago

The search is still on for a public domain small, portable, not a gigantic fucking mess embedded C library commented like you have amnesia that does the absolute minimum for TLSv1.3 with no cert code built-in except for hooks to call into the OS.

rya.nc•23 days ago

Are you complaining about libtomcrypt?

xershadowtail.bsky.social•23 days ago

I am not, I was not aware it existed until now. My main complaints that most crypto libraries are all-or-nothing, rather than minimalist and off-load to the OS what the OS does better.

rya.nc•23 days ago

A problem there is that Linux doesn't have any OS level certificate validation, unless you count OpenSSL.

xershadowtail.bsky.social•23 days ago

Unfortunately, but that would be a problem for future me to solve. There are also like a dozen different libraries just for that, so I guess Linux is screwed. But not like the applications my stuff can run is using HTTPS anyway.

xershadowtail.bsky.social•23 days ago

There is the shiny new systemd 257 keyutil that came out in November 2024 which can do certificate verification, so will probably just use that. So that problem is going to eventually solve itself once everyone gets upgraded. Those with it not available will just get a dialog then.

blowdart.me•23 days ago

Sharing that internally with my crypto pals 😂

blowdart.me•23 days ago

I’ll note that I’m partially responsible for “Developing your own cryptography library out of standard constructions of cryptographic algorithms”

soatok.bsky.social•23 days ago

That isn't necessarily a disaster lol

blowdart.me•23 days ago

For key management 😈

soatok.bsky.social•23 days ago

I am intrigued and would like to know more :3

blowdart.me•23 days ago

lol. It’s all documented.

https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/introduction

Comments

Posting Rules

Reply