[liberationtech] DecryptoCat

[Ralph Holz]

Hi Tom,

> If you think this bug could never happen to you or your favorite pet
> project; if you think there's nothing you can learn from this incident
> - you haven't thought hard enough about ways it could have been
> prevented, and thus how you can prevent bugs in your own codebase.

Amen to that.

Thanks for the write-up; it was my feeling, too, that too many people
have been uttering very sharp criticism in this particular case, and
that wasn't helping anyone.

There are projects that don't get nearly as much coverage but have a
very poor security record. I personally know programmers with a hell of
a global reputation whose code contained bugs found by peers. We should
keep things in perspective.

Ralph

-- 
Ralph Holz
I8 - Network Architectures and Services
Technische Universität München
http://www.net.in.tum.de/de/mitarbeiter/holz/
Phone +49.89.289.18043
PGP: A805 D19C E23E 6BBB E0C4  86DC 520E 0C83 69B0 03EF