61–63 of 63 posts
Earlier quoted context omitted.
Wow. While the bias was tiny, I expect more from crypto software. Calling it a "non-problem" is very strange. Edit: submitted another patch https://github.com/SpiderOak/Encryptr/pull/263
Thank you! We'll take a look. By the way: I recognized your nick from various repos you've authored/contributed to. Always really solid stuff!
Earlier quoted context omitted.
Can you go into more detail about this? Because I hear "biased RNG" and the switch that flips in my head is "never use this thing".
Considering how tiny the bias is along with the added complexity of the solution (in a chaotic language like Javascript, no less), I'd say the SpiderOak people are not crazy for not having accepted it. There would be somewhat of an argument here if the original was reducing random bytes modulo 84. As it is, this is almost like dinging EdDSA for doing a similar thing: reducing a 512-bit number modulo a 252-bit integer…
Earlier quoted context omitted.
> I'd say the SpiderOak people are not crazy for not having accepted it. They didn't simply not accept it. They tossed one bit of feedback my way, which I addressed in a follow-up commit, and then they neglected to do anything further. No discussion, no rejection, etc. If they wanted to reject it because of complexity concerns, I would have been fine with that. At least it would have been some sort of closure, and I…
Thank you for your interest and efforts to contribute to the project. I think there were some questions about your patch that you did not answer, and reviewers moved to other projects. Honestly we felt overall the patch was low quality. Certainly the serious error in the first version of the patch which dramatically added bios didn't help. In general we had already completed auditing the selection approach taken by t…