Tink VS freebsd-src

> I wonder what people say when they find a bug despite you using standard crypto?

Not using TLS doesn't automatically mean you need to "roll your own crypto". They could have used a well documentend library such as Google Tink[1] instead of doing their own crypto.

[1] https://github.com/google/tink

I sort of rewrote google's tink project in rust. There is already a rust version by project oak but it didn't exactly jive.

PassManager uses the Tink library for encryption, which provides state-of-the-art** security for your passwords. Tink uses industry-standard encryption algorithms like AES to ensure that your passwords are kept safe from prying eyes.

Note that in the example jwt refers to the Tink jwt package.

What I can't tell is if the new version had any fixes related to the bug being discussed here

Even the slightest hiccup could leave me vulnerable. I don't want to roll my own encryption. I want to use something like tink (a secure crypto library by Google) but unfortunately they don't support node or Javascript (there's a library that was published 2 years ago).

I dont have an answer for you, but 2 resources that are worth checking out: https://developer.android.com/guide/topics/security/cryptography and https://developers.google.com/tink

> Do C (or something where the mapping to C is known), and lots of languages have FFI libs where wrapping that is fairly trivial

That is an interesting idea, yet still a lot of work, sadly. I was hoping somebody had done the legwork already. I looked at Tink [1] and age [2] based on my co-worker's recommendation, but they all seem to have limited implementations in other languages.

[1] https://github.com/google/tink

[2] https://github.com/FiloSottile/age

2023-06-26: https://github.com/freebsd/freebsd-src/commit/ee0aa1ce12b3caea34477a31e9d2111a329e33b9 to main (tagged release/14.0.0).

It's not yet in FreeBSD base so if you want to test it you'll have to use the patch from the PR: https://github.com/freebsd/freebsd-src/pull/881

Lots of great work by many people. But I bet this guy and his optimizations to the vfs and locking has made a significant impact.

https://github.com/freebsd/freebsd-src/commits?author=mjguzi...

and then there were deep concerns about the stability of same, so vfs.zfs.bclone_enabled = 0 was left in-place

https://github.com/freebsd/freebsd-src/commit/068913e4ba3dd9...

Well there are some examples:

https://github.com/freebsd/freebsd-src/tree/main/share/examp...

But yeah that pf.conf could be expanded allot, but there are many source to cobble a conf together. My conf is massive but 99.9% commented out so i have my "template" for nearly everything, from mail to web to blacklistd etc.

The BSD version is sort of very recent, for what it's worth -- FreeBSD imported a not fully functional version in 2017 and has seen more work on it in 2022: https://github.com/freebsd/freebsd-src/commits/main/usr.bin/... , but the default version shipped is still GNU diff3: https://man.freebsd.org/cgi/man.cgi?query=diff3&apropos=0&se... .