HN Explorer

10 comments

[ 0.21 ms ] story [ 12.3 ms ] thread
coppercrisp62
Curious where you landed on password hashing, since zero deps in Go means you either pull x/crypto for bcrypt/argon2 or hand roll scrypt from stdlib. I've been down that road and stdlib pbkdf2 wasn't there until recently.
computerfriend
The readme and commit messages were written by an LLM without disclosure. I didn't look at the code.
samber
Do you need to disclose it when everybody do it ?

[EDIT] It is disclosed in contributors

computerfriend
* Not everyone is doing it.

* Yes, I do.

* It's not, that is from a stray Copilot commit.

* My main issue is not related to the non-disclosure.

LVB
Nothing to see here IMO. A large amount of code piled together in a month. Not picking this for my auth. FWIW I’m quite ok with bringing in a well tested/maintained dep…
dwroberts
Also, a quickly vibecoded project doing something important to security, to be used by other applications, seems like a perfect way to drop a malicious backdoor (and maybe even provides the author plausible deniability when it’s found)