Ryan Castellucci :nonbinary_flag: (ryanc@infosec.exchange)'s status on Tuesday, 09-Jul-2024 20:34:51 JST

@varbin Yeah.

Someone used 512 bit RSA, which was demonstrably breakable by a small org a quarter of a century ago, and is now practically breakable on a standard PC in under a week, and in hours using distributed computing.

The vendor is working to fix the issue, but it shouldn't have been possible for them to make the error in the first place without an obvious "please let me do dangerous things" opt-in.

Developers should not need to be cryptography experts to build secure systems, libraries should be task-oriented and opinionated - libsodium is a good example of this.