You know, Marcus Ranum once decided to write an HTTP server "minus the stuff in HTTP that makes it hard to write a safe HTTP server" for his Network Flight Record intrusion detection product.
No I haven't. My security metric for tarsnap is "can the NSA break this"; as much as I respect your abilities, I have a feeling that any security flaws you can find, the NSA can also find.
I wasn't talking about me; my point was, by being reasonable, you're going to have a hard time picking fights with security researchers.
Hmm, you may have a point there. In that case... there's no way you'll ever find any security flaws in tarsnap! My code is far too good for either you or anyone else to find any bugs in it! And your mother is... oh, never mind. I'm really not very good at acting unreasonable. :-)
Incidentally: you'd be surprised how many "names" in the industry are ex-NSA.
Fair enough -- but the principle of conservatism requires me to presume that the NSA has at very least more resources than its former employees.
http://archives.neohapsis.com/archives/bugtraq/1999_1/0736.h...
Not that you're Marcus Ranum. Among other things, you never provoked us into finding a horrible flaw in your product. SO WATCH YOUR MOUTH, BUDDY.
It really is a common failure mode, though. "OpenSSL looks scary, so I'll just implement a subset of SSL on my own."