[phyzome]

It sure would be nice if the author did that, but crypto is a non-trivial amount of work to get right.

It's easy to look at one small part of a codebase and say "this is wrong", but to get it right you have to learn large chunks of the code. Be aware what level of work you are shoving onto the author in your comment.

[kdbuck]

I did aim to clarify things in one of my responses below. It wasn't my intent to suggest that the author should necessarily be the one making a PR. My main point is that contribution and improvement should be encouraged where this post leans more towards staying away from a piece of open source code altogether.

[TheRealPomax]

But keep in mind that people have plenty of time to have a look at a codebase, but often do not in any way shape or form have anywhere near enough time to actually work on that code, even to file what you might call "a simple PR". Spotting errors is a very quick job. Writing even a small PR on a codebase you do not work on, that properly passes tests (in this case crucial) as well as fuzzing (again, it's crypto, it's crucial) takes hours if not days. Sometimes, and this is one of those times, the only thing you're going to realistically get is feedback that you should act on ASAP, not code that helps you get started. And that's a critical contribution, too.