[anon7331]

Was this kid arguing about the automatic encrypt/decrypt file capability and Bram's unwillingness to use a cryptographically secure algorithm? It was a long, long thread that got heated.

I was with Bram though! It was never meant to be secure in a cryptographic sense...

[coldtea]

"Never meant to be cryptographically secure" should never go together with "encrypt/decrypt file capability".

This can even mean someone's loss of life in the right (meaning wrong) regime, or property (e.g. storing bitcoin info there).

It's like advertising a "self-driving technology" when your car needs human supervision to not crash and kill you or someone you fall into.

[anon7331]

I am not sure it's so black and white with encryption. It depends on your threat model. Keeping it secure from an angry ex-girlfriend is one thing, but keeping it secure from a three letter agency is another.

The mistake you are referring to is someone that assumes "encrypted" means three letter agency safe, which is a pretty terrible way to leverage encryption. In that case, it's exactly like hopping in a Tesla and assuming auto pilot will take you home without your supervision.

[coldtea]

>The mistake you are referring to is someone that assumes "encrypted" means three letter agency safe, which is a pretty terrible way to leverage encryption.

That's not a mistake, that's table stakes. People reading that X offers "encryption", should assume its cryptographically safe to the standards of the day, and be given that.

Not just some "safe from your spouse, ...maybe..." glorified rot13.

Else, just don't offer it. It's not Vim's place to offer "file encryption" anyway, especially if they can't keep that promise. It's fine not to offer it.

And it doesn't have to be a "three letter agency" that's the threat. The "angry ex-girlfriend" could might as well be a programmer. Or have a script-kiddie nephew. Or know a person or two who can use off-the-shelf tools to decrypt it. And the file might have things like a person's bank account passwords.

[TrapLord_Rhodo]

the three letter agencys built modern encryption with explicit loopholes. [0] They probably made bitcoin too.

Thus, the GF V. FBI scenario. Just because you "encrypt" something doesn't make it '100% Safe'. Such as someone keylogging you for your onepass pass.

[0] https://www.washingtonpost.com/graphics/2020/world/national-...

[H8crilA]

This would make sense if only it wasn't faster to run AES_GCM or some other AEAD, than whatever they did there.

[MSFT_Edging]

That sounds really familiar tbh. Basically the argument was "this is insecure" vs "Yeah, its supposed to be like that".