Cryptographic APIs misuses

[misterAnderson90]

I'm a PhD student interested in finding security vulnerabilities in open source projects.

We found a total of 34 warnings (indicating potential vulnerabilities) when running the CogniCrypt static analyzer (*) on etesync-notes (or its library dependencies). We documented each one of these issues in private gists for the sake of confidentiality (non-disclosure).

Can you please let us know whether we can share these gists with you? We are eager to evaluate the perception of developers (e.g. severity of these warnings) and improve etesync-notes' security, and the quality of the reports of static analysis tools.

(*) https://github.com/CROSSINGTUD/CryptoAnalysis

[tasn]

Please report to: security @ the domain

Though I guess that since you already gave a link to the analyzer used to find things it's public knowledge anyway, so you may as well just post it here and we can have a discussion here.

I find it quite unlikely that there are real issues though, because this application doesn't actually power the cryptographic code in EteSync. The code is written in TypeScript and resides in Etebase-JavaScript...

[theAkito]

Please, report this spammer. This is just a bot spamming the very same message to tons of open source repositories. The only things that are changed in the message are the repository's name and the amount of warnings.

[tasn]

I don't think you can report spammers, no?

But anyway, closing this ticket, as it was nonsense from the start.