I'm not eager to review this one - also because that one above was just a random vuln I checked on the spot because I remembered it from 2 weeks ago or so - I think imma do a pass on this. I also don't understand why you would take the supply chain risk of having breez sdk in your secure messenger. All that ffi, bridges and cargo hell... <what can possibly go wrong>? I already cry every time i have to do signal (kotlin)->ringrtc (rust)->webrtc (c++) review, which is about every other release, meaning 3x per month or so.
This "integrated payments" feature is something I'll probably never understand though. I don't want my money exposed to a thing that literally takes crap in from outside, or my confidential messages exposed to SDKs that interface with public networks. Sandboxing is a thing.
I honestly believe you can sell anything to bitcoiners as long as you say there's bitcoin in it (no bitcoin actually needs to be in it). We’re all more normies than not.
Ouch!
I'm not eager to review this one - also because that one above was just a random vuln I checked on the spot because I remembered it from 2 weeks ago or so - I think imma do a pass on this. I also don't understand why you would take the supply chain risk of having breez sdk in your secure messenger. All that ffi, bridges and cargo hell...
<what can possibly go wrong>? I already cry every time i have to do signal (kotlin)->ringrtc (rust)->webrtc (c++) review, which is about every other release, meaning 3x per month or so.This "integrated payments" feature is something I'll probably never understand though. I don't want my money exposed to a thing that literally takes crap in from outside, or my confidential messages exposed to SDKs that interface with public networks. Sandboxing is a thing.