In reply to @kira:jakira.space
hi! i noticed that libsodium, one of the crypto libraries needed for lix, is lead by someone who thinks that vibe coding is an effective way of building software: https://www.reddit.com/r/vibecoding/comments/1kmptbo/my_first_significant_100_vibecoded_project.

i don't know that much about libsodium, but just that fact that lix relies on a crypto library managed by one person already makes me nervous.

it looks like it was added to support ed25519 signing keys in 2015 for binary caches (https://git.lix.systems/lix-project/lix/commit/e0def5bc4b41ad09ce3f188bf522814ef3389e1f), but it looks like openssl supports them now too. would it be worth it to replace it with openssl and drop the dependency?

I personally know jedisct1, it's certainly disappointing to see that but I suspect that there's much more than Lix in the boat with libsodium, if libsodium started to have a massive decrease in quality due to AI stuff being introduced or whatever, we would definitely take an action and move away

FTR, I don't think jedisct1 is writing much cryptography code in libsodium given that it's a fork of djb's NaCl and the NaCl team is djb, Tanja Lange and Peter Schwabe so… I think this is going to be fine.

In the ideal world, we would just move to RustCrypto once we can go to Rust and this will make this problem nonexistent.

On the more general problem, I think that there will be plenty of people who believe that vibe coding is an effective way of building software and who will be maintainers of some of our dependencies, I would rather err on waiting until a dependency degrade rather proactively replacing it otherwise we will soon run into resource issues.

In reply to @aloisw:julia0815.de
Libsodium also had quality incidents in the past, like https://github.com/jedisct1/libsodium/commit/ad4584d45590654b9d863ced90d2b2561d5cfbda .