Typically people who disclose vulnerabilities give the vendor months to fix the issue before they disclose it. sarciszewski didn't even give this guy a day.
When it comes to cryptography, immediate full disclosure is more responsible than maintaining bug secrecy. Even so, I've tread the path of bug secrecy before, and all it results in is inertia. Projects would wait until hours before I publish to fix the problem. Others would sit unnoticed for months; meanwhile peoples' systems remain vulnerable in very obvious ways.
Don't try to frame this conversation as if I owe anyone months or even a day.
I see nothing wrong with this. Everyone has to start somewhere.
Read.
That's fixable
All of the problems I identified are fixable, but at what cost? Who's going to invest the time to volunteer to fix all of this project's problems? And even if you do, the end result will end up being somewhere between phpseclib and defuse/php-encryption -- at which point, why not use those?
Most AES implementations out there are vulnerable to cache timing attacks.
Most software AES implementations, you mean! You can side-step these by using AES-NI-- but to leverage AES-NI from PHP, you need to use OpenSSL. You can't execute raw ASM from PHP (but you can from C).
TLDR I think sarciszewski is, to an extent, doing a good thing by bringing an awareness of common issues to the community at large.
Thank you for saying so.
But he's also being a huge dick about it, being extremely trigger happy to publicly shame any and every project he can.
I previously sat silently for seven months! on another project's vulnerabilities. That's not exactly trigger happy. And the goal is not to publicly shame any and every project [I] can, it's to stop people from deploying insecure cryptography today to prevent disasters tomorrow.
we cheer him on like he's some sort of hero
And this is where I call bullshit. Nobody does this. Even the folks in the PHP community who don't hate me outright are very critical of everything I do.
The next time the developers of these pet projects write a project it's unlikely they'll open source it since the last time they open sourced something it got shammed in every possible forum. Like this project. Sure, maybe a handful of people use it. But just a handful. With 9 stars and 6 forks it just isn't a super popular project. Sure, it has had a few pull requests but only a scant number.
"You are not your project."
sarciszewski - if you're reading this... please just stop.
I'll make you a deal: If the rest of the PHP community agrees to stop writing insecure code, I'll stop publicly disclosing vulnerabilities in it. :]