Microsoft Maintains Go Fork for FIPS 140-2 Support

If this doesn't also _add_ some "accidental" backdoor, I'd be surprised.

Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced.

Don't use this repo. Very interesting TIL about golang at Microsoft. Thanks for sharing.

It's built from source. You can just diff it. Of course, you don't have to, because they provide the patches.

Don't use any FIPS branch of any platform, because FIPS is terrible. But the argument presented here seems facile.

>Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced.

They are a lot better than they used to be. They went through a trial by fire in the 90s and early 00s and came through for the better.

It's worth noting that classified computer systems in the military-industrial complex run Windows, and not Linux, nor do they run the security cosplay that is OpenBSD.

Jonathan Blow ranted about the susceptibility of open source to supply chain attacks from state actors, which discussion recently became germane again in light of the xz backdoor.

What he didn't discuss was how vulnerable proprietary vendors (including, but by no means limited to, Microsoft) are to "rubber-hose vulnerability injection".

Anyway, it's good to see Microsoft actually participating in the open source process.

FIPS is terrible, except that sometimes if you shout "FIPS 140 compliance for US gov contracts" enough into the corporate hierarchy you eventually get the budget to implement any security whatsoever, even though it's just FIPS.

If you're not trying to get US government contracts that require it, don't bother with FIPS. It mandates older algorithms; they're mostly secure enough but not as performant and there are a lot more footguns. FIPS 140-3 fixed a few, but not all.

There's a difference between FIPS approved algorithms, which are actually pretty broad and well-selected these days, and FIPS validated implementations, which are at best a PITA and often actively harmful. Very rarely do you actually need a FIPS-validated implementation.