Is anyone interested in taking over SJCL

[Mike Hamburg]

Hello all,

I've been nominally the maintainer of SJCL for a couple years now, but I haven't done any real work on it in a few months. I'm not sure I have the time and energy to keep up with it. But perhaps more importantly, I haven't actually used SJCL myself, and I don't even do web development. So I don't know what's important in a web crypto library, what systems and crypto packages I need to interoperate with, or any of that I also don't keep up with web dev news, so I don't know much about the finer points of new crypto APIs, web workers or other things which have become popular since Emily, Dan and I wrote SJCL.

So perhaps it's time to pass the mantle to someone else. Is anyone interested in maintaining SJCL? Assuming you aren't Stanford affiliated, it might be a good idea to rename or at least backronymize the project, but I'd be happy to pass down leadership and mailing list control.

Cheers,
-- Mike

[Giulio Cesare Solaroli]

Hello Mike,

my name is Giulio Cesare Solaroli [1] and I'm the main developer of Clipperz [2], an online digital vault and password manager.

As no one has been stepping forward yet, I submit my name to be considered as a candidate for the position of maintainer of the SJCL code repository.

I have been coding crypto algorithms with javascript since 2005 when, along with Marco Barulli, I started the Clipperz project. In 2007 we released a first version of the online password manager along with our own Javascript Crypto Library, that currently includes AES, SHA2, Fortuna, and SRP.

All our code is available here: https://github.com/clipperz/password-manager/

We also have a separate repository for just the Crypto library [3], but we haven't merged there all the latest improvements.

At that time I had no choice but write from scratch all crypto algorithms required by our security architecture [4] as all Javascript implementations where only suitable for running trivial examples.

As we are not affected by the NIH syndrome, we have been long thinking about replacing our own library with SJCL; we haven't pull the trigger yet, as we would rely on the async behavior of our library to process large amount of data without locking the browser.

Having an active duty to maintain SJCL codebase would definitely put some more pressure on myself to upgrade Clipperz to use SJCL itself. And having SJCL integrated into an actual service may provide some of the feedback to improve its suitability for inclusion in full featured applications.

I am not affiliated with Stanford in any way. My only interaction with Stanford had been the Crypto I Coursera course I attended a few months ago.

Sincerely,

Giulio Cesare Solaroli

[1]: http://www.linkedin.com/in/gcsolaroli

[2]: https://www.clipperz.com

[3]: https://github.com/clipperz/javascript-crypto-library

[4]: https://www.clipperz.com/security_privacy

[dark.cton]

Hi,

I am Nils Kenneweg and I develop whispeer [1] an encrypted social network (not published yet).

I would also be interested in taking over sjcl. I know a lot about web development and nodejs. I also know about crypto but not nearly as much as you guys do.
I already implemented workers for my own use of sjcl in seperated files and would be interested in adding them. Also I would be interested to add sjcl to npm and to make it compatible with requirejs.

There is no affiliation with Stanford either.

Greets,
Nils

[1] http://www.whispeer.com

[Michael Hamburg]

Hi all,

OK, I've been totally negligent on this and I'm sorry.

Nils, I think you're probably the best one to take over SJCL, because you have crypto experience, and you're using the project and also you've contributed to it and written patches.

What's the best way to hand over the project?  Point the GH repository at your fork of it, maybe?

Cheers,

-- Mike

--
You received this message because you are subscribed to the Google Groups "SJCL discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to sjcl-discuss...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[dark.cton]

I think the typical way would be to give me push access to your repository.
This way you keep your access and you can still accept PRs anytime you want but I can also do that.

Cheers and thanks,
Nils

[Michael Hamburg]

Ah, that makes sense.  What's your login?

-- Mike

[dark.cton]

My Login is Nilos.

[Michael Hamburg]

Added!  Have fun, and let me know if there are any other issues to take care of.

Thanks,

-- Mike