[Cryptography] how reliably do audits spot backdoors?

[CodesInChaos]

On Sun, Dec 29, 2013 at 10:07 PM, ianG <iang at iang.org> wrote:
> Does C# have this problem?

C# has the using statement, which is a bit of syntax over try-finally,
probably similar to try-with-resources in java. Typically looks like

using(var file = File.Open(path))
{
  // do something with file
}

> And, what actually happens if the close() isn't called?

For C# it works like this, for java it's probably similar: For
disposable classes that implement both `Dispose`/`Close` and a
finalizer, when the GC attempts to collect the object it runs the
finalizer which releases the resources. But there are some issues with
that:

* The GC can collect the object much later. So if your resource is
expensive, that can be unacceptable. For filestreams it might keep
files locked for an indefinite amount of time. This is the main reason
why manual disposing is recommended.
* there are some tricky cases regarding multi-threading and locking
* finalization happens in undefined order. This can be tricky if
resources depend on each other.