We at LeastAuthority have written a blog post about the Cryptocat audit from our perspective: https://leastauthority.com/blog/