OpenSSL 1.0.2 Released

[phoronix]

Phoronix: OpenSSL 1.0.2 Released

Version 1.0.2 of the OpenSSL toolkit is now available...

http://www.phoronix.com/scan.php?page=news_item&px=OpenSSL-1.0.2-Released

[uid313]

But can OpenSSL even be trusted anymore?
Do they even pay attention to security?

Or should everyone just switch to LibreSSL now?

[nanonyme]

But can OpenSSL even be trusted anymore?
Do they even pay attention to security?

Or should everyone just switch to LibreSSL now?

Why do you think LibreSSL would be any better?

[uid313]

Why do you think LibreSSL would be any better?

Because the OpenSSL guys had tons of weird abstractions for portability and was like whatever, this is fine, look the code is portable. All that abstraction and weirdness resulted in lots of buggy and insecure code.

The LibreSSL guys are about stripping out legacy code, stripping out insecure code, removing all weird abstractions and putting the primary focus on security instead of portability.

Also the LibreSSL is developed by the OpenBSD guys who has a development history of being all about security, strictness and robustness. OpenBSD doesn't care about fun, fancy or cool stuff, they're all about security. Also, they have Theo de Raadt which is an asshole and he won't let any shit fly. He would probably torch someone if they were to submit something buggy or insecure.

[nanonyme]

Because the OpenSSL guys had tons of weird abstractions for portability and was like whatever, this is fine, look the code is portable. All that abstraction and weirdness resulted in lots of buggy and insecure code.

The LibreSSL guys are about stripping out legacy code, stripping out insecure code, removing all weird abstractions and putting the primary focus on security instead of portability.

Also the LibreSSL is developed by the OpenBSD guys who has a development history of being all about security, strictness and robustness. OpenBSD doesn't care about fun, fancy or cool stuff, they're all about security. Also, they have Theo de Raadt which is an asshole and he won't let any shit fly. He would probably torch someone if they were to submit something buggy or insecure.

Crypto programming is also notoriously complicated do I wouldn't expect anything actually secure from the project in the first five years at least

[uid313]

Crypto programming is also notoriously complicated do I wouldn't expect anything actually secure from the project in the first five years at least

You are right, programming cryptographic software is notoriously complicated and layers of additional abstraction just makes it more complicated, which is why the LibreSSL team is stripping away all the layers of abstraction and deleting tons of code, to make the code base leaner, cleaner, and smaller.

[OneTimeShot]

You are right, programming cryptographic software is notoriously complicated and layers of additional abstraction just makes it more complicated, which is why the LibreSSL team is stripping away all the layers of abstraction and deleting tons of code, to make the code base leaner, cleaner, and smaller.

The OpenBSD guys do concentrate on security, but they are *definitely* not as infallible as they like to think that they are. In fact, I think I'd prefer my crypto written by people who are generally more in touch with their own limitations.

There are a *lot* of extremely smart people researching OpenSSL security constantly, if just from the position of: "I have a big company, I'm going to throw $10m a year at this security stuff, find me some auditors to read some code". You can argue "monoculture" but if your job is on the line, you'll go with the industry standard.


FWIW - my favourite GPL vs BSD license example is the OpenSSH vulnerability that was fixed in Solaris for several years before someone binary diff'ed the files. That means that someone in the Solaris security team knew how to remote root *every* sshd in the world for years. Sun never needed to release their fix, 'coz BSD doesn't require that source code is released.