LibreSSL 2.3 Released: Completely Nukes SSLv3 Support

[phoronix]

Phoronix: LibreSSL 2.3 Released: Completely Nukes SSLv3 Support

The OpenBSD crew has released version 2.3.0 of their forked OpenSSL project, the widely-known LibreSSL...

http://www.phoronix.com/scan.php?page=news_item&px=LibreSSL-2.3-Released

[willmore]

Woah, someone was using the toy crypto hash SHA-0 in a real system? That was proven insecure in 2004!

The heck with backwards compatability, you might as well not be using crypto if that's all you can do.

[AJenbo]

Woah, someone was using the toy crypto hash SHA-0 in a real system? That was proven insecure in 2004!

The heck with backwards compatability, you might as well not be using crypto if that's all you can do.

If it is all the server can do and it enforces SSL you now can't access it.

[cb88]

If it is all the server can do and it enforces SSL you now can't access it.

Better to break loudly than quietly...

[AJenbo]

Better to break loudly than quietly...

I would prefer rejecting connection by default, but with an option to force it. There are some really outdated corporate servers out there.

[gigaplex]

I would prefer rejecting connection by default, but with an option to force it. There are some really outdated corporate servers out there.

Part of me agrees with you, and part of me would gladly shame the corporate servers that don't bother with security updates.

[boxie]

The great thing about LibreSSL is that is is new, has less shit code in it (because they got rid of a lot of it) and is now probably a lot more secure due to the improved focus on OpenSSL/BoringSSL/LibreSSL

Now to keep those servers of yours up to date sysadmins, you have no excuses!

[carewolf]

So in other words, no more SSL support?

Shouldn't it be LibreTLS then?