> OpenSSL's crypto code isn't all that bad as long as you're not worried about side channel attacks. I consider "horrible API that makes it basically impossibl

> OpenSSL's crypto code isn't all that bad as long as you're not worried about side channel attacks. I consider "horrible API that makes it basically impossible to write safe code" to be a security vulnerability. Not to mention that OpenSSL's example code actually had security vulnerabilities (they didn't check the return value from one of the IV routines, whish means that you could end up using a shorter key than you expected).