3 ms·
OK, now we can go ahead with FreeBSD 11.0-RELEASE. In my time as security officer, it was a rare and surprising occurrence when we didn't need to hold an upcom
by cperciva 10y ago
OK, now we can go ahead with FreeBSD 11.0-RELEASE.
In my time as security officer, it was a rare and surprising occurrence when we didn't need to hold an upcoming release due to a pending OpenSSL advisory. It got to the point of the release engineer saying "I think we're ready to start the release builds tomorrow, any news from OpenSSL" and me replying "nothing yet, but I'm sure it will come" -- their timing was absolutely impeccable.
- astrodust 10y agoLibreSSL isn't up to speed yet? http://www.libressl.org http://www.libressl.org
- cperciva 10y agoIt certainly wasn't when I was Security Officer -- it didn't exist yet. I believe some people are working on bringing libressl into the FreeBSD base system, but there are some challenges; for example, FreeBSD supports stable branches for 5 years, while libressl follows OpenBSD's "break everything once a year" model.
- tedunangst 10y agoCould be biased, but I think we're more careful about bundling breaking changes in security patches though.
- cperciva 10y agoIf you try at all, then you're trying harder than OpenSSL. But that doesn't necessarily help if there has been so much code churn over the past 5 years that we can't figure out how or if we should apply the security patch.