4 ms·
One thing they don't mention is that it's built against libcrypto. They make it seem like this replaces OpenSSL, but it really only replaces half of it (libssl
by luhn 10y ago
One thing they don't mention is that it's built against libcrypto. They make it seem like this replaces OpenSSL, but it really only replaces half of it (libssl).
Still an exciting project, especially since the API looks dirt simple to use, but it doesn't live up to the awe I felt when I, at first glance, thought they had given a big middle finger and left OpenSSL behind entirely.
- cperciva 10y agoIt only replaced half of OpenSSL, but it replaces the half which has been responsible for almost all of the worst vulnerabilities.
- jlouis 10y agoErlang has the `ssl` application which is built on top of `crypto`. The latter uses OpenSSLs libcrypto, but ssl is written in Erlang. Historically, whenever there is an OpenSSL vulnerability, it doesn't affect the ssl application, and so Erlang isn't vulnerable. In short, corroboration.
- zvrba 10y agoNot the whole half either it seems. They use openssl for ASN.1 / certificate parsing too (opensl/x509.h) here: https://github.com/awslabs/s2n/blob/b9e3636db98e4ba765fb21932c94d1bd3358620f/crypto/s2n_rsa.c https://github.com/awslabs/s2n/blob/b9e3636db98e4ba765fb2193...
- StreamBright 10y agoI don't think that you have to replace everything, but only: - what you actually use - what is broken I think s2n does exactly that.