3 ms·
It only replaced half of OpenSSL, but it replaces the half which has been responsible for almost all of the worst vulnerabilities.
by cperciva 10y ago
It only replaced half of OpenSSL, but it replaces the half which has been responsible for almost all of the worst vulnerabilities.
- jlouis 10y agoErlang has the `ssl` application which is built on top of `crypto`. The latter uses OpenSSLs libcrypto, but ssl is written in Erlang. Historically, whenever there is an OpenSSL vulnerability, it doesn't affect the ssl application, and so Erlang isn't vulnerable. In short, corroboration.
- zvrba 10y agoNot the whole half either it seems. They use openssl for ASN.1 / certificate parsing too (opensl/x509.h) here: https://github.com/awslabs/s2n/blob/b9e3636db98e4ba765fb21932c94d1bd3358620f/crypto/s2n_rsa.c https://github.com/awslabs/s2n/blob/b9e3636db98e4ba765fb2193...