4 ms·

OpenSSL's security is hard to beat. Constant code audits plus massive usage equals pretty secure software. The vulns in the blog post are denial of service bug

OpenSSL's security is hard to beat. Constant code audits plus massive usage equals pretty secure software. The vulns in the blog post are denial of service bugs: memory exhaustion and an assertion crash. While these good to fix, they have little impact on security. You're much more likely to introduce hundreds of bugs attempting to port it to Rust than just maintaining OpenSSL's C code. Of course, you could try porting the codebase line-by-line to Rust. It'd certainly be an interesting challenge. But once you're done, you'll need to convince everybody to abandon a hardened, audited codebase for an untested, unaudited codebase written in an unfamiliar language, with a nascent open source ecosystem (mailing lists, CVE processes, etc).

willvarfar 9y ago
Eh hmm OpenSSL is infamously bad at security? There have been numerous critical bugs, and numerous criticism of its codebase, and numerous rewrites and migrations away from it! This is why the wikipedia page for OpenSSL https://en.wikipedia.org/wiki/OpenSSL https://en.wikipedia.org/wiki/OpenSSL lists notable vulnerabilities and even a list of forks away from it!
- sillysaurus3 9y ago
  Well, yes. And now those bugs are fixed. Meanwhile, it's one of the most popular security libraries on the planet. The fact that everybody uses it means you're unlikely to be burned by any given vulnerability since every vulnerability impacts a huge number of people. From a security perspective, the worst situation to be in is where you're using some obscure library that has a critical flaw that nobody notices because it's obscure. At that point, a reasonably competent pentester will make your app sing and dance, and you won't know until too late. If you stick with OpenSSL, you leverage the massive investment of resources being poured into it.
  - deleted 9y ago
    [deleted]
  - omginternets 9y ago
    > And now those bugs are fixed "Those bugs" are bad enough that they should have never been there. Moreover they exist only because the codebase was for all intents and purposes unmaintainable. Given the above, I wouldn't be so sure there are no more bugs.
steveklabnik 9y ago
> It'd certainly be an interesting challenge. See https://crates.io/crates/ring https://crates.io/crates/ring, which is a port of BoringSSL -> Rust + asm. It still has a lot of C in it, but it's slowly melting away.

willvarfar 9y ago

Eh hmm OpenSSL is infamously bad at security? There have been numerous critical bugs, and numerous criticism of its codebase, and numerous rewrites and migrations away from it! This is why the wikipedia page for OpenSSL https://en.wikipedia.org/wiki/OpenSSL https://en.wikipedia.org/wiki/OpenSSL lists notable vulnerabilities and even a list of forks away from it!

sillysaurus3 9y ago
Well, yes. And now those bugs are fixed. Meanwhile, it's one of the most popular security libraries on the planet. The fact that everybody uses it means you're unlikely to be burned by any given vulnerability since every vulnerability impacts a huge number of people. From a security perspective, the worst situation to be in is where you're using some obscure library that has a critical flaw that nobody notices because it's obscure. At that point, a reasonably competent pentester will make your app sing and dance, and you won't know until too late. If you stick with OpenSSL, you leverage the massive investment of resources being poured into it.
- deleted 9y ago
  [deleted]
- omginternets 9y ago
  > And now those bugs are fixed "Those bugs" are bad enough that they should have never been there. Moreover they exist only because the codebase was for all intents and purposes unmaintainable. Given the above, I wouldn't be so sure there are no more bugs.

steveklabnik 9y ago

> It'd certainly be an interesting challenge. See https://crates.io/crates/ring https://crates.io/crates/ring, which is a port of BoringSSL -> Rust + asm. It still has a lot of C in it, but it's slowly melting away.