3 ms·
Eh hmm OpenSSL is infamously bad at security? There have been numerous critical bugs, and numerous criticism of its codebase, and numerous rewrites and migrati
by willvarfar 9y ago
Eh hmm OpenSSL is infamously bad at security?
There have been numerous critical bugs, and numerous criticism of its codebase, and numerous rewrites and migrations away from it!
This is why the wikipedia page for OpenSSL https://en.wikipedia.org/wiki/OpenSSL https://en.wikipedia.org/wiki/OpenSSL lists notable vulnerabilities and even a list of forks away from it!
- sillysaurus3 9y agoWell, yes. And now those bugs are fixed. Meanwhile, it's one of the most popular security libraries on the planet. The fact that everybody uses it means you're unlikely to be burned by any given vulnerability since every vulnerability impacts a huge number of people. From a security perspective, the worst situation to be in is where you're using some obscure library that has a critical flaw that nobody notices because it's obscure. At that point, a reasonably competent pentester will make your app sing and dance, and you won't know until too late. If you stick with OpenSSL, you leverage the massive investment of resources being poured into it.
- deleted 9y ago[deleted]
- omginternets 9y ago> And now those bugs are fixed "Those bugs" are bad enough that they should have never been there. Moreover they exist only because the codebase was for all intents and purposes unmaintainable. Given the above, I wouldn't be so sure there are no more bugs.