3 ms·
The LibreSSL fork tries to do exactly that: Although they still provide the original OpenSSL API for existing applications, they add a much simpler and hassle-f
by vog 9y ago
The LibreSSL fork tries to do exactly that: Although they still provide the original OpenSSL API for existing applications, they add a much simpler and hassle-free API on top of it ("libtls" [1]), with the goal that all applications will be switched part-by-part to the new interface.
[1] https://www.openbsd.org/papers/libtls-fsec-2015/ https://www.openbsd.org/papers/libtls-fsec-2015/
- baby 9y agoDoes it make sense to stop recommending OpenSSL and start recommending LibreSSL now?
- wbl 9y agoYes. Or tell people to use mebd or s2n or the other one that doesn't allocate. Don't use OpenSSL.
- baby 9y agoBearSSL
- vog 9y agoYes, if only because LibreSSL is still a working drop-in replacement (which is nice to have as a first step of adoption), and because in LibreSSL they threw away lots of legacy code. This throwing away of legacy code should not be underestimated. There were quite a lot of recent OpenSSL security issues from which LibreSSL had just a fraction, simply because the vulnerable code is no longer present at all in LibreSSL.