2 ms·
Fascinating that Golang reimplemented all the crypto/ssl/tls in Golang itself rather than linking to a C library. I'd probably trust the Go code (a safer langua
by andy_ppp 8y ago
Fascinating that Golang reimplemented all the crypto/ssl/tls in Golang itself rather than linking to a C library. I'd probably trust the Go code (a safer language) over OpenSSL so that's a pretty interesting use case.
- beatgammit 8y agoWhy? Surely OpenSSL has a bigger team auditing the codebase, especially recently since they've gotten so much attention for previous security failures. Also, Go's TLS library is missing some important features, like decrypting most varieties of private keys. I use Go's TLS library, but I don't think it's necessary "better" than openssl, though it's certainly more convenient.
- andy_ppp 8y agoI'm making no definitive statements just more interested that they did it. I would personally trust a new Go codebase over an old C codebase but I could definitely be wrong in this case.