4 ms·
Rust 1.43.1
- Communitivity 6y agoIncluding a nice update: OpenSSL updated to 1.1.1g. Full list: * Updated openssl-src to 1.1.1g for CVE-2020-1967. * Fixed the stabilization of AVX-512 features. * Fixed cargo package --list not working with unpublished dependencies.
- colejohnson66 6y agoIs there a reason people still use OpenSSL? Aren’t there better forks?
- CameronNemo 6y agoLibreSSL is the only fork. Only openbsd and Void Linux use it. Void is considering abandoning it due to: * software compatibility. Notably Qt does not support LibreSSL and Python hashlib disables a few important crypto algorithms with libressl. Other various packages require some patching, which distro maintainers are uncomfortable doing for unfamiliar and security critical code. * performance. The portable version of libressl does not generate assembly used to accelerate important crypto algorithms on several CPU architectures such as ppc64el and aarch64. * slowness to implement tls 1.3. Which is a funny one since tls 1.3 is what caused openssl's most recent vulnerability. Other notable tls implementations include rustls, gnutls, bearssl, and boringssl.
- Communitivity 6y agoAs I understand it, RustTLS will be replacing OpenSSL in somewhat near future. I don't know what the time frame is though. Not sure about RustTLS current support for DTLS or forward secrecy [2]. And of course the older, effectively insecure, alg. might not be supported. The performance is not a barrier to replacement, but they want to make sure it's at least as secure [1]. [1] https://www.zdnet.com/article/a-rust-based-tls-library-outperformed-openssl-in-almost-every-category/ https://www.zdnet.com/article/a-rust-based-tls-library-outpe... [2] https://www.reddit.com/r/rust/comments/7oxc71/tls_bulk_performance_rustls_versus_openssl/ https://www.reddit.com/r/rust/comments/7oxc71/tls_bulk_perfo...