4 ms·
Back around the time of Heartbleed, there was a bunch of childish[1,2] attention given to OpenSSL's warts, mostly centered around the OpenBSD fork called LibreS
by coldpie 6y ago
Back around the time of Heartbleed, there was a bunch of childish[1,2] attention given to OpenSSL's warts, mostly centered around the OpenBSD fork called LibreSSL, which stripped out a lot bad, old code and code for non-Unix platforms.
Unsurprisingly, the childish attention faded into nothing because it's much harder to write good code than it is to tear apart someone else's. But the smear on the OpenSSL volunteers' reputation remains, as seen by GP's comment.
[1] https://opensslrampage.org/page/49 https://opensslrampage.org/page/49
[2] https://opensslrampage.org/post/83555615721/the-future-or-lack-thereof-of-libressls-fips https://opensslrampage.org/post/83555615721/the-future-or-la...
- tialaramex 6y agoI have previously characterized OpenSSL as "Stamp collector cryptography". Here's an implementation of IDEA. Should you use IDEA? No. So why is this even here? Compare the Go crypto reaction when somebody wants to add ECB mode: https://github.com/golang/go/issues/5597 https://github.com/golang/go/issues/5597 OpenSSL is better now than it was then, it might even be the least worst option for a lot of people in low-level languages who want to spin up a TLS client or server. But that is deliberately faint praise.