6 ms·

I'm curious when/if there will be a drive to displace OpenSSL with RusTLS. I'm also unsure how many remote exploits have come down to TLS implementations, but

I'm curious when/if there will be a drive to displace OpenSSL with RusTLS. I'm also unsure how many remote exploits have come down to TLS implementations, but it seems that it's such a core part of system security, any drive towards providing a library more safe from exploit is a good goal. Also, would be interesting to see performance differences.

nextaccountic 6y ago
Perhaps an entry point could be this project https://github.com/mesalock-linux/mesalink https://github.com/mesalock-linux/mesalink that provides an openssl-compatible interface for rustls.
- rkangel 6y ago
  I don't have first hand experience of this, but I have read several things suggesting that a big part of the problem with OpenSSL is the API - that it doesn't help you to make sensible security decisions. A large part of the design of RusTLS seems to be to have sensible defaults and to not make available insecure algorithms. That said, we shouldn't let perfect be the enemy of good. An OpenSSL compatible implementation with no memory issues would definitely be good.
  - adev_ 6y ago
    Yes. One of the main problem of OpenSSL is how messy is the API itself. There is a pretty good talk about it by the libreSSL guys on that [1] [1]: https://www.youtube.com/watch?v=Wd_dyRbE4AA https://www.youtube.com/watch?v=Wd_dyRbE4AA
Thaxll 6y ago
I don't think it will be used any time soon by something major, the fact that it only supports TLS1.2 and TLS1.3 is a problem for lot of use cases. Also because it's more secure than OpenSSL is just one thing, what about bugs? OpenSSL is battle tested and widely used.
- jen20 6y ago
  The vast majority of important OpenSSL bugs _are_ security bugs, no?
yyyk 6y ago
There are more than a few OpenSSL alternatives. RusTLS is probably not in the lead, not as long as people don't introduce Rust into the base system or their build.
- sayrer 6y ago
  If the Rust displaces C/C++, that introduction could be viewed as an advantage.
  - deleted 6y ago
    [deleted]
- fluffything 6y ago
  > not as long as people don't introduce Rust into the base system If your base system uses Firefox or ripgrep, Rust is already there.
  - yyyk 6y ago
    'Already there' in that case is just 'there's a package for Rust and cargo' (but not necessarily RusTLS). That still leaves a significant integration challenge.
    - fluffything 6y ago
      Most (all?) Linux distros (Debian, Arch, Ubuntu, Fedora, ...) use their packaged Rust and cargo to build other packages like Firefox, ripgrep, etc. Which challenges are not showing up there ? There are packages, and they are usable to build other packages.
      - yyyk 6y ago
        1) "I'm using Python/Ruby/Java/C#/some other non-C/C++/Rust language, how do I even call this RusTLS thingy? OpenSSL has shims everywhere so I don't have to worry about FFI/JNI/etc." 2) "My distro does not include a RusTLS package. How do I package this? Do I have to add Rust to my build dependencies now? How do I add the Rust steps to my build system? Where was that CMake manual again..." Rust has a bright future ahead, but yet another TLS library doesn't justify the overhead and complexity of bringing Rust into a build of non-Rust code. Now, if most distros were to offer a rustls package, this could be entirely different story.

nextaccountic 6y ago

Perhaps an entry point could be this project https://github.com/mesalock-linux/mesalink https://github.com/mesalock-linux/mesalink that provides an openssl-compatible interface for rustls.

rkangel 6y ago
I don't have first hand experience of this, but I have read several things suggesting that a big part of the problem with OpenSSL is the API - that it doesn't help you to make sensible security decisions. A large part of the design of RusTLS seems to be to have sensible defaults and to not make available insecure algorithms. That said, we shouldn't let perfect be the enemy of good. An OpenSSL compatible implementation with no memory issues would definitely be good.
- adev_ 6y ago
  Yes. One of the main problem of OpenSSL is how messy is the API itself. There is a pretty good talk about it by the libreSSL guys on that [1] [1]: https://www.youtube.com/watch?v=Wd_dyRbE4AA https://www.youtube.com/watch?v=Wd_dyRbE4AA

Thaxll 6y ago

I don't think it will be used any time soon by something major, the fact that it only supports TLS1.2 and TLS1.3 is a problem for lot of use cases. Also because it's more secure than OpenSSL is just one thing, what about bugs? OpenSSL is battle tested and widely used.

jen20 6y ago
The vast majority of important OpenSSL bugs _are_ security bugs, no?

yyyk 6y ago

There are more than a few OpenSSL alternatives. RusTLS is probably not in the lead, not as long as people don't introduce Rust into the base system or their build.

sayrer 6y ago
If the Rust displaces C/C++, that introduction could be viewed as an advantage.
- deleted 6y ago
  [deleted]
fluffything 6y ago
> not as long as people don't introduce Rust into the base system If your base system uses Firefox or ripgrep, Rust is already there.
- yyyk 6y ago
  'Already there' in that case is just 'there's a package for Rust and cargo' (but not necessarily RusTLS). That still leaves a significant integration challenge.
  - fluffything 6y ago
    Most (all?) Linux distros (Debian, Arch, Ubuntu, Fedora, ...) use their packaged Rust and cargo to build other packages like Firefox, ripgrep, etc. Which challenges are not showing up there ? There are packages, and they are usable to build other packages.
    - yyyk 6y ago
      1) "I'm using Python/Ruby/Java/C#/some other non-C/C++/Rust language, how do I even call this RusTLS thingy? OpenSSL has shims everywhere so I don't have to worry about FFI/JNI/etc." 2) "My distro does not include a RusTLS package. How do I package this? Do I have to add Rust to my build dependencies now? How do I add the Rust steps to my build system? Where was that CMake manual again..." Rust has a bright future ahead, but yet another TLS library doesn't justify the overhead and complexity of bringing Rust into a build of non-Rust code. Now, if most distros were to offer a rustls package, this could be entirely different story.