3 ms·

I always feel a bit nervous when software uses GnuTLS. Far less usage and far fewer eyeballs on the source code mean this probably isn't the only serious vulner

I always feel a bit nervous when software uses GnuTLS. Far less usage and far fewer eyeballs on the source code mean this probably isn't the only serious vulnerability hiding in plain sight. On the other hand, having multiple implementations of TLS seems like a good thing for finding bugs (or areas of risk) in the standards, and for ensuring interoperability.

MaxBarraclough 6y ago
Too-few-eyeballs is a sad reality for much security-sensitive code, isn't it? Serious security audits aren't cheap.
bjoli 6y ago
I am not commenting on being nervous or not, but the reason I use gnutls is the documentation. Getting started with gnutls is so much easier than the competition that I just didn't bother with anything else for my hobby projects. I am happy that they are getting audits. I don't know whether I would use it if someone paid me to write something secure, but I hope that the audits will result in a future where it would be a good option.
dijit 6y ago
On the flip side: I’m really not happy with the state of OpenSSL- it hasn’t improved markedly since libreSSL began either. Eyeballs mean nothing when the code is a dense ball of mud.
- psanford 6y ago
  > it hasn’t improved markedly since libreSSL began either That's not really true. Pre-heartbleed there were very few contributors to OpenSSL. After heartbleed the management of the project was overhauled. There was also a large inflow of funding (Linux Foundation’s Core Infrastructure Initiative) and new contributors.[0] In 2018 the OpenSSL team was one of the winners of the Levchin prize "for dramatic improvements to the code quality of OpenSSL". [0]: https://www.securityweek.com/evolution-openssl-security-after-heartbleed https://www.securityweek.com/evolution-openssl-security-afte...
- bschwindHN 6y ago
  rustls recently received a third party security audit and seemed to do quite well, if you're looking for an alternative: http://jbp.io/2020/06/14/rustls-audit.html http://jbp.io/2020/06/14/rustls-audit.html
- fanf2 6y ago
  I recently saw this paper which describes several ways in which OpenSSL is better than it was: "The impact of Heartbleed on openssl's development practices" https://arxiv.org/abs/2005.14242 https://arxiv.org/abs/2005.14242

MaxBarraclough 6y ago

Too-few-eyeballs is a sad reality for much security-sensitive code, isn't it? Serious security audits aren't cheap.

bjoli 6y ago

I am not commenting on being nervous or not, but the reason I use gnutls is the documentation. Getting started with gnutls is so much easier than the competition that I just didn't bother with anything else for my hobby projects. I am happy that they are getting audits. I don't know whether I would use it if someone paid me to write something secure, but I hope that the audits will result in a future where it would be a good option.

dijit 6y ago

On the flip side: I’m really not happy with the state of OpenSSL- it hasn’t improved markedly since libreSSL began either. Eyeballs mean nothing when the code is a dense ball of mud.

psanford 6y ago
> it hasn’t improved markedly since libreSSL began either That's not really true. Pre-heartbleed there were very few contributors to OpenSSL. After heartbleed the management of the project was overhauled. There was also a large inflow of funding (Linux Foundation’s Core Infrastructure Initiative) and new contributors.[0] In 2018 the OpenSSL team was one of the winners of the Levchin prize "for dramatic improvements to the code quality of OpenSSL". [0]: https://www.securityweek.com/evolution-openssl-security-after-heartbleed https://www.securityweek.com/evolution-openssl-security-afte...
bschwindHN 6y ago
rustls recently received a third party security audit and seemed to do quite well, if you're looking for an alternative: http://jbp.io/2020/06/14/rustls-audit.html http://jbp.io/2020/06/14/rustls-audit.html
fanf2 6y ago
I recently saw this paper which describes several ways in which OpenSSL is better than it was: "The impact of Heartbleed on openssl's development practices" https://arxiv.org/abs/2005.14242 https://arxiv.org/abs/2005.14242