3 ms·
LibreSSL has long outlived its purpose. It was started in a situation where OpenSSL had bad security practices, a chaotic coding style and plenty of obsolete g
by hannob 6y ago
LibreSSL has long outlived its purpose.
It was started in a situation where OpenSSL had bad security practices, a chaotic coding style and plenty of obsolete garbage. None of that is true any more.
If you look at the vuln posted here it's a sign how mature OpenSSL became: They rate it HIGH, but it's a rather insignificant vuln that will barely matter in practice.
- nwmcsween 6y agoThe openssl api is still a painful, compare it with libtls which is much nicer. if I were to use something today I would probably use https://github.com/michaelforney/libtls-bearssl https://github.com/michaelforney/libtls-bearssl which is a wrapper around bearssl that exposes a libtls api.
- agwa 6y agoYou should only use BearSSL when you control the server and the certificate that it uses, since BearSSL's certificate validation implementation is intentionally limited so that it can be more efficient on embedded devices at the cost of being unable to correctly handle all publicly-trusted certificates. See https://medium.com/@sleevi_/path-building-vs-path-verifying-implementation-showdown-39a9272b2820 https://medium.com/@sleevi_/path-building-vs-path-verifying-...