4 ms·

I might as well switch back to OpenSSL on Gentoo reading this. I use LibreSSL and have been from early days when it was quite a bit better and there was no rea

I might as well switch back to OpenSSL on Gentoo reading this. I use LibreSSL and have been from early days when it was quite a bit better and there was no real reason not to but I read more and more that OpenSSL has fixed most of the issues that prompted the start of Libre and that the compatibility issues are causing some pains. My use of Libre on Gentoo is completely seamless and simply required a USE flag change but if support end for it then it won't be a problem I suppose. I agree with the choice argument, however; Gentoo supports configurations that are more esoteric and more of a hassle than this, some of which I do actually need, but as far as a TSL library goes, I personally do not notice any real difference between the two and it's a background library.

yjftsjthsd-h 6y ago
> I agree with the choice argument, however, Gentoo supports things that are more esoteric and more of a hassle than this, some of which I do actually need, but as far as a TSL library goes, I personally do not notice any real difference between the two and it's a background library. Actually, that raises an interesting point: Are there other libraries that could be used? That is, if the goal is diverse implementations, openssl and a fork of openssl are too little of a difference. There's bearssl which looks even more different (although then there's the question of being API-incompatible), and boringssl (which is... another openssl fork...). Or is this going to end up like browser engines where if you want to be compatible enough to swap in you have to implement 30 years of features which is to say that nobody will ever do it?
- rapsey 6y ago
  Rustls, a company even developed an OpenSSL compatible API for it.
  - papaf 6y ago
    Just to add to your point. Rustls is excellent, but has a Rust API and does not do I/O. Its a great alternative for Rust applications but, for C/C++ applications, the API wrappers are needed [1][2] [1] https://github.com/stepancheg/rust-tls-api https://github.com/stepancheg/rust-tls-api [2] https://mesalink.io/ https://mesalink.io/
  - MaxBarraclough 6y ago
    I realise this is a fuzzy question, but is rustls considered a production-strength TLS implementation, or just a curiosity? A TLS implementation in the safe subset of Rust, with the guarantees that brings, sounds like a great thing. If it can be used as a drop-in replacement for OpenSSL, even better.
    - rapsey 6y ago
      Yes and it also has had a security audit.
    - papaf 6y ago
      Its being used in production [1]. I am also using it in Internet connected servers without any problems. You could argue that it is not mature, but its much more than a curiosity. [1] https://www.reddit.com/r/rust/comments/b9gd10/mesalink_10_openssl_c_apis_done_with_rust_10m/ https://www.reddit.com/r/rust/comments/b9gd10/mesalink_10_op...
- Elv13 6y ago
  Gentoo has USE flags to use gnutls+compat_layer rather than openssl. This is/was possible because they was a strong-ish push a decade ago by GNU aligned projects to force this down the throat of each package because OpenSSL had a problematic license exception deemed incompatible with GPL by some. The heathbleed fiasco helped this push. Then with LibreSSL, diversity survived a bit longer. However, now that OpenSSL work to solve "all the problems" is starting to get into releases distribution actually can use (OpenSSL 1.1.1*) and will eventually be able use after extensive effort (OpenSSL 3), I don't think this support for TLS diversity will survive very long. The technical and licensing being solved, only the philosophical/political ones remain, which isn't enough for the large effort required to support multiple TLS libs.
- sanxiyn 6y ago
  Amazon has its own TLS implementation: https://github.com/awslabs/s2n https://github.com/awslabs/s2n
- magicalhippo 6y ago
  I used Mbed TLS[1], formerly PolarSSL, for a project. Was easy to use and compiled fairly effortlessly on Windows, so I didn't look much further. [1]: https://developer.trustedfirmware.org/w/mbed-tls/ https://developer.trustedfirmware.org/w/mbed-tls/

yjftsjthsd-h 6y ago

> I agree with the choice argument, however, Gentoo supports things that are more esoteric and more of a hassle than this, some of which I do actually need, but as far as a TSL library goes, I personally do not notice any real difference between the two and it's a background library. Actually, that raises an interesting point: Are there other libraries that could be used? That is, if the goal is diverse implementations, openssl and a fork of openssl are too little of a difference. There's bearssl which looks even more different (although then there's the question of being API-incompatible), and boringssl (which is... another openssl fork...). Or is this going to end up like browser engines where if you want to be compatible enough to swap in you have to implement 30 years of features which is to say that nobody will ever do it?

rapsey 6y ago
Rustls, a company even developed an OpenSSL compatible API for it.
- papaf 6y ago
  Just to add to your point. Rustls is excellent, but has a Rust API and does not do I/O. Its a great alternative for Rust applications but, for C/C++ applications, the API wrappers are needed [1][2] [1] https://github.com/stepancheg/rust-tls-api https://github.com/stepancheg/rust-tls-api [2] https://mesalink.io/ https://mesalink.io/
- MaxBarraclough 6y ago
  I realise this is a fuzzy question, but is rustls considered a production-strength TLS implementation, or just a curiosity? A TLS implementation in the safe subset of Rust, with the guarantees that brings, sounds like a great thing. If it can be used as a drop-in replacement for OpenSSL, even better.
  - rapsey 6y ago
    Yes and it also has had a security audit.
  - papaf 6y ago
    Its being used in production [1]. I am also using it in Internet connected servers without any problems. You could argue that it is not mature, but its much more than a curiosity. [1] https://www.reddit.com/r/rust/comments/b9gd10/mesalink_10_openssl_c_apis_done_with_rust_10m/ https://www.reddit.com/r/rust/comments/b9gd10/mesalink_10_op...
Elv13 6y ago
Gentoo has USE flags to use gnutls+compat_layer rather than openssl. This is/was possible because they was a strong-ish push a decade ago by GNU aligned projects to force this down the throat of each package because OpenSSL had a problematic license exception deemed incompatible with GPL by some. The heathbleed fiasco helped this push. Then with LibreSSL, diversity survived a bit longer. However, now that OpenSSL work to solve "all the problems" is starting to get into releases distribution actually can use (OpenSSL 1.1.1*) and will eventually be able use after extensive effort (OpenSSL 3), I don't think this support for TLS diversity will survive very long. The technical and licensing being solved, only the philosophical/political ones remain, which isn't enough for the large effort required to support multiple TLS libs.
sanxiyn 6y ago
Amazon has its own TLS implementation: https://github.com/awslabs/s2n https://github.com/awslabs/s2n
magicalhippo 6y ago
I used Mbed TLS[1], formerly PolarSSL, for a project. Was easy to use and compiled fairly effortlessly on Windows, so I didn't look much further. [1]: https://developer.trustedfirmware.org/w/mbed-tls/ https://developer.trustedfirmware.org/w/mbed-tls/