3 ms·
Not looking for an argument, just trying to incorporate some more perspective.
by bluejekyll 6y ago
Not looking for an argument, just trying to incorporate some more perspective.
- tptacek 6y agoCryptography might be the one single place where I'd look askance at replacing memory-unsafe code with memory-safe de novo implementations. Fortunately, you mostly don't have that dilemma; there are good options in Go and Rust. But a lot of energy goes into auditing the cryptography code in OpenSSL. Certainly, you might reasonably pick OpenSSL over some random high-level implementation nobody is auditing. That's why I think it's worth calling this out. Odds are, it's some dumb memory corruption thing. But we don't know yet. OpenSSL sev:hi tends to mean "dubiously exploitable crasher", and good crypto bugs in OpenSSL tend to be sev:med.