I've been replacing my OpenSSL installations with LibreSSL [1] where possible. I manage a lot of machines and it's just way nicer to not have to do patching whe

I've been replacing my OpenSSL installations with LibreSSL [1] where possible. I manage a lot of machines and it's just way nicer to not have to do patching whenever these things come up, with the peace of mind that there's not some little-used internal script or feature which ends in privilege escalation or whatever when it's supposed to be a SECURITY product first and foremost. Besides this bug I subscribe to Debian's security announcements list and CVE-2022-2068 was something that came up yesterday for patching [2] I've heard some people moan that "it's not exactly a drop-in replacement" but I've yet to find in my own work a case where this is true. The only off-putting thing to me is the fact that these OpenBSD projects love giving puffy lips for some reason. [1] https://www.libressl.org/ https://www.libressl.org/ [2] https://security-tracker.debian.org/tracker/CVE-2022-2068 https://security-tracker.debian.org/tracker/CVE-2022-2068