4 ms·

Has BoringSSL been widely adopted? The OpenBSD people forked to LibreSSL which looked very promising (coming from people who make their main obsession about sec

Has BoringSSL been widely adopted? The OpenBSD people forked to LibreSSL which looked very promising (coming from people who make their main obsession about security) but seemed to quickly burn out at least on Linux hosts

joecool1029 4y ago
>Has BoringSSL been widely adopted? It was never meant to be, it's only providing a subset of the features openssl has. >The OpenBSD people forked to LibreSSL which looked very promising (coming from people who make their main obsession about security) but seemed to quickly burn out at least on Linux hosts In the beginning yes it was, they moved fast on cleaning up OpenSSL codebase. The problems began because it's not explicitly a goal to maintain OpenSSL compatibility, so distros had a huge maintenance burden patching things to work with it. Eventually the distros that were maintaining it (Void and Gentoo?) got tired of it and decided OpenSSL had gotten through the worst of its problems. Then OpenSSL 3 dropped, once again making it annoying to patch for and introducing issues like this CVE. I think Alpine was discussing looking at LibreSSL again but I think that ship has sailed.
- spijdar 4y ago
  I'm pretty sure even OpenBSD packages OpenSSL in ports for third party software, since so many pieces of software basically require it and do not work with LibreSSL anymore. I suppose a Linux distro could hypothetically take the same approach and use a mixture of both, but realistically most people don't want to bother with that. Personally I'd love a Linux distro with a BSD-style base system and extra packages kept separately, but the closest to that would be ... Slackware with pkgsrc or something I guess.
  - anjbe 4y ago
    > I'm pretty sure even OpenBSD packages OpenSSL in ports for third party software, since so many pieces of software basically require it and do not work with LibreSSL anymore. Theo Buehler talked about the current status of LibreSSL compatibility at EuroBSDcon last week. To take some quotes: “> 2000 OpenBSD ports link against libcrypto or libssl” [i.e., LibreSSL] “< 100 of these need patches (< 5%)” “6 ports link against OpenSSL” https://www.youtube.com/watch?v=bF1d_aCSzS0 https://www.youtube.com/watch?v=bF1d_aCSzS0

joecool1029 4y ago

>Has BoringSSL been widely adopted? It was never meant to be, it's only providing a subset of the features openssl has. >The OpenBSD people forked to LibreSSL which looked very promising (coming from people who make their main obsession about security) but seemed to quickly burn out at least on Linux hosts In the beginning yes it was, they moved fast on cleaning up OpenSSL codebase. The problems began because it's not explicitly a goal to maintain OpenSSL compatibility, so distros had a huge maintenance burden patching things to work with it. Eventually the distros that were maintaining it (Void and Gentoo?) got tired of it and decided OpenSSL had gotten through the worst of its problems. Then OpenSSL 3 dropped, once again making it annoying to patch for and introducing issues like this CVE. I think Alpine was discussing looking at LibreSSL again but I think that ship has sailed.

spijdar 4y ago
I'm pretty sure even OpenBSD packages OpenSSL in ports for third party software, since so many pieces of software basically require it and do not work with LibreSSL anymore. I suppose a Linux distro could hypothetically take the same approach and use a mixture of both, but realistically most people don't want to bother with that. Personally I'd love a Linux distro with a BSD-style base system and extra packages kept separately, but the closest to that would be ... Slackware with pkgsrc or something I guess.
- anjbe 4y ago
  > I'm pretty sure even OpenBSD packages OpenSSL in ports for third party software, since so many pieces of software basically require it and do not work with LibreSSL anymore. Theo Buehler talked about the current status of LibreSSL compatibility at EuroBSDcon last week. To take some quotes: “> 2000 OpenBSD ports link against libcrypto or libssl” [i.e., LibreSSL] “< 100 of these need patches (< 5%)” “6 ports link against OpenSSL” https://www.youtube.com/watch?v=bF1d_aCSzS0 https://www.youtube.com/watch?v=bF1d_aCSzS0