4 ms·

> A reminder that LibreSSL exists and has a fraction of the problems OpenSSL does. Ahem. Cough. Maybe I should leave this little link here for a patch publish

• lucb1e 4y ago
  Going by the patch, that looks like the same bug as OpenSSL fixed. That's seven of the eight bugs not applicable. But this is just one round of patches, I have no further information or experience on/with LibreSSL or how the features compare. Just saying that one patch release does not mean either secure or insecure software.
• brynet 4y ago
  Commit message: https://marc.info/?l=openbsd-cvs&m=167578479210650&w=2 https://marc.info/?l=openbsd-cvs&m=167578479210650&w=2 > "Release date for this was set to be January 31. Unilaterally pushed back to February 7 by OpenSSL by way of announcement of many completely unrelated embargoed issues, some of which they had been sitting on since July 2020"
  • g0xA52A2A 4y ago
    This exemplifies one of the key reasons OpenBSD forked OpenSSL. For those who haven't seen it I'd recommend this presentation from Bob Beck[1], around the 10 minute mark he recounts fixing issues in the memory allocator which had been reported 4 years prior. Seems there's still a similar backlog sitting behind embargoes? [1] https://www.youtube.com/watch?v=GnBbhXBDmwU https://www.youtube.com/watch?v=GnBbhXBDmwU