5 ms·
That's a lot of sizeable new features in something that's supposed to be bulletproof
by ape4 3y ago
That's a lot of sizeable new features in something that's supposed to be bulletproof
- chrisherbt 3y agoTrue and concerning. LibreSSL has been leading the pack in terms of security, but I wouldn't even call it bulletproof. These are very complicated codebases. I'd love to see OpenSSL adopt an approach of "useful features, tested well, and nothing else" but that's basically why LibreSSL was born after heartbleed. So I won't hold my breath.
- halJordan 3y agoOk whats you're problem that you want to see addressed?
- jjjjmoney 3y agoPersonally, I’d like to see a slower addition of features in something as critical as OpenSSL. LibreSSL (part of the OpenBSD project) has been aggressively pruning and hardening the codebase and is not immune to bugs. Security in crypto libraries is very hard.
- formerly_proven 3y agoOpenSSL is the kitchen sink for relatively well validated, fast crypto primitives, yet every project that uses one of those has to include the other couple megs of libcrypto (most of that is in ASN1 and X509 implementations, which are libcrypto and not libssl). Certainly seems to me like there's room for a librealcrypto (ought to fit in well under a meg) and a libitutils (all that X509 stuff). OpenSSL is historically also the kitchen sink for TLS features and extensions, with rather mixed results.
- rurban 3y agobulletproof? Ha. Have you ever looked at their UI and API? bulletproof is not the word which comes to mind