4 ms·

"just fixing the problems in openssl." That's what libressl is about. If you're in any doubt, please see this talk: https://www.youtube.com/watch?v=GnBbhXBDmwU

• Alupis 12y ago
  There is no doubt that is the intention. The doubt is whether or not it is a good call to fork openssl instead of attempting to get changes into upstream that fix it and make it better, safer, more reliable.
  • sigzero 12y ago
    Are we talking about OpenSSL that had bugs languishing for years? Yeah, good luck with that one. LibreSSL was the way to go and the OpenBSD folks are the ones I trust to do it.
    • Alupis 12y ago
      Yup, just like all these OpenSSH bugs: https://bugzilla.mindrot.org/buglist.cgi?bug_status=__open__&content=&no_redirect=1&order=changeddate&product=Portable%20OpenSSH&query_based_on=&query_format=specific https://bugzilla.mindrot.org/buglist.cgi?bug_status=__open__... Fork it now! ~~~ Seriously, stop buying into all the hype generated by heartbleed. Things will simmer down, and it's doubtful libressl will replace openssl anytime in the next 5 years as the standard default ssl lib for many things. I do not buy into OpenSSL devs not wanting bugfixes. Where are the public rejections/closures of submitted fixes? There aren't any. There are just assumptions that they wont take certain patches, or submitted patches waiting for review (how about you jump in and help review?).
  • protomyth 12y ago
    Well, one of the bugs that got fixed in LibreSSL was reported to OpenSSL with a patch which was not applied. If they ignore that stuff, then you have to fork. http://www.openbsd.org/papers/bsdcan14-libressl/mgp00008.html http://www.openbsd.org/papers/bsdcan14-libressl/mgp00008.htm...