3 ms·

> Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL You say that, but it's not as though this is a fundamentally hard prob

> Since it is not in fact possible to wave a magic wand and get everyone to run LibreSSL You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago? Moreover, the biggest problem sits with the biggest, and often most capable, internet companies. So having a reasonable path for them to a more secure TLS implementation, even if it meant hand rolling their own packages or building from source, is potentially a big win for the internet in general. And, of course, eventually switching from openssl to libressl will become as easy as spending a couple minutes with a package manager. The fact is that this industry has a track record of keeping up to date technologically. This isn't some corporate IT in the industry gulag saddled with bullshit LoB apps that depend on IE6 in perpetuity. We're talking about the most capable and savvy tech companies in the world. If there's a better option to be had, it'll see high adoption rates.

Xylakant 12y ago
> You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago? How many years did it take to get there? How many servers are still running apache? > And, of course, eventually switching from openssl to libressl will become as easy as spending a couple minutes with a package manager. Eventually, maybe. That's no reason not to audit openssl right now, that people cannot switch - especially the ones that use platforms that the OpenBSD team decided to remove support for.
- danudey 12y ago
  The comparison isn't terribly apt; for example, LibreSSL's intention is to be a drop-in replacement for OpenSSL; if nginx were a drop-in replacement for Apache I suspect we would see a lot more people using it than there are now. As for auditing OpenSSL, the OpenBSD team has found so many problems, misdesigns, misfeatures, idiotic decisions, and bugs, that it seems a shame to repeat that work again. If I had to choose, I'd say give the OpenSSL name to the OpenBSD guys, let them take over the project officially, and let the folks behind the OpenSSL foundation handle things like platform-dependent code, FIPS compliance patches, etc.

Xylakant 12y ago

> You say that, but it's not as though this is a fundamentally hard problem. How many servers are running nginx today vs. even a few years ago? How many years did it take to get there? How many servers are still running apache? > And, of course, eventually switching from openssl to libressl will become as easy as spending a couple minutes with a package manager. Eventually, maybe. That's no reason not to audit openssl right now, that people cannot switch - especially the ones that use platforms that the OpenBSD team decided to remove support for.

danudey 12y ago
The comparison isn't terribly apt; for example, LibreSSL's intention is to be a drop-in replacement for OpenSSL; if nginx were a drop-in replacement for Apache I suspect we would see a lot more people using it than there are now. As for auditing OpenSSL, the OpenBSD team has found so many problems, misdesigns, misfeatures, idiotic decisions, and bugs, that it seems a shame to repeat that work again. If I had to choose, I'd say give the OpenSSL name to the OpenBSD guys, let them take over the project officially, and let the folks behind the OpenSSL foundation handle things like platform-dependent code, FIPS compliance patches, etc.