5 ms·
Yes. It's also funny that if you look at each of the 8 points identified in the posted link, they're like all have already been identified and many have alread
by cnst 12y ago
Yes. It's also funny that if you look at each of the 8 points identified in the posted link, they're like all have already been identified and many have already been fixed in LibReSSL.
Why use OpenSSL, if LibReSSL already has had a head start on each issue? And OpenSSL probably doesn't even intend to address some of these, like removal of FIPS support.
- viraptor 12y agoCan they remove FIPS at all? Big distributions will certainly want to (have to) offer the FIPS-capable version to some of their customers. I imagine it would cause some serious overtime at RedHat for a number of weeks (months?) if OpenSSL decided to drop FIPS completely.
- cnst 12y agoIf RedHat or Oracle needs FIPS, they should be the ones who are supporting it, not the rest of the unpaid open-source volunteers. I'm pretty sure that OpenBSD, Debian, Slackware, Arch Linux and many others don't care about supporting some insecure and obscure government standards. In fact, FIPS was removed from LibReSSL in OpenBSD due to being unmaintained and insecure.