6 ms·

LibreSSL on Gentoo

99 points by stefantalpalaru 12y ago

mpyne 12y ago
The interaction between OpenSSH portable and LibreSSL portable is especially amusing.
- derefr 12y ago
  It sounds like there should be something like a libopenbsdcompat containing arc4random et al., which both these packages would then import+depend on.
  - pyroh 12y ago
    There's libbsd for Linux, although I can't comment on the quality of its implementation.
    - vezzy-fnord 12y ago
      libbsd and gnulib are pretty much just functions copy-pasted out of their original locations into conveniently organized repositories. There's not much to speak of concerning implementation quality.
  - AlyssaRowan 12y ago
    Now that the glibc leadership changes have taken place, hopefully we can see functions like arc4random, explicit_bzero, timingsafe_bcmp, reallocarray and the other stuff actually appear in glibc where they belong, so no glue will be required. They are pretty damn useful when you're trying to do secure programming. (Of course, arc4random should use ChaCha20.)
    - dobbsbob 12y ago
      the function name is arc4random but it's chacha20 http://marc.info/?l=openbsd-cvs&m=138065251627052&w=2 http://marc.info/?l=openbsd-cvs&m=138065251627052&w=2
      - AlyssaRowan 12y ago
        Indeed, that's my point: don't forget that the name is legacy and slightly misleading. RC4 is about to get another public result against it, btw.
    - fafner 12y ago
      I think there recently was a proposal for reallocarray in glibc. Not sure what happened to it though.
- DArcMattr 12y ago
  The current source for OpenSSH no longer requires linking to (Open|Libre)SSL http://undeadly.org/cgi?action=article&sid=20140430045723 http://undeadly.org/cgi?action=article&sid=20140430045723
click170 12y ago
Did anyone else get a blue bar in the middle of the text while trying to read fr mobile?
- deleted 12y ago
  [deleted]
- hannob 12y ago
  Hello, I'm the owner of the blog, I have changed the blue bar now to be only in the header, should improve things and no longer get into the content. I need to look into this in detail at some point, but for now it should be readable.
  - crishoj 12y ago
    Another issue: The page at 'https://blog.hboeck.de/archives/851-LibreSSL-on-Gentoo.html' was loaded over HTTPS, but displayed insecure content from 'http://vg07.met.vgwort.de/na/4f1f65b6b6e4419c97ea81e7d27cc0a0': this content should also be loaded over HTTPS.
    - JohnTHaller 12y ago
      You'll see this often on sites that use CDNs to server images. Adding SSL to a CDN at levels used by smaller sites easily doubles the cost.
    - moschlar 12y ago
      In that case that's a nasty tracker image by a german "writers collecting society"...
daurnimator 12y ago
Only tangential to the article, but only now (via the link to the apache patch) did I realise it was libReSSL. Makes the name so much more interesting!
- currysausage 12y ago
  It was LibReSSL for a while, but it seems they changed it back to LibreSSL: http://www.libressl.org/ http://www.libressl.org/
swills 12y ago
FreeBSD already has it in ports: http://www.freshports.org/security/libressl http://www.freshports.org/security/libressl And there is work underway to make it an option for things that use OpenSSL currently.

LibreSSL on Gentoo

mpyne 12y ago

The interaction between OpenSSH portable and LibreSSL portable is especially amusing.

derefr 12y ago
It sounds like there should be something like a libopenbsdcompat containing arc4random et al., which both these packages would then import+depend on.
- pyroh 12y ago
  There's libbsd for Linux, although I can't comment on the quality of its implementation.
  - vezzy-fnord 12y ago
    libbsd and gnulib are pretty much just functions copy-pasted out of their original locations into conveniently organized repositories. There's not much to speak of concerning implementation quality.
- AlyssaRowan 12y ago
  Now that the glibc leadership changes have taken place, hopefully we can see functions like arc4random, explicit_bzero, timingsafe_bcmp, reallocarray and the other stuff actually appear in glibc where they belong, so no glue will be required. They are pretty damn useful when you're trying to do secure programming. (Of course, arc4random should use ChaCha20.)
  - dobbsbob 12y ago
    the function name is arc4random but it's chacha20 http://marc.info/?l=openbsd-cvs&m=138065251627052&w=2 http://marc.info/?l=openbsd-cvs&m=138065251627052&w=2
    - AlyssaRowan 12y ago
      Indeed, that's my point: don't forget that the name is legacy and slightly misleading. RC4 is about to get another public result against it, btw.
  - fafner 12y ago
    I think there recently was a proposal for reallocarray in glibc. Not sure what happened to it though.
DArcMattr 12y ago
The current source for OpenSSH no longer requires linking to (Open|Libre)SSL http://undeadly.org/cgi?action=article&sid=20140430045723 http://undeadly.org/cgi?action=article&sid=20140430045723

click170 12y ago

Did anyone else get a blue bar in the middle of the text while trying to read fr mobile?

deleted 12y ago
[deleted]
hannob 12y ago
Hello, I'm the owner of the blog, I have changed the blue bar now to be only in the header, should improve things and no longer get into the content. I need to look into this in detail at some point, but for now it should be readable.
- crishoj 12y ago
  Another issue: The page at 'https://blog.hboeck.de/archives/851-LibreSSL-on-Gentoo.html' was loaded over HTTPS, but displayed insecure content from 'http://vg07.met.vgwort.de/na/4f1f65b6b6e4419c97ea81e7d27cc0a0': this content should also be loaded over HTTPS.
  - JohnTHaller 12y ago
    You'll see this often on sites that use CDNs to server images. Adding SSL to a CDN at levels used by smaller sites easily doubles the cost.
  - moschlar 12y ago
    In that case that's a nasty tracker image by a german "writers collecting society"...

daurnimator 12y ago

Only tangential to the article, but only now (via the link to the apache patch) did I realise it was libReSSL. Makes the name so much more interesting!

currysausage 12y ago
It was LibReSSL for a while, but it seems they changed it back to LibreSSL: http://www.libressl.org/ http://www.libressl.org/

swills 12y ago

FreeBSD already has it in ports: http://www.freshports.org/security/libressl http://www.freshports.org/security/libressl And there is work underway to make it an option for things that use OpenSSL currently.