4 ms·

The interaction between OpenSSH portable and LibreSSL portable is especially amusing.

• derefr 12y ago
  It sounds like there should be something like a libopenbsdcompat containing arc4random et al., which both these packages would then import+depend on.
  • pyroh 12y ago
    There's libbsd for Linux, although I can't comment on the quality of its implementation.
    • vezzy-fnord 12y ago
      libbsd and gnulib are pretty much just functions copy-pasted out of their original locations into conveniently organized repositories. There's not much to speak of concerning implementation quality.
  • AlyssaRowan 12y ago
    Now that the glibc leadership changes have taken place, hopefully we can see functions like arc4random, explicit_bzero, timingsafe_bcmp, reallocarray and the other stuff actually appear in glibc where they belong, so no glue will be required. They are pretty damn useful when you're trying to do secure programming. (Of course, arc4random should use ChaCha20.)
    • dobbsbob 12y ago
      the function name is arc4random but it's chacha20 http://marc.info/?l=openbsd-cvs&m=138065251627052&w=2 http://marc.info/?l=openbsd-cvs&m=138065251627052&w=2
      • AlyssaRowan 12y ago
        Indeed, that's my point: don't forget that the name is legacy and slightly misleading. RC4 is about to get another public result against it, btw.
    • fafner 12y ago
      I think there recently was a proposal for reallocarray in glibc. Not sure what happened to it though.
• DArcMattr 12y ago
  The current source for OpenSSH no longer requires linking to (Open|Libre)SSL http://undeadly.org/cgi?action=article&sid=20140430045723 http://undeadly.org/cgi?action=article&sid=20140430045723