4 ms·
> if I remember correctly, LibreSSL was not infallible LibreSSL is a fork of OpenSSL - it would not be a huge surprise if there remained OpenSSL bugs in it.
by kibibu 12y ago
> if I remember correctly, LibreSSL was not infallible
LibreSSL is a fork of OpenSSL - it would not be a huge surprise if there remained OpenSSL bugs in it.
- hardwaresofton 12y agoMy point was that some OpenBSD guys rewrote OpenSSL in an attempt to fix it, yet also introduced some bugs (I read one article about a bug that was introduced by them, though I don't have a link, nor want to search the internet for it)... nvm, here's the link- http://www.theregister.co.uk/2014/07/17/libressl_crypto_bug/ http://www.theregister.co.uk/2014/07/17/libressl_crypto_bug/
- ZoFreX 12y agoThey didn't rewrite it, they made changes to it - and they removed hundreds of bugs and potential bugs, on balance it's a huge improvement.
- clarry 12y agoThey forked OpenSSL and inherited all its bugs. And if you pay attention, you'll notice that this overblown bug was only relevant to Linux. Linux simply lacked some functionality OpenBSD has so they tried to hack a solution into the compatibility layer. So the first one or two preview releases turned out not to be perfect. OpenBSD was never affected. Though there were a few other unintended OS-agnostic changes that did actually slip in and were subsequently noticed and corrected.