3 ms·

Interesting and quick work. The story of the libcrypto SRP glass house makes me feel like a little kid who just heard a ghost story. Is OpenSSL being notified

• clarry 12y ago
  > Is OpenSSL being notified of security bugs you all find in your pairing down process? Determining whether a bug can actually be exploited (on what system, under what configuration?) is hard work, and it's harder still to prove a negative. Mostly the OpenBSD devs just fix the bug and move on. If it looks like the typical kind of a bug that could lead to crashes, they release a patch against the previous two releases (assuming the code is present there). A lot of the bugs they fix turn out to be "security bugs" only long after someone else finds that out on a version of the code running on another system not hardened by the OpenBSD devs. After 5.6, if any serious bug is found, you can expect to find a patch for it on http://www.openbsd.org/errata56.html http://www.openbsd.org/errata56.html ; however, as the code between LibreSSL and OpenSSL diverges, it won't be obvious whether they apply to OpenSSL at all.