4 ms·

I have been using Hiawatha webserver which uses PolarSSL, and have avoided almost all of the recent bugs (on the servers that weren't running other things). I r

I have been using Hiawatha webserver which uses PolarSSL, and have avoided almost all of the recent bugs (on the servers that weren't running other things). I really like PolarSSL, but they just got bought up by ARM, so I'm a bit scared for the project. Regarding SSL, I just generally consider it borked and try not to trust it if possible. SSH/VPN are just about the only thing I do trust (and even then with trepidation). Once again, I think the many eyes theory only works when the code is sufficiently simple/terse. I bet if you did a study on lines of code in proportion to security vulnerabilities you would find a correlation (obviously not necessarily a causation).

xorcist 12y ago
PolarSSL has had their own fair share of nasties. Only a few months after Heartbleed they had a remote code execution in the ASN.1-parser. They fixed it quickly however, and keep a current CVE list at their home page. It just goes to show that all popular SSL options are more or less bad (and the same goes for IPsec).