4 ms·
It is, but please note that OpenSSH uses very little of OpenSSL's code. None of the serious bugs lately had any impact on OpenSSH.
by xorcist 12y ago
It is, but please note that OpenSSH uses very little of OpenSSL's code. None of the serious bugs lately had any impact on OpenSSH.
- some_furry 12y agoThat's probably very reassuring. I personally don't share this belief that openssl is bad (in fact, for PHP developers, openssl is preferable to libmcrypt which has been abandoned since 2007), I just know it's a common sentiment of infosec people. :)
- jamiesonbecker 12y agoJust because OpenSSL is very hard to replace doesn't mean it's not very bad.
- some_furry 12y agoSure. I simply use it for crypto primitives (e.g. aes-256-gcm) in environments where I cannot install libsodium from PECL (e.g. crypto_easybox() and crypto_easybox_open()).