4 ms·
I think another implementation is not necessarily a bad thing, but it's a shame that this effort couldn't be combined with LibreSSL and BoringSSL or even OpenSS
by mattbillenstein 11y ago
I think another implementation is not necessarily a bad thing, but it's a shame that this effort couldn't be combined with LibreSSL and BoringSSL or even OpenSSL under a single project. Having more eyes on one thing would be better it would seem.
- cwp 11y agoNo! Let's have many implementations all with completely separate code bases. Then when the next security bug is found it won't affect the whole internet.
- mattbillenstein 11y agoI can see that side of it, but when N >> M I don't really see how that helps things significantly. N = number of https sites M = number of tls implementations
- cwp 11y agoYou don't think N(M-1)/M sites not being affected by the next heartbleed wouldn't be significant?