5 ms·
> nothing proved to be more reliable to this moment. Huh? Of the 22 vulnerabilities OpenSSL has disclosed since March (4 high severity, 14 moderate, 4 low), Li
by glass- 11y ago
> nothing proved to be more reliable to this moment.
Huh? Of the 22 vulnerabilities OpenSSL has disclosed since March (4 high severity, 14 moderate, 4 low), LibreSSL has been vulnerable to 8 (0 high, 6 moderate, 2 low).
References:
March: https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2 https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2
June: https://marc.info/?l=openbsd-announce&m=143406498020131&w=2 https://marc.info/?l=openbsd-announce&m=143406498020131&w=2
Today: https://marc.info/?l=openbsd-tech&m=143645910727507&w=2 https://marc.info/?l=openbsd-tech&m=143645910727507&w=2
- dozzie 11y agoAnd how long is LibreSSL on the market? A year? It's hard to call it proof. It's easy to point intervals longer than whole LibreSSL lifetime with no security bugs in OpenSSL.
- jandrese 11y agoLibreSSL is a cleanup of the OpenSSL base. They started with OpenSSL and worked from there. They have mostly deleted code, not added it, so they shouldn't be adding many new vulerabilities. On top of this, it is being written by the OpenBSD/OpenSSH people, who have a good history with writing secure software.
- dozzie 11y agoStill, a sole year is hardly an evidence of quality.