Date: Fri, 25 Apr 2014 09:41:45 +0100 From: David Chisnall <theraven@FreeBSD.org> To: Matthias Gamsjager <mgamsjager@gmail.com> Cc: FreeBSD Current <freebsd-current@freebsd.org> Subject: Re: OpenSSL vs. LibreSSL (OpenBSD) Message-ID: <81BF8B42-A98C-4A0E-BCBB-CA3A795AA980@FreeBSD.org> In-Reply-To: <CA%2BD9Qhte7G4UZORiem9Mut9g8kDPGAuUd2ou6ZQgreqkfiy6Lw@mail.gmail.com> References: <20140424223540.627bf130.ohartman@zedat.fu-berlin.de> <535984EC.7050509@mu.org> <CAHSQbTDoDco9bX%2Bgg9EE6x1Mo3pmyBsC8hbwUfFaYfyS4Qqvug@mail.gmail.com> <20140425033141.GB28939@lonesome.com> <CA%2BD9Qhte7G4UZORiem9Mut9g8kDPGAuUd2ou6ZQgreqkfiy6Lw@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 25 Apr 2014, at 09:16, Matthias Gamsjager <mgamsjager@gmail.com> = wrote: > Isn't the latest news that Google&co and the linux foundation setup a > construction that these vital opensource projects get the proper > funding. Meaning more man power and hopefully less bugs Yes, there's effort to improve OpenSSL from there, there's the LibreSSL = project from OpenBSD and there's a from-scratch reimplementation of SSL = in the Cambridge Computer Lab that's intended for easy verification[1], = and Apple's CommonCrypto (which, in light of goto fail, might not be the = best choice), so there are going to be a lot of choices in time for 11. =20= There are very few users of OpenSSL in the base system (7, I think), so = rewriting them to use less error-prone APIs would be feasible - a 100% = OpenSSL-compatible API is not necessarily a requirement for a = base-system SSL library. =20 so@ and secteam@ get to make the final call on what we should be = shipping, because they're the ones that will have to suffer from the = fallout the next time there's a vulnerability. David [1] It's written in OCaml, but can have C APIs and can probably be = compiled into C. C that is machine generated from a typesafe language = is a lot less likely to contain memory management bugs than C that is = generated by a human...=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?81BF8B42-A98C-4A0E-BCBB-CA3A795AA980>