Hacker News new | ask | show | jobs
by OrpheanBeholder 3552 days ago
No one is claiming that LibreSSL has fixed all the OpenSSL bugs, the parent certainly didn't. LibreSSL has historically been vulnerable to less of the bugs than OpenSSL and, for a long time, none of the sev:high bugs.
2 comments
anon1385 3552 days ago
>none of the sev:high bugs.

Well it looks like that has just changed: https://marc.info/?l=libressl&m=147454940615412&w=2

link
Alupis 3552 days ago
> LibreSSL has historically been vulnerable to less of the bugs than OpenSSL and, for a long time, none of the sev:high bugs.

You say this like LibreSSL has been out for a long time. It's just barely crossed it's 2 year mark... and for most of it's life, it's difficult to call it "production ready".

Coupled with its low adoption rate (really only some select BSD's, and some adventurous linux folks), it's not surprising more vulnerabilities haven't been discovered (yet).

The OpenBSD folks do good work, but let's not pretend they are infallible.

link