Hacker News new | ask | show | jobs
by yalooze 3532 days ago
There is LibreSSL[0] which is a fork of OpenSSL done primarily by the OpenBSD team (it was created as a direct response to Heartbleed).

BoringSSL[1] is Google's attempt.

[0] https://www.libressl.org/ [1] https://boringssl.googlesource.com/boringssl/

3 comments

LibreSSL is OpenSSL with some of the ugly bits stripped out. It's still aiming for compatibility, and so it retains many of the warts and will continue to do so. It's not a modern library though it may be a bit better than OpenSSL.

BoringSSL is similar, except there you additionally have the problem that google strongly discourages its use by third parties, as they consider it an internal library and semantics can change.

A better example of a modern library would be NaCL or libsodium.

That's not accurate - the LibreSSL developers have overhauled the internals fairly substantially in a lot of ways, and they are also making a sensible API on top of it (libtls).
> it was created as a direct response to Heartbleed

The reason for the fork was not Heartbleed itself but the crazy memory allocation done behind the scenes.

https://youtu.be/GnBbhXBDmwU?t=308

I haven’t paid much attention to LibreSSL since the project started but I recently downloaded the source code for OpenSSH and was very impressed with how clean and readable the code for ssh-keygen is. After seeing that, I’d have a more confidence in the OpenBSD team; they already have a great reputation for security but looking at their actual output impressed me more. (Maybe, some day I’ll explore free Unix-like operating systems other than GNU/Linux.)