71–80 of 217 posts
Earlier quoted context omitted.
It is still a significant upgrade in terms of safety over C.
The main argument against Ada is you can achieve a higher level of safety/convenience using C++ frameworks and code analysis tools.
Earlier quoted context omitted.
Yep we've been using rustls for most of a year no issues. Memory safety go brrr :) Would encourage others to take a look at it. Ring is a good base that's been audited and the lower attack surface from no old openssl bloat code makes a difference.
Ring, unfortunately, has quite toxic project leadership with a history of making hostile decisions towards their contributors and userbase ( see https://github.com/briansmith/ring/issues/774 for one example ). Something to be aware of if you're considering building with it.
Earlier quoted context omitted.
Does OpenSSH use OpenSSL? I thought they migrated to LibreSSL.
The Ubuntu 22.04 LTS openssh-server package seems to depend on libss3 which is built from OpenSSL: https://packages.ubuntu.com/jammy/openssh-server -> https://packages.ubuntu.com/jammy/libssl3 -> https://packages.ubuntu.com/source/jammy/openssl Apparently there are some problems with LibreSSL on Linux: https://lwn.net/Articles/841664/ (Also, do we know that LibreSSL is unaffected?)
> If you’re using version 1.1.1, this vulnerability doesn’t affect you
AFAIK, LibreSSL forked even before that - when OpenSSL was version 1.0 or 0.9 even. So likely not affected - unless a similar issue appeared there after the fork.
Earlier quoted context omitted.
The main argument against Ada is you can achieve a higher level of safety/convenience using C++ frameworks and code analysis tools.
The F-35 JSF project used C++, and had a draconian coding standard, and likely used all of the tools you mentioned. It was plagued with defects that costed the taxpayer billions of dollars. https://www.stroustrup.com/JSF-AV-rules.pdf
> And by widely leveraged, I mean almost completely ubiquitous, if you’re using HTTPS, chances are you’re using OpenSSL. Almost everyone is. This is probably a bit of an exaggeration. There are quite a few other SSL implementations that actually are also "widely leveraged"[1]. In particular, LibreSSL was forked and cleaned up after Heartbleed. Google uses BoringSSL. GnuTLS is widely used and unrelated to OpenSSL. [1]…
Is GnuTLS widely used? People bring it up, but I've never actually seen it in a codebase (and I deal with a lot of x509 + PKCS code). I've seen more wolfSSL and mbedTLS than GnuTLS.
How many times does this have to happen before we start rejecting components written in unsafe languages?
I want it to be never. Controversial opinion: as long as those who use "security" to oppress us have the upper hand, code written in "unsafe languages" will always leave a path to freedom from the authoritarian dystopia of corporations and governments who will seek to increase their control over our lives. We've already seen the battle start at DRM, jailbreaking/rooting, etc. IMHO the periodic but not-too-often occur…
How many times does this have to happen before we start rejecting components written in unsafe languages?
Otherwise I look forward to the day when we stop driving unsafe cars, whatever that means. Accidents can always happen.
Earlier quoted context omitted.
The Ubuntu 22.04 LTS openssh-server package seems to depend on libss3 which is built from OpenSSL: https://packages.ubuntu.com/jammy/openssh-server -> https://packages.ubuntu.com/jammy/libssl3 -> https://packages.ubuntu.com/source/jammy/openssl Apparently there are some problems with LibreSSL on Linux: https://lwn.net/Articles/841664/ (Also, do we know that LibreSSL is unaffected?)
The globalsign atricle says: > If you’re using version 1.1.1, this vulnerability doesn’t affect you AFAIK, LibreSSL forked even before that - when OpenSSL was version 1.0 or 0.9 even. So likely not affected - unless a similar issue appeared there after the fork.
In the previous OpenSSH vs OpenSSL 3 bug it went like this:
> The issue has been identified in OpenSSL version 3.0.4, which was released on June 21, 2022, and impacts x64 systems with the AVX-512 instruction set. OpenSSL 1.1.1 as well as OpenSSL forks BoringSSL and LibreSSL are not affected. (https://thehackernews.com/2022/06/openssh-to-release-securit...)
Earlier quoted context omitted.
Yep we've been using rustls for most of a year no issues. Memory safety go brrr :) Would encourage others to take a look at it. Ring is a good base that's been audited and the lower attack surface from no old openssl bloat code makes a difference.
Ring, unfortunately, has quite toxic project leadership with a history of making hostile decisions towards their contributors and userbase ( see https://github.com/briansmith/ring/issues/774 for one example ). Something to be aware of if you're considering building with it.
Don't know what 'yanking' a crate means specifically, but that seems like an ecosystem problem; in Java for example, maven dependencies are supposed to be immutable and the largest distributor (mvnrepository) doesn't allow updating a package.