Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

article.gmane.org

Post reply on HN
Print view View original

11–20 of 245 posts

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#11

Post by doe88 »

robin_reala wrote: post #4

So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?

Not sure which one I'd pick; all of the main libraries seems to either have had very bad issues reported at one point or another or are maybe not used enough to inspire enough conficdence; anyway here is a list https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementati...

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#12

Post by riffraff »

robin_reala wrote: post #4

So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?

fedora is apparently trying to consolidate all crypto to NSS

https://fedoraproject.org/wiki/FedoraCryptoConsolidation

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#13

Post by baq »

simias wrote: post #5
bananas wrote: post #2

Great analysis. Theo is always up front on this sort of stuff which is commendable.

Could have done without the final line though, but I guess it's his equivalent of a signature...

theo's an asshole, but he's quite often right. i don't like his attitude too, but it has to be said that in this particular case, consequences have been - and/or will be - extraordinary.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#14

Post by Confusion »

robin_reala wrote: post #4

So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?

PolarSSL is used by the OpenVPN-NL variant of OpenVPN that has a Dutch government 'seal of trust' attached to it. They require you to use OpenVPN-NL (instead of regular OpenVPN) for various purposes. They have issued a statement on their mailinglist that they (of course) were not vulnerable.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#15

Post by recentdarkness »

riffraff wrote: post #12
robin_reala wrote: post #4

So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?

fedora is apparently trying to consolidate all crypto to NSS https://fedoraproject.org/wiki/FedoraCryptoConsolidation

That page has not been changed since May 7th 2013, I am not sure that this is currently still actively pursued. Also I haven't seen this on the proposals for F21

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#16

Post by hoggle »

antocv wrote: post #6
robin_reala wrote: post #4

So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?

GnuTLS exists. And NSS in mozilla. Probably others too.

I always felt like there unfortunately was no proper alternative to libopenssl (might be unfair but it seemed like a somewhat smelly library) but thanks to this event I've now been made aware of all the alternatives.

How much more fun/comfortable is NSS/GnuTLS to use in a typical C project in comparison to OpenSSL?

Great potential to learn for developers and users alike this heartbleed.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#18

Post by lazyjones »

doe88 wrote: post #11
robin_reala wrote: post #4

So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?

Not sure which one I'd pick; all of the main libraries seems to either have had very bad issues reported at one point or another or are maybe not used enough to inspire enough conficdence; anyway here is a list https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementati...

Perhaps this task should be moved away from libraries (which in some cases are even statically linked and hard to update) into a well-audited daemon, written in a safe language. Or even into several separate daemons for better protection (each with the least privileges required and minimal interface), for example one for handling keys / signing requests only.

Re: "OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"

#19

Post by greatsuccess »

If this post is truth, its a shocking condemnation of open source custodianship of security software.

Im shocked, dismayed and disheartened.

OpenSSL if still maintained by these folks should be wholesale deprecated in all versions and forever more.

Over and out.

Post reply on HN