We need something with TLS in the name for the next one so people stop getting confused.
rustls is there. It has TLS in the name, it is good and there is a C FFI wrapper.
WolfSSL sucks too, so now what?
11–20 of 136 posts
Re: WolfSSL sucks too, so now what?
#12This is the WolfSSL maintainer's response[1] > This ticket is rather long and has a lot of irrelevant content regarding this new topic. If I need to bring in a colleague I do not want them to have to wade through all the irrelevant context. If you would like, please open a new issue with regards to how we support middlebox compatibility. The author turns this into: > The GitHub issue comment left at the end leads me…
I don't know, I don't think it's really a huge waste of time considering I just read the entire comment thread in a handful of minutes. And beyond that, failing to comply with RFC requirements is the bug here -- a workaround existing for a specific language isn't a fix.
Again: the maintainer does not say there is no bug. He says: please open a new issue, with a proper title and description for the actual underlying problem. Is that seriously too much to ask? Instead, the guy writes a whole blog post shitting on the project. Does anyone still wonder why people burn out on maintaining FOSS projects?
Re: WolfSSL sucks too, so now what?
#13Regarding HAProxy, they ended up using AWS-LC in their new Debian/Ubuntu “performance” packages: https://www.haproxy.com/blog/fresh-from-aws-reinvent-superch...
Re: WolfSSL sucks too, so now what?
#14There’s always rustls.
FIPS compliant?
Re: WolfSSL sucks too, so now what?
#15Many people and projects have tried to ditch OpenSSL in favor of LibreSSL, WolfSSL, MbedTLS, etc, but by now many have returned to OpenSSL. The IQ curve meme with "just use OpenSSL" applies.
Re: WolfSSL sucks too, so now what?
#16We need something with TLS in the name for the next one so people stop getting confused.
You're obviously looking for lastLs.
Re: WolfSSL sucks too, so now what?
#17Usability-wise (I do not need many features or compliance for FIPS) I have been happy with Botan: https://botan.randombit.net/
Re: WolfSSL sucks too, so now what?
#18We need something with TLS in the name for the next one so people stop getting confused.
rustls is there. It has TLS in the name, it is good and there is a C FFI wrapper.
Rustls still outsources cryptographic primitives. I believe the currently supported providers of those are… drumroll… AWS-LC and Ring. The latter is a fork of BoringSSL. The article describes AWS-LC and BoringSSL as "Googled and Amazoned to death; they don't care about anyone but their own use cases".
The state of things sucks :-(
Re: WolfSSL sucks too, so now what?
#19There’s always rustls.
Rustls still outsources cryptographic primitives. I believe the currently supported providers of those are… drumroll… AWS-LC and Ring. The latter is a fork of BoringSSL. The article describes AWS-LC and BoringSSL as "Googled and Amazoned to death; they don't care about anyone but their own use cases".
The state of things sucks :-(
Re: WolfSSL sucks too, so now what?
#20We need something with TLS in the name for the next one so people stop getting confused.
rustls is there. It has TLS in the name, it is good and there is a C FFI wrapper.
rustls doesn't have its own implementation of cryptography, you have to choose a provider like openssl or aws lc