Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WolfSSL sucks too, so now what?

blog.feld.me

Post reply on HN
Print view View original

131–136 of 136 posts

Re: WolfSSL sucks too, so now what?

#131

Post by yencabulator »

gspr wrote: post #18
weinzierl wrote: post #11

Earlier quoted context omitted.

rustls is there. It has TLS in the name, it is good and there is a C FFI wrapper.

Rustls still outsources cryptographic primitives. I believe the currently supported providers of those are… drumroll… AWS-LC and Ring. The latter is a fork of BoringSSL. The article describes AWS-LC and BoringSSL as "Googled and Amazoned to death; they don't care about anyone but their own use cases". The state of things sucks :-(

You might like https://github.com/ctz/graviola/

Also, even if rustls is using aws-lc-rs, you still get the TLS parts from the rustls project, and aws-lc-rs is just lower-level crypto. That means there's less places for Amazon to say no; they either implement an algorithm or don't.

Re: WolfSSL sucks too, so now what?

#132

Post by yencabulator »

stabbles wrote: post #15

Many people and projects have tried to ditch OpenSSL in favor of LibreSSL, WolfSSL, MbedTLS, etc, but by now many have returned to OpenSSL. The IQ curve meme with "just use OpenSSL" applies.

Rustls is great.

I think it's also worth pointing out that https://pkg.go.dev/crypto/tls has no OpenSSL in it.

Re: WolfSSL sucks too, so now what?

#133

Post by perching_aix »

move-on-by wrote: post #117
randallsquared wrote: post #109

Earlier quoted context omitted.

The "victim" was the Elixir or Erlang library, not himself. To be clear.

I don’t think it was clear, but thanks for the insight. Was WolfSSL forced upon Elixir or Erlang? Did they purchase it and received a defective product? Are they held hostage by WolfSSL’s decisions? Are they not allowed to modify WolfSSL as needed themselves? I fail to see any victims beyond perhaps the WolfSSL maintainers for having to suffer such entitlement.

You explicitly modeled the situation so that no victims can exist, so please do spare people from the autofellatious poetic questions and remarks about how you fail to see any victims.

> Was WolfSSL forced upon Elixir or Erlang?

Yes actually, and upon others, that's how computer networking works. Did you read the blogpost by the way? Even just the beginning? Really doesn't seem like it.

Hint: there's a reason the word "middlebox" is mentioned 16 times in there, and that the word "server" is mentioned another 6 more.

> Did they purchase it and received a defective product?

They did not purchase a copy, WolfSSL distributed them one for free. The blogpost author did identify the product as defective however, as it allows for and defaults to spec-noncompliant behavior. It stands to reason that this then affects WolfSSL's paying customers (and their downstream customers) too, who might be unknowingly operating or interacting with spec-noncompliant services as a result.

Will people need to read out the whole article for you?

> Are they held hostage by WolfSSL’s decisions?

Yes, and so are others, that's (still) how computer networking works.

> Are they not allowed to modify WolfSSL as needed themselves?

What would they do with it? Put it on a USB stick and stick it up their ass?

> for having to suffer such entitlement

Are you really one to take issue with another person's behavior after this power tantrum?

Re: WolfSSL sucks too, so now what?

#135

Post by tialaramex »

vrighter wrote: post #134
tialaramex wrote: post #53

> Last updated on 2026-12-13 Yeah, no, I can't find a way to read this in which it's not in the future.

Never wondered why the camera app in your phone also uses this convention for filenames?

What convention? Is the problem here that you didn't realise this claimed to have been written either in December 2026 (ie months in our future) or, if you're willing to stomach a weird YYYY-DD-MM formatting - a mythical thirteenth month of the year?

The actual article was, eventually, updated to give a real date: Last updated on 2026-02-16

But originally it said 2026-12-13 and that's why I commented.

Re: WolfSSL sucks too, so now what?

#136

Post by vrighter »

tialaramex wrote: post #135
vrighter wrote: post #134

Earlier quoted context omitted.

Never wondered why the camera app in your phone also uses this convention for filenames?

What convention? Is the problem here that you didn't realise this claimed to have been written either in December 2026 (ie months in our future) or, if you're willing to stomach a weird YYYY-DD-MM formatting - a mythical thirteenth month of the year? The actual article was, eventually, updated to give a real date: Last updated on 2026-02-16 But originally it said 2026-12-13 and that's why I commented.

I am an idiot.

I did not notice the date was in the future

Post reply on HN