Slashdot Mirror
OpenSSL 1.0.0 Released
hardaker writes "After over 11 years of development since the start of the OpenSSL Project (1998-12-23), OpenSSL version 1.0.0 has finally hit the shelves of the free-for-all store."
← Back to Stories (view on slashdot.org)
I'm running Debian stable so it'll be another 10 years until it hits the repos.
Meh. I never run version 1.0 of anything.
How can I believe you when you tell me what I don't want to hear?
Just in time for commonplace MiTM spoofing.
That little lock on your browser window indicating you are communicating securely with your bank or e-mail account may not always mean what you think its means.
Normally when a user visits a secure website, such as Bank of America, Gmail, PayPal or eBay, the browser examines the website's certificate to verify its authenticity.
At a recent wiretapping convention, however, security researcher Chris Soghoian discovered that a small company was marketing internet spying boxes to the feds. The boxes were designed to intercept those communications -- without breaking the encryption -- by using forged security certificates, instead of the real ones that websites use to verify secure connections. To use the appliance, the government would need to acquire a forged certificate from any one of more than 100 trusted Certificate Authorities.
The attack is a classic man-in-the-middle attack, where Alice thinks she is talking directly to Bob, but instead Mallory found a way to get in the middle and pass the messages back and forth without Alice or Bob knowing she was there.
The existence of a marketed product indicates the vulnerability is likely being exploited by more than just information-hungry governments, according to leading encryption expert Matt Blaze, a computer science professor at University of Pennsylvania.
"If the company is selling this to law enforcement and the intelligence community, it is not that large a leap to conclude that other, more malicious people have worked out the details of how to exploit this," Blaze said.
http://www.wired.com/threatlevel/2010/03/packet-forensics/
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
Be sure to encrypt your Ovaltine!
http://marc.info/?l=openssl-announce&m=126987886907671&w=2
http://www.openssl.org/source/exp/CHANGES
-molo
Using your sig line to advertise for friends is lame.
Fantastic! It's finally ready for production use! I can't until websites start using openssl! And I'll even be able to use a secure shell! Awesome!!
Be relentless!
From the Changelog:
Now that the first version is finally in relaase, how long before the first set of changes hits? Everybody knows 1.0 of anything is full of bugs.
And on a more serious note, did anyone ever publish a specification of what a 1.0 release should have in it? Or is this somewhere between "declare victory" and "declare exhaustion"?
Behold, this dreamer cometh. Come now, and let us slay him... and we shall see what will become of his dreams.
openssl(1): [STILL INCOMPLETE]
ssl(3): [STILL INCOMPLETE]
crypto(3): [STILL INCOMPLETE]
HOWTO: [STILL INCOMPLETE]
I would trade in the last 12 months worth of OpenSSL development for some decent documentation. [STILL INCOMPLETE] is a half truth as well; the complete bits suck in novel ways.
Looking over the changelog, it appears Google sponsored alot of the changes.
Guess they wanted to make sure openSSL is a good bit more secure, being that it's a hot button issue and all.
import system.cool.Sig;
Why do they call it Ovaltine? The mug is round. The jar is round. They should call it Roundtine.
There's no -1 for "I don't get it."
Why the flip does it need to depend on perl5? I'll never get ssh running on 386BSD this way.
... Duke Nukem Forever has ALSO been released.
On the up side, it only takes one mouse click and a pop up that says "Are you sure you want to get burnt?" to do so.
Tequila: It's not just for breakfast anymore!