Slashdot Mirror
OpenSSL Patches Eight New Vulnerabilities
itwbennett writes: Server administrators are advised to upgrade OpenSSL again to fix eight new vulnerabilities, two of which can lead to denial-of-service (DoS) attacks. Although the flaws are only of moderate and low severity, "system administrators should plan to upgrade their running OpenSSL server instances in the coming days," said Tod Beardsley, engineering manager at vulnerability intelligence firm Rapid7.
LibreSSL can't come soon enough.
Seems to make sense, no?
Howto switch from SSL to something else : How to remove SSL
With a closed source product you basically have to trust the vendor to get it right, and to patch defects in a timely manner.
OpenSSL is a classic demonstration of one of the truths of computer programming - namely that good cryptography is HARD.
I just wish that the big players who use this in their products would support the developers - and make it a better outcome for all of us who rely on this product.
OpenSSL had crippling bugs for years until heartbleed. Tens of thousands of people spoke of the virtue of open source and "many eyes" but apparently the author was the only one reading the source.
Only the State obtains its revenue by coercion. - Murray Rothbard
OpenSSL was written by a bunch of monkeys who either didn't understand security, didn't give a shit about security, or were NSA agents pretending to be dumb and careless.
Their source code looks like a fucking regurgitated hairball, pages after pages of deeply nested spaghetti if/else that requires hours/days to scroll up and down, switch back and forth between files just to understand what a small section does. That makes it nearly impossible for people to provide patches because by the time they understand half of the code they are already burnt out and have lost interest.
Fuck OpenSSL, it is now nothing more than a project run by burnt out programmers who doesn't give a shit and will only add even more shit to it to earn a paycheck, and whatever "bugs" they fix, you can bet the NSA is still sitting on a pile of 10 years old bugs and exploits.
Switch to LibreSSL, simply because it is developed by people who have standards and care about reputation.
OpenSSL patches eight old vulnerabilities
FTFY. They are newly discovered, but not new.
systemd is Roko's Basilisk.
"All those eyes on the code" != secure despite bs spouted here on /. hahahahahaha
No-one really cared to look into, or help support, OpenSSL for a very long time. They just used it, and relied on the few people that wrote it to maintain it on their own. Now that problems have been found, people are jumping on the bandwagon to shout about how terrible it is. If you are looking to blame someone, try starting with the person in the mirror. Many people on here have knowledge about coding, but did nothing to help OpenSSL. When did you take the time to look into the code, and report bugs over the years?
If there is a library that deserves to be eliminated it is OpenSSL. Not only it is a load of mostly incomprehensible spaghetti-like code but, in addition, it exposes one of the worst sets of APIs out there - repetitive, inconsistent, poorly documented, absurdly complicated. Sigh. I guess OpenSSL is a bit like Microsoft: the world would be a better place if they could be eliminated and replaced, but that's not gonna happen.
I feel it would make most sense if they plan for the abolishing of OpenSSL in favor of a new library called OpenTLS.
Fork OpenSSL to OpenTLS but only take those technologies that are currently known to be good/safe and still have some future. For instance, don’t copy SSL or TLS 1.0 to the new fork. Nobody should be using SSL anyway so it can easily stay out of the new OpenTLS.
The new OpenTLS library can then be cleaned up and strenghtened without causing too much harm to users of legacy OpenSSL, although some things could be backported from OpenTLS to OpenSSL.
Anyone starting a new project would obviously opt for OpenTLS and would stay clear of legacy OpenSSL and slowly but surely the use of legacy OpenSSL would diminish in favor of the brave new OpenTLS.
Comment removed based on user account deletion
He demands everyone do the work for him and have his vagina personally satisfied. He doesn't care how "low" the severity is.