Slashdot Mirror
OpenSSL 1.0.2 Released
kthreadd writes The OpenSSL project has released its second feature release of the OpenSSL 1.0 series, version 1.0.2 which is ABI compatible with the 1.0.0 and 1.0.1 series. Major new features in this release include Suite B support for TLS 1.2 and DTLS 1.2 and support for DTLS 1.2. selection. Other major changes include TLS automatic EC curve selection, an API to set TLS supported signature algorithms and curves, the SSL_CONF configuration API, support for TLS Brainpool, support for ALPN and support for CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
Is this. You are STILL owned at any time by those who you will never see.
libressl-2.1.3.tar.gz 21-Jan-2015 2.7M. For you non Open BSD users: portability wrappers. Full Source.
http://www.libressl.org/
Colin Dean Go a year without DRM
How much of FIPS/NIST aka NSA stuff was removed?
> Major new features in this release
Wait...no Space Invaders? :-/
"we fixed it"
No. They are not.
Do you think the absence of documentation is due only to laziness?
Do you think the absence of documentation is due only to laziness?
Yes. "Never attribute to malice that which can be explained by incompetence." Not every fuckup is a conspiracy.
I don't know any programmers who like writing documentation. Start with that, and add that the OpenSSL code is complicated and poorly written, and it's no wonder the documentation is lacking.
It's an affront to common sense that the Internet's security largely relies on this wretched library, with its utterly dismal coding standards, its hideously, and unnecessarily, baroque and complex API, and its pathetic documentation.
Sorry but that's all just pure baseless speculation on your part and fear mongering. The NSA can snoop SSL traffice regardless of ssl library simply by doing a man in the middle attack. And you'd never know it either, since they would be using a recognized root certificate. So I don't see what this issue has to do with openssl. And If they can brute force sniff SSL, I don't see how other ssl libraries are much safer.
Several of the OpenSSL developers have commented here on slashdot and expressed chagrin combined with determination to fix the problems which years ago were not considered problems--they were bad but accepted solutions for the portability problem. But times have changed, and openssl is changing too. As others have said it's still the most portable, and it is a good choice, and I do trust it. I think their response to heartbleed was admirable. They acknowledged and fixed the problem promptly.
If a browser crashes because of a site, it's the browser's developers fault.
Onda Technology Institute
Yippppeeeee for the new version!
The Ellipse has been broken and is a major security risk
http://saveie6.com/
My recommendation would be to submit a Chrome bug report.
The last sentence of the summary looks like they're showcasing a new random number generator;)
First of full disclosure...I am a member of the OpenSSL development team.
I've read a lot of anti-OpenSSL comments here along with some fairly amusing conspiracy theories! Some criticism is fair but much is not in my view.
OpenSSL is a very different project to what it was a year ago. This time last year the development team was very small (6 people...not all of whom were active coders, most of whom were doing it in their spare time). Supporting the project was (and still is) a thankless task, and they did their best - but frankly the resources were not there to do the job properly. There is now a whole new team, built upon the original, running the project. We have gone from 6 people to 15 and brought on board a number of full timers. I know most of that team personally, and I can tell you that you couldn't hope to find a more dedicated and experienced team. There is a strong sense of responsibility, along with lots of plans in place for how to make things better.
A lot is said about the problems with OpenSSL. Let me tell you about some of its strengths. The library will run on practically anything from desktops, to high end servers, to embedded devices, to mainframes, to mobile phones. It is highly optimised and is *fast*. We are lucky enough to have Andy Polyakov on the team who brings an exceptional talent in performing those optimisations. Due to its position in the market place OpenSSL is probably the most studied security software product out there. That study has intensified since Heartbleed. During the last year there have been a number of security issues identified and fixed as a result of that intensified study. This is a *good* news story.
I am really excited about what the future holds for the project. We are busy working on 1.1.0, which brings with it a focus on reducing complexity. Improved documentation (which I've seen mentioned a number of times on this page) is also on our roadmap. I'm not complacent...I know there is a lot still to do...but I have a huge amount of confidence in the team that is now in place.
If a browser crashes because of a site, it's the browser's developers fault.
You must have been deprived of Last Measure as a child.
Il n'y a pas de Planet B.
Happily.
Onda Technology Institute
WFM. What's the problem here?
Can someone provide a rundown on the advantages and drawbacks of these libraries, with a particular focus on network-facing applications?
Sufficiently advanced incompetence is indistinguishable from malice.
The last thing openssl needs is "major new features." Clean up the bugs and source code. Get things in order before creating yet more features.