Slashdot Mirror
OpenSSL 1.0.2 Released
kthreadd writes The OpenSSL project has released its second feature release of the OpenSSL 1.0 series, version 1.0.2 which is ABI compatible with the 1.0.0 and 1.0.1 series. Major new features in this release include Suite B support for TLS 1.2 and DTLS 1.2 and support for DTLS 1.2. selection. Other major changes include TLS automatic EC curve selection, an API to set TLS supported signature algorithms and curves, the SSL_CONF configuration API, support for TLS Brainpool, support for ALPN and support for CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
Stop.
Is this. You are STILL owned at any time by those who you will never see.
libressl-2.1.3.tar.gz 21-Jan-2015 2.7M. For you non Open BSD users: portability wrappers. Full Source.
http://www.libressl.org/
Colin Dean Go a year without DRM
How much of FIPS/NIST aka NSA stuff was removed?
And a bunch of new backdoors for the NSA now that the last batch were discovered.
With their big blocks o' digits, sourced from a government agency, and for some reason everyone trusts them not to have been deliberately chosen to weaken the cipher.
Like trusting Tor, a government project. Or Truecrypt, a project by [unknown].
I saw a computer with an "M-DISC Ready" label on this morning. I wondered what that was about. Apparently, it's an archival-quality disc. Except that the substrate formula is a TRADE SECRET.
There's a lot of buzz about Google self-driving cars. There have been zero independent tests that it actually works on an average set of roads.
Why do humans put so much trust in things done by other people even while those people deliberately hide information which is needed to test that their claims are true? It's antithetical to the academic process.
The OpenSSL Software "Foundation" is actually a corporation which happens to be located in Maryland, US - not too far from the NSA corporation (A US Department of Defense subsidiary). Are they trustworthy? Take a good hard look at the heartbleed "bug" and make your own educated opinion. It is interesting to note that according to information presented by Jacob Appelbaum at 31c1 the NSA corporation are able to snoop SSL traffic.
9/11: Never forget it was a false-flag operation
Why is this on slashdot. I wouldn't trust OpenSSL with my lunch money. I've replaced all my systems with libressl/libtls. And (moving a lot of my boxes to OpenBSD while I'm at it as I'm depending more and more on their stuff... libressl, pf, bgpd, the list goes on...)
Slashdot is causing tab crashes on recent versions of chrome!
Fix it you dumb fucks!
> Major new features in this release
Wait...no Space Invaders? :-/
"we fixed it"
It's an affront to common sense that the Internet's security largely relies on this wretched library, with its utterly dismal coding standards, its hideously, and unnecessarily, baroque and complex API, and its pathetic documentation.
Yippppeeeee for the new version!
The Ellipse has been broken and is a major security risk
http://saveie6.com/
The last sentence of the summary looks like they're showcasing a new random number generator;)
First of full disclosure...I am a member of the OpenSSL development team.
I've read a lot of anti-OpenSSL comments here along with some fairly amusing conspiracy theories! Some criticism is fair but much is not in my view.
OpenSSL is a very different project to what it was a year ago. This time last year the development team was very small (6 people...not all of whom were active coders, most of whom were doing it in their spare time). Supporting the project was (and still is) a thankless task, and they did their best - but frankly the resources were not there to do the job properly. There is now a whole new team, built upon the original, running the project. We have gone from 6 people to 15 and brought on board a number of full timers. I know most of that team personally, and I can tell you that you couldn't hope to find a more dedicated and experienced team. There is a strong sense of responsibility, along with lots of plans in place for how to make things better.
A lot is said about the problems with OpenSSL. Let me tell you about some of its strengths. The library will run on practically anything from desktops, to high end servers, to embedded devices, to mainframes, to mobile phones. It is highly optimised and is *fast*. We are lucky enough to have Andy Polyakov on the team who brings an exceptional talent in performing those optimisations. Due to its position in the market place OpenSSL is probably the most studied security software product out there. That study has intensified since Heartbleed. During the last year there have been a number of security issues identified and fixed as a result of that intensified study. This is a *good* news story.
I am really excited about what the future holds for the project. We are busy working on 1.1.0, which brings with it a focus on reducing complexity. Improved documentation (which I've seen mentioned a number of times on this page) is also on our roadmap. I'm not complacent...I know there is a lot still to do...but I have a huge amount of confidence in the team that is now in place.
Can someone provide a rundown on the advantages and drawbacks of these libraries, with a particular focus on network-facing applications?
The last thing openssl needs is "major new features." Clean up the bugs and source code. Get things in order before creating yet more features.