Slashdot Mirror
LibreSSL Unaffected By DROWN
serviscope_minor writes: The OpenBSD people forked and heavily cleaned up OpenSSL to create LibreSSL due to dissatisfaction with the maintainance of OpenSSL, culminating in the heartbleed bug. The emphasis has been on cleaning up the code and improving security, which includes removing things such as SSL2 which has fundamental security flaws. As a result, LibreSSL is not affected by the DROWN bug. LibreSSL is largely compatible with OpenSSL. The main exceptions are in the cases where programs use insecure functions removed from libreSSL, or require bug compatiblity with OpenSSL.
Removing old code is the best feeling in the world - it's kind of like spring cleaning!
I abandoned Linux in favor of OpenBSD earlier this year. I'm tired of how spread thin Linux developers on some projects have become and/or how complacent. My needs are minimal albeit specialized, so I need developers who actually care about code quality. Theo and team most certainly care about code quality. I've given up a little in the transition to BSD, but the stability, predictability, and ease of use have won me over. I started looking at OpenBSD seriously in 2001, but never made the jump. Better late than never...
`Why is this newsworthy? "This just in: software without a feature doesn't have vulnerability related to said feature."
EOM
BoringSSL is Google's internal fork of OpenSSL (though it's open source). It also removed all support for SSLv2 some time ago. Or, more accurately, it the SSLv2 implementation was never added to it.
https://www.imperialviolet.org/2015/10/17/boringssl.html
OpenVMS is not case sensitive. For critical applications I'd pick it over Linux any day.
Only the State obtains its revenue by coercion. - Murray Rothbard
Isn't SSL2 totally obsolete?
Captcha: enabled
It's 2016.. If your in any way affected by SSLv2 + export ciphers and you still feel compelled to blame it on the TLS stack - please do everyone a favor and find a new line of work.
... and neither is dummySSL distribution 4.3.2, or boringSSL distrubution 2.2.2, and so on.
"LibreSSL Unaffected By DROWN"
Even the title wreaks of an attempt at relevancy. Why is this even news?
"The OpenBSD people forked and heavily cleaned up OpenSSL to create LibreSSL due to dissatisfaction with the maintainance of OpenSSL, culminating in the heartbleed bug."
Translation: The lone overworked maintainer of OpenSSL and his one overworked assistant were swamped trying to keep OpenSSL working on multiple platforms, legacy systems, and the like without breaking the internets; so, we swiped their code, removed all the multi-platform and legacy code, snarked at the codebase that is damn near 20 years old, and now feel smugly superior for doing so.
So instead of putting effort into fixing the existing codebase and lending manpower to a vastly understaffed project that is highly critical for most network security, we swiped the existing code, put our 'best people' on it, and made LibreSSL and are still looking for that relevance.
Oh -- and don't forget to toot your own horn when a backwards compatibility feature had a bug you don't since backwards compatibility was one of the first things you stripped out of the codebase.
SMH
whipslash, the parent comment is at -1, and I think it's a perfect example of how bad modding here hurts the discussion.
Of the 20 comments currently here, it's one of the most insightful and informative.
It's obviously relevant, as the submission is all about how code maintained by the OpenBSD devs is free from a serious flaw that affected so many Linux distros.
Yet despite it being one of the best comments posted so far, I have to go out of my way to browse at -1 to see it!
Meanwhile, somebody else totally misunderstood what the parent comment says, and went off on a tangent about Photoshop and Windows. Yet that comment, despite being wrong and adding nothing of value, is currently at +4!
An excellent comment like the parent comment shouldn't be hidden just because it expresses an idea that conflicts with the twisted world view of some Linux fanatics who happen to have mod points here.
Both the -1 modding of the parent and the +4 modding of the other irrelevant comment indicate serious mod abuse is going on here. The best content is suppressed and harder to read, while the junk comments are shoved in our faces.
Bad modding like we see in these cases really hurts the Slashdot experience. It's even worse than the shitty videos. At least those are easy to ignore. The mod abuse, however, is much harder to overlook, given how good comments are hidden and shitty comments are shown instead.
You missed the point, and so did the idiots who upmodded you.
It doesn't matter who originally wrote the code.
What matters is that so many Linux distro maintainers included the broken OpenSSL code in their distros, which directly affected the users of these Linux distros.
Yet the OpenBSD maintainers, who clearly care far more about security than the Linux distro maintainers do, went out of their way to clean up and secure the broken OpenSSL code, and so OpenBSD users aren't affected by this serious flaw.
That's the point the GP was making: Linux distro maintainers will subject their users to any old shitty code. The OpenBSD maintainers, on the other hand, are far more cautious and don't put their users in the bad position that the Linux distro maintainers do.
This incident shows that we can trust OpenBSD, and that we just can't trust most Linux distros.
There is no way this should be modded as Troll. Linux fanboys run amok...
DROWN is an attack on your private key using SSLv2 to compromise TLS.
So even if your webserver uses LibreSSL, your private key could be exposed by your email server built with OpenSSL, or by your SSH server or ...
Once the private key is partially compromised, LibreSSL will not protect you
You need to test all exposed SSL ports and ensure that SSLv2 is disabled *everywhere*.
Any sane SSL configuration explicitly disable SSLv2 (and SSLv3) and is therefore not vulnerable to DROWN.