LibreSSL Unaffected By DROWN

Posted by timothy on Wednesday March 2, 2016 @05:15AM from the waterproof dept.

serviscope_minor writes: The OpenBSD people forked and heavily cleaned up OpenSSL to create LibreSSL due to dissatisfaction with the maintainance of OpenSSL, culminating in the heartbleed bug. The emphasis has been on cleaning up the code and improving security, which includes removing things such as SSL2 which has fundamental security flaws. As a result, LibreSSL is not affected by the DROWN bug. LibreSSL is largely compatible with OpenSSL. The main exceptions are in the cases where programs use insecure functions removed from libreSSL, or require bug compatiblity with OpenSSL.

3 of 60 comments (clear)

Min score:

Reason:

Sort:

Re:Another Fine Reason... by mlw4428 · 2016-03-02 05:45 · Score: 4, Insightful

The team working on OpenSSL is not the same team working on Linux. This is like being upset because the Photoshop team is thin on resources so you dump Windows. It's, frankly, a stupid thing to think.
Please stop by WaffleMonster · 2016-03-02 06:05 · Score: 4, Insightful

It's 2016.. If your in any way affected by SSLv2 + export ciphers and you still feel compelled to blame it on the TLS stack - please do everyone a favor and find a new line of work.
Re: Why is this newsworthy? by Anonymous Coward · 2016-03-02 06:28 · Score: 4, Insightful

Removing support for an inherently broken and insecure feature is tantamount to writing better code.