Date: Sat, 10 Feb 2018 11:17:15 +0000
From: Kevin Chadwick <m8il1ists@gmail.com>
To: alpine-devel@lists.alpinelinux.org
Subject: Re: [alpine-devel] Proposed change: openssl 1.1 as default system
 openssl implementation
Message-ID: <20180210111715.144a571e@mechanicum.chadwicks.me.uk>
In-Reply-To: <eaccb1de-0bfa-769f-34c6-f26a90bbb804@adelielinux.org>
References: <CA+T2pCGFeh30aEi43hAvJ3yoHBijABy_U62wfjhVmf3FmbNUUg@mail.gmail.com>
	<20180209211237.19ab8fda@ncopa-macbook.copa.dup.pw>
	<CA+T2pCGVM0jRKnh_2e=bi525uWdVpvUAK1U3Am0MipTYCCJmvQ@mail.gmail.com>
	<eaccb1de-0bfa-769f-34c6-f26a90bbb804@adelielinux.org>
Precedence: list
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

This is my last cross post as I am in danger or have already abused
your list likely atleast in some peoples eyes.

It seems like a strong argument to make upstreams reconsider to me. I
know security is an intangible asset and they likely won't care.
Though I think that lesson is becoming more widely understood, so maybe.


Theo posted this
________________________________________________________________________

> It isn't just this.  Qt 5.10 introduces new dependency on OpenSSL 1.1
> APIs for improved security, and LibreSSL does not implement those APIs
> at all.  

The 1.1 API does not improve security.

If anything, the new API requires to you repeat the same or similar
arguments to many functions, and in many ways the API is much more
fragile.  Also, more memory allocation and free is required, and as a
result quite a few software upgrades to 1.1 API have had memory leaks,
as well as use-after-free and double-free bugs.

A very large patch for converting openssh to 1.1 was provided by folk
who very much know the API, and it had several stupid and quite
dangerous mistakes of that sort.

Don't believe all the promises you hear.


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---