Date: Sat, 10 Feb 2018 19:06:46 +0000
From: Kevin Chadwick <m8il1ists@gmail.com>
To: alpine-devel@lists.alpinelinux.org
Subject: Re: [alpine-devel] Proposed change: openssl 1.1 as default system
 openssl implementation
Message-ID: <20180210190646.38ab746f@mechanicum.chadwicks.me.uk>
In-Reply-To: <7f5961a9-e09e-8e1c-12b4-23ae56fce034@adelielinux.org>
References: <CA+T2pCGFeh30aEi43hAvJ3yoHBijABy_U62wfjhVmf3FmbNUUg@mail.gmail.com>
	<20180209211237.19ab8fda@ncopa-macbook.copa.dup.pw>
	<CA+T2pCGVM0jRKnh_2e=bi525uWdVpvUAK1U3Am0MipTYCCJmvQ@mail.gmail.com>
	<eaccb1de-0bfa-769f-34c6-f26a90bbb804@adelielinux.org>
	<20180210111715.144a571e@mechanicum.chadwicks.me.uk>
	<CA+T2pCEgTXECOav-gBdprCa3psJFSKt6vrgdD7fMHAzQGU+DcA@mail.gmail.com>
	<20180210141109.55695e19@mechanicum.chadwicks.me.uk>
	<CA+T2pCEC2fsiHh_iJ9FFcmSmhc+NsZoXX1WYkhEWB4KSj+VvJA@mail.gmail.com>
	<20180210154513.66fa5b3a@mechanicum.chadwicks.me.uk>
	<7f5961a9-e09e-8e1c-12b4-23ae56fce034@adelielinux.org>
Precedence: list
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

On Sat, 10 Feb 2018 12:16:18 -0600


> I like how it was already pointed out, by you and possibly others, on
> openbsd-misc *and* this list, that most people do not use the CA / SAN
> verification routines correctly.
>=20

Wasn't me!

> Then you mention that "well, invalid certs like that shouldn't be
> trusted".

You missed the point entirely, he didn't ask the question.

=46rom the commit message I'm inclined to think it clamps the year for
good or bad but I was just pointing out his argument was potentially
obviously flawed.

OpenSSL only started in 1998! and any trusted CA that issues a pre 1970
cert is broken anyway. That was his assertion of it working that
way and being insecure.

The point wasn't that I knew but that he hadn't given LibreSSL the
chance despite it's merits over OpenSSL. I assure you that LibreSSL
devs know a lot more than us about LibreSSL. Not raising issue with
them is arrogance.

But yes, I use public key crypto not CA certificates for anything I
implement, except a website where I hope letsencrypt start doing
things properly and less traditionally.

I actually don't care one bit aside from dev time wasted for a
worse outcome. I simply saw a wrong

> The problem with the OpenBSD community is not bluntness.  Arrogance
> and trolling are problems for me.  And you know what?  Honestly, I
> don't find too many OpenBSD devs have that problem.  Their users,
> however...their users....

 Atleast you did enter some discussion and William might have learnt
 that passing imsgs can be more secure and protect the keys!


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---