Precedence: list
MIME-Version: 1.0
In-Reply-To: <20180210111715.144a571e@mechanicum.chadwicks.me.uk>
References: <CA+T2pCGFeh30aEi43hAvJ3yoHBijABy_U62wfjhVmf3FmbNUUg@mail.gmail.com>
 <20180209211237.19ab8fda@ncopa-macbook.copa.dup.pw> <CA+T2pCGVM0jRKnh_2e=bi525uWdVpvUAK1U3Am0MipTYCCJmvQ@mail.gmail.com>
 <eaccb1de-0bfa-769f-34c6-f26a90bbb804@adelielinux.org> <20180210111715.144a571e@mechanicum.chadwicks.me.uk>
From: William Pitcock <nenolod@dereferenced.org>
Date: Sat, 10 Feb 2018 07:50:22 -0600
Message-ID: <CA+T2pCEgTXECOav-gBdprCa3psJFSKt6vrgdD7fMHAzQGU+DcA@mail.gmail.com>
Subject: Re: [alpine-devel] Proposed change: openssl 1.1 as default system
 openssl implementation
To: Kevin Chadwick <m8il1ists@gmail.com>
Cc: alpine-dev <alpine-devel@lists.alpinelinux.org>
Content-Type: text/plain; charset="UTF-8"

Hello,

On Sat, Feb 10, 2018 at 5:17 AM, Kevin Chadwick <m8il1ists@gmail.com> wrote:
> This is my last cross post as I am in danger or have already abused
> your list likely atleast in some peoples eyes.
>
> It seems like a strong argument to make upstreams reconsider to me. I
> know security is an intangible asset and they likely won't care.
> Though I think that lesson is becoming more widely understood, so maybe.

I did not discuss the OpenSSL 1.1 API in my proposal.  I do not care about it.

I care about date comparisons that don't involve trusting anything
that overflows a time_t as being in the future and then naively trying
to prove it somehow.

I care about OpenSSL 1.0.1g functions continuing to exist.  OpenSSL
1.1 does include those functions, but not the OpenSSL 0.9.8 deprecated
functions.

I care about cryptographic offload support.

Most importantly, I care about not using either LibreSSL or OpenSSL in
the first damned place wherever possible.

No, the abuse you are creating has nothing to do with cross posting,
but instead posting nonsense to a mailing list about a software you
keep pointing out you do not even use, and my patience is now
exceeded.  Accordingly, I have configured my mail client to
automatically delete any future messages from you.

As for Theo, I mostly agree that the new OpenSSL 1.1 APIs for
certificate verification are crap, but I don't really care to hear any
more of your bad takes, so again, my mail client will be deleting any
future mail from you.

William


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---