Precedence: list
MIME-Version: 1.0
In-Reply-To: <20180208181647.1e8e6eed@mechanicum.chadwicks.me.uk>
References: <CA+T2pCGFeh30aEi43hAvJ3yoHBijABy_U62wfjhVmf3FmbNUUg@mail.gmail.com>
 <c486d19c-905d-83f3-c0fa-bdedf5d7e1aa@adelielinux.org> <20180208181647.1e8e6eed@mechanicum.chadwicks.me.uk>
From: William Pitcock <nenolod@dereferenced.org>
Date: Thu, 8 Feb 2018 13:15:33 -0600
Message-ID: <CA+T2pCGLFatPgXt2o0obxM_aTAu=f2U=wPDF2m52+EBaafZcgQ@mail.gmail.com>
Subject: Re: [alpine-devel] Proposed change: openssl 1.1 as default system
 openssl implementation
To: Kevin Chadwick <m8il1ists@gmail.com>
Cc: alpine-dev <alpine-devel@lists.alpinelinux.org>
Content-Type: text/plain; charset="UTF-8"

Hello,

On Thu, Feb 8, 2018 at 12:16 PM, Kevin Chadwick <m8il1ists@gmail.com> wrote:
> On Thu, 8 Feb 2018 12:09:38 -0600
>
>
>> > openssl 1.1 has a different situation: Akamai and the Core
>> > Infrastructure Initiative have come together to sponsor development
>> > and maintenance of openssl since we switched, which means that
>> > there's higher quality maintenance occuring now.
>>
>> This is good to hear, I didn't know about Akamai's involvement.
>
> I am fairly sure that funding was never a real issue and certainly not
> one that could explain heartbleed.

Heartbleed is explained by the support for custom allocators in
combination with their own custom allocator.  This functionality was
disabled in Alpine's openssl packaging prior to Heartbleed disclosure
and was ultimately removed upstream.  Much like other distributions,
we actually do look at our security-critical code and make
security-conscious decisions.

As far as funding goes, when your funding comes from consulting
contracts (adding new things to a product), then a majority of your
resources go towards adding new features.  The Akamai and CII funding
is explicitly for dedicated maintenance so that there is not a
capitalistic inversion of priorities.

> Akamai is probably also one of the lead reasons why people think
> websites are secure when they are not necessarily too (akamai cert for
> akamai server for download of acme.exe). Simplicity, cost issue?

I would argue Cloudflare is a larger offender there.

William


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---