Precedence: list
MIME-Version: 1.0
References: <20181011171746.4c01f758@ncopa-desktop.copa.dup.pw>
In-Reply-To: <20181011171746.4c01f758@ncopa-desktop.copa.dup.pw>
From: Leonardo Arena <rnalrd@gmail.com>
Date: Thu, 11 Oct 2018 18:39:14 +0200
Message-ID: <CAGG_d8BznmmOsMVTu3z_xY8P8XyF_M64o5-+L6_Lpy+JG+BMrA@mail.gmail.com>
Subject: Re: [alpine-devel] Switching back to OpenSSL
To: Natanael Copa <ncopa@alpinelinux.org>
Cc: Alpine-devel <alpine-devel@lists.alpinelinux.org>
Content-Type: multipart/alternative; boundary="00000000000027cecf0577f69d6d"

--00000000000027cecf0577f69d6d
Content-Type: text/plain; charset="UTF-8"

On Thu, Oct 11, 2018 at 5:17 PM Natanael Copa <ncopa@alpinelinux.org> wrote:

> Hi,
>
> Are there any good reasons to not switch back to OpenSSL for v3.9?
>
> Some reasons why I think we should switch back to OpenSSL:
> - better upstream support from projects
> - To my understanding, various of the issues in OpenSSL that made us
>   switch to libressl have been resolved. (for example memory management)
> - libressl failed to retain compability with OpenSSL
> - libressl breaks ABI every 6 months, OpenSSL does not
> - FIPS support
>
> Some reasons to why we may continue with libressl may be:
> - its smaller
> - has fewer CVEs (due to their approach to remove stuff)
> - libtls
>
> Previous thread on the issue:
> http://lists.alpinelinux.org/alpine-devel/6073.html
>
>
I think that the package maintenance work alone doesn't justify LibreSSL
pros, not to mention that some packages never worked with LibreSSL (not
implying that is due to LibreSSL fault).

+1 to revert.

/eo

--00000000000027cecf0577f69d6d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_quote"><div dir=3D"ltr">On Thu, Oc=
t 11, 2018 at 5:17 PM Natanael Copa &lt;<a href=3D"mailto:ncopa@alpinelinux=
.org">ncopa@alpinelinux.org</a>&gt; wrote:<br></div><blockquote class=3D"gm=
ail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-le=
ft:1ex">Hi,<br>
<br>
Are there any good reasons to not switch back to OpenSSL for v3.9?<br>
<br>
Some reasons why I think we should switch back to OpenSSL:<br>
- better upstream support from projects<br>
- To my understanding, various of the issues in OpenSSL that made us<br>
=C2=A0 switch to libressl have been resolved. (for example memory managemen=
t)<br>
- libressl failed to retain compability with OpenSSL<br>
- libressl breaks ABI every 6 months, OpenSSL does not<br>
- FIPS support<br>
<br>
Some reasons to why we may continue with libressl may be:<br>
- its smaller<br>
- has fewer CVEs (due to their approach to remove stuff)<br>
- libtls<br>
<br>
Previous thread on the issue:<br>
<a href=3D"http://lists.alpinelinux.org/alpine-devel/6073.html" rel=3D"nore=
ferrer" target=3D"_blank">http://lists.alpinelinux.org/alpine-devel/6073.ht=
ml</a><br>
<br></blockquote><div><br></div><div>I think that the package maintenance w=
ork alone doesn&#39;t justify LibreSSL pros, not to mention that some packa=
ges never worked with LibreSSL (not implying that is due to LibreSSL fault)=
.<br></div><div><br></div><div>+1 to revert.</div><div><br></div><div>/eo<b=
r></div></div></div>

--00000000000027cecf0577f69d6d--


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---