Precedence: list
MIME-Version: 1.0
In-Reply-To: <20180210111715.144a571e@mechanicum.chadwicks.me.uk>
References: <CA+T2pCGFeh30aEi43hAvJ3yoHBijABy_U62wfjhVmf3FmbNUUg@mail.gmail.com>
 <20180209211237.19ab8fda@ncopa-macbook.copa.dup.pw> <CA+T2pCGVM0jRKnh_2e=bi525uWdVpvUAK1U3Am0MipTYCCJmvQ@mail.gmail.com>
 <eaccb1de-0bfa-769f-34c6-f26a90bbb804@adelielinux.org> <20180210111715.144a571e@mechanicum.chadwicks.me.uk>
From: Alba Pompeo <albapompeo@gmail.com>
Date: Sat, 10 Feb 2018 09:32:29 -0200
Message-ID: <CAJDAfTDGS8yfe4+0FMHCA9_wLpfVcmwWUbQ=w=ffYaQUnBhYYA@mail.gmail.com>
Subject: Re: [alpine-devel] Proposed change: openssl 1.1 as default system
 openssl implementation
To: Kevin Chadwick <m8il1ists@gmail.com>
Cc: alpine-dev <alpine-devel@lists.alpinelinux.org>
Content-Type: text/plain; charset="UTF-8"

>switching from 64-bit TAIN date calculations to time_t
Is there a specific upstream commit that did that?
Couldn't in theory Alpine just revert the commit and keep it as local patch?
Just throwing the idea out there...

On Sat, Feb 10, 2018 at 9:17 AM, Kevin Chadwick <m8il1ists@gmail.com> wrote:
> This is my last cross post as I am in danger or have already abused
> your list likely atleast in some peoples eyes.
>
> It seems like a strong argument to make upstreams reconsider to me. I
> know security is an intangible asset and they likely won't care.
> Though I think that lesson is becoming more widely understood, so maybe.
>
>
> Theo posted this
> ________________________________________________________________________
>
>> It isn't just this.  Qt 5.10 introduces new dependency on OpenSSL 1.1
>> APIs for improved security, and LibreSSL does not implement those APIs
>> at all.
>
> The 1.1 API does not improve security.
>
> If anything, the new API requires to you repeat the same or similar
> arguments to many functions, and in many ways the API is much more
> fragile.  Also, more memory allocation and free is required, and as a
> result quite a few software upgrades to 1.1 API have had memory leaks,
> as well as use-after-free and double-free bugs.
>
> A very large patch for converting openssh to 1.1 was provided by folk
> who very much know the API, and it had several stupid and quite
> dangerous mistakes of that sort.
>
> Don't believe all the promises you hear.
>
>
> ---
> Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
> Help:         alpine-devel+help@lists.alpinelinux.org
> ---
>


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---