Hacker News Reader

"is now powering Chromium (on nearly all platforms), Android M and Google's production services"

Does it means you can exploit more easily Google's backend since the code is opensource?

OpenSSL as you can guess is also open source. Having boringssl opensourced does not change anything.

Google hadn't been using OpenSSL for most of their services; in fact, they discovered Heartbleed when studying the possible transition to OpenSSL from NSS; they ended up transitioning directly to BoringSSL.

This doesn't detract from your point, since NSS is also open source, it's just a factoid.

Who knows that google was using OpenSSL?

The security of a system should never rely on an attacker not knowing the details of the algorithm or implementation.

https://en.wikipedia.org/wiki/Security_through_obscurity

It is possible to fingerprint a TLS stack using its behaviour that a sysadmin can't change. People knew it was openssl.

Reply on news.ycombinator.com