Hacker News Reader

Comment by akerro | Hacker News Reader

Who uses LibreSSL on production or in their apps?

Note that it is about TLS client certificates so it's not as widespread as it seems (unless you use these certs of course :) ).

EAP-TLS. Wifi authentication for many enterprises and universities.

Most of which won't be using LibreSSL, tho...

Not to mention TLS VPNs like openvpn.

It's not about client certificates, but it can be a reason why some software might want to do this. The return value of 1 allows the program to deal with verification errors instead of aborting the connection. You can for instance use this to display a proper error message that authentication failed, instead of just closing the connection and getting a generic TLS error message.

Me and all BSD-admins I know. Though after a quick glance at the CVE I doubt any of us is affected.

So, who adopted LibreSSL, OpenBSD, Void Linux and TrueOS?

Alpinelinux (where this bug was found)

Alpine could very well be the largest user of LibreSSL due to its popularity in Linux container circles.

MacOS ships OpenSSH linked against LibreSSL

I think there are FreeBSD people working on getting it into base. I know people have replaced the base OpenSSL with LibreSSL on their own.

Edit: This is not the case as feld has pointed out below.

Not currently in the plans because the support window for LibreSSL is significantly shorter than a FreeBSD release support cycle.

Thanks for the correction, I've edited my comment.

HardenedBSD wanted to do LibreSSL in base but /usr/bin/openssl version on my home server still returns "OpenSSL 1.0.2k-freebsd". I use LibreSSL from ports anyway :) but it'd be nice to have it in base, yeah.

By the way I actually do use client certificates on my home server. It's behind my ISP's NAT though, no incoming connections from outside are possible lol

Yes, you have to roll your own. But for hardened setups one has build hosts anyway, so it's just a single config setting to rule them all.

DragonFly uses it for base and packages.

OpenELEC, OPNsense, CargOS, TrueOS, drupal.org, and bundled with h2o, plus what others have mentioned.

Reply on news.ycombinator.com