Hacker News Reader

Comment by aninteger | Hacker News Reader

Why has the adoption of alternative SSL software been so low. We have libressl, boringssl, something from Amazon? Very few Linux distributions seem interested in shipping alternative SSL software.

View on HN

Probably because once you wrap your code around one SSL stack it's hard to migrate it to another. So you stick to the one you use first. OpenSSL, for instance, isn't just an SSL library... since C has no standardized "stream" functionality, it's a whole big generic streaming library with pluggable modules for various streams and the ability to write your own... once you're stuck to that you can get stuck pretty hard if you don't properly wrap it with abstraction, which C is not, ahhh... let's say it's not really the best at that sort of thing anymore, which is of course partially because every language since C has known that it needs to be better than C at this to even be considered by anybody.

LibreSSL is a drop-in replacement for OpenSSL.

Well that's the intention... is it really in practice? They have deliberately removed a lot of support for rare architectures and features.

Distributions such as CentOS/RHEL which are focused on stability are not going to replace OpenSSL in any existing releases.

I can confirm that it currently just "drops in" when linked against nginx. This initially took a few small patches, but these have been merged into LibreSSL mainline.

I've been testing this against each release for some time and I'm very happy with it.

It /was/ a drop in replacement for a single point in time but it isn't if you make use of any of the recent improvements openssl has added. For example auto selection of DH/ECDH primes and curves.

Note that recently a big clean up of the openssl codebase has taken place so openssl master no longer exposes the internals of structs etc. meaning it's both more auditable and more maintainable. This code is not yet released however.

You missed the two oldest and most mature alternatives: libnss (firefox) and gnutls.

Because, quite frankly, many FOSS components are not that actively maintained, and all of the alternatives either raise licensing considerations, were not intended for use by general projects, or are not significantly mature yet.

Many projects have also invested heavily into optimizing the performance of OpenSSL itself or the use of its interfaces.

You can't sprinkle "magic SSL dust" over these components and just start using an alternative. In some cases, significant, non-trivial changes would be required to change which library is used.

The reality is, as fast as OpenSSL development is moving now, it remains the better option for a lot of projects because of the significant investments already being made and concerns I mentioned earlier.

Because despite bug history of OpenSSL, nothing proved to be more reliable to this moment.

> nothing proved to be more reliable to this moment.

Huh? Of the 22 vulnerabilities OpenSSL has disclosed since March (4 high severity, 14 moderate, 4 low), LibreSSL has been vulnerable to 8 (0 high, 6 moderate, 2 low).

References:

March: https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2

June: https://marc.info/?l=openbsd-announce&m=143406498020131&w=2

Today: https://marc.info/?l=openbsd-tech&m=143645910727507&w=2

And how long is LibreSSL on the market? A year? It's hard to call it proof. It's easy to point intervals longer than whole LibreSSL lifetime with no security bugs in OpenSSL.

LibreSSL is a cleanup of the OpenSSL base. They started with OpenSSL and worked from there. They have mostly deleted code, not added it, so they shouldn't be adding many new vulerabilities. On top of this, it is being written by the OpenBSD/OpenSSH people, who have a good history with writing secure software.

Still, a sole year is hardly an evidence of quality.

Some linux distributions allow you to choose your implementation of SSL upfront, be it libressl or openssl.

See: Exherbo Linux (http://www.exherbo.org/docs/eapi/providers-and-virtuals.html). This isn't one of the big distros, but you do have a choice.

Reply on news.ycombinator.com