Hacker News Reader

Because despite bug history of OpenSSL, nothing proved to be more reliable to this moment.

> nothing proved to be more reliable to this moment.

Huh? Of the 22 vulnerabilities OpenSSL has disclosed since March (4 high severity, 14 moderate, 4 low), LibreSSL has been vulnerable to 8 (0 high, 6 moderate, 2 low).

References:

March: https://marc.info/?l=openbsd-cvs&m=142677372515025&w=2

June: https://marc.info/?l=openbsd-announce&m=143406498020131&w=2

Today: https://marc.info/?l=openbsd-tech&m=143645910727507&w=2

And how long is LibreSSL on the market? A year? It's hard to call it proof. It's easy to point intervals longer than whole LibreSSL lifetime with no security bugs in OpenSSL.

LibreSSL is a cleanup of the OpenSSL base. They started with OpenSSL and worked from there. They have mostly deleted code, not added it, so they shouldn't be adding many new vulerabilities. On top of this, it is being written by the OpenBSD/OpenSSH people, who have a good history with writing secure software.

Still, a sole year is hardly an evidence of quality.

Reply on news.ycombinator.com