On Sat, Oct 28, 2017 at 08:03:32AM +0000, Poul-Henning Kamp
wrote:> --------
> In message <20171028022557.GE96685 at kduck.kaduk.org>, Benjamin
Kaduk writes:
>
> >But I think the main issue with OpenSSL in base that was leading to
> >thoughts about replacing it is the mismatch between FreeBSD release
> >branch support lifecycles and OpenSSL release branch support
lifecycles.
>
> That's not why I want OpenSSL gone from the tree.
>
> My reason is that I think OpenSSLs architecture, (to the extent you
> can talk about OpenSSL having one), APIs and the source code are
> all horrible.
Those are all fine reasons for an individual to want OpenSSL gone from
the tree, and I can't really dispute any of them for the 1.0.x series.
I would say that the 1.1.x series is less bad, especially on the last count,
but don't know how much you've looked at the differences in the new
branch.
Regardless, the point I was intending to make is that, fine reasons those
are, they in and of themselves may not be enough to overcome the weight
of POLA for staying with OpenSSL. I do, however, remember a few years
ago a Security Officer raising concerns about the support lifecycle
mismatch, and in that context that reason does seem to be able to overcome
the weight of POLA. That is, I was talking about history. We should
of course make our own, fresh, decision about whether your reasons are
currently enough to outweigh POLA, for the present discussion.
-Ben