LibreSSL with Bob Beck

Bob Beck also covers this in his talk about the first 30 days of libreSSL. The entire talk is amazing, even 7 years later. [VIDEO]

The LibreSSL talk is funny and scary. [watch the other version one [VIDEO] so you can hear the other people and see the end]

"just fixing the problems in openssl." That's what libressl is about. If you're in any doubt, please see this talk: [VIDEO]

It does a lot of things it really shouldn't be doing. I recommend you watch Bob Beck's talk about LibreSSL[1] (Ted's there too). [1]: [VIDEO]

The immediate effect of Heartbleed was the OpenBSD folk [1] and Google [2] forking OpenSSL. There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious [3]. In that case open source was at least able to react appropriately, even if it didn't act preemptively. [1]: [LINK] [2]: [LINK] [3]: [VIDEO]

This exemplifies one of the key reasons OpenBSD forked OpenSSL. For those who haven't seen it I'd recommend this presentation from Bob Beck[1], around the 10 minute mark he recounts fixing issues in the memory allocator which had been reported 4 years prior. Seems there's still a similar backlog sitting behind embargoes? [1] [VIDEO]

Just in case someone missed it, here's video of the libressl talk to go with the linked slide(s). [VIDEO]

I'd much rather have 1 really really good ssl library that everyone uses instead of 2 so-so ones. That's reasonable, but those aren't the options at play here. Not only because GnuTLS is already a thing, but the chances of OpenSSL becoming really really good are questionable. An OpenBSD guy gave a talk a few weeks back where he said that Heartbleed wasn't the reason for the split, it was the reason for digging into the code and realizing that OpenSSL under current leadership isn't capable of being a really really good option. [VIDEO]