News for hackers. Stuff that matters.
Re:OpenSSL will release a high-severity issue fix on 25th by tptacek on Monday March 22, 2021 @11:02PM (#26550534)
Cryptography might be the one single place where I'd look askance at replacing memory-unsafe code with memory-safe de novo implementations. Fortunately, you mostly don't have that dilemma; there are good options in Go and Rust. But a lot of energy goes into auditing the cryptography code in OpenSSL. Certainly, you might reasonably pick OpenSSL over some random high-level implementation nobody is auditing.

That's why I think it's worth calling this out.

Odds are, it's some dumb memory corruption thing. But we don't know yet. OpenSSL sev:hi tends to mean "dubiously exploitable crasher", and good crypto bugs in OpenSSL tend to be sev:med.

There are no comments on this comment yet.