boringssl
istlsfastyet.com
Our great sponsors
boringssl | istlsfastyet.com | |
---|---|---|
10 | 14 | |
1,719 | 418 | |
3.4% | - | |
6.5 | 1.8 | |
5 days ago | over 2 years ago | |
C | HTML | |
GNU General Public License v3.0 or later | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
boringssl
-
New vulnerabilities (CVE-2022-3602 and CVE-2022-3786) in OpenSSL, how they affect IoT and RTOS Devices.
I have nothing constructive to add except that OpenSSL has a long history of producing vulnerabilities so much so that Google has created their own fork publicly available here: https://boringssl.googlesource.com/boringssl/ (used in chromium, chrome, and android).
-
OpenSSL added new C parser code [...] without doing any basic security testing
> Large web companies like Google implement their own encryption stack anyway.
Google uses BoringSSL[1], which is another OpenSSL fork. I believe AWS uses a mix of OpenSSL and Boring SSL (someone can correct me!).
So it's "their own encryption stack," but that stack is at least originally comprised of OpenSSL's code. They've probably done an admirable job of refactoring it, but API and ABI constraints still apply (it's very hard to change the massive body of existing code that assumes OpenSSL's APIs).
[1]: https://boringssl.googlesource.com/boringssl/
-
CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows
OpenSSL gets plenty of funding but we need to put more funding into TLS implementations that have a bigger focus on security and stability like boringssl, nss, go's tls, and rustls. It's 2022 and we have both languages better suited for this and tools to make existing languages safer and more robust, it's incredible to me that we aren't even more anxious over the current state of openssl.
-
BearSSL: A smaller SSL/TLS library
It was not built for chromium AFAIK
To quote: https://boringssl.googlesource.com/boringssl/
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
- OpenSSL Security Advisory for CVE-2022-0778
-
I think a major issue with the rust ecosystem is that it's full of unexpected design decisions
Use Google's fork of OpenSSL which exists because Google likes to do it's own weird things sometimes. This doesn't say anything about "OpenSSL is considered dangerous", it says "This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you."
- Information and learning resources for cryptography newcomers
-
OpenSSL Security Advisory (14 December 2021)
And this is why projects like https://boringssl.googlesource.com/boringssl/ exist
-
U.S. Telecoms Are Going to Start Physically Removing Huawei Gear
The immediate effect of Heartbleed was the OpenBSD folk [1] and Google [2] forking OpenSSL.
There's a talk from Bob Beck of OpenBSD on pruning OpenSSL, it's pretty hilarious [3].
In that case open source was at least able to react appropriately, even if it didn't act preemptively.
[1]: https://www.libressl.org
[2]: https://boringssl.googlesource.com/boringssl/
[3]: https://www.youtube.com/watch?v=GnBbhXBDmwU
-
Cloudflare: Warp for Linux and Proxy Mode
I doubt the reference to Musk's brand is intentional. It's more likely that it's a reference/homage to BoringSSL (https://github.com/google/boringssl) and "boring tech" in general that is purposefully designed to be minimalist, simple to use, and narrow in scope.
istlsfastyet.com
- Is TLS Fast Yet? - TLS has exactly one performance problem: it is not used widely enough. Everything else can be optimized.
- Is TLS Fast Yet?
-
Lost something? Search through 91.7M files from the 80s, 90s, and 2000s
> You want your website to work on vintage computers where they run super old browsers? Then you probably need a HTTP version of the website without TLS/SSL as it's not gonna be accessible otherwise.
That's incredibly niche. I don't think it deserves to be an example of "meme needs to die".
> Running a software/package repository/registry where every package is signed and verified locally? No need for TLS/SSL and it would just slow down downloading 1000s of packages as handshaking does add latency to requests.
Need some secure way to pass around the SHA256 (or whatever) hash you're using for verification.
And thinking of "memes that need to die", https://istlsfastyet.com suggests this isn't as bad as I think you think it is.
-
Why does linux use HTTP to get updates?
Not really... TLS is pretty much unnoticable on "modern" hardware. https://istlsfastyet.com/
-
Healthcare IT: Encrypt PHI Traffic Inside the Network?
So it's not correct to say that simply using TLS is faster than using TCP (see here). It is accurate to say that securing a connection allows engineers to take advantage of some incredibly clever work that greatly accelerates connection speed, and that wouldn't be possible without the strong security guarantees provided by modern encryption.
-
Traefik vs Nginx Proxy Manager & HTTP vs HTTPS
It was a big complaint with TLS as it was coming onto the scene: https://istlsfastyet.com/
-
Consider Disabling HTTPS Auto Redirects
> increases it’s overhead by almost 100%.
3.8/2.9 kB is a 31% increase.
1.16/0.62 s is an 87% increase.
But okay, let's round up to 100%.
The article is citing a page that counter-argues this:
https://istlsfastyet.com/
> But what about sites like https://doesmysiteneedhttps.com? While this website makes a few valid points, it still relies heavily on “fear tactics” that honestly don’t apply for the vast majority of users. It’s overkill.
Sorry, but not good enough.
1. "a few valid points": you avoid making your visitors liable in oppressive environments (employers, regimes), you avoid very real content injection (commercial or malicious), and you give the visitor a way to know that content wasn't tampered. That's a few valid points. (The rest of https://doesmysiteneedhttps.com are counter-arguments.)
2. "fear tactics": not true. Protecting the integrity of your visitors and your content is nurture, not fear.
3. "don’t apply for the vast majority of users": by making HTTPS standard at practically no cost, you make it work for those for whom it matters. Just because I feel safe on Hacker News doesn't mean that any visitor who goes here will be treated fairly by reading my message.
- Vim awesome's website certificates are fucked?
-
Information and learning resources for cryptography newcomers
https://istlsfastyet.com/ (Is TLS fast yet?)
-
Why most of mirrors(if not all) use http instead of https?
CPUs have specific features to help with encryption now, and HTTP/2 (which pretty much requires TLS) can actually reduce the number of overall TCP connections and may use less resources than clear text HTTP/1.1. Check out https://istlsfastyet.com/
What are some alternatives?
OpenSSL - TLS/SSL and crypto library
CryptoDoneRight - CryptoDoneRight is a cryptographic knowledge base.
wolfssl - The wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. wolfSSL supports up to TLS 1.3!
docco - Literate Programming can be Quick and Dirty.
libsodium - A modern, portable, easy to use crypto library.
css-loaders - A collection of loading spinners animated with CSS
Tink - Tink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.
pnotify - Beautiful JavaScript notifications with Web Notifications support.
webpki - WebPKI X.509 Certificate Validation in Rust
Less - Leaner CSS, in your browser or Ruby (via less.js).
wgcf - 🚤 Cross-platform, unofficial CLI for Cloudflare Warp
card - :credit_card: make your credit card form better in one line of code