proxyboi VS rustls

proxyboi

We haven't tracked posts mentioning proxyboi yet.
Tracking mentions began in Dec 2020.

rustls

• RustPython: A Python Interpreter Written in Rust
  5 projects | news.ycombinator.com | 2 Aug 2024

  Interesting that it relies on OpenSSL, either dynamically from the OS or vendored at compile time. I wonder what the implications would be for using something like rustls. You’d get TLS batteries included and kill a large external dependency… but possibly introduce behavior changes to low-level cryptographic operations, which is scary.

  Still, the maintainers stated that they don’t plan to implement Python’s readline module because they already have a rust implementation of readline. A similar argument could apply here - use native rust implementations of dependencies and expose them via the expected Python APIs. This would break some ambitious Python programs, but those probably wouldn’t consider alternative runtimes anyway.

  https://github.com/rustls/rustls

• FOSS funding vanishes from EU's 2025 Horizon program plans
  1 project | news.ycombinator.com | 19 Jul 2024

  > memory safe openssl

  This is closer to done than not done. Rustls (https://www.memorysafety.org/initiative/rustls/) is a memory safe TLS library that is compatible with OpenSSL in API and has comparable performance. It has also passed security audits (https://github.com/rustls/rustls/blob/main/audit/TLS-01-repo...)

  But your point stands. Rustls wouldn’t have been possible without open source funding.

• Pingora: HTTP Server and Proxy Library, in Rust, by Cloudflare, Released
  6 projects | news.ycombinator.com | 28 Feb 2024
• Alternative to openssl for reqwest https with client certs.
  3 projects | /r/rust | 8 Dec 2023
• rustls 0.22 is out with pluggable crypto providers and better CRL support
  1 project | /r/rust | 4 Dec 2023
• Exploring the Rust compiler benchmark suite
  1 project | /r/rust | 22 Aug 2023

  The RustTLS project is currently setting up their own CI benchmarking workflow, so I think that you could find some inspiration there: https://github.com/rustls/rustls/issues/1385 and https://github.com/rustls/rustls/issues/1205.

• What are the scenarios where "Rewrite it in Rust" didn't meet your expectations or couldn't be successfully implemented?
  16 projects | /r/rust | 9 Jun 2023

  I also studied this question on FFI several weeks ago in terms of "rewrite part of the system in Rust". Unexpected results could be semantic issues (e.g., different error handling methods) or security issues (FFI could be a soundness hole). I suggest going through the issues of libraries that have started rewriting work such as rust-openssl or rustls (This is the one trying to rewrite in whole rust rather than using FFI; however, you will not be able to find the mapping function in the C version and compare them). I hope this helps!

• A brief guide to choosing TLS crates
  5 projects | /r/rust | 9 Jun 2023

  Now for rust implementation of tls. Certificates can be loaded in two ways. * Finds and loads certificates using OS specific tools3 * Uses a rust implementation of webpki4 for loading with certificates5

• Microsoft is busy rewriting core Windows library code in memory-safe Rust
  2 projects | news.ycombinator.com | 27 Apr 2023

  > Ring is mostly C/Assembly

  Crypto needs to be written in Assembly to ensure that operations take a constant time, regardless of input. Writing it in a high level language like C or Rust opens you up to the compiler "optimising" routines and making them no longer constant time.

  But you already knew this. And you also knew that the security audit (https://github.com/rustls/rustls/blob/master/audit/TLS-01-re...) of ring was favourable

  > No issues were found with regards to the cryptographic engineering of rustls or its underlying ring library. A recommendation is provided in TLS-01-001 to optionally supplement the already solid cryptographic library with another cryptographic provider (EverCrypt) with an added benefit of formally verified cryptographic primitives. Overall, it is very clear that the developers of rustls have an extensive knowledge on how to correctly implement the TLS stack whilst avoiding the common pitfalls that surround the TLS ecosystem. This knowledge has translated reliably into an implementation of exceptional quality.

  You said

  > a standard library with feature flags and editions would make rust ridiculously much more productive

  What's the difference between opting into a library with a feature flag and opting in with a line in Cargo.toml? Let's say you want to use the de-facto regex library. Would it really be ridiculously productive if you said you wanted the "regex" feature flag instead of the "regex" crate?

  I do agree that the standard library does need a versioning story so they can remove long deprecated functions. Where it gets complicated is if a new method is reintroduced using the same name in a later edition.

• gRPC with mutual TLS on IPs only
  1 project | /r/openssl | 2 Apr 2023

  I used the commands listed in the .sh file here: https://github.com/rustls/rustls/tree/main/test-ca to generate keys/certs for a server and a client (with IP.1 records for SANs). I have added the local root CA to the trust store of each VM.