Comment

Comment by acqq

Why should OpenSSL tell anything to LibreSSL? LibreSSL had very negative words for OpenSSL in the past and tried to build the impression of being "more secure" just based on the "low hanging fruits." It's easy to make the fork and reformat or remove the parts of the code. It's much harder to find the real security problems in what remains.

If I were in OpenSSL team I would also not tell LibreSSL anything and then in, for example, a year show statistics how often LibreSSL wasn't "more secure" at all. That's a fair comparison. (1)

Hard problems are hard.

1) Edit: but see fafner's comment here, it seems the truth is even harder to believe: it seems it's the LibreSSL guys themselves who decided not to be informed and now write what they write(!)

parent acqq 11 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton