OpenBSD Affirms That LibreSSL Will Be Portable

[stevenc]

When porting to debian you may want to look at libbsd-dev, it has the strlc{at,py} and arc4*

That seems like the best way going forward, although currently its arc4random is based on RC4 (discarding the early keystream, at least) whereas upstream OpenBSD 5.5 has moved to ChaCha20.

and you can use http://www.openbsd.org/cgi-bin/cvswe...reallocarray.c for lack of reallocarray.

That's what I used, it was mentioned in the Phoronix article.

And don't forget the mandatory reading:
http://insanecoding.blogspot.no/2014...d-and-bad.html
http://insanecoding.blogspot.no/2014...-mistakes.html
http://insanecoding.blogspot.nl/2014...evurandom.html

I find these articles tedious, with some good points buried in waffle. Guarding against the superuser having symlinked /dev/{,u}random to /dev/zero is not within the scope of a cryptographic library. The random vs. urandom complaint is irrelevant with the FreeBSD kernel.

Existing OpenSSL is already guilty of the alleged "dumbness" by using gettimeofday and urandom on Linux as part of its PRNG seeding. For some platforms it optionally implements considerably worse things that the articles neglect to mention: seeding from RSA secret exponents, digests, a screenshot of the desktop even...

[chinoto]

Please don't feed the troll. It is pretty obvious that bot, jake_lesser and beetreetime, are nothing but sockpuppet accounts of the anti-BSD troll, only here to boost this trolls ego with inciting hate and flamewars. Please just add them to your ignore list and move on with the actual topic.

Meh, it's fun to play with the trolls.

I think in return for how OpenBSD treated the OpenSSL development team, the next release of OpenSSL should be made as incompatible as possible will BSD.

Since LibreSSL will fail, BSD have no support support for secure communications and thus more people will move their servers from BSD to Linux.
Make OpenSSL dependent on systemd.

In what way are you thinking it will fail? It wont matter to the BSD people if LibreSSL fails to get adopted in the Linux community, they'll just use LibreSSL without direct support from the Linux community. I'm hoping that LibreSSL succeeds and replace OpenSSL. Regardless of that, making OpenSSL incompatible would be childish and ineffective, what are they going to do, write a virus to erase every old copy of the source?

[profoundWHALE]

As long as OpenBSD guys are still around, LibreSSL will be supported, so I'm not worried about it going away.