On Thu Mar 6, 2025 at 4:17 PM CET, Sarah Julia Kriesch via openSUSE Factory wrote:
If you wat to know the reason for introducing LibreSSL: https://www.internetsociety.org/blog/2014/06/heartbleed-libressl-and-the-imp...
I know more about it than I ever wish to know. Tomáš Mráz (then at Red Hat, one of few actually heroically fighting with the monster of OpenSSL, now OpenSSL Foundation) was my close colleague. One, historically completely unimportant consequence of the whole debacle was that I have finally decided to take all those patches we, Red Hat, had over the dead body of M2Crypto, the oldest and then the most complete Python bindings for OpenSSL, and make an upstream for it, now at https://sr.ht/~mcepl/m2crypto/, adding patches from all other distros, and porting whole monster to Python 3. What I also remember was that LibreSSL first claimed that any programmer can maintain OpenSSL if they are not complete morons, promising complete API compatibility, then sliding more and more from that position. I had periodically annoying demands on the M2Crypto issue tracker demanding switch to supporting LibreSSL. Whenever I suggested that a patch making M2Crypto build with LibreSSL would be considered, if they promised to maintain it, I have never heard from them since. I still believe that making such a patch would not be out of question, if anybody wish to making it and maintaining it, but nobody did, and now probably anybody reasonable should care more about Cryptography (more modern Python binding) anyway. Best, Matěj -- http://matej.ceplovi.cz/blog/, @mcepl@en.osm.town GPG Finger: 3C76 A027 CA45 AD70 98B5 BC1D 7920 5802 880B C9D8 Home is where ~/.profile is. -- from Usenet