Re: [gentoo-project] libressl/openbsd fundraising campaign

[Andrew Savchenko]

On Wed, 04 Mar 2015 14:49:02 -0500 Anthony G. Basile wrote:
> On 03/04/15 13:50, hasufell wrote:
> > As one of the contributors of the gentoo libressl ebuild overlay [0]
> > I've been asked to retweet the libressl/openbsd call for donation in
> > 2015 [1].
> >
> > Since a lot of people think of gentoo in terms of "freedom of choice", I
> > think the gentoo community might be interested to endorse the efforts of
> > the libressl developers.
> >
> > I don't intend to regularly post fundraising requests, but since openssl
> > is such a fundamental part of our operating system and internet
> > security, I guess it makes sense to raise awareness here.
> >
> >
> > --
> > [0] https://github.com/gentoo/libressl
> > [1] http://www.openbsdfoundation.org/campaign2015.html
> >
>
> Thanks you for posting this.  I understand and share your caution about
> posting about fundraisers, but there are a few issues worth
> "retweeting".  I think this is one.
>
> openssl + heartbleed and all that made me aware how tenuous some
> critical opensource projects are.  Another example is bash.  Yet another
> is gpg.  Its good to get the word out.

The fact that closed projects don't disclosure such vulnerability
information doesn't imply there are none there. And the fact that
there is no public audit of the code implies that code quality is
much worse, so more critical bugs are there.

As for libressl, idea of the project is good, but what worries me
that it is API incompatible with other solutions. So it can't be
used as a drop-in replacement for openssl or other implementations.
This way more resources are being dispersed for nothing.

Best regards,
Andrew Savchenko