First Release of LibreSSL Portable Available

Posted Jul 12, 2014 23:39 UTC (Sat) by jengelh (guest, #33263)
In reply to: First Release of LibreSSL Portable Available by moltonel
Parent article: First Release of LibreSSL Portable Available

Well, libressl cannot a drop-in replacement for all cases since it does not provide all of the openssl symbols. When I tried rebuilding w3m, it became apparent that, for example, "RAND_egd" was missing.

First Release of LibreSSL Portable Available

Posted Jul 13, 2014 20:52 UTC (Sun) by moltonel (subscriber, #45207) [Link]

RAND_egd is the typical example of an insecure feature that should not be used, and rightfully removed from LibreSSL. The fun thing is, w3m probably doesn't make use of the feature, it just links to it. So it's arguably a w3m bug (potentially using a feature that'll reduce security), that gets exposed by trying to link against LibreSSL instead of OpenSSL.