I-LibreSSL: kungani i-OpenSSL ingenaso isixazululo

i-arsebleed

Ngemva kwe-HeartBleedGate kanye nemifula yombhalo ebhalwe ngaleli cala, lelo qembu labathuthukisi be-OpenBSD abanenkani, abaholwa nguTheo de Raadt, bathi, "Masenze i-OpenSSL yethu ngokugembula kanye nezifebe." Kodwa njengoba uxhaso lwabo lungadluleli ekugembuleni kanye nezifebe, banqume ifoloko le-OpenSSL, abazolibiza ngokuthi i-LibreSSL , futhi elizotholakala ekuqaleni kwi-OpenBSD 5.6 futhi, uma konke kuhamba kahle, kwezinye izinhlelo ze-POSIX, kufaka phakathi i-Linux, vele.

UTed Unangst, unjiniyela we-OpenBSD, empeleni ukhuluma ngokuthi i-Heartbleed yayingenye nje yeziphazamisi eziningana ze-OpenSSL eziyingozi minyaka yonke , nokuthi lesi siphazamisi sasingeyona imbangela yokudala ifoloko. Iphutha uTed agxile kulo (lelo elalizogcina libangele ifoloko) lihlobene nohlu lwangaphakathi lwe-OpenSSL kanye neqiniso lokuthi i-Nginx ayisebenzi ngaphandle kwazo . Kodwa inkinga enkulu kakhulu kwakuwukuntuleka kwempendulo ye-OpenSSL, njengoba i-patch yalesi siphazamisi isivele iphakanyisiwe, futhi abakayisebenzisi. Leyo patch ibilokhu ingekho unyaka wonke ; i-OpenSSL, i-OpenBSD, ne-Debian bayilungisile bona. Uma abathuthukisi be-OpenSSL bebengeke basebenzise i-patch, babengeke bakholwe ukuthi bayeke ukusekela i-Visual C++ 5.0 (abahleli bezinhlelo ze-C bangahleka kakhulu ngalezi zibonelo ).

Ngakho-ke balahle cishe imigqa eyizinkulungwane eziyi-150 yekhodi nokubala, ikakhulukazi ngemuva kokukhipha ukwesekwa kwe-VMS, isistimu yokusebenza enyanyekayo evaliwe yamaseva agcinwa nguHewlett Packard. Kusengathi i-X iqhathaniswa neWayland.

Okwamanje, ngizokushiya nesayithi le -OpenSSL Valhalla Rampage , elibonisa igalari yezinto ezesabekayo ithimba le-OpenBSD elizama ukuzilungisa.


Engeza njengomthombo okhethwayo ku-Google