Re: SSL and mailfront

--bcaec547ca3303954704a6d3b18d
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Jun 28, 2011 at 11:47 PM, John R. Levine <[email protected]> wrote:

> Honestly, all this extra process junk strikes me as overkill.  The openssl
> library is complex, but it is well debugged and I don't see that it's
> notably more likely to do evil stuff to your program than anything else.
>

Maybe.  The CVE vulnerability database records 10 bugs in OpenSSL over the
last 10 years that could allow arbitrary code execution, see:

http://web.nvd.nist.gov/view/vuln/search-results?query=openssl+arbitrary+code


On average, about 1 a year.  Personally, I'm willing to use an extra few KB
of memory per connection to mitigate that risk, but certainly other
tradeoffs are reasonable.

-----Scott.

--bcaec547ca3303954704a6d3b18d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 28, 2011 at 11:47 PM, John R. Levine <span dir=3D"ltr">&lt;<a h=
ref=3D"mailto:[email protected]">[email protected]</a>&gt;</span> wrote:<br><div =
class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"margin:0 0=
 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

Honestly, all this extra process junk strikes me as overkill. =A0The openss=
l library is complex, but it is well debugged and I don&#39;t see that it&#=
39;s notably more likely to do evil stuff to your program than anything els=
e.<br>

</blockquote><div><br></div><div>Maybe. =A0The CVE vulnerability database r=
ecords 10 bugs in OpenSSL over the last 10 years that could allow arbitrary=
 code execution, see:</div><div><br></div></div><blockquote class=3D"webkit=
-indent-blockquote" style=3D"margin: 0 0 0 40px; border: none; padding: 0px=
;">

<div class=3D"gmail_quote"><div><a href=3D"http://web.nvd.nist.gov/view/vul=
n/search-results?query=3Dopenssl+arbitrary+code">http://web.nvd.nist.gov/vi=
ew/vuln/search-results?query=3Dopenssl+arbitrary+code</a></div></div></bloc=
kquote>

<div class=3D"gmail_quote"><div><br></div><div>On average, about 1 a year. =
=A0Personally, I&#39;m willing to use an extra few KB of memory per connect=
ion to mitigate that risk, but certainly other tradeoffs are reasonable.</d=
iv>

<div><br></div><div>-----Scott.</div><div><br></div></div>

--bcaec547ca3303954704a6d3b18d--