Re: OpenSSL's MD5?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Stefan Walter wrote:
> the FreeBSD port of spamprobe 1.2a has a local patch [1] to make use of
> OpenSSL's MD5 functions instead of using spamprobe's own implementation of
> the algorithm. Since the update of the port to version 1.4 would involve
> either making a new local patch or leave the code alone in the future, I
> was wondering what the reason is for spamprobe using its own
> implementation. OpenSSL should be available wherever spamprobe is used,
> and by using its routines one wouldn't have to maintain another
> implementation.
 >
 > What do you think?

The original FreeBSD port maintainer and I had a discussion about this. 
  My position is that the MD5 implementation used by SpamProbe is free, 
small, and guaranteed to be present everywhere because it comes as part 
of SP.  I want SP to have as few external dependencies as possible. 
Currently you can build and run SP on a system with just a C++ compiler 
and no extra third party libararies.  I like that and intend to keep it 
that way.

As far as maintenance goes I would have more coding and maintenance work 
if I tried to support two MD5 libaries (Aladdin and OpenSSL) vs the one 
that I have now.  The SP MD5 digest does not need to interact with any 
other MD5 implementation (i.e. the digests are used internally by SP, 
not passed on to any other entity) so even if they are wrong (which I 
don't believe them to be) it would not matter.  The Aladdin 
implementation runs cleanly in valgrind so I don't believe it to have 
any memory bugs.

So my advice is to simply use the MD5 that comes with SP and be happy. 
Had the original maintainer done so his port would probably still work 
trivially with 1.4.  I compile and test SP on a FreeBSD 4.5 VM and it 
compiles cleanly so the port really shouldn't have to do any patching to 
SP.  If you find any patches that are necessary to get SP to compile 
please let me know and I'll correct the problem in an updated release.

All the best,
++Brian

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.4 (Build 4042)

iQEVAwUBQ7k2dDxRyEoJfXIFAQibUQgAyDOVdwbQBLZ9Gopgk66640ZyiLhUIifW
tQja96VJ+/IM5uZYGh3PXZih0ew0YLFSIBzpuWNaMsPLxlq7j1DcKmVTAfXh0FWG
MjktuACSu4QB1Sdg09pk9/Hm/IPAzX8b/ljt2biJ7rH9QjBshicsQOtOaMQ0r+rb
aW1WTR6argdkp9DpGt0gM35wmcgpUIjSA+mevSgDuWk22zdrpJeF2Qbu+lVg7o2o
zsZNe4pZXvHHQY6freQqoa3ukAenQXLcSm92QPVORJikYGDB2WJSbyEk4w/tTUoh
5VFisuW364Aeid+ErqoIBcu98vCF3w1xGpqgNmp9VOzJMmIu8h34CA==
=aVes
-----END PGP SIGNATURE-----


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click