Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is any actual security firm doing a code review, or are there plans by the OpenSSL project to hire one?
-
It appears the answer is yes (blog.bugcrowd.com/open-letter-to-internet-users-and-businesses) – mikeazo Apr 18 '14 at 13:08
-
Maybe those guys will take care of it in a similar manner as truecrypt has been audited opencryptoaudit.org – binaryanomaly Apr 20 '14 at 19:08
OpenBSD folks have started an OpenSSL code review recently, after which they decided to fork OpenSSL into LibreSSL. Their changes to the code can be followed here.
As of last week, the major changes were:
Tons and tons of VMS/MacOS 9/Windows code removal
KNF format the whole source tree (jsing)
