Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is any actual security firm doing a code review, or are there plans by the OpenSSL project to hire one?
-
It appears the answer is yes (blog.bugcrowd.com/open-letter-to-internet-users-and-businesses)– mikeazoApr 18, 2014 at 13:08
-
Maybe those guys will take care of it in a similar manner as truecrypt has been audited opencryptoaudit.org– binaryanomalyApr 20, 2014 at 19:08
Add a comment
|
1 Answer
OpenBSD folks have started an OpenSSL code review recently, after which they decided to fork OpenSSL into LibreSSL. Their changes to the code can be followed here.
As of last week, the major changes were:
Tons and tons of VMS/MacOS 9/Windows code removal
KNF format the whole source tree (jsing)
