Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4780

Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team?

Show all headers | View raw

   Just wanted to tell that I am quite happy not to have boringSSL in 
Debian - main. I think it is depeerable there apart from the security 
risk of adopting the SSL package from a company which was largely funded 
by intelligence services and the Pentagon. I would rather like to see 
OpenBSD`s libressl as an option for Debian. I believe the OpenBSD 
programmers have done a pretty good job at it!

Elmar

Am 2016-05-13 um 08:44 schrieb Moritz Mühlenhoff:
> 殷啟聰 <seamlikok@gmail.com> schrieb:
>> Dear Debian Security Team,
>
> Our contact address is team@security.debian.org, not debian-security...
>
>> The "android-tools" packaging team
>> <https://qa.debian.org/developer.php?login=android-tools-devel%40lists.alioth.debian.org>
>> are introducing BoringSSL, a fork of OpenSSL by Google. The latest
>> Android OS and its SDK no longer use OpenSSL and they use some APIs
>> only provided by BoringSSL, hence we are bringing BoringSSL to Debian.
>> You can see the ITP at <https://bugs.debian.org/823933>.
>
> No, that's not acceptable. You can try to provide that additional APIs
> on top of OpenSSL, but we're not going to support an entire OpenSSL
> fork just for Google's NIH syndrome.
>
> Cheers,
>         Moritz
>

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Will Packaging BoringSSL Bring Any Trouble to the Security Team? 殷啟聰 <seamlikok@gmail.com> - 2016-05-13 07:50 +0200
  Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team? Moritz Mühlenhoff <jmm@inutil.org> - 2016-05-13 08:50 +0200
    Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team? Moritz Mühlenhoff <jmm@inutil.org> - 2016-05-13 21:10 +0200
    Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team? Elmar Stellnberger <estellnb@gmail.com> - 2016-05-13 22:40 +0200
      Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team? 殷啟聰 <seamlikok@gmail.com> - 2016-05-17 10:10 +0200
        Will Packaging BoringSSL Bring Any Good to Debian Geert Stappers <stappers@debian.org> - 2016-05-17 10:50 +0200
        Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team? Michael Stone <mstone@debian.org> - 2016-05-17 17:30 +0200
          Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team? Ralph Sanchez <rwsanchez3@gmail.com> - 2016-05-17 17:40 +0200
            Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team? Hans-Christoph Steiner <hans@at.or.at> - 2016-05-18 12:00 +0200
              Re: Will Packaging BoringSSL Bring Any Trouble to the Security Team? Hans-Christoph Steiner <hans@at.or.at> - 2016-05-18 12:30 +0200

csiph-web