Podcast Episode Details
Back to Podcast Episodes
82: SSL in the Wild
Coming up this week, we'll be chatting with Bernard Spil about wider adoption of LibreSSL in other communities. He's been doing a lot of work with FreeBSD ports specifically, but also working with upstream projects. As usual, all this weeks news and answers to your questions, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
EuroBSDCon 2015 call for papers
- The call for papers has been announced for the next EuroBSDCon, which is set to be held in Sweden this year
- According to their site, the call for presentation proposals period will start on Monday the 23rd of March until Friday the 17th of April
- If giving a full talk isn't your thing, there's also a call for tutorials - if you're comfortable teaching other people about something BSD-related, this could be a great thing too
- You're not limited to one proposal - several speakers gave multiple in 2014 - so don't hesitate if you've got more than one thing you'd like to talk about
- We'd like to see a more balanced conference schedule than BSDCan's having this year, but that requires effort on both sides - if you're doing anything cool with any BSD, we'd encourage you submit a proposal (or two)
- Check the announcement for all the specific details and requirements
- If your talk gets accepted, the conference even pays for your travel expenses ***
Making security sausage
- Ted Unangst has a new blog post up, detailing his experiences with some recent security patches both in and out of OpenBSD
- "Unfortunately, I wrote the tool used for signing patches which somehow turned into a responsibility for also creating the inputs to be signed. That was not the plan!"
- The post first takes us through a few OpenBSD errata patches, explaining how some can get fixed very quickly, but others are more complicated and need a bit more review
- It also covers security in upstream codebases, and how upstream projects sometimes treat security issues as any other bug
- Following that, it leads to the topic of FreeType - and a much more complicated problem with backporting patches between versions
- The recent OpenSSL vulnerabilities were also mentioned, with an interesting story to go along with them
- Just 45 minutes before the agreed-upon announcement, OpenBSD devs found a problem with the patch OpenSSL planned to release - it had to be redone at the last minute
- It was because of this that FreeBSD actually had to release a security update to their security update
- He concludes with "My number one wish would be that every project provide small patches for security issues. Dropping enormous feature releases along with a note 'oh, and some security too' creates downstream mayhem." ***