OpenSSL

“neither gnupg nor openssl could determine what mode and keysettings the sender had used”

“Openssl 3.0, which was the version in the official packages of our LTS distro was unacceptably slow.”

“There were massive improvements to performance in some of the areas criticized by PyCA and haproxy.”

“Not back to 1.1.1 levels of performance, but enough that it's probably not a dealbreaker for most people.”

“Technically yes, OpenSSL 3.X is slow, measurably so, but not enough that we wanted to deal with it.”

“i think a project like this would slough old architecture like mad and let major versions tick, but they forge on”

“I was more shocked that I managed to get stock OpenSSL to issue a certificate that worked.”

“many have complex non-standard grammars (e.g., openssl, ffmpeg)”

“Try to find a TLS library for Common Lisp that doesn't rely on openssl”

“A lot of people would like to -eventually- move away from openssl too, myself among them”

“Since OpenSSL 3 is now available under a GPL-compatible license, I think it's long past time to switch.”

“please just use OpenSSL or another similar major crypto library”

“Use JWT tokens and OpenSSL or another established library to sign them.”

“Compared to other things on the internet, it doesn't cause that much of a slow down.”

“OpenSSL's CI is exceptionally flaky, and the OpenSSL project has grown to tolerate this flakiness, which masks serious bugs.”

“Now you're constructing OSSL_PARAM arrays, looking up providers by string name, and hoping you got the key type right because nothing checks at compile time.”

“the design of OpenSSL 3.0 was a major step backwards, not least for performance”

“is of prime importance to those operating Internet-accessible servers, or clients”

“looks like decent cleanup. (IIRC, engines in particular will not be missed).”

“Almost all CPUs have AES native instructions so you'll be able to produce pseudorandom junk really fast.”

“OpenSSL, by virtue of trying to do everything is the most buggy implementation of TLS generally available today”

“I wish AES-GCM was available...but openssl can't do it on its own without further dependencies”

“It seems to me that after seeing some of the presentations by the LibreSSL folks that OpenSSL is not evidence of elegant code.”

“OpenSSL maintains a module for FIPS compliance, which includes an entire boatload of weak and broken algorithms nobody else bothers with.”

“OpenSSL and other similar security substandard projects have process deficiencies that lead to similar bugs over and over again.”

“The number of updates that fixed a critical security problem but needed application changes to work was pretty high.”

“a significant fraction of OpenSSL bugs could be prevented if they just used a small library for managing buffers”

“I found that the OpenSSL source code was so complex that I would have spent a lot more time discussing the intricacies of the C code itself”

“OpenSSL lets you bundle your CA policies with the app and thus avoid that issue”

“on the TLS parts, quite a lot, up to 2x slower on certain paths”

“OpenSSL has historically been crap with respect to development compatability”

“OpenSSL is documentation is very complete, very thorough, but also completely opaque”

“Absolutely none of this is true when used as a signing tool on the CLI.”

“For those two things, OpenSSL is fine as it is.”

“OpenSSL is rather confusing, and I want to use my own handling of the certificates but OpenSSL makes it too confusing to do that”

“I tell them to learn from examples set by the Linux kernel, SQLite, OpenSSL, FFMpeg, etc.”

“providing a safety net when our politicians decide to tighten their grip on privacy and secure communications”

“you can combine presets such as HIGH with your additional preferences”

“there is exactly one thing that OpenSSL is actually well-suited to doing (setting up TLS sessions), and then 20+ years of people getting themselves into grave trouble”

“that's how some of the most serious OpenSSL bugs have emerged”