Re: Critical GnuTLS bug ...

To: Howard Chu <hyc@symas.com>

Subject: Re: Critical GnuTLS bug ...

From: Erwann Abalea <eabalea@gmail.com>

Date: Tue, 4 Mar 2014 21:50:02 +0100

Cc: OpenLDAP Technical <openldap-technical@openldap.org>

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=EhShC65nlrreLTaV52bOITxADWxHypgAoFJ6SuOI430=; b=UHIXH3wPnTeZNs/mdlwzlg3iSRM8HnpX5yJ9pXto4tle+xDVz9/8seXsIWbtzmqKOK 0fGOlCm/YCytn1DSTpr/PuKLsY310robHDYrOKE7uydLfuXxVmpYyInS6/Z6U2hU9rWy GJ0c56AyKoAMFhRuZ1yoJdVB68YxpRPGmlTOxieTCd7/zo/Dqh5rwYv3GHmqd81Dosqn YvUz4lxmWQhSF/t/+c+jfPLQ+Jn7RJjOcLisX0M4V2+XZyf73Zlfznax/5NYFrzg4jHl /ahkfFlCPvONUt4/iDwhYH22LeXYnZNyAlFGwFnvZw1ejZVKB8OJWYdCKJVmNXrc5moa JE2w==

In-reply-to: <53162C1E.1000501@symas.com>

References: <53162C1E.1000501@symas.com>

While I disagreed with you on some PKI-related topics, I fully agree with you on that specific one.

GnuTLS is bad.

(back reading that new triple handshake TLS attack)

2014-03-04 20:40 GMT+01:00 Howard Chu <hyc@symas.com>:

http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hundreds-of-apps-open-to-eavesdropping/

Perhaps folks will take us more seriously the next time we say "don't use GnuTLS" ... http://www.openldap.org/lists/openldap-devel/200802/msg00072.html

--
Erwann.

References:

Critical GnuTLS bug ...
- From: Howard Chu <hyc@symas.com>