Episode 348 - OpenSSL is the new lead paint

<p dir="auto"><a href="https://twitter.com/joshbressers" rel= "nofollow">Josh</a> and <a href="https://twitter.com/kurtseifried" rel="nofollow">Kurt</a> talk about the recent OpenSSL nothingburger. OpenSSL got everyone whipped into a frenzy over a critical vulnerability, then changed the severity to high. The correct solution to this whole problem is to stop using a TLS library written in C, we need to be using memory safe languages. Don't migrate from OpenSSL 1 to 3, migrate from OpenSSL 1 to Rustls.</p> <h2 dir="auto">Show Notes</h2> <ul dir="auto"> <li><a href= "https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/" rel="nofollow">OpenSSL Blog Post</a></li> <li><a href= "https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html" rel="nofollow">OpenSSL pre-announcement</a></li> <li><a href= "https://twitter.com/iamamoose/status/1584908434855628800" rel= "nofollow">Mark Cox Tweet 3.0 only affected</a></li> <li><a href= "https://twitter.com/GossiTheDog/status/15860315723267973130" rel= "nofollow">GossiTheDog NDA Tweet</a></li> <li><a href= "https://twitter.com/GossiTheDog/status/1586054681159430144" rel= "nofollow">Claims of a name and logo</a></li> <li><a href="https://www.memorysafety.org/initiative/rustls/" rel= "nofollow">Rustls</a></li> </ul> <p> </p> <p><a href= "https://commons.wikimedia.org/wiki/File:LeadPaint1.JPG">Image Credit</a></p>